Privacy Notice

1. Introduction

Qiddiya Investment Company, together with its affiliates/sister companies and subsidiaries, collectively referred to as "Qiddiya" (also denoted as " QIC", " us", " we", or " our”) is committed to respecting and protecting the data privacy of your personal or sensitive data in accordance with the applicable laws and regulations in the Kingdom of Saudi Arabia (the “ Kingdom”) including but not limited to the Kingdom of Saudi Arabia Personal Data Protection Law (“ KSA PDPL”) and its Implementing Regulations (the “ Regulations”).

At Qiddiya, we want you to understand the information we collect, how we use it, and how we share it. Therefore, we encourage you to read our Privacy Notice to understand our practices regarding your personal data.

In this Privacy Notice, we detail how we collect, use, share, retain, and transfer information: (a) when you browse or interact with our website; and (b) when you engage with us in the context of recruitment, whether by applying for a vacancy, submitting an application or participating in our candidate evaluation process (“ Recruitment activities”). This Privacy Notice also informs you of your rights. Each section of this Notice includes helpful examples and simple language to make our practices easier to understand. For your convenience, we have divided our Notice into sections and will continue to make improvements.

This Notice should be read together with:

Qiddiya’s Cookie Notice, which explains when and how Qiddiya collects cookies when you visit Qiddiya website; and
Qiddiya’s Terms of Use, which governs the access and use of Qiddiya’s websites and domains.

If you have any concerns or questions about how we look after your personal data, contact our Data Protection Officer at the following email address:

Email ID - [email protected]

2. About Qiddiya

The entity responsible for your personal data is QIDDIYA INVESTMENT COMPANY, with registered office located in Assafarat Dist., 12512, Riyadh, Kingdom of Saudi Arabia. If you are interacting with a Qiddiya affiliate or subsidiary, that affiliate may also act as a controller or joint controller.

As a business entity operating in Saudi Arabia, we adhere to the laws of the Kingdom along with other applicable international laws and regulations.

If you have any concerns or questions about how we look after your personal data, contact our Data Protection Officer at the following email address:

Email ID - [email protected]

3. What personal data do we collect

Personal data means any information about an individual from which that person can be identified.

Website Visitors

Qiddiya may collect and obtain the following types of personal data directly or indirectly when you interact with our website or contact us by telephone, email or in writing:

Personal identifiers: such as your email, phone number, position, first name, last name, birth date, nationality, or any other personal data you submit through our website, when you create an account or apply for our loyalty programs.
Transaction information: such as your address, telephone number and payment information, when you request information, contact guest services, or purchase, return or request.
Location information: such as your location information provided by a mobile or other device interacting with our website, or associated with your IP address or other online or device identifier, where we are permitted by law to process this information.
Essential browser data and trackers: such as your IP address and other website tracking information through “essential cookies”.
Optional browser data and trackers: such as your IP address, browser/device type and version, operating system, referral source, length of visit, page views and website navigation paths, as well as information about the timing, frequency, and other website tracking information through “optional cookies”.

Applicants and Candidates

For Recruitment Activities, Qiddiya may collect and obtain the following types of personal data:

Recruitment information: such as your personal identifiers (name, date of birth, nationality), contact information (address, email, phone), professional information (CVs, educational history, work experience, skills, references, compensation expectations), assessment data (interview notes, test results, background check results where lawful), immigration status, and any other information you elect to submit. Where lawful and relevant for a particular role, we may also collect sensitive or “special category” data, such as health data, strictly in accordance with applicable laws.

We also collect, use and share aggregated data such as statistical or demographic data which is not personal data as it does not directly (or indirectly) reveal your identity.

4. How we collect your personal data

We collect your personal data as follows:

Information you give us: Directly from you when you:
- request or purchase products, services or information from us, register with us, visit our physical properties, call our service numbers, or otherwise interact with us.
- submit information by filling in online forms, by corresponding with us.

in each case, including via Qiddiya subsidiaries and our interactive services, including Six Flags Qiddiya City or Aquarabia Qiddiya City.

