Privacy Policy

What we collect, why, and with whom we share it — aligned with the Saudi PDPL.

Last updated: 2026-08-29

Your privacy is not a compliance line item — it is a condition of your trust. This policy explains exactly what we collect and why, who we share it with, and what you can do about it. It is written to align with Saudi Arabia's Personal Data Protection Law (PDPL) and its implementing regulation.

1. Who controls your data

PlayTix is the controller of the data the platform collects. Our legal entity details and address appear at the end of this page.

When you book at a club, that club becomes an independent controller for your booking and membership data with them, applying its own policy in addition to this one.

2. What we collect

Data you provide

• Account: name, mobile number, email, password (stored as a one-way hash that cannot be reversed), profile photo if you add one.
• Bookings and sharing: club, court and time, and the playing partners you invite.
• Payment: method, amount, transaction status, invoices. We do not store your card number or CVV — these are handled directly by the licensed payment gateway.
• Content: match clips, comments, in-platform chat messages.
• Correspondence: what you send through the contact or support form.

Data collected automatically

• Usage: pages visited, timing, actions taken.
• Device: device type, OS, browser, interface language, device token for push notifications.
• Network: IP address — used for security and abuse prevention, stored hashed in contact-form records.
• Location: only with your permission, to show nearby clubs. You can decline and still use the whole platform.

Data from other parties

• Transaction confirmations from the payment gateway.
• Membership registration from a club you joined in person.

We do not collect sensitive personal data (health, religious, ethnic or similar) and do not ask for it.

3. Why we process your data — and the legal basis

4. Who we share it with

We share only the necessary minimum, and we never sell your data to anyone.

• The club you book with: your name, mobile number and booking details — so it can receive and serve you.
• The licensed payment gateway: transaction data to complete payment and refunds.
• Our hosting provider: storage and operation of the database and servers.
• Our email provider: confirmation and password-reset messages.
• Push notification service: delivering notifications to your device.
• Competent authorities: on a valid legal request.

Every provider is bound to process data on our instructions and at an appropriate level of protection.

5. Transfers outside the Kingdom

Some technical providers may host servers outside Saudi Arabia. Where that happens we verify that appropriate safeguards are in place, as permitted by the PDPL and the data transfer regulation.

6. How long we keep it

When you delete your account we anonymise rather than fully erase: your personal data is removed and the invoice record remains stripped of identity, because deleting it would breach a tax obligation.

7. Your rights

Under the PDPL you have the right to:

1. Be informed of how your data is processed — this page is part of that.
2. Access a copy of the data we hold about you.
3. Receive it in a machine-readable format to move it elsewhere.
4. Correct anything inaccurate or incomplete.
5. Request destruction when it is no longer needed — within the legal obligations above.
6. Withdraw consent for marketing or location at any time.

How to exercise them: from the Contact us page choosing the "Personal data rights request" topic, or directly from your account settings. We respond within 30 days at most, and may ask you to verify your identity to protect your account.

Complaints: if our response does not satisfy you, you may complain to the Saudi Data & AI Authority (SDAIA) as the supervisory authority.

8. How we protect your data

• Transport encryption over HTTPS/TLS on all connections.
• Passwords stored as salted one-way hashes — we cannot read them.
• Role-based access: club staff see only their own club's data.
• Time-limited login sessions you can revoke from your device.
• Regular backups and access reviews.

No system is perfectly secure. Should a breach affecting your data occur, we will notify you and the supervisory authority within the statutory timeframes.

9. Children

The service is intended for people aged 18 and over. We do not knowingly collect children's data. If we learn of an account created by a child without guardian supervision, we delete it. Children participate in bookings through a guardian's account.

10. Marketing and notifications

• Operational notifications (booking confirmation, reminders, invoices, schedule changes) are part of the service and cannot be switched off while you have an active booking.
• Marketing messages require your consent, and every message carries an unsubscribe link that works immediately.

11. Cookies

We use cookies and local storage to run your session and remember your preferences. Full details and controls are on the Cookies page.

12. Updates to this policy

We may update it whenever our services or the regulations change. We will notify you of material changes before they take effect. The last-updated date is shown at the top of this page.