Privacy Policy

CEFA RESIDENCE PRIVACY POLICY

Last Updated: 5 September 2026

1. Introduction

CEFA RESIDENCE (“CEFA Residence,” “we,” “us,” or “our”) respects the privacy of our guests, customers and website visitors and is committed to protecting their personal data.

This Privacy Policy explains how we collect, use, process, store, disclose and protect personal data when you:

Visit or use the CEFA Residence website;
Create or manage a reservation;
Stay at accommodation operated or managed by CEFA Residence;
Make a payment;
Communicate with us through WhatsApp, telephone, SMS, email or other communication channels; or
Otherwise use our accommodation and related services.

We process personal data in accordance with applicable laws and regulations in the Kingdom of Saudi Arabia, including the Personal Data Protection Law (“PDPL”) and its Implementing Regulations.

2. About CEFA Residence

Business Name: CEFA RESIDENCE
Legal Entity: مؤسسة سفا السكنية للسياحة
Commercial Registration (CR): 7028811524
Business Activity: Tourist Accommodation and Hospitality Services
Location: Riyadh, Kingdom of Saudi Arabia
Website: cefaresidence.com
Email: fvhvdsh@gmail.com
Telephone: 0551832541

For personal data for which CEFA Residence determines the purposes and means of processing, CEFA Residence acts as the Data Controller.

3. Personal Data We Collect

Depending on your interaction with CEFA Residence, we may collect the following categories of personal data.

A. Identity Information

We may collect:

Full name;
Saudi National ID information;
Iqama information;
Passport information;
Copies or photographs of identification documents;
Nationality, where required; and
Other identification information reasonably required for guest verification or legal compliance.

B. Contact Information

We may collect:

Mobile telephone number;
Email address; and
Other contact details supplied when making a reservation or inquiry.

C. Reservation and Accommodation Information

This may include:

Check-in and check-out dates;
Property, apartment, room or accommodation unit booked;
Number of guests;
Reservation history;
Booking reference;
Reservation status;
Guest requests;
Check-in information; and
Other information necessary to manage your accommodation.

D. Payment and Transaction Information

We may process or retain:

Amount paid;
Payment status;
Transaction reference;
Booking reference;
Refund information; and
Payment method information necessary for transaction administration.

Online card payments are processed through our third-party payment service provider, PayTabs.

CEFA Residence does not intend to store complete credit/debit card numbers, CVV security codes or complete payment-card credentials when these are processed directly through PayTabs, unless such processing is otherwise necessary and permitted by applicable law.

E. Communications

We may collect and retain communications between you and CEFA Residence, including communications through:

WhatsApp;
SMS;
Telephone;
Email;
Our website;
Customer-support channels; and
Other communication platforms used to provide our services.

These communications may include inquiries, booking instructions, complaints, requests and feedback.

F. Website and Technical Information

When you use our website, certain information may be collected automatically, including:

IP address;
Device type;
Browser type;
Operating system;
Website activity;
Date and time of access;
Referral information;
Cookies and similar technologies; and
Other technical information necessary to operate, secure and improve our website.

4. How We Collect Personal Data

We may collect personal data:

Directly from you when you make a reservation;
When you enter information on our website;
During check-in and guest-verification procedures;
When you provide your National ID, Iqama, passport or other identification document;
When you communicate with CEFA Residence;
When you make or receive a payment or refund;
Automatically through our website and related technologies;
Through authorized booking channels or platforms;
From payment and technology service providers; or
From another person making a reservation on your behalf, where permitted.

We seek to collect only personal data that is relevant and reasonably necessary for the identified purpose.

5. Why We Use Your Personal Data

CEFA Residence may process personal data for the following purposes:

Reservations and Accommodation

To:

Create and confirm reservations;
Modify or cancel reservations;
Allocate accommodation;
Facilitate check-in and check-out;
Verify guest identity;
Provide accommodation services; and
Maintain records relating to a guest's stay.

Guest Verification

To verify the identity of guests and, where applicable, comply with requirements relating to tourist accommodation, security, guest registration or other applicable Saudi laws and regulations.

Payments

To:

Process payments;
Verify payment status;
Administer deposits;
Issue refunds;
Maintain transaction records; and
Detect or prevent fraudulent transactions.

Guest Communication

To provide:

Booking confirmations;
Check-in instructions;
Reservation updates;
Payment notifications;
Customer support;
Responses to inquiries; and
Important information concerning a guest's stay.

Legal and Regulatory Compliance

To comply with applicable Saudi laws, regulations, government requirements, accounting requirements, judicial orders and lawful requests from competent authorities.