Information collected automatically: Indirectly via:
- certain technologies, such as cookies, pixels, tags, APIs, including when you visit our websites and applications; or
- collect information using analytics tools, including when you visit our sites or use our applications.
Information from third parties: For Recruitment Activities, we may collect personal data from third parties, such as professional networking sites, recruiters, background check providers, public databases, and references you have authorized us to contact.

5. Personal data usage

At Qiddiya, we may process the above types of personal data collected in connection with Qiddiya’s Website according to the lawful basis for processing personal data, and we rely on your consent for the following activities:

Contact us and customer services: Such as when we reply to messages, address inquiries, or manage other submissions from you to communicate with you.
Direct marketing and advertising: Such as promoting Qiddiya services to you based on your interests and behavior including marketing and promotional activities, targeted announcements relating to events, newsletters or alerts. You can ask us to stop sending you marketing communications at any time by contacting us [email protected]. If you opt-out of receiving marketing communications, you will still receive service-related communications that are necessary for customer service purposes.
Customer retention and loyalty program: Such as engaging with you for our loyalty programs (Points and Rewards).
Ride photos: Such as your ride images in our advertisements, social media, and website.
Recruitment activities: Such as administering, evaluating, and progressing Recruitment Activities, including verifying information, assessing qualifications, extending offers, and, if successful, creating an employment record. Please note that personal data you submit during the job registration process, the jobs you view and apply for, and any messages exchanged through our third party are subject to the third party’s privacy notice. For further details on how your data is used by the third party, please visit the relevant privacy or cookie notices on their websites.

If any activity has relied on your consent, you may withdraw that consent at any time. If you decline to provide personal data, we may be unable to provide you with the relevant service or offering as described above.

We rely on performance of our contractual obligations for the following activities:

Manage our relationship with you: Such as registering your account and managing our loyal programs, notifying you about changes to our terms or Privacy Notice, dealing with your requests, complaints and queries.
Recruitment activities: Such as taking steps at your request prior to entering into a contract and, where applicable, performance of a contract (for example, to assess your application and qualifications, and to take steps necessary to enter into an employment contract.

We rely on legitimate interests for the following activities:

To administer and protect our business and our website.
To deliver relevant website content to you and measure or understand the effectiveness of our content.
To ensure site security, such as when we monitor traffic to identify whether the site is being used as expected.
To operate, understand and enhance our services, maintaining our customer relationships and offer you a better guest experience.
To engage with you on social media platforms to provide information, respond to inquiries, and promote our events.
To detect, investigate and prevent activities that may violate our policies, pose safety issues or be fraudulent or illegal.
In relation to Recruitment Activities, to evaluate and select candidates, verify information, maintain records of the recruitment process, and to improve our recruitment practices.

In addition, we may use your personal data as following:

To comply with our applicable legal obligations.
If the Processing serves your actual interests and communicating with you is impossible or difficult.

6. Security and retention

Qiddiya will retain your personal data for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless a longer retention period is required or permitted by applicable laws and regulations.

When personal data is no longer required, we securely dispose of, anonymize or de-identify it. If we anonymise or deidentify your personal data, we may use this data indefinitely without further notice to you.

We have in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. Despite our reasonable efforts to protect your information, no security measures are impenetrable, and we cannot guarantee “perfect security.” Any information you send to us electronically, while using the services or otherwise interacting with us, may not be secure while in transit. We recommend that you do not use unsecure channels to send us sensitive or confidential information.

7. Disclosures of your personal data

We may disclose your personal data to third parties for the purposes set out above, including to the following third parties:

With our subsidiaries and affiliates, and entities within the Qiddiya corporate family.
With our service providers performing services on our behalf. These companies are prohibited from using your personal data for purposes other than those requested by us or as required by law.
With third parties when you direct us to share your personal data with third party sites or platforms, such as social networking sites.
With third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Notice.
With third parties to ensure the safety and security of our customers and third parties, to protect our rights and property and the rights and property of our customers and third parties, to comply with legal processes, or in other cases if we believe in good faith that disclosure is required by law.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

8. Data transfers outside the kingdom

The data that we collect from you may be accessed from, transferred to, and stored and used in countries outside the Kingdom, by us and by our third party service providers or partners. We will take all steps reasonably necessary to ensure that your personal data is treated securely and in accordance with this Privacy Notice.

