Privacy Policy

This Policy explains how personal data is collected, used, disclosed, protected, retained and destroyed when you use The Gala website, the customer app, TheGala Partner, and the related booking, payment, support and communication services. It applies to platform visitors, customers, service providers and their representatives, and anyone who contacts us.

This Policy does not govern independent parties we do not control, such as a service provider when dealing with a customer outside the platform, or third-party websites and applications. Please review the relevant party’s privacy terms in those cases.

The controller responsible for processing under this Policy is The Gala T & D Company, Unified Number 7041321329, based in Jeddah, Kingdom of Saudi Arabia. You may contact us at [email protected], customer care number 920031594, WhatsApp 920031594, or through https://thegala.com.sa/.

“The Gala,” “we,” “us” or “our” means the company and its digital platform. “Platform” means the website, customer app, TheGala Partner and connected systems. “Customer” means a person who searches for, requests or books a service. “Service Provider” means an establishment or independent professional offering a service through the Platform. “Personal data” means any information that identifies, or can directly or indirectly identify, an individual.

Identity and account data: name, mobile number, email address, city, login credentials, language preference and profile image if supplied.

Booking and event data: event type, date, time and location, guest count, requested services, offer details, notes, booking status and the selected cancellation policy.

Service Provider data: business or representative name, commercial registration, licence or identity data where required, contact details, service descriptions, pricing, availability, portfolio images, settlement bank details and documents needed for verification and compliance.

Payment and transaction data: amount, currency, payment or refund status, transaction reference, selected payment method and billing data. Full card details are normally processed by the payment provider, and we do not intentionally store complete card numbers or card security codes.

Communications and content: in-platform chats, support requests, complaints, reviews, photographs, videos and files uploaded by a user.

Technical and usage data: IP address, device and browser type, operating system, device and app identifiers, login and crash logs, pages and features used, and cookie data.

Location and permission data: we may collect approximate or precise location, contacts, photos, camera or notification permissions only when the related feature is used and the relevant device permission is granted.

We receive data directly from you when you register, submit a booking or contact us; from the other Customer or Service Provider involved in a booking; from payment, verification and support systems; from your device, browser, cookies and measurement technologies; and from public sources or competent authorities where lawful and necessary for verification or compliance.

We process data to operate and verify accounts; display services, search and recommendations; receive and route booking requests and track acceptance and payment; manage deposits, payments, refunds and settlements; enable Customer–Service Provider communications; send confirmations and alerts through the app, messages or WhatsApp; provide support and resolve complaints and disputes; prevent fraud and misuse and protect the Platform; improve performance and user experience; create analytics and statistics; meet legal, accounting and tax requirements; and send marketing where we have consent or another appropriate lawful basis.

Depending on the circumstances, processing is based on your consent; performance of a contract with you or steps taken at your request before contracting; compliance with a legal obligation; a legitimate interest that does not override your rights and interests; protection of vital interests; or a request from a competent authority. Where consent is the basis, you may withdraw it at any time without affecting processing lawfully carried out before withdrawal.

The Platform may use strictly necessary cookies and similar technologies for login, security and bookings; functional technologies to remember preferences; and analytics or advertising technologies to measure performance and campaigns. Tools used or planned may include Google Analytics, Meta Pixel, TikTok Pixel and Snap Pixel. We request consent for non-essential technologies where required. You may manage choices through the consent tool or browser and device settings. Disabling essential technologies may affect functionality.

Payments are processed through independent payment service providers, which may include MyFatoorah. Tabby or Tamara may be available for eligible bookings. The payment provider shares the transaction status, reference, amount and information needed for reconciliation, refunds and fraud prevention. Buy-now-pay-later use is subject to the user’s eligibility and the selected provider’s own terms and privacy policy.

