Privacy Policy & Terms of Use سياسة الخصوصية وشروط الاستخدام

Welcome to Zawaya, the digital guest assistant of the hotel where you are staying. This notice explains what personal data is processed when you use the assistant, the restaurant & café ordering, room requests and the local guidebook, why it is processed, how long it is kept, and the rights you have under the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations issued under the supervision of the Saudi Data & AI Authority (SDAIA).

Who is responsible for your data

Two parties are involved, with different roles under the PDPL:

To exercise any of your rights, contact the hotel reception, or reach us through our website zawayatech.com.sa and we will route your request to the hotel and support it technically.

In line with the PDPL principle of data minimisation, processing is limited to the following:

We do not collect: payment card numbers, national ID or passport numbers, contacts, photos or files from your device, or advertising identifiers.

• Delivering your stay services — signing you in, filing and tracking room requests, complaints and restaurant/café orders, notifying the team, keeping you updated, and adding the related amounts to your room account. Basis: necessary to provide the accommodation and services you requested.
• Answering you — the assistant uses your conversation and the hotel's published information to reply. Basis: providing the service you requested.
• Translating for the team — your requests, order notes and the team's replies may be machine-translated so each side reads their own language. Basis: providing the service you requested.
• Security and abuse prevention — protecting access codes, limiting repeated attempts, detecting misuse, and keeping security records. Basis: the legitimate interest of the hotel and of Zawaya in keeping the service safe, balanced against your privacy.
• Optional features — using your precise location and extended usage measurement. Basis: your consent, which you can withdraw at any time from Settings without affecting the rest of the service.
• Service improvement — aggregated usage statistics with no names, room numbers or guest identifiers.
• Legal obligations — responding to lawful requests from competent authorities and keeping records the law requires.

We use a small number of cookies and browser-storage entries. Essential ones are required to sign you in securely and run the service, so they cannot be switched off. Optional ones are used only after you accept them in the cookie banner — refusing them does not limit any service you order.

No advertising or cross-site tracking cookies. Basic usage statistics are counted on the server in aggregate, without cookies and without your name or room; they are linked across the days of your stay only if you allow extended measurement.

Your data is shared only with the following, each bound by contract or by its role to use it solely for the stated purpose:

We may disclose data where required by law or by a competent authority in the Kingdom of Saudi Arabia, and only to the extent required.

Some of the providers above (such as the AI, translation and mapping services) may process data outside the Kingdom of Saudi Arabia. Any such transfer is made in line with Article 29 of the PDPL and the Regulation on Personal Data Transfer outside the Kingdom:

• only the minimum data needed for the specific purpose is transferred;
• transfers are limited to providers bound by contractual and technical safeguards appropriate to the data;
• chat messages pass through automated redaction before AI processing, while text for translation is sent as written (see Section 05);
• the hotel, as controller, approves the providers used for its property.

• Encryption in transit (HTTPS/TLS) and encryption at rest for sensitive fields such as names, access codes and notes.
• Device-bound sign-in: a copied link or token does not work on another device; reception can sign all devices out of your room instantly, and every sign-in ends at checkout.
• Least-privilege access: each staff role sees only what its work needs, and staff actions are logged.
• Abuse protection: rate limits and protection against code guessing, with alerts to reception.
• Separation between hotels: each hotel's data is kept in its own database and encryption scope.

If you believe your data has been processed unlawfully, you also have the right to lodge a complaint with the Saudi Data & AI Authority (SDAIA).

Data is kept only as long as needed for the purpose it was collected for, then deleted or anonymised:

Your requests and orders stay visible to you in the app until you check out. Records that the hotel must keep by law (for example financial records) may be kept for the legally required period in the hotel's own systems.

The guest app is intended for adult guests. We do not knowingly collect data from children; where a minor uses the service in a family room, the guest responsible for the booking is responsible for that use, and any consent for a minor must come from their parent or guardian. If you believe a child's data reached us, tell reception and it will be deleted.

These terms govern your use of the Zawaya guest app at the hotel where you are staying. By signing in and ticking the acceptance box you agree to them and to the Privacy Policy above. If you do not agree, please do not use the app — all hotel services remain available through reception. Your contract for accommodation, food and services is with the hotel; Zawaya provides the technology.

• Your access code is personal to your room. Do not share it; anyone with it can place requests and orders charged to your room.
• Up to two devices can be signed in to a room. Ask reception to sign devices out or to issue a new code if you think it was seen by someone else.
• Access is active for the stay period set by reception and ends at checkout. The hotel may pause access at any time for security or operational reasons.
• On a shared or public device, sign out when you finish.

• Menus, prices, availability and preparation times are set by the hotel and may change; the price that applies is the one shown in the review you confirm before sending.
• Confirmed orders and any fees shown to you (for example for items beyond a free allowance) are added to your room account and settled with the hotel under its policies. The app does not take card payments.
• You can cancel an order before the kitchen starts preparing it; after that, cancellation is a request that the hotel may accept or decline.
• Allergen and dietary information is declared by the hotel kitchen. If you have an allergy, always confirm it with the staff directly before eating.
• Delivery times are estimates, not guarantees.

The assistant uses generative AI and the hotel's published information. Its answers are generated automatically and may occasionally be incomplete or inaccurate; they are not professional (medical, legal, financial or safety) advice. In an emergency, contact reception or the emergency services directly.

Guidebook places are selected for convenience; opening hours, prices and availability are set by each venue and can change. Links to third-party sites and ticket pages are governed by their own terms.

• Use the app only for your own stay and lawful purposes.
• Do not post offensive content or content that violates the laws of the Kingdom of Saudi Arabia.
• Do not attempt to access other rooms' data, guess access codes, disrupt, scrape or reverse-engineer the service.
• Do not place false orders or requests. Misuse may lead to access being suspended and, where required, reported.

To the extent permitted by the laws of the Kingdom of Saudi Arabia, Zawaya Tech Solutions is not liable for indirect or consequential loss arising from use of the app, for the hotel's services, food, prices or delivery, or for third-party content and sites. The hotel remains responsible for the services it provides to you. Nothing in these terms limits any right you have that cannot be limited by law.

The app, its design and software belong to Zawaya Tech Solutions, and hotel content (names, menus, photos) belongs to the hotel. You may use them only to enjoy your stay.

These terms are governed by the laws of the Kingdom of Saudi Arabia. Any dispute will first be sought to be resolved amicably with the hotel; failing that, it falls under the jurisdiction of the competent courts in the Kingdom.

We may update this notice as the service or the law changes. The date at the top shows the current version. Material changes will be shown in the app, and where a change affects something you consented to, we will ask for your consent again.