Privacy PolicyLast updated: 18/11/2025

1. Purpose of this Policy

This Privacy Policy explains how Resal Al-Wud Information Technology Company collects, uses, discloses and protects your personal data in accordance with applicable law, and in particular the Saudi Personal Data Protection Law (PDPL) issued under Royal Decree No. (M/19) dated 9/2/1443H and amended by Royal Decree No. (M/148) dated 5/9/1444H.

2. Scope of the Policy

The scope of this Policy applies to Resal’s employees, clients, contractors, partners and third parties who have a direct or indirect relationship with Resal for the processing, sharing or retention of personal data.
This Policy applies to all individuals within the Kingdom of Saudi Arabia whose personal data is processed by Resal in accordance with the Personal Data Protection Law (PDPL).

In addition, Resal may process the personal data of individuals outside the Kingdom of Saudi Arabia, including users in other regions such as the European Economic Area (EEA). In such cases, Resal ensures that personal data is processed in accordance with applicable law, including the General Data Protection Regulation (GDPR) where applicable, and that appropriate safeguards and necessary technical measures (such as contractual obligations and technical security measures) are applied to international data transfers.

3. Reference

  • The Saudi Personal Data Protection Law (PDPL).
  • The General Data Protection Regulation (GDPR), applicable to international users whose personal data Resal processes outside the Kingdom of Saudi Arabia.

4. Definitions

For the purposes of this Privacy Policy:

  • Account means a unique account created by the person themselves or on your behalf to access the Resal website or application, or parts of it.
  • Application means the Resal consumer application.
  • The Company (referred to as “Resal”, “the Company”, “we”, “us” or “our”) refers to Resal Al-Wud Information Technology Company, Kingdom of Saudi Arabia.
  • Cookies are small files placed on your devices by a website, containing details of your browsing history, which may be accepted, rejected or customised.
  • Country refers to the Kingdom of Saudi Arabia.
  • Device means any device that can access the website or application, such as a computer, mobile phone or tablet.
  • Merchant means any establishment that accepts Resal products and services (including Resal Pay) or offers goods or services available through Resal (including booking services). Resal may process operational data belonging to the merchant (such as branch identifiers, point-of-sale terminal identifiers and transaction reference numbers) for the purpose of enabling and completing Resal Pay transactions, and this data is treated as part of the data Resal processes under this Policy.
  • Personal Data refers to all data, whatever its source or form, that may identify an individual specifically, directly or indirectly, including but not limited to: name, identity number, addresses, contact numbers, licence numbers, records, personal property, bank account and payment card numbers, still or moving images, and any data of a personal nature.
  • Resal Points (ResalPoints) means loyalty points or any non-cash value issued and managed by Resal (issued, earned and credited to your account based on qualifying transactions within the Resal network), redeemable with participating merchants (for example through Resal Pay).
  • Resal Pay (ResalPay) means the feature that allows you to use Resal Points as a means of payment, in whole or in part, with merchants within the Resal network.
  • Balance Top-Up means the feature that allows you to increase your available balance within the Resal application using one of the following methods:
  • Redeeming or adding balance through Resal cards,
  • Transferring or converting value from participating loyalty programs (such as the Alinma Akthar program, Qitaf, and other programs that may be added from time to time),
  • Or any other non-cash value sources integrated by Resal.

Topped-up balance may be used within the application to complete purchases, payments or other services available from Resal, in accordance with the applicable terms and conditions.

  • Booking Services means the feature that allows you to search for and book services provided by third parties (such as events, flights and hotels) using Resal’s payment interface.
  • Mobile Top-Up means the feature that allows you to top up a mobile number or purchase bundles for supported networks.
  • Service Provider means any natural or legal person who processes personal data on Resal’s behalf, including payment, support, analytics and anti-fraud providers, notification platforms, booking enablers, telecom aggregators and operators, and merchant transactions.
  • Third-Party Social Media Service refers to any website or social network through which a user may log in or create an account to use the Service.
  • Usage Data refers to data collected automatically through the use of the website or application, or generated by their infrastructure (such as the duration of a page visit).
  • The Website refers to Resal’s website at https://www.resal.me.
  • You means the individual who accesses or uses the Resal website or application, or any legal entity on whose behalf that individual accesses or uses it, as applicable.

