Your data, handled with care
Privacy Policy
FlyTaq serves guests whose privacy is paramount. This policy explains what we collect, why, with whom we share it, and the rights you hold over your personal data.
On this page
Who we are and how to reach us
FlyTaq is a private-aviation marketplace headquartered in Riyadh, Kingdom of Saudi Arabia. When you use our platform, FlyTaq acts as the controller of your personal data in respect of bookings made directly through us.
You can contact our Data Protection Officer by email at dpo@flytaq.com or by post to our registered office. Wherever possible, please mention the booking reference or the email address associated with your account so we can respond quickly and precisely.
What personal data we collect
Identity data: full legal name, date of birth, nationality, passport or national ID scans, and any additional identity documents that aviation authorities or operators require for the flight.
Contact data: email address, telephone number, postal address and emergency contact.
Payment data: tokenised proxy identifiers returned by our payment service providers. We do not store full card numbers or CVV values on our systems.
Travel preferences: cabin configuration, catering, dietary needs, disclosed medical requirements, onboard connectivity and ground-transport choices.
Technical data: IP address, device identifiers, browser type, language and session timings.
Loyalty data: membership tier, points balances, redemption history and preferences you share with our concierge team.
Legal bases for processing
We process your personal data under the Saudi Personal Data Protection Law (PDPL) issued by the Saudi Data and Artificial Intelligence Authority (SDAIA), and, where applicable to EU or UK residents, under the General Data Protection Regulation (GDPR) and the UK GDPR.
Our legal bases include: performance of the contract between you and FlyTaq, compliance with legal and regulatory obligations (including aviation, immigration and tax law), our legitimate interests in operating and securing the platform, and your consent where required (for example, for optional analytics or marketing).
Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to the withdrawal.
How we use your data
To fulfil your bookings — from quote to arrival — including coordination with aircraft operators, airport handlers, customs and crew.
To comply with aviation, security and regulatory requirements such as passenger manifests.
To detect and prevent fraud, unauthorised access and financial abuse of the platform.
To personalise the concierge experience, tailor suggestions made by our Sama AI assistant, and remember your preferences across trips.
To send you operational communications about your booking, and — only with your consent — occasional invitations to FlyTaq events, lounges or offers.
With whom we share your data
Aircraft operators and flight crew: to plan and safely operate your flight, on a need-to-know basis.
Ground-handling providers, caterers and transport partners: to deliver the services you request at each leg.
Payment processors and banks: to charge, settle or refund transactions through tokenised references.
Aviation authorities, customs, immigration and tax authorities (including ZATCA): where required by law or by a legitimate aviation or fiscal process.
Professional advisers, auditors and insurers: under duties of confidentiality, for legal and compliance purposes.
We do not sell your personal data to marketers or data brokers. We never trade passenger records for advertising revenue.
International transfers
Because private aviation is inherently international, fulfilling your booking often requires transferring limited personal data to operators, handlers or authorities outside the Kingdom of Saudi Arabia.
Such transfers are carried out in accordance with the PDPL and, where applicable, the GDPR. Where a destination country has not been recognised as providing an adequate level of protection, we rely on approved safeguards such as Standard Contractual Clauses, binding corporate rules, or explicit consent, and we limit the data shared to what is strictly necessary for the flight.
How long we keep your data
Booking, invoice and payment records are retained for seven (7) years from the date of issue, in line with ZATCA and general tax retention requirements in the Kingdom of Saudi Arabia.
Account and preference data are kept while your account is active and for a reasonable period thereafter, so we can re-onboard you smoothly if you return. Backup archives are overwritten on a rolling basis under our information-security policy.
How we secure your data
Passwords are hashed with bcrypt and never stored in reversible form; authentication tokens are rotated, scoped and revocable. System credentials we store on your behalf — such as a connected mail account's access token — are encrypted at rest using AES-256.
We apply rate limiting, role-based access control and audit logging of account and data changes across our systems. CVV values are never stored. Production secrets are held in a dedicated vault with least-privilege access.
Despite these measures, no system is invulnerable. If you believe an incident has occurred, please notify security@flytaq.com immediately so we can investigate and, where required, notify affected users and regulators within the statutory timeframe.
Your rights
Subject to the PDPL and, where applicable, the GDPR, you have the right to access your personal data, to request rectification of inaccurate data, to request erasure (subject to our legal retention obligations), to restrict processing, to data portability, to object to certain processing, and to withdraw consent at any time.
To exercise any right, email dpo@flytaq.com with enough information for us to verify your identity. We will respond within the statutory deadline — typically thirty (30) days — and will never charge a fee for a legitimate request.
You also have the right to lodge a complaint with SDAIA (the competent authority in the Kingdom of Saudi Arabia) or, where applicable, with your local data-protection authority.
Cookies and similar technologies
We use strictly necessary cookies to keep you signed in, remember your locale preference, and protect the platform from abuse. These cookies are always on.
Children's data
FlyTaq is a service for adults. We do not knowingly solicit or collect personal data from anyone under the age of 18 for their own account.
Where a booking includes a minor as a passenger, the adult booker is responsible for providing the minor's information lawfully and for obtaining the consent of the minor's parent or legal guardian.
Updates to this policy
We may update this Privacy Policy to reflect changes in law, regulation, our services or our infrastructure. The most current version will always be posted on this page with an updated date.
For material changes, we will take reasonable steps to notify you — for example, via email or a platform banner — before the change becomes effective.