Privacy Policy

Last updated: —

1. 01

   What we collect

   This website collects personal data in two places, and only when you enter it yourself.

   • The enquiry form: your name, your organisation, your email address, your phone number, the service you are interested in, your arrival and departure dates, the size of your delegation, the package you have in mind, and anything you write in the message field.
   • The newsletter field in the footer: your email address, and nothing more.

2. 02

   What stays on your device

   The four selections in the planning bar on the home page — service, dates, delegation size and package — are held in your browser's session storage so that the contact form opens already filled in. They stay on your device, are cleared the moment the form reads them, and reach us only if you submit the form.

   We set no analytics cookies and no advertising cookies on this site. We do not measure your visit, build a profile of you, or pass anything to an advertising network.

3. 03

   Why we hold it, and on what basis

   We hold enquiry data for one purpose: to answer you and, if the conversation continues, to plan and deliver the visit you are arranging. A newsletter address is held solely to send ECHO updates.

   Our basis for processing is your consent, given when you submit the form, together with the steps necessary to prepare or perform a service agreement with you or the organisation you represent. You may withdraw consent at any time; withdrawing it does not undo what was lawfully done beforehand.

   Read the Terms and Conditions

4. 04

   The framework we work to

   This policy is written with reference to the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL) and its implementing regulations. It sets out the practice we intend to hold ourselves to; it is not a claim of certified or audited compliance.

5. 05

   How enquiries are used, and who sees them

   An enquiry reaches the ECHO team that plans and coordinates visits. Only the people who need it in order to answer you see it: coordination and operations, and the commercial team where a proposal follows.

   Where delivering a visit requires it, we pass the minimum necessary to the partners serving that visit — hotels, transport providers, venues and protocol partners. We share only what the partner needs, only for that visit, and never for the partner's own marketing.

   We do not sell personal data. We do not rent it, trade it, or otherwise make it available to anyone for their own commercial purposes.

6. 06

   How long we keep it

   An enquiry that does not lead to work is kept while we are in correspondence about it and for a reasonable period afterwards, then deleted. Records connected to a visit we delivered are kept for as long as the engagement and any legal, tax or contractual obligation requires. A newsletter address is kept until you ask to be removed.

   The exact periods are among the items awaiting legal review, and will be stated here once they are confirmed.

7. 07

   Who processes data on our behalf

   This site is hosted on Vercel, which operates the servers that deliver these pages and therefore processes the requests your browser makes, including the contents of a form you submit.

   Once enquiry delivery is configured, an email delivery provider will carry submissions from the form to ECHO's inbox. We engage such providers under contract, require them to act only on our instructions, and do not permit them to use your data for their own purposes.

8. 08

   International transfers

   Our providers run global infrastructure, so your data may be processed or stored outside the Kingdom. Where that happens we require a level of protection consistent with the PDPL, and we require the provider to act only on our instructions.

9. 09

   Security

   The site is served over an encrypted connection, and access to enquiries is limited to the people who need it. No system is beyond risk; we take reasonable technical and organisational measures and keep them under review.

10. 10

    Your rights

    Under the PDPL you may ask us for the following.

    • To be informed — what personal data we hold about you, and why we hold it.
    • Access — a copy of the personal data we hold about you.
    • Correction — anything inaccurate, incomplete or out of date put right.
    • Deletion — removal of your data where we have no continuing need and no legal obligation to keep it.
    • Objection — an end to a particular use, or the withdrawal of your consent.

11. 11

    How to exercise them

    Write to ECHO through the contact page and tell us what you would like us to do. We will confirm receipt, satisfy ourselves that the request comes from you, and respond within the period the PDPL allows. A reasonable request carries no charge.

12. 12

    Children

    This website is intended for organisations and adult travellers, and we do not knowingly collect personal data from children. Where a delegation includes a minor, those details reach us from the host or guardian arranging the visit, never from the child. If you believe a child has sent us personal data, contact us and we will delete it.

13. 13

    Changes to this policy

    When our practice changes — a new provider, a new tool, analytics we do not use today — we will update this page and change the date shown above. Material changes will be noted on the page rather than made quietly.

14. 14

    Contacting us

    Questions about this policy, and requests about the data we hold, go to the same place as every other enquiry: one point of contact, through the contact page.

    ECHO's postal address and the dedicated address for data requests will be published here once they are confirmed.