ADDENDUM 1
For Kingdom of Saudi Arabia (KSA) use only 

THE APPOINTMENT GROUP (TAG)  
SUPPLEMENTAL PRIVACY POLICY FOR KSA  

Alternatively, you can download a pdf version of the policy here. 

  1. Introduction 

TAG respects your privacy and is committed to protecting it. This Supplemental Privacy Policy is designed to help you understand how we use your personal data when you visit our website (regardless of where you visit it from) or when you otherwise provide personal data to us via other means (such as over the telephone, via email or by text message) (regardless of where you provide it from) and tell you about your privacy rights and how the law protects you. 

For the purposes of this Supplemental Privacy Policy "we", "our" and "us" refer to The Appointment Group For Travel and Tourism Limited (CR 1010872745) (TAG) and "you" and "your" refers to a specific KSA based individual. 

  1. Purpose Of This Supplemental Privacy Policy  

This Supplemental Privacy Policy for KSA supplements but does not replace the TAG Privacy Policy which can be found here: https://www.tag-group.com/privacy.  

For the purposes of this Supplemental Privacy Policy, the following data protection legislation will apply: The Personal Data Protection Law (PDPL) implemented by Royal Decree M/19 of 9/2/1443H (16 September 2021) approving Resolution No. 98 dated 7/2/1443H (14 September 2021), as amended by Royal Decree No. M147 of 5/9/1444H (corresponding to 27 March 2023). 

  1. Data That We Collect About You  

TAG collects, processes and stores personal data as disclosed in Section 2 of the TAG Privacy Policy. Please note, that the collection of any sensitive personal data (which may also include (i) security and criminal data; and (ii) data indicating that a person has unknown parent/parents), will be subject to specific restrictions and/or additional safeguards.  

  1. How Do We Obtain Your Data 

TAG collects personal data about you disclosed as disclosed in Section 3 of the TAG Privacy Policy.  

  1. How We Will Use Your Data 

TAG will use personal data about you as disclosed in Section 4 of the TAG Privacy Policy. We use your personal data on the following bases, where available under applicable data protection laws: 

  • for our legitimate interests. Using your personal data helps us to operate, improve and minimise any disruption to our website. We also have a legitimate interest in sending you information on the products, services and offerings we believe will be of interest to you;  

  • because you have given your consent (if we expressly ask for consent to process your personal data, for a specific purpose); and 

  • to comply with legal, regulatory and risk management obligations.  

We will not process your personal data in a manner that is inconsistent with the purpose for which we have collected the data or the basis on which we have relied to collect your personal data. 

  1. How Will We Share Your Data 

TAG may share your personal data in the manners disclosed in Section 5 of the TAG Privacy Policy. In addition, we may disclose your personal data to any competent authorities if we are legally required to comply with a request for data.  

  1. How We Will Transfer Your Data 

TAG may transfer your personal data as disclosed in Section 6 of the TAG Privacy Policy.  

The information you submit or otherwise provide to us may be transferred, stored and hosted outside the country from which you may be accessing the website, and may be transferred to countries which do not have data protection laws or to countries where your privacy and other fundamental rights will not be protected as extensively. These and all other transmissions will remain secure and under our control. 

We will implement appropriate measures to ensure that your personal data remains protected and secure when it is transferred outside your home country, and you can exercise your rights effectively.  

In particular, TAG will ensure that it has a valid purpose in accordance with Article 29(1) of the KSA PDPL and it has satisfied the conditions set out in Article 29(2) of the KSA PDPL.  

If the Supervisory Authority issues any standard contractual clauses (SCCs) from time to time for transfers outside the KSA, then both TAG and you agree that these KSA SCCs will apply to such transfer. Any KSA SCCs introduced by the Supervisory Authority shall be incorporated by reference into this Supplementary Privacy Policy. In the event of any inconsistency between the terms of the KSA SCCs and any terms of this Supplementary Privacy Policy with respect to transfers subject to the KSA PDPL, the terms of the KSA SCCs will govern and control with respect to such transfers. 

  1. Data Security 

TAG protects your personal data in the manner described in Section 7 of the TAG Privacy Policy. 

  1. Data Retention 

TAG retains your personal data in the manner described in Section 8 of the TAG Privacy Policy.  

TAG will destroy your personal data without delay as soon as the purpose of collecting it, or the legal requirement for which we are required to keep the personal data, has expired. However, we may retain such data after the purpose of collecting it or the legal requirement has expired if it has been anonymised (i.e. any data that may lead to your identification has been removed). 

  1. Legal Rights 

Under certain conditions, you may have the right to:  

  • be informed, which includes informing you of the legal basis of collecting your personal data;  

  • access your personal data held by us;  

  • correct, complete or update your personal data;  

  • request the deletion of personal data;  

  • obtain your personal data in a legible and clear format, including the right to request the transfer of your personal data to another controller (if this is technically possible); and 

  • withdrawn consent at any time.  

Subject to any overriding legal obligations, requirements and/or exemptions, we will endeavour to respond to your request promptly in compliance with applicable laws, unless we require further information from you. We may ask you to provide proof of your identity. 

Where applicable, we will ensure that the rectification of data is notified to the relevant entities to whom we have disclosed or transferred the personal data. 

  1. Contact Us  

This Supplemental Privacy Policy sets out in broad terms how we handle your personal data and safeguard your privacy. If you have any questions relating to your data processing activities or this Supplemental Privacy Policy, please contact us using the details below:  

Full name of legal entity: The Appointment Group for Travel and Tourism  

Name or title of DPO: Jennifer Pratt 

Email address: dpo@tag-group.com 

Postal address: 7868 King Abdulaziz Road, Al Sahafah District, Riyadh 13321, Saudi Arabia 

Telephone number: +966 539 730 685 

  1. Your Right To Complain 

If you are not satisfied with our use of your personal data in respect of this website or our response to any request by you to exercise your rights, or if you think that we have breached any relevant data protection laws, then please contact us.  

You may in addition have the right to complain to any regulatory authority that supervises our processing of your personal data or, where you are based in KSA, the Saudi Data & Artificial Intelligence Authority or National Data Management Office (together the Supervisory Authorities). 

  1. Hyperlinks 

Our websites may provide links to third party websites for your convenience. If you access those links, you leave our website. We do not control those websites or their privacy practices, which may differ from ours. We do not endorse or make any representations about third-party websites. This Supplementary Privacy Policy does not cover the personal data you choose to give to unrelated third parties. We encourage you to review the privacy notice of any company before submitting your personal data. Some third-party companies may choose to share their personal data with us; that sharing is governed by that third-party company’s privacy notice. 

  1. Notification Of Changes 

We may be required to update or change our Supplemental Privacy Policy from time to time. In such case, we will upload an updated Supplemental Privacy Policy on the website and it will be effective from the time of posting.  

This Supplemental Privacy Policy was last updated on 30 May 2023.