Privacy policy

Who we are

This website, layaliproperties.sa, is run by Layali AlDiyafa Company For travel and tourism (الشركة ليالي الضيافة للسفر والسياحة), trading as Layali Properties, Commercial Registration 1009097434. We are the controller of the personal data described in this policy: we decide why and how it is used, and we are responsible for it under Saudi Arabia's Personal Data Protection Law and its regulations.

We are based in Riyadh, Saudi Arabia. For anything about this policy or your data, email admin@layaliproperties.sa or call +966 920 032175.

What this policy covers

This policy covers the personal data we collect through this website, its forms and the Layali booking site, and in messages you send us about our services or a stay. Booking platforms such as Airbnb, Booking.com, Gathern and Aqar have their own privacy policies for the data you give them; this policy covers what they share with us for your booking.

What we collect

We collect what you give us, what a booking platform shares with us for your stay, and a small amount of technical data.

• If you are a property owner: through our estimate forms, your name, your mobile or WhatsApp number, your apartment's district, number of bedrooms and current status, and either how many apartments you own or an email address if you choose to give one. Where a form offers it, you can also search for your building and pick it, which is optional and which you can skip and still get an estimate. When you do, we keep the map provider's identifier for that building, the address you confirmed and the district it is in. We do not keep map coordinates for it.
• If you contact us: through the contact form, your name, your mobile number, an email address if you choose to give one, whether you are a property owner, a guest or something else, and your message.
• If you book or ask about a stay: your name, contact details, dates, number of guests and messages, whether you book on the Layali booking site, through a booking platform or with us on WhatsApp.
• When you message, email or call us: your number or email address and what you tell us.
• Consent records: the consent wording you agreed to, its version, and the date and time you agreed.
• Technical data: when you submit a form, we keep a one-way code made from your IP address and a secret key, never the address itself, so we can block repeated or abusive submissions. Our hosting provider also processes IP addresses and browser details to deliver the website and keep it secure.

We do not ask for identity documents, bank details or card details on this website, and we do not collect sensitive data such as health or religious information through it.

If you book a stay on the Layali booking site

When you book directly on the Layali booking site, we collect your name, email address, mobile number and preferred language, together with the apartment, your dates, the number of guests and the price quoted. We also keep a record of each payment step: the payment and invoice references our payment gateway gives us, the amount and currency, and whether the payment went through, did not go through or was refunded.

You enter your card details on the secure payment page of MyFatoorah, our payment gateway, not on this website. We never see or store your card number or security code.

• To take your payment and confirm your booking. We send your name and email address to MyFatoorah with the amount due, and we check the result with MyFatoorah directly before we confirm anything. We rely on your booking.
• To reserve the apartment for you. Once your payment is confirmed, we send your name, email address, mobile number, dates and number of guests to Hostaway, our property management and booking system, which holds the reservation. We rely on your booking.
• To contact you about your stay, such as check-in details or a change to your booking. We rely on your booking.
• To keep the records the law requires, including payment and tax records, and to meet our legal obligations for guest stays. We rely on our legal obligations.

We keep these details for as long as your booking runs, then for the period the law sets for commercial and tax records, as set out below. If a booking is not completed, for example because the payment did not go through, we keep the record of the attempt so that any payment made against it can be matched and, where needed, refunded.

For anything about your booking data, email admin@layaliproperties.sa or call +966 920 032175.

Required and optional details

Each form marks what is optional, such as an email address. We need your name and mobile number to reply, and your apartment's details to prepare an estimate. If you leave out a required detail, we cannot prepare the estimate or reply through that form, but you can still message or call us.

How we use it, and on what basis

• To reply and prepare what you asked for, such as an estimate or an answer to your message. We rely on the consent you give on the form and on your request.
• To discuss our management service with you if you are a property owner, including arranging a visit to your apartment. We rely on your consent and, if you go ahead, on the agreement you sign.
• To arrange and support your stay if you are a guest. We rely on your booking.
• To keep the website secure and stop spam and abuse. We rely on our legitimate interest in protecting the website and the people who use it, and never for sensitive data.
• To keep the records the law requires and to answer lawful requests from public authorities. We rely on our legal obligations.