5. Policy Statement

5.1 Collection and Use of Personal Data

5.1.1 Information Resal Collects

Resal collects information about you through three main channels:

  • Directly from your input.
  • From external sources.
  • Through automated technologies.
5.1.1.1 Data You Provide to Us

When you use the Resal website or application, we may collect personal data that may include:

  • Contact and account data such as name, email address, postal address, mobile number, social media accounts, preferred language, and profile data (such as job title).
  • Authentication data such as username, encrypted passwords and password hints.
  • Communication content such as comments, feedback, support requests, surveys and search queries.
  • Recruitment data (when applying) such as employment history, nationality, date of birth and other data required for background checks.

Feature-specific data (when used):

  • Booking Services: traveller, guest or attendee data required to complete the booking (such as full name as shown on identification, contact details, booking preferences, itinerary details, and loyalty program numbers you choose to add, if any). Resal does not retain copies of official travel documents unless expressly necessary to complete the transaction or to comply with applicable regulation.
  • Mobile Top-Up: the mobile number to be topped up, the selected operator or network, the bundle or top-up amount, and the contact name or label if you choose to save it. The user is responsible for the accuracy of the selected mobile number, service operator and top-up amount. Resal bears no responsibility for failed transactions resulting from the entry of incorrect data.
  • Resal Pay: your mobile number for verification, the details of the transaction you approve, the number of Resal Points to be redeemed (subject to available balance), and one-time passwords (OTP) or equivalent to authorise the transaction. You are responsible for entering the OTP personally and for not sharing it with any other party. Resal will never ask you for the OTP verbally, by telephone or by message, and no party may complete a transaction on your behalf using that code.
5.1.1.2 Tracking Technologies and Cookies

Resal’s web services may automatically collect information about how you and your devices interact with the Service in order to provide you with a better experience, including:

  • Device and connection details such as IP address, browser type and version, operating system, installed software, mobile platform, unique identifiers and other technical identifiers, together with error reports and performance data for security and fraud prevention purposes.
  • Usage data such as features used, settings selected, clickstream (URL) data including date and time stamps and referring and exit pages, search terms and pages visited.
  • For location-based services: information about the region, city or town in which your device is located, in order to deliver relevant content. Where access is by mobile device, we may collect the device type and its unique identifier, IP address, operating system, mobile internet browser, device identifiers and other necessary diagnostic data.

Additional automated collection by feature (where applicable):

  • Booking Services: search, selection and payment events, to resume a booking in progress and for anti-fraud purposes.
  • Mobile Top-Up: attempt and completion events, to confirm delivery and resolve issues.
  • Resal Pay: the merchant, branch and cashier identifier sent by the merchant, the timestamp, and the technical events required to create, verify and complete the transaction.
5.1.2 The Purposes for Which We Use Your Personal Data

We may use your personal data for the following purposes:

  • Providing and operating core services, including account creation, authentication, user support, and operating website and application functionality.
  • Booking Services: to search, display, book, confirm, amend and cancel events, flights or hotels; to send confirmations, invoices and updates; to process payments and refunds; and to provide support in coordination with the relevant service providers, organisers and operators.
  • Mobile Top-Up: to verify the mobile number and operator, process the selected bundle or top-up amount, execute the top-up through service providers and telecom partners, send confirmations, and provide technical support to confirm delivery and resolve failures where needed.
  • In-app Balance Top-Up: to enable you to increase and manage your balance within the Resal application using Resal cards or participating loyalty programs (such as Alinma Akthar, Qitaf and others) managed by Resal, or any other integrated non-cash value sources; to verify the source of top-up requests; to process and confirm the transaction; and to update your account balance data accurately.
  • Resal Pay (ResalPay): to enable you to pay participating merchants using Resal Points, including:
    (1) Creating and verifying the payment request submitted by the merchant using your mobile number,
    (2) Notifying you to approve the transaction,
    (3) Enabling you to specify the number of points to be redeemed (subject to available balance),
    (4) Authentication using a one-time password (OTP) or equivalent, and
    (5) Notifying the merchant of the redeemed amount and any remaining amount outside the scope of Resal.
  • Commercial activities such as communication, invoicing, order processing, payments, permitted marketing activities, procurement, supplier due diligence, client screening, and contracts (such as non-disclosure or licensing agreements).
  • Improvement and security: including analytics, service monitoring, fraud detection and prevention, security enhancement, bug fixing and performance improvement.
  • Compliance with regulatory obligations: including responding to requests from regulatory authorities, resolving disputes, enforcing agreements, and maintaining commercial records.
  • Business transfers: evaluating or carrying out mergers, acquisitions, restructuring or asset transfers that may include personal data as part of the transferred assets.
  • With your consent: to send news, offers and general information about goods, services and events similar to those previously purchased or enquired about, unless you choose to unsubscribe from these communications.
  • User consent for Resal Pay transactions: Resal Pay transactions are processed only after the user provides express consent within the Resal application. The merchant does not obtain user consent on Resal’s behalf. Resal processes the user’s personal data for the purposes of authorisation, point redemption and transaction completion only after the user confirms the payment within the application.
5.1.3 Disclosure or Sharing of Your Information