Safety, Security and Fraud Prevention

To protect:

Our guests;
CEFA Residence;
Accommodation properties;
Our website and systems; and
Transactions against fraud, misuse, unauthorized access and other security risks.

Website and Service Improvement

To operate, maintain, secure, analyze and improve our website, reservation processes and guest services.

Marketing

Where permitted by applicable law, and where required with your consent, we may use your contact information to provide information about CEFA Residence promotions, offers or services.

You may opt out of marketing communications at any time.

6. Legal Basis for Processing

Depending on the processing activity, CEFA Residence may rely on an appropriate legal basis available under applicable Saudi law, including:

Your consent, where consent is required;
Processing necessary in connection with providing services you have requested or contractual arrangements relating to your reservation;
Compliance with applicable legal or regulatory requirements;
Protection of vital interests where applicable;
Legitimate interests where permitted under the PDPL and its Implementing Regulations and where the applicable conditions are satisfied; or
Another lawful basis permitted under applicable Saudi law.

Where processing is based on consent, you may withdraw your consent in accordance with applicable law. Withdrawal does not affect processing lawfully performed before the withdrawal.

7. Required Information

Certain personal information is necessary to make or complete a reservation, verify a guest, process a payment or comply with applicable legal requirements.

This may include:

Name;
Mobile number/contact information;
Reservation details;
Identification information;
National ID, Iqama or passport information where required; and
Information necessary for payment processing.

If required information is not provided, we may be unable to confirm a reservation, permit check-in, process a transaction or provide some or all of our services.

8. National ID, Iqama and Passport Copies

As part of our guest-registration and verification procedures, CEFA Residence may collect and store copies or photographs of identification documents, including:

Saudi National ID;
Iqama; and
Passport.

These documents may be collected for legitimate purposes including guest identification, check-in, accommodation administration, security and compliance with applicable Saudi laws and regulatory requirements.

Access to stored identification documents is restricted to authorized persons who require access for legitimate operational, security, regulatory or legal purposes.

We do not use copies of identification documents for unrelated advertising or marketing purposes.

Identification information will be retained only for as long as necessary for the purposes for which it was collected or where continued retention is required or permitted by applicable law.

When retention is no longer necessary or legally required, CEFA Residence will take appropriate measures to securely delete, destroy or anonymize the information in accordance with applicable requirements.

9. Payment Processing – PayTabs

CEFA Residence uses PayTabs as a third-party payment service provider for online payment processing.

When you make an online payment, payment information may be provided directly to and processed by PayTabs for purposes including:

Payment authorization;
Transaction processing;
Fraud prevention;
Refund processing; and
Transaction management.

CEFA Residence may retain transaction-related information such as the payment amount, transaction reference, payment status, booking reference and refund status.

Complete payment-card credentials entered into the PayTabs payment system are processed subject to PayTabs' own applicable privacy, security and payment-processing practices.

10. Sharing Personal Data

CEFA Residence does not sell personal data.

Where necessary and legally permitted, personal data may be disclosed to categories of recipients such as:

Payment Service Providers

Including PayTabs, where necessary to process payments and refunds and manage payment-related matters.

Accommodation and Operational Service Providers

Where necessary to manage your reservation, property, accommodation, check-in or related guest services.

Technology and Hosting Providers

Where necessary to host and operate our website, reservation systems, databases and other technology.

Communication Providers

Where necessary to communicate with guests through email, SMS, WhatsApp or other communication services.

Professional Advisers

Including accountants, auditors, legal advisers or other professional advisers where necessary.

Government, Judicial and Regulatory Authorities

Where disclosure is required or permitted by applicable Saudi law, regulation, court order, lawful request or competent government authority.

We seek to limit disclosure to personal data reasonably necessary for the applicable purpose.

11. International Processing and Transfers

Some third-party technology, communication, hosting, payment or other service providers used by CEFA Residence may operate infrastructure or process information outside the Kingdom of Saudi Arabia.

Where personal data is transferred, disclosed or processed outside Saudi Arabia, CEFA Residence will take appropriate steps to ensure that the transfer or processing is carried out in accordance with applicable requirements under the PDPL, its Implementing Regulations and applicable rules governing transfers of personal data outside the Kingdom.

Where required, appropriate safeguards and transfer mechanisms will be used.

12. Data Retention and Destruction

CEFA Residence retains personal data only for the period reasonably necessary to fulfill the purpose for which it was collected and to satisfy applicable legal, regulatory, accounting, security or dispute-resolution requirements.

Retention periods may differ depending on the category of information and the purpose for which it is processed.

