Privacy policy

Dream of the Desert LLC

Privacy Policy

Operations Officer: Mr. Rakan Al Mutib

Address: Building no. 3141, Anas Ibn Malik Street, 8292 AL Malqa District, 13521, Riyadh

Phone Number: +966 54 512 9157

E-mail: dreamofthedesert@dreamofthedesert.com

Commercial Register: 7050530497

Effective Date

This Privacy Policy was implemented/modified on 27 October 2025.

Who we are and what we do?

Dream of the Desert LLC (“Dream of the Desert”, “we”, “us”, or “our”), is a limited liability company incorporated in the Kingdom of Saudi Arabia (“Kingdom”), bearing commercial registration no. 7050530497 with its registered address at Building no. 3141, Anas Ibn Malik Street, 8292 AL Malqa District, 13521, Riyadh, Kingdom of Saudi Arabia. Dream of the Desert is a company supporting its clients by providing bookings for passenger railway transport services, off-board experiences, and ancillary onboard services.

For the purposes of applicable data protection laws and regulations in the Kingdom, this Privacy Policy applies if Dream of the Desert and/or any of its subsidiaries, affiliates and related entities (together “Dream of the Desert”) are controllers of your Personal Data.

What is Personal Data and what Personal Data do we collect?

As per the applicable data protection laws in the Kingdom “Personal Data” refers to “any data, regardless of its source or form, that may lead to identifying an individual specifically, or that may directly or indirectly make it possible to identify an individual, including name, personal identification number, addresses, contact numbers, license numbers, records, personal assets, bank and credit card numbers, photos and videos of an individual, and any other data of personal nature”.

The Personal Data we collect will vary based on the purpose it is used for. However, below are examples of Personal Data we collect:

Identity Data: your title, full name, gender, nationality, example of signature, National ID/ Iqama number, passport details, and related documentation, and the date and place of birth.

Contact Data: your email address (work and private), national address or business address, job title, contact telephone numbers and preferences regarding marketing communications.

Transaction Data: data about your transactions and our products that you use, including account activity and product use and any details pertaining to our serices and payments details.

Payment Data: this includes data collected for payment purposes (e.g., as bank card number, payment amounts).

Third Party Data: this includes data obtained from other parties.

Cookies Data: this includes data we collected by website logs, cookies or similar technologies.

Employment details: work title and information relating to your professional (where relevant) background and education information prior or during employment.

Account Data: collected from your use of our services, websites, or mobile apps (such as cookies). This may include;

IP Address

Mobile Number

Usage Data: Collected during your website visits. This includes information about how you use our website, application, platforms, through and from our site (including date and time) and so forth.

Interaction Data: This includes records of phone calls between you and us and customer support requests and feedback that we receive from you either through our websites, mobile apps, and social media accounts, or any channels we use to communicate with our customers.

Other Data: This includes other data required by applicable regulations, identification data, geo-location data, behavioural data, personal relationship data, financial and commercial data, biometric data, health data and criminal convictions, proceedings or allegations data.

How do we collect your Personal Data?

We will collect Personal Data directly from you or through our channels. We also collect personal information about you from other sources where lawful and reasonable. The ways in which we will collect your Personal Data are set out in further detail below:

During onboarding and service or product use. When you become a customer and use our products and services.

Directly from you. This is Personal Data you provide to us, such as through visiting our website, mobile app or through direct correspondence with us, or via other direct interactions with us such as completing a form on our website, applying for our products or services, creating an account on our website or mobile app, requesting marketing to be sent to you, giving feedback, contacting us by any means to submit an inquiry complaint and so forth.

Communication exchanges. When you complete a form and upload it on our website or mobile apps, email, social media post, via calling our call centre, or through participation in promotional campaigns.

Interactions (Social Media). Any posts and interactions you have directly with us on social media channels.

