Privacy Policy

FlyNow Arabia Limited (“FlyNow”, “we”, “us” or “our”) respects your privacy and is committed to protecting your Personal Data.

This Privacy Policy explains how we collect, use, process, store, disclose and protect Personal Data when you visit our website, contact us, subscribe to our communications or otherwise interact with FlyNow.

We process Personal Data in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia (“PDPL”), its Implementing Regulations, the Regulation on Personal Data Transfer Outside the Kingdom and other applicable laws and regulations.

1 — Who We Are

FlyNow Arabia Limited is the Data Controller responsible for the Personal Data covered by this Privacy Policy.

Questions concerning this Privacy Policy or the processing of your Personal Data may be submitted using the contact details above.

2 — Scope of this Privacy Policy

This Privacy Policy applies to Personal Data processed through FlyNow websites and digital services that link to this Privacy Policy, as well as information provided to us when you:

• browse our website;
• complete a contact or enquiry form;
• contact us by email, telephone or other communication channels;
• subscribe to our newsletter or other communications;
• communicate with us in connection with a business, partnership, media or other professional enquiry; or
• otherwise interact with FlyNow through our website.

This Privacy Policy does not apply to websites or services operated independently by third parties.

3 — Personal Data We Collect

The Personal Data we collect depends on how you interact with us.

Information you provide directly

We may collect:

• first and last name;
• email address;
• telephone number;
• company or organisation;
• job title or professional role;
• country or location information you provide;
• communication preferences;
• information contained in messages, enquiries or correspondence;
• newsletter subscription information; and
• other information you voluntarily provide to us.

Where information is required in order for us to respond to a request or provide a particular service, the relevant fields will be identified as mandatory.

Information collected automatically

When you access or use our website, certain technical information may be collected automatically, including:

• Internet Protocol (IP) address;
• browser type and version;
• operating system;
• device type;
• language settings;
• date and time of access;
• referring website or source;
• pages viewed;
• time spent on pages;
• website interactions;
• server log information; and
• cookie or similar technology identifiers.

We aim to collect only the minimum amount of Personal Data reasonably necessary for the relevant purpose.

4 — How We Collect Personal Data

Directly from you

We may collect Personal Data when you:

• submit an online form;
• subscribe to a newsletter;
• contact us by email or telephone;
• communicate with members of the FlyNow team;
• request information from us; or
• otherwise voluntarily provide information to us.

Automatically

Certain information may be collected automatically through:

• website server logs;
• cookies;
• similar digital technologies;
• security and fraud-prevention technologies; and
• website analytics tools.

From other sources

Where permitted by applicable law, we may also receive Personal Data from:

• other FlyNow group companies;
• business partners;
• service providers;
• event organisers;
• publicly available professional or business sources; or
• other parties where you have authorised the disclosure or where another lawful basis permits us to receive the information.

Where required by law, we will inform you if Personal Data has been obtained indirectly.

5 — Why We Process Personal Data

Operating and securing our website

We process technical and usage information to:

• make the website available;
• ensure that pages and content display correctly;
• maintain website performance;
• identify technical errors;
• protect our systems against cyber threats and misuse;
• prevent unauthorised access; and
• maintain network and information security.

Responding to enquiries

We process information provided through contact forms, email, telephone or other communication channels in order to:

• respond to enquiries;
• provide requested information;
• communicate about FlyNow, its technology and activities;
• respond to media enquiries;
• respond to partnership or business enquiries; and
• follow up on requests.

Managing business relationships

We may process professional contact information to:

• establish and maintain relationships with partners, suppliers, customers and other stakeholders;
• communicate regarding projects and opportunities;
• arrange meetings;
• administer business relationships; and
• maintain appropriate business records.

Newsletters and marketing communications

If you choose to receive newsletters, company updates, invitations or other promotional communications, we may process your name, email address and communication preferences for these purposes.

We will obtain consent where required before sending direct marketing communications.

You may withdraw your consent or unsubscribe at any time by using the unsubscribe function in the relevant communication or by contacting us.

Website analytics and improvement

We may process website usage information to:

• understand how visitors use our website;
• measure website performance;
• identify popular content;
• improve navigation and usability;
• improve the design and content of our website; and
• understand general website traffic patterns.

Where consent is required for analytics technologies, they will only be activated after the appropriate consent has been provided.

