Privacy Policy

Solstice is operated by Qumm Shams for Trips Company, a limited liability company registered in the Kingdom of Saudi Arabia. We are the data controller for the personal data described in this policy, which means we decide what is collected and why.

• Commercial Registration: 1009050995
• Unified National Number: 7039960229
• Tourism licence: 73105500 — General Travel and Tourism Services
• Registered in: Riyadh, Kingdom of Saudi Arabia
• Privacy contact: info@oursolstice.com

This policy explains what we collect, why we collect it, who we share it with, how long we keep it, and what you can ask us to do about it under the Saudi Personal Data Protection Law (PDPL).

It covers the Solstice website, the booking service, the messages we send you, and the trips booked through us. It applies whether you are a customer, a guide, or someone whose details were entered on a booking by another person.

The personal data we collect

When you book a trip

The booking form asks for a contact name, a mobile number and an email address. We also record the number of participants, the departure you chose, the trip itself, the language you were browsing in, the amount paid, and the cancellation policy that applied when you booked.

We keep a record of how the trip was described at the time you booked — the price, the dates, what was included and the cancellation terms. If the trip is later changed, this is what lets us show you what you actually agreed to, and it is the basis on which any refund is worked out.

When you create an account or sign in

If you sign in, we hold your name, mobile number, email address, preferred language, and whether you asked to receive marketing messages.

Signing in works by sending a one-time code to your mobile number or email address. Codes are short-lived and are stored in a form we cannot read back.

If you are a guide

Guides give us more, because we are accountable for who leads trips under our licence. Depending on the trips you offer, this may include:

• your name, national identity number and date of birth;
• your contact details;
• bank account details so that we can pay you;
• the certifications you hold, documents evidencing them, and their expiry dates;
• an emergency contact;
• health information relevant to leading trips safely;
• a profile photo and a written biography;
• the regions and categories of trip you offer;
• your agreement with us.

Documents you upload are kept private and are made available only to the people within Solstice who need to review them.

Payment information

Card payments are handled by a payment provider licensed in Saudi Arabia, and card details are entered directly with that provider. We do not receive or store your full card number, expiry date, or security code.

What we keep is a short description of the payment such as "Visa ending 4242", along with the amount, the date and a reference — enough to identify the payment if you ask about it or need a refund.

Messages

We keep a record of the messages we send you — booking confirmations, sign-in codes, reminders, refund notices — and of replies you send us, together with basic delivery information.

Technical information

Our website and the services that support it record technical information such as IP address, browser and device details, and the pages requested. We use this for security, for diagnosing faults, and for keeping the service working.

Information about other people

If you book for someone else, or enter someone else's contact details, you are giving us personal data about that person. Please only do so when you are entitled to, and let them know that their details were given to us and that this policy applies to them too.

Why we use your data

To provide the service you asked for. Creating and holding your booking, taking payment, sending you the confirmation, the meeting details and reminders, and giving you a way to view or cancel the booking afterwards.

To verify who you are. Sending sign-in codes and checking them, and protecting accounts from misuse.

To handle money. Processing payments, refunds, platform credit and guide payouts, and keeping the records that go with them.

To meet our obligations as a licensed tour operator. Checking that guides are who they say they are, that their certifications are valid, and that trips are reviewed before they are offered.

To support you before and during a trip. Giving the guide what they need to run the trip and account for everyone present, and answering questions through our support channels.

To comply with the law. Keeping accounting, tax and commercial records, and responding to lawful requests from courts, regulators and authorities.

To improve the service. Understanding which trips are viewed and booked, diagnosing problems, and testing changes.

To send you marketing — only where you asked us to, and only until you tell us to stop.

Who we share it with

We do not sell personal data, and we do not share it for anyone else's advertising.

We share personal data with service providers who process it on our behalf, under contract and on our instructions. They fall into these categories:

• providers who host our website and store our data;
• a licensed payment provider that handles card payments and refunds;
• providers that deliver our email and messaging;
• a provider of automated translation, used to translate trip descriptions written by guides between Arabic and English;
• providers that help us monitor faults and understand how the service is used;
• professional advisers such as lawyers, accountants and auditors, where we need their advice.

If you would like to know which providers we are using, write to info@oursolstice.com and ask.