Browsing pattern. Data about how you are exploring our website, the timings of your visit, Internet Browser types, and how you were referred to our website. Please see section on “Use of Cookies”

Surveys. Online web surveys that enable us to gather feedback regarding issues. Such as your likes and dislikes about the look and feel of our website and mobile apps. Your valuable feedback enables us to enhance the quality of experience we provide to you as an organization.

Third parties and public sources. This includes legal representatives and employees of companies with which we are in business, regulatory or a customer relationship or in the process of establishing such a relationship; businesses and other organizations; our corporate and business customers; cookies; part of business relationships with our service providers (data of representatives of service providers); our employees’ Personal Data, as well as, including their relatives in the process of establishing an employment visa, as per local regulations; and information legitimately acquired from publicly available sources and combined information from external sources.

Government Agencies. This includes government agencies. If you are a third-party service provider, we may collect Personal Data about you as a data subject in order to ensure that the business relationship and matters relating to the agreement between you and us can be fulfilled. You warrant that, if you provide us with any Personal Data about other persons, such as employees, shareholders or your directors, you are authorised to share their Personal Data with us for purposes set out in this Privacy Policy.

What is the purpose and scope of this Privacy Policy?

The purpose of this statement is to inform you about how we collect, use, store, make available, disclose, update, safeguard, destroy or otherwise deal with (process) your Personal Data and also to explain your rights relating to the privacy of your Personal Data and how the law protects you:

Deliver our products and services, or process your transactions;

Assessing and providing products and services to our customers;

Operating our business; and

Improving our products and services to our customers.

Why do we process your personal information?

In order for us to provide you with our products and services we need to process your Personal Data and also for the reasons set out below. Any Personal Data received by us will be used for the purposes indicated in this Privacy Policy or in a separate notice provided to you. Except for where permitted by law, we will not process your Personal Data in a manner that is inconsistent with the defined purpose for which it was collected.

What are the legal basis and purposes for collection and the use of your Personal Data?

We only collect and use Personal Data as required by our businesses to provide you with products and services. In most cases, our legal basis and purposes include, but are not limited to:

Performance of a contract. It may be necessary to process your Personal Data in order to perform a contract with you relating to the following purposes:

to create your account;

to allow us to provide you with our products or services;

enhance our products, services, and your experience across our channels and to inform you about key updates and changes to our channels including Privacy Policy and other terms and policies; and

for the purposes of identity management. and when you sign-in to your account.

Compliance with a legal obligation. As an entity we are subject to a number of statutory and regulatory obligations that may require us to process your Personal Data. We also need to process your Personal Data to comply with any obligations and requirements issued by governmental, legal and regulatory authorities within the Kingdom.

Legitimate Interests. Where necessary we process your Personal Data in the regular management of our business and to protect Dream of the Desert interests, the interests of our customers, shareholders, employees and other third parties, including our business partners and members of the general public. Examples of where we rely on legitimate interests includes:

to understand your needs as a customer and your eligibility for products and services and to understand how you use and interact with our products and services and the people or things you are connected to and interested in.

to contact you for your opinions about our products and services, including through surveys and other market research.

to respond to enquiries and communications and to record these interactions for the purpose of analysis and improvement;

to design, develop and test products, services and solutions for customers, which may include combining sources and types of your Personal Data across multiple legal entities and countries, subject to compliance with applicable laws;

to deliver and improve our products and services, or process your transactions;

to operate our business;

to improve our products and services to our customers;

to keep you and our staff safe;

to detect, investigate and prevent financial crimes;

to conduct risk management;

to prevent any data leakage through our Data Leakage Prevention (“DLP”) tools and policies;

ensure security and business continuity;

to conduct data analytics for customers targeting; and

to protect our legal rights.

Consent. In addition to the reasons above, we may process your Personal Data if we have specific consent for a defined purpose. We will also obtain your consent where we are required to do so under applicable laws. We will rely on your consent for the following purposes which may include:

to send you marketing and advertising communications via (please note that you can opt-out of receiving such communications at anytime by contacting us at the details provided below);

to evaluate your profile and consider your application for a job role at Dream of the Desert. (Please note that if you are an applicant, Dream of the Desert will also process your Personal Data).

