Privacy Policy
Version 1.0 — Last updated: 17 August 2026
1. Who We Are
Ratbli (operated by AL-TREIQ AL-MUTAGUL – One Partner - Holding, Commercial Registration 1010926408) is the “Data Controller” responsible for your personal data when you use the Ratbli app or website (the “Platform”). In this Policy, “we”, “us”, and “our” refer to Ratbli.
2. What Personal Data We Collect
Identity & Contact Data
- Full name, date of birth, nationality
- Email address and phone number
- Passport or national ID details, where required for a specific Booking (e.g., private jet charters, certain hotel or visa-linked bookings)
Booking & Transaction Data
- Booking history, preferences, and Supplier interactions
- Payment confirmation data (Ratbli does not store full card numbers — payments are processed by PCI-DSS compliant third parties)
Technical Data
- Device type, operating system, IP address, app usage analytics
- Location data, where you have granted permission (e.g., to show nearby Suppliers)
3. How We Collect Your Data
- Directly from you, when you register, make a Booking, or contact customer support
- Automatically, through your use of the Platform (cookies, analytics, device data)
- From Suppliers and payment processors, in connection with fulfilling your Booking
4. Legal Basis & Purpose of Processing
Under the Saudi Personal Data Protection Law (PDPL), we only process your personal data where we have a valid legal basis to do so. We rely on:
- Consent — for marketing communications and any optional data uses. Consent is opt-in and never assumed from a pre-ticked box.
- Contractual necessity — to create your account, process a Booking, and provide customer support.
- Legal obligation — to comply with Saudi tax, tourism, and financial regulations.
- Legitimate interest — for fraud prevention, Platform security, and service improvement, balanced against your rights.
5. How We Use Your Data
- To create and manage your account
- To process Bookings and payments, and to share necessary details with the relevant Supplier
- To provide customer support and respond to inquiries
- To send Booking confirmations, updates, and (with consent) promotional offers
- To detect and prevent fraud and misuse of the Platform
- To comply with legal and regulatory obligations, including those of the Saudi Ministry of Tourism and the Saudi Data & AI Authority (SDAIA)
6. Sharing Your Data
We share personal data only where necessary, including with:
- Suppliers — hotels, private jet and helicopter operators, yacht charter companies, restaurants, and car rental agencies, to the extent needed to fulfil your Booking
- Payment processors — to complete transactions securely
- Distribution and inventory partners — including our hotel and flight inventory and booking-processing partners
- Regulators and authorities — where required by Saudi law
- Professional advisors — lawyers, auditors, and insurers, where necessary
We do not sell your personal data to third parties.
7. Cross-Border Data Transfers
7.1 Because some Suppliers, payment processors, and technology partners operate outside the Kingdom of Saudi Arabia, your personal data may be transferred to and processed in other countries.
7.2 Where this occurs, we ensure appropriate safeguards are in place — such as standard contractual clauses or equivalent legal mechanisms — consistent with PDPL requirements, so that your data receives a comparable level of protection wherever it is processed.
8. Data Retention
8.1 We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, to meet legal or regulatory obligations (including Saudi tax and commerce record-keeping requirements), or to establish, exercise, or defend legal claims.
8.2 When data is no longer required, it is securely deleted or anonymized.
9. Your Rights
Under the PDPL, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate or incomplete data
- Request deletion of your data, subject to legal retention obligations
- Request a portable copy of your data
- Object to or restrict certain processing
- Withdraw consent at any time, where processing is based on consent
To exercise any of these rights, contact us at info@ratbli.io. We will respond within the timeframe required by applicable law.
10. Data Security
10.1 We apply appropriate technical and organizational measures to protect your personal data, including encryption in transit and at rest for sensitive data such as passport and ID information, access controls, and regular security review.
10.2 In the event of a personal data breach that may compromise your data, Ratbli will notify SDAIA within the timeframe required by law and will inform affected Users where required.
11. Cookies
Our website uses cookies to analyze traffic and improve user experience, as disclosed via the cookie banner on ratbli.io. You can manage cookie preferences through your browser settings.
12. Children's Privacy
The Platform is not directed at, and should not be used by, individuals under the age of 18. We do not knowingly collect personal data from minors.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified through the Platform. The “Last updated” date at the top of this Policy reflects the most recent revision.
14. Contact Us & Complaints
For questions or concerns about this Privacy Policy or how your data is handled, contact us at info@ratbli.io.
If you are not satisfied with our response, you have the right to lodge a complaint directly with the Saudi Data & AI Authority (SDAIA).