We also disclose personal data:

• to courts, regulators, or law enforcement acting within their powers;
• where we need to establish, exercise or defend a legal claim;
• to a buyer or successor, if the business or part of it is ever transferred, in which case this policy continues to apply until you are told otherwise.

What a guide can see about you

Guides are given only what they need to run the trip you booked — normally a name and the number of people in the party.

Whether a guide can see a customer's contact details is controlled by us, and we keep it to the minimum the trip requires. Communication between customers and guides is designed to run through Solstice, so that there is a record if something goes wrong and neither side has to hand over personal contact details.

Guides do not see your payment details, your other bookings, or your platform credit.

Transfers outside the Kingdom

Some of the providers described above operate outside Saudi Arabia. Where personal data is transferred outside the Kingdom, we do so on the conditions permitted by the PDPL and its implementing regulations, and we require the recipient to protect it appropriately.

How long we keep it

We keep personal data for as long as we need it for the purpose we collected it, and then delete it or reduce it to what we are required to retain.

• Sign-in codes are short-lived and are not kept afterwards.
• Account details are kept while your account is open, and for a short period afterwards.
• Booking, payment, refund and invoice records are kept for the period required by Saudi tax, accounting and commercial law, even after an account is closed. These are also the records we would rely on to answer a dispute.
• Guide records, including certifications, are kept while the guide is active with us, and afterwards for as long as a claim arising from a trip they led could still be brought.
• Reviews are kept for as long as the trip is listed, unless you ask us to remove yours.
• Message and delivery records are kept as an operational record of what we told you and when.
• Marketing preferences are kept until you withdraw them, together with a record of the withdrawal.
• Technical and security records are kept for a limited period appropriate to investigating problems.

Your rights

Under the PDPL you have the right to:

• be informed — to know what we collect, why, and who we share it with, which is what this page is for;
• access — to be told whether we hold personal data about you, and to receive a copy of it;
• correction — to have inaccurate or incomplete data corrected;
• destruction — to ask us to delete personal data we no longer have a lawful reason to keep;
• withdraw consent — where we relied on your consent, including for marketing, you may withdraw it at any time. Withdrawing does not undo what we did lawfully beforehand.

How to exercise them

Write to info@oursolstice.com, telling us which right you want to exercise and which mobile number or email address you used with Solstice.

Before we act, we will check that the request really came from you — normally by sending a code to the contact details on the record in question. This is a protection for you: without it, anyone could ask for a copy of your data, or ask for your account to be erased.

We respond within 30 days. If a request needs longer, we will tell you before that period is up and explain why. There is no charge.

Our Data Deletion Instructions explain the deletion process in more detail, including what we are required to keep.

If you are not satisfied

Tell us first — write to info@oursolstice.com and we will look at it again. If you remain dissatisfied, you have the right to complain to the Saudi Data and Artificial Intelligence Authority (SDAIA).

How we protect your data

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. Access is limited to the people who need it to do their job, sensitive documents are kept private rather than on public addresses, and administrative changes to records are logged.

No system is perfectly secure. If a breach ever affects your personal data, we will notify you and the regulator as the PDPL requires.

Cookies and similar technologies

We use a small number of cookies and similar browser storage. We do not use them to track you across other websites.

• Essential — keeping you signed in, remembering your language, and holding the state of a checkout in progress so a refresh does not create a duplicate booking. The service cannot work without these.
• Preferences — remembering choices such as light or dark appearance, and trips you saved before signing in.
• Analytics and fault monitoring, where enabled, to understand usage and diagnose problems.

You can clear or block cookies in your browser settings. If you block the essential ones, signing in and checkout will not work.

Children

Solstice is not intended for children and we do not knowingly collect data about them. Bookings must be made by a person aged 18 or over, and individual trips may set a higher minimum age, shown on the trip page. If you believe a child has given us personal data, write to info@oursolstice.com and we will delete it.

Changes to this policy

We may update this page as our practices change. The date shown at the top of the page is the date of the version you are reading, and we encourage you to check it from time to time.

How to contact us

For any question about this policy, or to exercise any right described in it:

Qumm Shams for Trips Company Riyadh, Kingdom of Saudi Arabia info@oursolstice.com