Privacy policy —7Stars

P01 — Controller and contact
Seven Stars Travel and Tourism Agency (7Stars), Riyadh, Saudi Arabia, operates 7starsss.sa and is the controller of data used for the purposes described here. Customer support handles privacy requests in coordination with management through support@7starsss.com. Currently, only the owner reads the agency’s WhatsApp messages; this procedure does not grant others access to conversations. The owner confirms actual 24/7 customer-service coverage for enquiries and complaints. Management supervises continuity of coverage when the responsible person is absent. Enquiries go through WhatsApp +966501234818; privacy requests and complaints go to support@7starsss.com.

P02 — Launch scope
The initial launch is informational, with enquiries through WhatsApp only. The approved email channel handles privacy requests and complaints and does not activate website forms. Email and quotation forms are disabled, with no online payments, direct bookings or active memberships. Any additional collection for a future service will be explained before the necessary data is collected. Preserving a legacy trial-payment record does not enable new website payments. Rights, obligations and records relating to prior transactions are preserved.

P03 — Data and collection
Technical infrastructure may process your IP address, request time and path, browser type and response information to deliver, operate and protect the website. When you contact us through WhatsApp, we receive your number, profile name, message and any destination, dates or traveller counts you choose to provide. Enquiry details are optional, but a suitable quotation may require relevant information. Do not send card details, identity or passport images, health information or sensitive data in an initial enquiry. For a privacy request, we receive contact details, the request and the minimum proportionate information needed to verify the requester’s identity.

P04 — Cookies and external services
V2 files add no external advertising or visitor-analytics tools; fonts and images are included in the website files. Website forms are disabled. Hosting and CDN services may process technical logs or use security technologies according to the service. WordPress and private-preview sessions are not attributed to every V2 page. The Cloudflare Access preview is separate from the public site; public browsing requires no account. Opening WhatsApp or official verification sites is optional, and their providers’ policies apply after you leave. Contact support@7starsss.com about processing of your data and related technologies.

P05 — Purposes and bases of processing
Enquiry data is used only to respond and follow up for the specific purpose you choose, based on informed consent where that is the applicable basis. Browsing alone does not constitute consent to other processing, and consent to a response is not marketing consent; enquiries are not used for marketing in phase one. Operational data is used to deliver and protect the site; reliance on legitimate interest requires the necessary assessment of necessity, proportionality and impact on rights. Mandatory retention or disclosure relies on the applicable legal obligation. This policy does not authorise additional purposes or sharing outside the applicable lawful basis.

P06 — WhatsApp and suppliers
The approved number is +966501234818. The WhatsApp button opens a draft for you to review and choose whether to send; the website sends no message automatically. The agency creates no cloud conversation backups and does not export conversations to a CRM or email. It does not share enquiry details with a supplier or hotel before the enquirer agrees to that intended sharing. This does not rule out WhatsApp’s technical processing to provide its service. Any mandatory disclosure is limited to a valid request by a competent authority.

P07 — Providers and processing locations
The official frontend and legacy WordPress are hosted by Hostinger, retaining the existing CDN and prior transaction records. The account inventory identifies a server in Frankfurt, Germany, and backups in France; this does not identify every CDN, support or subprocessor location. Cloudflare is used for the separate private preview, not for the public frontend under the current launch route. The agency uses WhatsApp for communications and Google’s email service when you email it; website email forms do not operate. These services may process data outside Saudi Arabia. A provider’s headquarters is not its only processing location. Transfers must rely on the applicable lawful mechanism and safeguards; this policy does not mean that every country or subprocessor used by a provider receives your data.

P08 — Access and sharing
Access within the agency is limited to the necessary task, with WhatsApp reading currently restricted to the owner. Infrastructure and communication providers’ roles differ from sharing your enquiry content with a travel supplier. A general subprocessor list does not mean that each listed party receives your conversation, and this policy does not authorise marketing disclosures.

P09 — Retention and destruction
The approved rule remains 90 days after closure for an enquiry that does not become a service, subject to an applicable legal obligation or approved documented need. The approved procedure retains and retrieves incoming and outgoing customer-service correspondence for at least one year under applicable legal obligations; an enquiry is not excluded simply because no sale follows. This year is not applied to all data, and the 90-day rule does not erase correspondence that must still be retained. The starting point and any longer retention are documented according to purpose and legal duties. No new cloud storage is created. Service-related call summaries are documented without claiming audio recording. Monthly review does not extend retention.
The processing-activities record, which describes categories and purposes rather than every message’s contents, is retained while processing continues and for five years after the activity ends. Rights requests are documented. The approved operational period for the minimal tracking record is one year after closure, subject to any longer statutory period. Supporting material is assessed according to its purpose and applicable obligations; the tracking-record period is not automatically applied to it.
Hosting, security and CDN logs, backups and financial records are separate from enquiries; neither 90 days nor one year applies universally. Processing purposes, necessity and legal obligations are considered when determining retention and erasure. An erasure request does not mean immediate removal from all backups or override mandatory retention. Request information about your data through support@7starsss.com.

P10 — Rights and requests
Subject to applicable law and exceptions, you may request information about processing, access and a copy, correction and destruction, and withdraw consent where processing relies on it. Withdrawal does not affect previous lawful processing or mandatory retention. Email support@7starsss.com; customer support handles requests in coordination with management, using proportionate identity verification and protecting others’ data. The statutory period is no more than 30 days without delay, with up to 30 additional days only for the statutory reasons and with prior reasoned notice. Any legal restriction on destruction will be explained. Complaints may be submitted to the competent authority through https://dgp.sdaia.gov.sa/.

P11 — Updates and effect
This policy takes effect when published with the trial launch. It is updated when collection channels, uses, providers or retention periods change. It does not enable website payments, bookings or quotation forms.