This privacy statement (“Privacy Statement”) explains how we use the personal data that THE GROVES (“we”, “us” and “our”) collects or generates about our users (“you” or “your”) in relation to the THE GROVES platform and website accessed at www.thegroves-sa.com and its sub-domains, including the services and other benefits made available thereon (collectively the “Platform”).
The list below sets out what is covered in this Privacy Statement.
- 1.About this Privacy Statement
- 2.Personal Data We Collect About You And How We Collect It
- 3.How We Use your Personal Data
- 4.Disclosure of Your Personal Data to Third Parties
- 5.International Transfers of Data
- 6.Data Security
- 7.Data Retention
- 8.Your Rights
- 9.Contact Us
1. About this Privacy Statement
Please take the time to carefully read and understand this Privacy Statement. The purpose of this Privacy Statement is to describe the Personal Data we collect about you and provide you with information about how we use, process, disclose and protect the Personal Data we collect about you.
This Privacy Statement applies to (a) the Platform; (b) any email, text, and/or other electronic messages between you and any party via the Platform; (c) any mobile or desktop applications you download from the Platform; and (d) when you interact with any of our services and applications that include links to this policy.
This Privacy Statement also applies to The Groves mobile application for iPhone and Android devices (the “App”), which forms part of the Platform.
This Privacy Statement may change from time to time. Your continued use of the Platform after we make changes is deemed to be acceptance of those changes, so please check the statement periodically for updates.
2. Personal Data That We Collect About You And How We Collect It
Personal Data means any data which relates to a living individual who can be identified from that data or other information which is in our possession, or is likely to come into our possession (or the possession of our representatives or service providers). Personal Data does not include data from which the identity has been removed (anonymous data).
We may collect and process the following Personal Data about you when you use the Platform:
- a.Information that you provide to us. This includes information about you that you give to us by filling-in forms or by communicating with us, whether face-to-face, by phone, e-mail, surveys and feedback requests or otherwise. This information may include:
- b.Identity Information: first name, last name, nationality and gender.
- c.Contact Information: mobile telephone number and e-mail address.
- d.Payments & Transaction Information: details of products and services you have purchased from us. Card payments are processed by our licensed payment provider; we do not store your card details.
- e.Booking and Visit Information: your reservations and tickets, party size, venue, date and time, entry scans at the gate (arrival time), survey responses and private-venue enquiry details (event date, number of guests and occasion).
- f.Device Information: push-notification token and language preference.
- g.Information we collect or generate about you. We may use automated technologies or interactions such as cookies, pixels, and other tracking technologies to collect information about you as you navigate through the platform. This information may include usage details, technical information like your internet protocol (IP) address and location information. Please see below for more information regarding our use of cookies. We may also collect information about purchases and orders made by you, your preferences in receiving marketing from us and our third parties and your communication preferences.
- h.Information we obtain from other sources. This includes the Personal Data provided to us by third-parties, service providers, agencies or other publicly available sources where applicable.
- i.CookiesCookies are small data files transferred to your computer’s hard-drive by a website that keep a record of your preferences, making your subsequent visits to the site more efficient. Cookies may store a variety of information, including your location, time zone, language preferences, the number of times that you access a site and the amount of time you spend viewing a particular page or other item on the site. You can set your browser to refuse all or some browser cookies. You should note, however, that if you disable or refuse cookies some parts of our Platform may become inaccessible or not function properly.
- j.Account Information: to create an account, we need your mobile number, first name, last name, e-mail address and nationality; your date of birth, gender and profile photo are optional. If you do not provide the required information, we cannot create your account, and an account is needed to make a booking in the App or on the website.
- k.Sign-in and Security Information: when you sign in with your mobile number, we send you a one-time code by SMS through our SMS verification provider and record when your number was verified. To protect accounts against misuse, we also record, for a limited period, how many codes were requested for a number and the internet protocol (IP) address and device from which they were requested.
- l.Booking Details: any special requests you add to a booking (for example, a food allergy you tell us about), and the entry code and QR code issued for it. If you join a restaurant’s waiting list, we record your name, party size and the restaurant. A booking made for you by our staff or at a ticket window with your mobile number is added to your account once you have verified that number.