Compliance with legal obligations

We may process Personal Data where necessary to:

• comply with applicable laws and regulations;
• respond to lawful requests from competent authorities;
• meet regulatory obligations;
• establish, exercise or defend legal rights; or
• maintain records required by law.

Protecting FlyNow and others

We may process Personal Data where necessary to protect:

• FlyNow's systems and operations;
• our legal rights and legitimate interests;
• our personnel;
• website visitors;
• business partners; or
• other persons.

Any processing based on legitimate interests will be carried out in accordance with the requirements of applicable Saudi data protection law.

6 — Legal Bases for Processing

Depending on the particular processing activity, FlyNow may rely on one or more lawful bases permitted under the PDPL.

Consent

We may process your Personal Data where you have given us your consent, for example when subscribing to marketing communications or accepting certain non-essential cookies.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Contractual necessity

We may process Personal Data where this is necessary to enter into or perform an agreement with you or to take steps at your request in connection with a potential agreement.

Legal obligation

We may process Personal Data where this is necessary to comply with an obligation imposed on FlyNow by applicable law or regulation.

Legitimate interests

Where permitted under the PDPL, we may process Personal Data where this is necessary for a legitimate business interest and where that interest does not adversely affect your rights and interests.

Such interests may include:

• operating and securing our website;
• protecting our IT infrastructure;
• communicating with existing business contacts;
• maintaining appropriate business records;
• preventing fraud or misuse; and
• improving our services and operations.

Where required, we assess and document our legitimate interests before relying on this legal basis.

Other lawful bases

In appropriate circumstances, Personal Data may also be processed on another basis permitted under applicable Saudi law, including where necessary to protect a person's vital interests or actual interests or to comply with judicial or regulatory requirements.

7 — Cookies and Similar Technologies

Our website may use cookies and similar technologies. Cookies are small data files stored on or accessed through your device when you visit a website.

We may use the following categories of cookies:

Strictly necessary cookies

These cookies are necessary for the proper functioning, security and operation of the website.

Preference cookies

These cookies may remember settings or choices you make while using the website.

Analytics cookies

These cookies may help us understand how visitors interact with the website and allow us to improve its performance and content.

Third-party and embedded-content cookies

Our website may contain embedded content or functionality provided by external platforms, including video or media services. These services may use their own cookies or similar technologies when the relevant content is loaded.

Where required by applicable law, non-essential cookies will only be used after you have provided consent.

You may change your cookie preferences through the cookie settings available on our website. You may also be able to restrict or delete cookies through your browser settings.

Disabling certain cookies may affect the functionality of parts of the website.

8 — Embedded Content and Third-Party Services

Our website may contain content provided by third-party services, including embedded video or media functionality.

For example, content may be embedded from platforms such as YouTube or Vimeo.

When you choose to load or interact with third-party content, the provider may receive technical information such as:

• your IP address;
• browser information;
• device information;
• the page you are visiting;
• cookie identifiers; and
• information about your interaction with the embedded content.

The third-party provider may process this information under its own privacy terms.

Where consent is required before third-party content or associated technologies are activated, we will request the appropriate consent through our website.

9 — Newsletter and Direct Marketing

If you subscribe to our newsletter or other marketing communications, we will process your Personal Data for the purpose of sending you the communications you requested.

We will obtain your consent before processing Personal Data for direct marketing where required under applicable law.

Our marketing communications will identify FlyNow as the sender and provide a clear and simple method for you to unsubscribe.

If you withdraw your consent or unsubscribe, we will stop sending the relevant marketing communications without undue delay.

We may retain a limited record of your unsubscribe request to ensure that your preference continues to be respected.

We do not sell Personal Data to third parties for their own direct marketing purposes.

10 — Who We Share Personal Data With

We do not disclose Personal Data to third parties unless there is a valid business or legal reason to do so.

Personal Data may be disclosed to the following categories of recipients where necessary:

FlyNow group companies

We may share Personal Data with other companies within the FlyNow group where necessary for administration, responding to enquiries, business operations or other lawful purposes.

Where such disclosure involves a transfer outside Saudi Arabia, the requirements described in Section 12 apply.

Technology and website providers

We may use service providers that support:

• website development;
• hosting;
• cybersecurity;
• IT infrastructure;
• website analytics;
• cookie management;
• email communications;
• newsletters;
• video and media content; and
• other digital services.

These providers may process Personal Data on our behalf or, depending on the service, as independent Data Controllers.