Resal may disclose your personal data in the following cases:

  • With service providers: we share data with third parties acting on our behalf to deliver services, including payment providers and checkout interfaces, booking enablers (for events, flights and hotels), telecom aggregators and operators (for mobile top-up), merchants and their transactions (for Resal Pay), support tools, notification platforms, analytics, risk management and anti-fraud services, and IT and security providers. We do not name these parties in this Policy and they may change over time.
  • With merchants, organisers and operators:
    • In Resal Pay: we share the transaction data required to complete the redemption (such as the redeemed amount and confirmation or authorisation references) with the participating merchant.
    • In Booking Services: we share the booking details required to fulfil the booking with the event organiser, airline or hotel and their partners.
    • In Mobile Top-Up: we share the top-up details (recipient number, operator, bundle or amount, and references) with telecom aggregators and the relevant operator in order to complete delivery and resolve failures where needed.
  • For business transfers: in any merger, sale of company assets, financing or acquisition of all or part of our business.
  • With commercial partners: to provide specific products, services or offers (where the law permits).
  • With your consent, or as otherwise permitted by law.
  • For regulatory and security purposes: where we believe in good faith that disclosure is necessary to comply with the law, to detect or prevent fraud or security issues, or to protect the rights, property and safety of Resal, its users, employees or others.
5.1.4 International Data Transfers

We store and process your personal data in various jurisdictions, including the Kingdom of Saudi Arabia. In order to provide Booking Services, Mobile Top-Up and Resal Pay, your personal data may be transferred to and processed by service providers, merchants, operators and organisers outside the Kingdom (such as airlines, hotels, event organisers, telecom operators or payment and checkout providers). The laws there may be less stringent than those of your country. Where the Personal Data Protection Law and its implementing regulations so require, we apply appropriate transfer mechanisms and safeguards (such as contractual obligations, risk assessments and technical measures) and take reasonable steps to ensure your information is handled securely and in accordance with this Policy and applicable law.

5.1.5 Data Retention

We retain your personal data until it is anonymised or destroyed, as necessary to provide the service, carry out the requested transactions, or for other essential purposes such as compliance with regulatory obligations, record keeping, dispute resolution, ensuring security, detecting and preventing fraud and misuse, and enforcing our agreements. Transaction records relating to Booking Services, Mobile Top-Up and Resal Pay may be retained for the period required by regulation and for the periods needed for disputes, auditing and anti-fraud requirements. Usage data is generally retained for a shorter period, unless it is required for information security or service improvement, or retention is mandatory by law.

5.1.6 Data Destruction

When the purpose for which your personal data was stored comes to an end, Resal will securely destroy it in accordance with internal policies, or anonymise it, in accordance with applicable law. If you wish to have it deleted earlier, you may request this by email at [email protected]. In the event of any questions or complaints, you may contact our Data Protection Officer at [email protected].

5.1.7 Data Security

Resal is committed to ensuring the security of your information. We have implemented appropriate physical, electronic and administrative measures to protect information and prevent unauthorised access to or disclosure of it. These include encryption in transit and at rest where required, multi-factor authentication and OTP for high-risk actions (such as Resal Pay approvals), access controls and monitoring, and adherence to applicable security standards for handling card data (such as PCI DSS) when processing payments through approved partners.

5.1.8 Your Rights

As the owner of the personal data under applicable law, you have the rights set out in the PDPL:

  • The right to be informed: to know the justification for collecting your personal data and the purpose of processing it, as declared in this Policy.
  • The right of access: to obtain a clear and comprehensive copy of your personal data available in your account through the Resal website or application.
  • The right to rectification: to request the correction, completion or updating of your personal data at [email protected].
  • The right to erasure: to request the deletion of your personal data, subject to legal provisions.
  • Other rights: the additional rights set out in the PDPL and its regulations. For processing based on legitimate interests, you may object by writing to us at [email protected], which may affect your access to the website or application.
  • Contacting Resal: to exercise your rights or to enquire about data protection and privacy, you may contact the Data Protection Officer at [email protected].