- m.Payment Information: card payments are made on the secure payment page of our payment provider; your card details are entered there and never reach our servers. We receive and keep the result of each payment (the amount, its status, the payment references, the card type and the last four digits of the card, and the time) and, as the payment provider requires, the internet protocol (IP) address from which the payment was made, which we also pass to the payment provider. We also use that address to limit how many unpaid bookings can be held at the same time from one network. If our staff send you a payment link by SMS, your mobile number and the link are sent through our SMS provider.
- n.Notification Information: if you allow notifications, the App obtains a notification token for your device through Expo, our notification delivery service, and Apple (on iPhone) or Google (on Android), and we keep that token together with your device type, your language and your notification choices. The text of each notification we send you passes through these services.
- o.App Crash Reports: if the App stops unexpectedly or meets an error, it sends a crash report to Firebase Crashlytics, a service provided by Google. A crash report contains technical details of the error (the error message and the part of the App where it occurred), your device model, operating system and App version, and a random installation identifier created by Crashlytics. If you are signed in, the report also carries your internal account identifier, a random code that does not reveal your name, mobile number or e-mail address. Before a report is sent, the App removes mobile numbers, e-mail addresses, one-time codes and access tokens from it. We process crash reports on the basis of our legitimate interest in keeping the App working and secure, and we use them only to find and fix faults. Crash reports are processed by Google outside the Kingdom of Saudi Arabia and are kept for about 90 days.
- p.Information Stored on Your Device: the App keeps your sign-in session, your profile details and a random device identifier in your device’s secure storage, and keeps copies of content, such as images, and a copy of your bookings for up to 24 hours on the device, so that it opens quickly and works on a weak connection; your session and your account details are removed from the device when you sign out. If you open your entry pass with Face ID or your fingerprint, the check is carried out by your device and we never receive your biometric data. On the website, we currently use only the cookies needed for it to work: one that keeps you signed in (for up to 30 days) and one that remembers your language (for one year). While you make a booking on the website, your browser keeps the details you enter until you close the tab.
3. How we Use your Personal Data
Your Personal Data may be stored and processed by us in the following ways and for the following purposes:
- to provide you with our products, services and events;
- to meet your customer service needs with respect to the use of our products and services;
- to improve the Platform, our products or service offerings, marketing efforts and/or customer relationships and customer experiences;
- to allow you to use and access the functionality provided by the Platform;
- to fulfil and respond to your enquiries and requests;
- to analyse the needs, interests and activities of our users to improve the user experience;
- to communicate with you in order to provide you with marketing and promotional information (and other information) we think might interest you about our products, services and events; and
- for the administration and maintenance of our databases storing Personal Data.
We may also use your Personal Data for purposes for which we have obtained your consent, and for such other purposes as may be permitted or required by applicable data protection laws, including the Personal Data Protection Law (PDPL), including, as necessary to discharge our legal and regulatory obligations, pursue our legitimate business interests and to establish, exercise and/or defend our legal rights and perform our contractual obligations.
We send marketing messages only with your consent; you can opt out at any time from the app’s notification settings.
We also use your Personal Data:
- to verify your mobile number and to protect accounts, bookings and payments against fraud and misuse;
- to send you service notifications about your bookings, such as confirmations, reminders, changes and invitations to rate your visit;
- to add to your account the bookings made for you with your verified mobile number; and
- to find and fix faults in the App using crash reports, on the basis of our legitimate interest in keeping the App working and secure.
4. Disclosure of Your Personal Data to Third Parties
We may disclose your Personal Data within our group of companies for the purposes described above. We will take steps to ensure that your Personal Data is accessed only by our employees that have a need to do so for the purposes described in this Privacy Statement.
We may also share your Personal Data outside of our group of companies as further described below:
- with our business partners;
- with our third-party service providers and contractors for the purposes of providing services to us, including e-commerce providers, payment card processors, IT and communications providers, research and analytics providers, law firms, accountants and auditors, as well as our SMS verification provider, e-mail provider, push-notification services (Apple and Google), cloud hosting provider and payment provider;
- to the extent required by law or regulation;
- to establish, exercise or defend our legal rights;
- if we sell our business or assets, in which case we may need to disclose your Personal Data to the prospective buyer for due diligence purposes; and
- if we are acquired by a third party, in which case the Personal Data held by us about you will be disclosed to the third party buyer.