We may share the minimum data necessary with the Customer or Service Provider to perform the booking; payment providers, banks and payment networks; hosting, cloud, cybersecurity, analytics, communications and customer support vendors; advisers, auditors and insurers; government, judicial and regulatory authorities where requested or required; or a buyer of all or part of the business, subject to continued data protection. We do not sell personal data. Contractors must process data under appropriate instructions, confidentiality and security obligations according to their role.

Some hosting, support or analytics services may involve processing outside the Kingdom of Saudi Arabia. Transfers are made only for a lawful purpose, to the extent necessary and in accordance with the Saudi Personal Data Protection Law and its regulations, after assessing the level of protection, applying appropriate safeguards and completing any required assessment or approval.

We retain data while the account or contractual relationship remains active, and afterwards for as long as necessary to fulfil the stated purpose, comply with legal, accounting and tax requirements, establish or defend rights, resolve disputes and prevent fraud. Periods vary by data category and booking type. When retention is no longer required, data is securely deleted, destroyed or anonymised, unless continued retention is required by law or a competent authority. Aggregated anonymous statistics may be kept longer.

We use appropriate administrative, technical and organisational measures, including access controls, identity verification, encryption in transit where appropriate, monitoring, backups, vulnerability management and staff training. No electronic system is completely secure. Users must protect their passwords and verification codes, avoid sharing them and report suspected unauthorised use promptly.

Subject to applicable law, you may ask to know the basis and purpose of collection, access your data, receive a clear copy, correct, complete or update it, request destruction when there is no lawful need to retain it, withdraw consent where consent is the basis, and stop marketing messages. Send a request to [email protected] with your name, mobile number and request type. We may verify identity and will respond within the statutory period, explaining any refusal or restriction permitted by law.

A destruction request does not require us to delete information that must be retained by law or is needed for an existing claim or fraud prevention. In such a case, use will be restricted to the lawful purpose. You may first complain to us and, if the complaint is not resolved satisfactorily, complain to the competent personal data protection authority.

We may send offers or news by email, messaging, WhatsApp or push notification after obtaining any required consent. You may opt out using the link, app settings or our contact channels. Opting out does not stop necessary operational messages, such as verification codes, booking and payment confirmations or complaint updates.

We may retain in-platform chats and support records to perform bookings, maintain security and resolve disputes. Reviews and posted content may appear under a display name or indirectly according to the service settings. Users must not upload another person’s data without a lawful basis or suitable consent and must not share sensitive payment information in chat.

When a Service Provider receives Customer data to perform a booking, the provider must use it only for that service, keep it secure, not sell it or use it for independent marketing without lawful consent, and not retain it after the lawful need ends. A Service Provider is independently responsible for processing it undertakes outside Platform instructions.

The Platform is intended for persons aged 18 or over. We do not knowingly create independent accounts for children. If a booking concerns a child, a parent, guardian or authorised adult must provide only the minimum necessary information and supervise its use. If we learn that child data was collected without a proper basis, we will take steps to delete or restrict it.

If a security incident affects personal data, we take steps to contain, investigate and remediate it. We notify the competent authority and affected individuals where the applicable legal thresholds are met, describing the incident, likely effects and mitigation measures to the extent possible.

The Platform may contain links to or features from other parties. We do not control their practices, and their services are governed by their own terms and privacy policies. A link does not mean that we endorse every item of content or practice of that party.

We may update this Policy to reflect service or legal changes. The revised version and effective date will be published, and appropriate notice will be provided for material changes. Continued use after the new effective date constitutes acceptance where permitted by law. Where fresh consent is required, we will request it before applying the relevant change.

For questions, rights requests or complaints, contact [email protected], telephone 920031594, or WhatsApp 920031594. Address: Jeddah, Kingdom of Saudi Arabia. Website: https://thegala.com.sa/. If a complaint remains unresolved, you may use the National Data Governance Platform of the competent authority at https://dgp.sdaia.gov.sa/, without affecting any other statutory complaint right.

This Policy is available in Arabic and English. If there is a conflict of interpretation, the Arabic version prevails to the extent permitted by applicable law.