If we rely on consent to process your Personal Data, you may at any time withdraw such consent. However, this will not affect the lawfulness of the processing, based on your consent, conducted prior to such withdrawal, or where we have other legitimate reasons for processing your Personal Data.

How and why do we retain your Personal Data?

We will retain your Personal Data in an identifiable form only for the period necessary to fulfil (i) the purposes outlined in this Privacy Policy, (ii) our business and operational purposes; (iii) in line with our accounting legal and regulatory obligations; and (iv) as necessary to resolve any potential disputes.

We will only retain your Personal Data after the purposes for why we collected it no longer exists, in the following cases:

if there is an accounting, legal or regulatory requirement for retaining your Personal Data for a specific period, in which case the Personal Data shall be destroyed upon the lapse of that period or when the purpose of the collection is satisfied, whichever longer.

if your Personal Data is or could be related to a case under consideration before a judicial authority and the retention of the data is required for that purpose, in which case the Personal Data shall be destroyed once the judicial procedures are concluded.

What are your rights to your Personal Data?

It is important to us that you understand your rights under the law and how you can exercise them. You have the following rights:

right to be informed about the legal basis and the purpose of the collection of your Personal Data;

right to request access to your Personal Data that we hold about you;

right to request your Personal Data from us in a readable and clear format;

right to request corrections to your Personal Data if incorrect, and/or modifications to your Personal Data if incomplete or updates where your Personal Data held by us is out of date. In this instance you may request us to restrict processing of your Personal Data that is incorrect;

right to request destruction of your Personal Data;

right to withdraw your consent you previously gave us to the extent any of your Personal Data is collected based on consent. You can exercise your right to withdraw consent as set out below;

right to lodge a complaint with the data protection authority in respect of our processing activities regarding your Personal Data;

right to claim compensation for material or moral damage if you are harmed as a result of any violation stipulated under the applicable laws.

Direct marketing

We will not send you any communications for the purpose of direct marketing without obtaining your prior explicit consent. If you consent to receive such direct marketing communications, you have at any time a right to opt out by contacting us via the email dreamofthedesert@arsenalegroup.com or follow the instructions provided in the direct marketing communication.

Transfer of your Personal Data cross border

We may share your Personal Data with our affiliates or subcontract the processing of your data to, or otherwise share your data with, service providers located inside or outside the Kingdom. Such third parties may be engaged in, among other things, the provision of services to you, the processing of transactions, payments and/or the provision of support services. We will fulfil any requirements in relation to the international transfers of Personal Data under applicable laws.

We will store your Personal Data at jurisdictions where Dream of the Desert is operating or where an adequate level of protection of your Personal Data is accorded, whether such Personal Data are stored on our headquarters servers or on servers of an external entity, such as cloud computing service providers (whether inside or outside the Kingdom). We will store your Personal Data for the period necessary to fulfil the purposes outlined in this Privacy Policy, our business and operational purposes and in line with our legal and regulatory obligations. In destroying your Personal Data, after its intended purpose is fulfilled, we will use reasonable endeavours to destroy all your Personal Data and destroy or permanently erase (to the extent technically practicable) all copies of your Personal Data, in each case save to the extent that we or any of the Dream of the Desert entities are required to retain any such Personal Data by any applicable law, rule or regulation or by any competent judicial, governmental, supervisory or regulatory body or in accordance with internal policy. Depending on the type of your Personal Data, we will use the following administrative, technical, and organizational means and measures that have been taken to protect Personal Data from incidents of leakage, damage, or illegal access, including, but not limited to, the use of data encryption, anonymization, and coding methods.

How do we protect your Personal Data?

We ensure your Personal Data is appropriately protected by utilizing the necessary physical, technical, administrative, and procedural security measures to prevent unauthorized access, collection, use, disclosure, copying, modification, or disposal. We safeguard and protect your data in a manner that complies with the applicable data protection regulation of the Kingdom.

