Privacy and Personal Data Protection Policy

1. Data Controller

The controller is Miqyas Vision Experts Company (legal Arabic name: شركة رؤية خبراء المقياس الصحيح), a limited liability company registered in the Kingdom of Saudi Arabia under Commercial Registration No. 1009186699, referred to in this policy as “the Company”, “we”, “us” or “our”.

This policy covers mveg-ksa.com and the Company’s activities and brands, including ROVA Travel and the sector activities presented on the website, unless a separate privacy notice is provided for a specific service or contract.

2. Scope

This policy applies when you browse the website, complete a form, request a proposal, booking, supply or partnership, or contact us by telephone, email, WhatsApp or social media.

Specialised contracts and services may include additional notices for specific processing. The more specific notice will apply to that purpose to the extent it is consistent with applicable law.

3. Personal Data We May Collect

• Identity and contact data: name, telephone number, WhatsApp and email address.
• Professional and commercial data: organisation, job title, sector, city or market.
• Inquiry and service data: selected activity, travel, event or project details, destinations and dates, quantities, budget and operating requirements.
• Communications: messages, inquiries, attachments and follow-up history.
• Technical data: IP address, browser and device type, security and hosting logs, and saved language preference when hosted.

4. Sources and Collection Methods

We collect data directly from you through forms, calls and messages, and from your interaction with the website. We may receive information from a person you authorise or a contracting party connected with the service after confirming an appropriate legal basis.

Fields marked mandatory are needed to respond, assess or deliver the request. If they are not provided, we may be unable to contact you, prepare an offer or provide the requested service. Optional fields may be left blank.

5. Purposes and Legal Bases

We process data only as reasonably necessary to:

• Receive the inquiry and route it to the relevant specialist team.
• Contact you, confirm requirements and prepare an offer, plan or booking.
• Take pre-contract steps, perform a contract and manage service and support.
• Coordinate suppliers, partners, operations and logistics required for delivery.
• Protect the website, prevent fraud or misuse and safeguard legal rights.
• Meet statutory, accounting and regulatory duties and respond to authorities.
• Improve services and user experience using aggregated or anonymised data where possible.
• Send marketing only where consent or another lawful basis exists, with an opt-out.

Depending on the context, processing is based on your consent, performance of a contract or steps taken at your request before entering a contract, a legal obligation, a properly assessed legitimate interest that does not override your rights, or another basis permitted by the PDPL.

6. Sharing and Disclosure

We do not sell personal data. We may disclose the minimum necessary data to:

• Authorised employees and activity teams according to the request.
• Hosting, technical support, email, CRM, booking and payment providers when enabled.
• Suppliers required to deliver the service, such as hotels, airlines, transport, event and logistics providers.
• Professional advisers, auditors and insurers where necessary.
• Government, judicial or regulatory bodies where required or permitted by law.

Processors and service providers are required, to the extent applicable, to protect the data and process it only for the agreed purpose and in accordance with instructions.

7. Transfers Outside the Kingdom

International services and global technology platforms, including WhatsApp, Meta, booking or travel systems, may involve processing or storage outside Saudi Arabia. Transfers are made only for a legitimate purpose and in accordance with the PDPL and the Regulation on Personal Data Transfer Outside the Kingdom, including appropriate safeguards and risk assessment where required.

When you follow a third-party link, that platform’s own privacy policy also applies to its processing.

8. Retention and Destruction

We keep personal data only for the period necessary to fulfil the purpose, manage requests and relationships, comply with statutory retention duties, and resolve claims or disputes. The period varies by data, service and legal requirement.

When the purpose ends and no legal basis for retention remains, data is securely destroyed or anonymised. Limited copies may remain in backups until the normal deletion cycle, with use restricted.

9. Security and Data Incidents

We apply organisational and technical measures appropriate to the data, including access restrictions, communication and system safeguards, backups, provider review, awareness and incident response. No electronic method can guarantee absolute security.

If a personal data incident occurs, we take containment and assessment steps and notify the Competent Authority and affected individuals where required by law.

10. Data Subject Rights

Subject to statutory conditions and exceptions, you have the right to:

• Be informed of the legal basis, purpose, data, uses and disclosure.
• Access your personal data.
• Obtain a copy in a clear, readable format where applicable.
• Request correction, completion or updating of inaccurate, incomplete or outdated data.
• Request destruction when the purpose ends or in cases provided by law.
• Withdraw consent where consent is the basis, without affecting earlier lawful processing.

To exercise a right, contact us below and identify the right and relevant data. We may request reasonable information to verify identity and protect data, and will respond within the statutory procedures and periods.

11. Cookies and Similar Technology

The website currently saves your language preference locally on your device using localStorage. Hosting may create technical logs needed for security and operation. The current version does not use non-essential advertising cookies or behavioural analytics.

If analytics, marketing tools or non-essential cookies are introduced, we will update this policy and provide appropriate notice and consent controls before activation where required.

12. Children’s Data

The website is not directed at children for direct data collection. Travel or event services may include minors in a request made by a parent or legal representative. Only necessary data will then be requested with their authority and through appropriate channels.

13. Automated Decisions and Policy Updates

The website does not currently make automated decisions that produce legal or similarly significant effects. We review and update this policy when services, processing technology or legal requirements change. The effective date appears above, and material changes may be highlighted on the website.

14. Contact, Rights Requests and Complaints

Contact the Company’s privacy team with questions, rights requests or complaints:

If you are not satisfied with our handling of a request, you may complain to the Competent Authority, the Saudi Data & AI Authority (SDAIA), through the official channels of the National Data Governance Platform.