Where a provider acts as our processor, we require appropriate contractual and organisational safeguards for Personal Data.

Professional advisers

Personal Data may be disclosed where necessary to professional advisers such as:

• lawyers;
• auditors;
• accountants;
• consultants; and
• other professional service providers.

Authorities

We may disclose Personal Data to governmental, judicial, law-enforcement or regulatory authorities where required or permitted by applicable law.

Corporate transactions

If FlyNow is involved in a merger, acquisition, restructuring, financing, investment, sale of assets or similar corporate transaction, relevant Personal Data may be disclosed to advisers, investors, counterparties or other parties involved in the transaction, subject to appropriate safeguards and applicable law.

11 — Where We Store Personal Data

The FlyNow website and its primary website hosting infrastructure are located in the Kingdom of Saudi Arabia.

Personal Data collected directly through our website is therefore primarily stored on hosting infrastructure located within Saudi Arabia.

We implement appropriate technical, organisational and administrative measures to protect Personal Data stored through our systems.

Certain external service providers used for communications, analytics, embedded media or other functionality may process limited Personal Data outside Saudi Arabia.

Any such international processing or transfer is subject to the requirements described below.

12 — International Transfers of Personal Data

Although our primary website hosting is located in Saudi Arabia, FlyNow operates internationally and may use service providers or work with FlyNow group companies located outside the Kingdom.

As a result, certain Personal Data may be transferred to, accessed from or otherwise processed outside Saudi Arabia.

Where Personal Data is transferred outside the Kingdom, FlyNow will comply with the PDPL, the Regulation on Personal Data Transfer Outside the Kingdom and other applicable requirements.

Depending on the circumstances, this may include:

• verifying that the relevant legal requirements for the transfer are met;
• ensuring that only the minimum necessary Personal Data is transferred;
• carrying out required transfer assessments;
• implementing appropriate contractual safeguards;
• using approved standard contractual clauses or other recognised safeguards where required; and
• taking appropriate technical and organisational measures to protect transferred Personal Data.

13 — How Long We Keep Personal Data

We retain Personal Data only for as long as necessary for the purpose for which it was collected and in accordance with applicable legal and regulatory requirements.

As a general rule:

• Website enquiries and contact-form information are retained for up to three years after the last relevant communication, unless a longer period is necessary because of an ongoing business relationship, legal requirement or legal claim.
• Newsletter subscription information is retained for as long as you remain subscribed. If you unsubscribe, your details will be removed from active marketing lists, while a limited suppression record may be retained for up to five years to document and respect your opt-out.
• Website and security logs are generally retained for up to 12 months, unless they need to be retained for longer to investigate a security incident, prevent misuse or comply with a legal obligation.
• Cookie consent and preference records may be retained for up to 24 months to record and manage your privacy choices.
• Analytics information is retained only for the period necessary for website analysis and is deleted or anonymised when it is no longer required.
• Business correspondence and records may be retained for the duration of the relevant relationship and for any additional period required under applicable law or reasonably necessary for the establishment, exercise or defence of legal claims.

Where applicable law requires a longer retention period, we will retain the relevant Personal Data for the required period.

When Personal Data is no longer required, it will be securely deleted, destroyed or anonymised so that the individual can no longer be identified.

14 — How We Protect Personal Data

FlyNow takes appropriate administrative, organisational and technical measures designed to protect Personal Data from:

• unauthorised access;
• unlawful processing;
• unauthorised disclosure;
• loss;
• misuse;
• alteration;
• accidental destruction; and
• other security risks.

Depending on the nature of the Personal Data and processing activity, these measures may include:

• access controls;
• authentication measures;
• network and system security;
• encryption where appropriate;
• access restrictions based on business need;
• secure hosting;
• monitoring and logging;
• backup and recovery procedures;
• contractual confidentiality requirements; and
• internal data-protection procedures.

No Internet transmission or electronic storage system can be guaranteed to be completely secure. We therefore continuously assess and improve appropriate safeguards in light of relevant risks and technological developments.

15 — Personal Data Breaches

If a Personal Data breach occurs, FlyNow will assess the nature and potential impact of the incident and take appropriate measures to contain, investigate and remedy it.

Where required under applicable Saudi law, we will notify the competent authority and affected Data Subjects in accordance with the applicable legal requirements.

16 — Your Rights

Subject to the PDPL and any applicable conditions, limitations or exceptions, you have rights in relation to your Personal Data.