The service providers referred to above include Expo, which delivers the App’s notifications, and Google, which provides the App’s crash reporting service (Firebase Crashlytics).
5. International Transfers of Data
Some of our service providers may process data outside the Kingdom of Saudi Arabia; any such transfer is made in accordance with the Personal Data Protection Law (PDPL) and its regulations.
Where we transfer your Personal Data to another country, we will ensure that it is protected and transferred in a manner consistent with applicable legal requirements.
In particular, the App’s crash reports are processed by Google, and notifications are delivered through Expo, Apple and Google, on servers outside the Kingdom of Saudi Arabia.
6. Data Security
We have put in place appropriate security measures to prevent your Personal Data from being accidentally lost, used, altered, disclosed or accessed in an unauthorized way. In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who have a business ‘need-to-know’. They will only process your Personal Data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected Personal Data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
7. Data Retention
How long we hold your Personal Data for will vary. The retention period will be determined by the following criteria:
- the purpose for which we are using your Personal Data – we will need to keep the data for as long as is necessary for that purpose; and
- legal obligations – laws or regulation may set a minimum period for which we have to keep your Personal Data.
Booking and account data are kept while your account is active and as required by law; gate entry records are kept for 12 months; you may delete your account from the app at any time.
In addition:
- one-time sign-in codes expire after 3 minutes, and the records of code requests that we keep to protect accounts are deleted 30 days after the last request;
- the records of actions taken on your account and bookings, which we keep for security and audit purposes, are deleted after 12 months;
- payment records, including the internet protocol (IP) address recorded with a payment, are kept for as long as the law requires;
- App crash reports are kept by Google for about 90 days;
- when you delete your account, in the App or on the website, we erase your name, mobile number, e-mail address, nationality, date of birth, gender, profile photo, notification token and notification choices, delete your notifications and saved favourites, and remove your name and contact details from your survey responses;
- the records of your bookings and payments, including the name and mobile number recorded on a booking, are kept as the law requires, and any upcoming booking stays valid;
- if a payment of yours is still pending, you can delete your account once that payment has been resolved; and
- information that has been deleted may remain in our backups for a limited period until they are replaced.
8. Your Rights
Subject to applicable law, you may have the following rights with respect to Personal Data we collect, use and store about you. These rights may include:
- the right to obtain information regarding the processing of your Personal Data and access to the Personal Data which we hold about you;
- the right to withdraw your consent to the processing of your Personal Data at any time;
- the right to request that we rectify your Personal Data if it is inaccurate or incomplete;
- the right to request that we erase your Personal Data in certain circumstances;
- the right to object to, or request that we restrict, our processing of your Personal Data in certain circumstances;
- the right to lodge a complaint with the relevant data protection regulator (if any) if you think that any of your rights have been infringed by us.
Please note that there may be circumstances in which we are legally obligated or entitled to refuse requests made by you with respect to the Personal Data we use and store about you.
Where applicable, you can exercise your rights by contacting us using the details listed in “Contact Us” section below. Where applicable, you may also obtain further information about the rights available to you by contacting the relevant supervisory data protection authority (if any) located in your jurisdiction.
Your rights include the right to obtain a copy of your Personal Data in a readable and clear format. You can also view and correct your profile, and delete your account, at any time in the App or on the website. In the Kingdom of Saudi Arabia, the competent authority for the protection of personal data is the Saudi Data & Artificial Intelligence Authority (SDAIA). We will respond to your request within the period required by the Personal Data Protection Law and its Implementing Regulations.
9. Contact Us
If you would like further information on the collection, use, disclosure, transfer or processing of your Personal Data or the exercise of any of the rights listed above, please address questions, comments and requests to
Email Address: info@thegroves-sa.com
Data Controller: The Groves for Entertainment, Commercial Registration No. 4030173317, Building 2444, Taha Khasiyfan Street, Ash Shati District, Jeddah 23511, Additional No. 7333, Kingdom of Saudi Arabia