We may retain information where necessary to:

Complete and document accommodation services;
Maintain financial and accounting records;
Meet tourism or other regulatory obligations;
Handle complaints;
Resolve disputes;
Prevent or investigate fraud;
Establish, exercise or defend legal claims; or
Comply with applicable laws and lawful government requirements.

When personal data is no longer required and there is no lawful reason for continued retention, CEFA Residence will take appropriate measures to securely destroy, delete or anonymize it.

13. Security

CEFA Residence takes reasonable administrative, organizational and technical measures designed to protect personal data against:

Unauthorized access;
Unauthorized disclosure;
Accidental loss;
Misuse;
Alteration;
Destruction; and
Other unauthorized processing.

Access to personal data, particularly identification documents, should be restricted to authorized personnel with a legitimate need to access such information.

No electronic system or method of storage or transmission can be guaranteed to be completely secure.

If a personal-data breach occurs, CEFA Residence will take appropriate action and make notifications to the competent authority and/or affected individuals where required by applicable law.

14. Your Personal Data Rights

Subject to applicable Saudi law and any lawful limitations or exceptions, you may have the following rights regarding your personal data:

Right to Be Informed

You have the right to be informed about the legal basis and purpose of collecting your personal data and how it is processed.

Right of Access

You may request access to personal data held about you.

Right to Obtain a Copy

You may request a copy of your personal data in a readable and clear format in accordance with applicable requirements.

Right to Correction

You may request the correction, completion or updating of inaccurate, incomplete or outdated personal data.

Right to Request Destruction

You may request the destruction of your personal data when the applicable legal conditions are satisfied.

Withdrawal of Consent

Where processing depends on your consent, you may withdraw that consent in accordance with applicable law.

To exercise any applicable personal-data right, contact CEFA Residence using the details in Section 21.

We may need to verify your identity before processing your request to protect personal data from unauthorized access or disclosure.

15. Marketing Communications

Where permitted by applicable law and, where necessary, after obtaining your consent, CEFA Residence may send information about:

Promotions;
Special offers;
Accommodation availability; and
CEFA Residence services.

You may withdraw your marketing consent or opt out of promotional communications at any time.

Opting out of marketing will not prevent us from sending necessary transactional or service communications relating to your reservation, check-in, stay, payment, security or customer-support request.

16. WhatsApp, SMS and Electronic Communications

If you provide your telephone number or communicate with CEFA Residence through WhatsApp, SMS, email or another electronic communication service, we may use that channel for purposes such as:

Booking confirmations;
Guest verification;
Check-in instructions;
Reservation updates;
Payment-related communication;
Customer support;
Responding to inquiries; and
Other communications necessary to manage your stay.

Third-party communication platforms may independently process information under their own terms and privacy policies.

17. Cookies and Similar Technologies

Our website may use cookies and similar technologies to:

Enable essential website functionality;
Maintain website security;
Remember preferences;
Understand website usage;
Analyze performance;
Improve our website and booking experience; and
Support analytics or marketing where permitted.

Where consent is legally required for non-essential cookies, we will seek to obtain appropriate consent.

Users may also control certain cookies through their browser settings.

18. Third-Party Websites and Services

The CEFA Residence website may contain links to or integrate with third-party services, including payment, communication or other service providers.

Independent third parties operate under their own privacy policies and terms. We encourage users to review those policies before providing information directly to a third party.

19. Children's and Minors' Data

Online reservations should be made by persons legally capable of making the reservation.

Personal data relating to minors may nevertheless be processed where a minor accompanies a guest or where such information is necessary for legitimate accommodation, registration or legal purposes.

Where applicable law requires consent or action by a parent or legal guardian, CEFA Residence will seek to handle such data in accordance with those requirements.

20. Changes to This Privacy Policy

CEFA Residence may update this Privacy Policy to reflect changes to our business, services, technologies, data-processing practices or applicable legal requirements.

The latest version will be made available through our website and will display an updated “Last Updated” date.

Where required by applicable law, additional notice or consent will be provided before materially different processing takes place.

21. Contact Us and Exercise Your Rights

For questions regarding this Privacy Policy, concerns about the handling of your personal data, or requests to exercise your personal-data rights, please contact:

CEFA RESIDENCE
مؤسسة سفا السكنية للسياحة
Commercial Registration (CR): 7028811524
Riyadh, Kingdom of Saudi Arabia

Email: fvhvdsh@gmail.com
Telephone: 0551832541
Website: cefaresidence.com

Please provide sufficient information for us to identify and understand your request.

For your protection, CEFA Residence may request appropriate information to verify your identity before responding to a request involving personal data.

If you believe that the processing of your personal data violates applicable Saudi personal-data protection requirements, you may also submit a complaint to the competent authority in accordance with applicable procedures.