Where legally required, transfers of personal data outside the Kingdom will take place to jurisdictions deemed to provide an adequate level of protection for personal data by the relevant competent authority in the Kingdom, or alternatively will take place on the basis of an appropriate safeguard or exception.

9. Your rights

Subject to applicable laws, you can exercise certain privacy rights, including:

The right to be informed: You have the right to be provided with information about how we use your personal data, and about your rights.
The right to access: You have the right to access your personal data held by us.
The right to obtain a copy: You have the right to obtain a copy of your personal data held by us.
The right to request rectification: You can request the correction or update of any incomplete, inaccurate, or outdated personal data that Qiddiya has collected.
The right to request erasure: You have the right to request the deletion of your personal data collected by Qiddiya, including any data shared with third parties. However, please note that Qiddiya may retain such information in accordance with applicable laws and regulations.
The right to withdraw consent.
The right to file a complaint: You have the right to file complaint to the competent authority when you feel that your rights have not been met.

Unless required by law, you will not incur any fees for exercising this right.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights).

We will try to respond to all legitimate requests within 30 days of receiving it, however, it may take us longer if your request is particularly complex.

You can exercise any of these rights, ask questions about how we use personal data, or complain by contacting us at:

You may submit a request to exercise your rights by filling out the Data Subject Request Form online or by emailing [email protected] with the same information requested in the Data Subject Request Form.

Please note that a number of these rights only apply in certain circumstances, and all of these rights may be limited by law. Your rights may also depend on the jurisdiction in which you reside.

10. Your responsibilities

While we take reasonable steps to protect your personal data, you need to act appropriately to safeguard your information, such as keeping your login credentials secure and promptly notifying us of any unauthorized access to your personal data you may be aware of.

11. Children's personal data

We recognise the need to provide further privacy protections with respect to personal data we may collect from children on our website. If we collect personal data of a child under the age of 18 through our website, the purpose would solely be to directly respond to user’s request without using their personal data for any other purposes.

The child’s data will not be processed without notifying the child’s parent or guardian of the request except if there is a legal justification for Qiddiya to process the data specified by applicable law, regulations, or for security reasons.

12. Third party links

Our website may contain links to third-party websites or services that are not operated or controlled by us. This Privacy Notice does not apply to such third-party websites or services, and we are not responsible for their privacy practices, content or their use of your information. We encourage you to review the privacy notices of those third parties before providing any personal data to them.

13. Data security

We take our responsibility to protect your personal data very seriously. We use physical, technical, and procedural safeguards that comply with applicable legal standards to ensure the security and confidentiality of your personal data from unauthorized access, use, disclosure, accidental or unlawful alteration, destruction and other unauthorized forms of processing. The security measures are reviewed periodically by us to keep pace with security and regulatory changes.

14. SMS Communications

We may use your phone number only to send messages related to park updates, ticket purchases, and account notifications. We do not share or sell your phone number or consent data to third parties or affiliates for marketing. You can opt out anytime by replying STOP or text HELP for help.

15. Governing Law and Jurisdiction

This Privacy Notice shall be governed by and construed in accordance with the applicable laws of the Kingdom of Saudi Arabia. Any disputes arising out of or relating to this Privacy Notice shall be subject to the exclusive jurisdiction of the courts of Kingdom of Saudi Arabia.

16. Versions and updates to THIS privacy notice

From time to time, we may modify or update this Privacy Notice, including to reflect changes in our privacy practices and legal obligations or in accordance with applicable data protection laws and regulations.

This is version 1.2 of the Qiddiya Website Privacy Notice, published 18-10-2025.