We use your data only for the purpose you gave it for, or for a purpose the law allows. We do not sell your personal data, we do not use it for advertising, and we do not send you marketing messages unless you agree to receive them.

Who we share it with

We share personal data only with service providers who process it for us, on our instructions and under data protection terms:

• Vercel hosts the website. Its server functions run in Mumbai, India, and it delivers pages from a global network.
• Supabase stores form submissions and consent records in a database in Mumbai, India, and runs the sign-in for our own team.
• Resend sends the website's emails, such as the alert we receive when you submit a form, from Ireland in the European Union.
• Google Workspace provides our business email.
• Bevatel, our WhatsApp Business messaging system, and WhatsApp, when you message us there or we reply to you there.
• Hostaway, our property management and booking system, for stays and guest messages.
• MyFatoorah, our payment gateway, when you pay for a stay on the Layali booking site.
• Google Maps, where a form offers a location search: the text you type is sent to Google to suggest places.
• Google Analytics, from Google, counts visits to this website, only if you allow it, as set out below.

If you book through a booking platform, we exchange the details of your booking with that platform. We disclose personal data to public authorities only where the law requires it.

Transfers outside Saudi Arabia

Some of your data is stored or processed outside the Kingdom: our database and website functions are in India, website emails are sent from Ireland, and our email, messaging, booking, payment, map and analytics providers may process data in other countries.

We transfer personal data outside the Kingdom only as Article 29 of the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom allow, to provide the service you asked for. We send each provider only the data its task needs, use providers bound by data protection terms, and assess the risks of each transfer. If the basis for a transfer changes, we will update this policy.

Cookies and analytics

The public website sets no advertising cookies, and no analytics cookies unless you allow them. It may keep a display preference in your browser for the length of your visit, and it remembers your analytics choice. Our own team's sign-in uses a session cookie that is strictly necessary for it to work.

We use Google Analytics to count visits and see which pages help people. It runs only if you allow it: until you choose, or if you decline, it does not load at all. If you allow it, Google sets analytics cookies in your browser and receives details such as the page you visited, the site that sent you, your approximate location and your browser and device type. We use it for totals rather than to identify you, we do not use it for advertising, and we never send it your name, your number or anything you type in our forms. You can change or withdraw your choice at any time through Analytics settings at the bottom of our pages.

How long we keep it

• Estimate and contact requests that do not lead to an agreement: up to 24 months after our last contact with you, then deleted or made anonymous.
• Consent records: for as long as we keep the data the consent covers.
• The IP code used to stop abuse: kept with the submission it belongs to, and deleted with it.
• Owner clients and guests: for as long as the agreement or booking runs, then for the period the law sets for commercial and tax records.

If you ask us to delete your data, we delete it unless the law requires us to keep it, and we tell you when that is the case.

Your rights

Under the Personal Data Protection Law, you have the right to:

• Be told how and why we collect and use your personal data, which this policy does.
• Access the personal data we hold about you.
• Receive a copy of it in a clear, readable format.
• Ask us to correct, complete or update it.
• Ask us to delete it when we no longer need it.
• Withdraw your consent at any time. Withdrawing does not affect what we did before.

To use a right, email admin@layaliproperties.sa or message us on WhatsApp. We may ask you to confirm who you are first. We reply within 30 days; if a request needs unusual effort, or you send several, we may take up to 30 more days and will tell you why.

If you are not satisfied with our reply, you can complain to the Saudi Data and AI Authority (SDAIA), the authority responsible for personal data protection in the Kingdom.

How we protect it

Form submissions are encrypted in transit and stored in a database that only people we authorise can read, with every access checked by the database itself. We never store your IP address in plain form. No system is completely secure: if a breach affects your personal data, we will notify the Saudi Data and AI Authority within 72 hours of learning of it, and tell you without delay where it puts you at risk.

Children

The website and our services are for adults. We do not knowingly collect personal data from anyone under 18. If you think a child has sent us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy as our services, our providers or the law change. We post every change on this page with its new date. Where a change affects how we use data you have already given us, we tell you, and where the law requires it, we ask for your consent again.

This policy sits alongside our terms and conditions.