Right to be informed

You have the right to know:

• why your Personal Data is being collected;
• the legal basis for collection and processing;
• how your Personal Data is processed;
• how it is stored;
• how long it will be retained;
• how it will be destroyed;
• to whom it may be disclosed; and
• whether it may be transferred outside Saudi Arabia.

This Privacy Policy is intended to provide that information.

Right of access

You have the right to request access to Personal Data about you that is held by FlyNow, subject to applicable legal requirements.

Right to obtain a copy

You may request a copy of your Personal Data in a readable and clear format. Where feasible, the information may be provided electronically in a commonly used format.

Right to correction, completion and updating

You have the right to request correction of inaccurate Personal Data and completion or updating of Personal Data that is incomplete or outdated.

Right to request destruction

You may request the destruction of your Personal Data in circumstances provided by the PDPL and its Implementing Regulations.

Certain Personal Data may need to be retained where continued retention is required or permitted by applicable law.

Right to withdraw consent

Where processing is based on your consent, you may withdraw that consent at any time.

Withdrawing consent does not affect processing lawfully carried out before the withdrawal and does not prevent processing based on another lawful basis.

Right to complain

You have the right to raise a complaint concerning the processing of your Personal Data with FlyNow and, where appropriate, with the competent Saudi data protection authority.

Your rights are subject to the conditions and exceptions provided by applicable law.

17 — How to Exercise Your Rights

To exercise any of your Personal Data rights or ask a question about how we process your information, please contact:

Please clearly describe your request and provide sufficient information for us to identify the Personal Data concerned.

We may take reasonable steps to verify your identity before responding to a request in order to protect your Personal Data from unauthorised disclosure.

We will respond to a valid request without undue delay and, under the applicable Implementing Regulations, generally within 30 days of receiving the request.

Where permitted by law and where implementing a request requires disproportionate effort or multiple requests have been received from the same Data Subject, this period may be extended by up to an additional 30 days. If an extension is necessary, we will inform you and explain the reason.

Requests are generally handled without charge unless applicable law permits otherwise.

18 — Complaints

If you have a concern regarding our processing of your Personal Data or believe that we have not complied with applicable data protection requirements, please contact us first at fly@flynow-aviation.com.

We will review your complaint and seek to respond appropriately.

If you are not satisfied with our response, you may submit a complaint to the competent authority responsible for Personal Data protection in Saudi Arabia:

19 — Automated Decision-Making and Profiling

We do not currently use Personal Data collected through our website to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.

If this changes, we will provide the information and safeguards required by applicable law and update this Privacy Policy where necessary.

20 — Sensitive Personal Data

Our website is not intended to collect Sensitive Personal Data unless such information is specifically required for a lawful purpose.

Please do not provide sensitive information through general website contact forms unless it is necessary for your enquiry.

If we need to process Sensitive Personal Data, we will apply the additional protections and legal requirements applicable to such processing under the PDPL.

21 — Persons Without Full Legal Capacity

Our website and general corporate services are primarily intended for persons who have full legal capacity. Where FlyNow becomes aware that Personal Data relating to a person who lacks full or partial legal capacity requires processing, we will apply the requirements of applicable Saudi law, including obtaining and verifying consent from a legal guardian where required.

22 — Third-Party Websites

Our website may contain links to third-party websites, social media platforms or external services.

These third parties operate independently from FlyNow and may process Personal Data under their own privacy policies and terms.

FlyNow is not responsible for the privacy practices or content of independent third-party websites or services.

We recommend reviewing the relevant privacy information before submitting Personal Data to a third party.

23 — Social Media

FlyNow maintains profiles on third-party social media platforms.

If you interact with FlyNow through a social media platform, the platform may process information about you independently in accordance with its own privacy terms.

Information you choose to make publicly available through social media may also be visible to FlyNow and other users of the platform.

24 — Changes to this Privacy Policy

We may update this Privacy Policy periodically to reflect:

• changes to our website;
• changes to the Personal Data we process;
• new technologies or service providers;
• changes to our business activities;
• organisational changes; or
• changes to applicable laws or regulatory requirements.

The current version of this Privacy Policy will be made available on our website.

The “Last updated” date at the beginning of this Privacy Policy indicates when the latest revision was made.

Where a change materially affects how we process Personal Data, we will provide additional notice where required by applicable law.

25 — Contact Us

For questions, requests, complaints or other matters relating to privacy and Personal Data protection, please contact: