Privacy PolicyLast updated: 01/09/2026

1. Purpose of the Policy

This Privacy Policy sets out how Resal Company (“Resal”) collects, uses, and discloses your Personal Data in accordance with applicable laws and regulations, in particular the Saudi Personal Data Protection Law (the “Personal Data Protection Law”), promulgated pursuant to Royal Decree No. (M/19) dated 9/2/1443 AH, as amended by Royal Decree No. (M/148) dated 5/9/1444 AH.

2. Scope of the Policy

This Privacy Policy applies to Resal Saudi Arabia’s employees, customers, contractors, and third parties who have a direct or indirect relationship with Resal in connection with the processing, sharing, or retention of Personal Data.

This Policy applies to all individuals in the Kingdom of Saudi Arabia whose Personal Data is processed by Resal on their behalf.

3. References

  • The Saudi Personal Data Protection Law (PDPL).
  • The General Data Protection Regulation (GDPR), as applicable to international users whose Personal Data is processed by Resal outside the Kingdom of Saudi Arabia.

4. Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set forth below:

  1. Personal Data: Means any data, regardless of its source or form, that may identify an individual specifically, whether directly or indirectly, including, without limitation, the individual’s name, identification number, addresses, contact numbers, license numbers, personal records and property, bank account numbers, payment cards, still or moving images, and any other data of a personal nature.
  2. Company: Means Resal Al-Wad Information Technology Company, Kingdom of Saudi Arabia, and shall be referred to herein as “Resal,” “the Company,” “we,” “us,” or “our.”
  3. Account: Means a unique account created by or on behalf of the User to access the Resal Website/Application or any part thereof.
  4. You / User: Means the natural person who uses the Resal Website/Application, or the legal entity represented by such individual or on whose behalf such individual acts pursuant to a valid authorization.
  5. Service Provider: Means any natural or legal person that processes Personal Data on behalf of Resal, including, without limitation, payment service providers, technical support providers, analytics companies, fraud prevention and detection providers, notification platforms, booking facilitators, telecommunications aggregators and operators, merchants, and transaction partners.
  6. Usage Data: Means data collected automatically through the use of the Website/Application or generated by its underlying infrastructure, including, without limitation, the duration of a page visit, the pages visited, connection data, and standard technical protocol data.
  7. Cookies: Means small text files and technical files stored on the User’s Device by the Website, which record the User’s interactions and preferences and which the User may accept, reject, or customize.
  8. Device: Means any technological or electronic device capable of accessing the Website/Application, including, without limitation, computers, mobile phones, and tablets.
  9. Third-Party Social Media Service: Means any external website or social media platform through which the User may log in or which the User may link to create an Account for the purpose of accessing and using Resal’s services.
  10. Country: Means the Kingdom of Saudi Arabia.
  11. Website: Means Resal’s official website, accessible at: https://www.resal.me.

5. Policy Statement and Processing Controls

5.1 Collection and Use of Personal Data

Resal collects information through three primary means: directly from information provided by You, from third-party sources (such as integrated loyalty programs), and through automated technologies (such as Cookies).

Personal Data provided to Resal: This includes your name, mobile number, email address, authentication data, traveler details (in connection with booking services), and the mobile numbers to which airtime or credit is to be added (in connection with mobile top-up services).

Purposes of Processing: Resal processes Personal Data for the purposes of operating and managing Accounts, processing payments and redeeming loyalty points through ResalPay, completing flight and hotel bookings, providing technical support, and complying with applicable legal and regulatory obligations and maintaining business records.

5.2 Sharing of Personal Data

We share only the Personal Data necessary for the relevant purpose with Service Providers, merchants (for the completion of ResalPay transactions), telecommunications operators (for the provision of mobile top-up services), and competent regulatory or governmental authorities where required by applicable law, regulation, or a judicial order.

5.3 International Transfer of Personal Data

We primarily store and process your Personal Data within the Kingdom of Saudi Arabia. In certain circumstances where the nature of the service requires it, such as international flight bookings or hotel bookings outside the Kingdom, your Personal Data may be transferred to third-party service providers or external entities in accordance with the safeguards and mechanisms prescribed under the Personal Data Protection Law (PDPL) and its applicable regulations.

5.4 Retention of Personal Data

We retain your Personal Data for as long as necessary to provide the requested services, complete the relevant transactions, or fulfill other essential purposes, including compliance with applicable legal and regulatory obligations, maintaining records, and resolving disputes. Where appropriate and in accordance with applicable requirements, Personal Data will be anonymized or securely destroyed once it is no longer required for the purposes for which it was collected.

For transparency and compliance purposes, Resal determines the applicable retention periods for key categories of Personal Data as follows:

  • Transaction and Operational Data: Records relating to booking services, mobile top-up services, ResalPay transactions, and invoices shall be retained for ten (10) years from the date of the relevant transaction, in accordance with applicable commercial and tax requirements in the Kingdom of Saudi Arabia and to meet audit, fraud prevention, and anti-money laundering requirements.
  • Customer Account Data: Basic Account Data shall be retained for the duration of the Account’s active status and for a period ranging from one (1) year to a maximum of three (3) years from the date of Account closure or the submission of a deletion request, as necessary to address any legal claims or potential disputes.
  • Resal Points Data: Data associated with loyalty points shall be retained for the duration of your subscription and activity and for twelve (12) months from the date of your Account’s last interaction or from the date on which the points expire, as applicable.
  • Marketing Consent Data: Records of consent to receive marketing communications shall be retained until you withdraw your consent (unsubscribe). Upon withdrawal of consent, your contact information will automatically be transferred to a “Do Not Contact” / suppression list to ensure that you do not receive further marketing communications.
  • Usage Data is generally retained for a shorter period, unless retention is necessary for information security purposes, network performance improvement, or is otherwise required by applicable laws and regulations.

5.5 Data Destruction and Security

  • Destruction: Upon expiry of the applicable retention periods set out above, Resal shall securely destroy the relevant Personal Data in accordance with its internal policies or permanently anonymize such data so that it can no longer be attributed to an identifiable individual.
  • Security: We implement stringent security measures to protect Personal Data, including encryption, multi-factor authentication, and compliance with PCI DSS requirements for the protection of payment card data.

5.6 User Rights and How to Exercise Them

As the owner of Personal Data under the Personal Data Protection Law (PDPL), you have the right to be informed, the right to access your Personal Data, the right to request its correction or update, and the right to request its erasure or destruction through the following official channels:

Our team is committed to handling your requests and will respond with the action taken within a maximum period of thirty (30) days from the date on which a duly completed request is received. Certain exceptional requests may require additional time due to their number or complexity. In such cases, we will notify you in advance of any extension and provide the reasons for such extension, in accordance with the Implementing Regulations of the Personal Data Protection Law (PDPL).