Privacy Policy

1.1 Data Controller

HAYYAFIT Services Company (“Hayyafit”) is the data controller in respect of personal data collected through the Platform.

1.2 Contact

Privacy queries: privacy@hayyafit.com | Building 4640, Al Zarqa Street, Al Nakheel District 8548, Riyadh 12391, Kingdom of Saudi Arabia

2.1 Data You Provide

We collect: (a) registration data — name, email, phone, date of birth, gender, profile photo; (b) booking data — name, contact details, payment information; (c) matchmaking data — sports preferences, skill level, availability; (d) User Content — photos, videos, posts, reviews; (e) support data — name, email, query content.

2.2 Automatically Collected Data

We automatically collect: (a) device information — device type, OS, identifiers; (b) usage data — pages visited, session duration, features used; (c) location data — general location if you grant permission; (d) log data — IP address, access times, error logs; (e) cookie data — described in our Cookie Policy.

2.3 Data from Third Parties

We may receive data from: (a) social login providers; (b) payment service providers; (c) Facility Providers; and (d) analytics partners.

2.4 Sensitive Data

We do not intentionally collect sensitive personal data. Users should not submit health, biometric, or religious information through the Platform.

The table below sets out the purposes for which we process personal data, the legal basis under the PDPL, and the applicable retention period.

4.1 Contractual Necessity

Processing necessary to perform our contract with you and deliver Platform services.

4.2 Consent

Where we rely on consent (marketing, analytics cookies, location), we obtain your consent before processing begins. You may withdraw consent at any time without affecting prior processing.

4.3 Legal Obligation

Processing necessary to comply with Saudi Law, including commercial, VAT, and data disclosure requirements.

4.4 Legitimate Interest

Security, fraud prevention, and product improvement, assessed against your data protection rights.

5.1 Facility Providers

Booking data is shared with the relevant Facility Provider to manage your booking.

5.2 Other Users

Certain profile information is visible to other Users through the Platform, including via Find a Buddy. You can manage visibility through Account settings.

5.3 Payment Providers

Transaction data is shared with Payment Gateways to process your payment. Card data is handled directly by payment providers under PCI-DSS compliance.

5.4 Service Providers

Third-party processors operate under data processing agreements and our instructions. These include: (a) cloud hosting — Amazon Web Services (AWS); (b) analytics providers; (c) messaging and push-notification providers; (d) customer support tools; and (e) payment service providers. A current list of processors is available on request.

5.5 Legal Disclosure

Data may be disclosed to Saudi authorities where required by law, including under the Anti-Cybercrime Law or pursuant to a valid judicial order.

5.6 Business Transfers

In a merger or acquisition, personal data may transfer to the successor entity, which will be bound by this Privacy Policy.

6.1 Transfer Restrictions

Hayyafit will not transfer personal data outside the Kingdom of Saudi Arabia unless: (a) the destination country provides adequate protection recognised by NDMO; (b) appropriate contractual safeguards are in place; or (c) you have given express informed consent.

6.2 Cloud Hosting (AWS — India)

Hayyafit hosts personal data on Amazon Web Services (AWS) cloud infrastructure located in the Asia Pacific (Mumbai) region in the Republic of India. Personal data is therefore processed and stored on servers located outside the Kingdom of Saudi Arabia, in India. Such transfers are carried out in accordance with the cross-border data transfer requirements of the PDPL and its implementing regulations, on the basis of appropriate contractual and technical safeguards (including a data processing agreement with the hosting provider) and, where required, your consent.

7.1 Retention Principles

Data is retained only as long as necessary for the purposes collected or to satisfy legal requirements.

7.2 Retention Periods

Specific retention periods are set out in the processing table in Section 3 above.

7.3 Account Closure

Upon Account closure, personal data will be deleted or anonymised within a reasonable period, subject to legal retention obligations.

8.1 Security Measures

We implement: (a) TLS/SSL encryption in transit; (b) encryption at rest for sensitive data; (c) role-based access controls; (d) regular security assessments; and (e) staff training on data protection.

8.2 Payment Security

Payment card data is processed by PCI-DSS compliant payment providers. Hayyafit does not store card numbers.

8.3 Breach Notification

In the event of a breach likely to result in risk to Users’ rights, we will notify you and SDAIA/NDMO in accordance with PDPL obligations.

9.1 Access

Request confirmation and a copy of your personal data, with processing information.

9.2 Correction

Request correction of inaccurate or incomplete data. Update profile data through Account settings.

9.3 Deletion

Request deletion where: data is no longer needed; consent is withdrawn; processing was unlawful; or deletion is legally required. Subject to legal retention obligations.

9.4 Withdraw Consent

Withdraw consent for consent-based processing at any time without affecting prior processing.

9.5 Object

Object to processing based on legitimate interests, including direct marketing.

9.6 Restrict

Request restriction of processing in certain circumstances.

9.7 Portability

Request data in a structured, machine-readable format where technically feasible.

9.8 How to Exercise

Submit requests to privacy@hayyafit.com with identity verification. We respond within the PDPL-required timeframes.

9.9 Complaint

Complaints may be lodged with SDAIA/NDMO at www.sdaia.gov.sa.

10.1 Under 13

We do not knowingly collect data from children under 13. Contact privacy@hayyafit.com if you believe a child under 13 has submitted data without parental consent.

10.2 Ages 13-17

Users aged 13-17 require parental consent. Parental consent is required before minors use the Platform.

11.1 Consent Basis

Marketing communications are sent only with your prior express consent.

11.2 Opt-Out

Withdraw marketing consent via: (a) the unsubscribe link in any marketing email; (b) Account notification settings; or (c) privacy@hayyafit.com.

12.1 Automated Processing

We use automated processing, including artificial intelligence and machine-learning techniques, to operate sports partner matchmaking (Find a Buddy), generate recommendations, moderate content, detect fraud, and analyse Platform usage.

12.2 Profiling

This may involve profiling based on your preferences, activity, and usage data in order to improve and personalise the Services.

12.3 Human Involvement

We do not make decisions producing legal or similarly significant effects concerning you based solely on automated processing without human involvement, except where permitted by applicable law.

12.4 Legal Basis

Such processing is carried out on the basis of contractual necessity, our legitimate interests, or your consent, as applicable and as set out in Section 3.

12.5 Your Queries

You may contact privacy@hayyafit.com for information about automated processing affecting you.

We use cookies and similar tracking technologies. Full information is available in our Cookie Policy on the Platform.

We may update this Privacy Policy at any time. Material changes will be notified through the Platform or by email. Continued use following update constitutes acceptance of the revised Policy.

This Privacy Policy is governed by the laws of the Kingdom of Saudi Arabia, including the PDPL and its implementing regulations. Disputes are subject to the exclusive jurisdiction of the competent Saudi courts.