In order to protect your Personal Data, Dream of the Desert or any affiliate or subsidiary or other Operators located abroad has put in place a number of technical and organizational measures. Technical and organizational measures include appropriate actions to address online security, risk of data loss, alteration of data, or unauthorized access. Among the measures that Dream of the Desert implements there are appropriate confidentiality clauses in our contracts and data protection and security terms in our arrangements with third parties. Dream of the Desert has implemented information security data privacy policies, including incident management and reporting procedures, DLP, rules and technical measures to protect Personal Data and to comply with legal and regulatory requirements. We train and require staff who access your Personal Data to comply with our data privacy and security standards. We require our service providers, or other third parties we engage with and to whom we disclose your Personal Data to implement similar confidentiality, data privacy and security standards and measures when they handle, access or process your Personal Data. 

When, how and with whom will we share your Personal Data?

We share your Personal Data with our own employees who have access to your Personal Data on a need to know basis for the performance of their duties. We may share your Personal Data with our Dream of the Desert to perform our obligations under our contract with you.

We may also share your Personal Data with our service providers or third parties involved in the provision of the information or services you have requested from us for lawful purposes in order to help us run our business. We rely on such trusted third parties for a range of our business operations and provision of services. We do not share your Personal Data with third parties for their own marketing purposes, except with your specific consent.

We may share your data with any of the parties mentioned below, if this is permissible under Saudi applicable laws:

any court, regulatory body, or government authority to comply with any obligations and requirements issued by legal and regulatory authorities within the Kingdom;

any professional advisors (e.g. auditors and lawyers);

any agents, service providers and vendors and suppliers (e.g. IT suppliers);

any authorised third parties (consent collected or legal representatives / guarantors/ trustees / transferees / customer’s authorised persons etc);

any third parties, data collection agency that can verify information;

any of our service partners (professional advisers, insurers, service providers, social media platform providers, advertiser etc);

any of our strategic referral partners (business alliance or charitable and non-profit organizations);

any member of Dream of the Desert or their service providers for the purpose of providing you with the products or services, enhancing our products, services, and your experience across our channels, and promoting services that may be of interest to you and for the purposes of centralising our business operations.

We take extra care when we transfer or share information and will enter into suitable contracts with the third parties with whom we share your information, thus ensuring your confidentiality is maintained and your rights under the applicable law are upheld.

How to withdraw your consent?

When we rely on your consent (and no other alternate legal bases) you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

If you wish to withdraw your consent, you can do so by contacting us at dreamofthedesert@arsenalegroup.com. Please note that even after you withdraw your consent, we may be obliged to keep your Personal Data due to legal requirements.

Please feel free to reach out if you have any questions or concerns about how we handle your data.

What happens if you do not provide us with your Personal Data?

The Personal Data requested by Dream of the Desert or any affiliate or subsidiary or other Operators located abroad is necessary to provide you with our products and services. If it is not provided, we may be unable to comply with our legal or regulatory obligations or provide you with our products and services.

Changes to our Privacy Policy

We reserve the right to amend this Privacy Policy at any time. The Effective date of the Privacy Policy, as stated above, indicates the latest date the Privacy Policy was revised or changed. Checking the Effective date allows you to determine whether there have been changes since the last time you reviewed the Privacy Policy. Therefore, we recommend you check the Privacy Policy periodically to be aware of the most updated version of this Privacy Policy.

Use of Cookies

In order to improve our customers’ experience, our websites and/orapps use a standard technology called “cookies” to collect information about how our websites are used, which may include your data. The use of cookies is essential to the operation of our websites.

Cookies help to make a website or app function better and make it easier for us to give you a better user experience on our online channels. To use or store cookie types that are not required for the functioning of the website or app and are optional, we will obtain your consent first.

For this reason, we limit our use of cookies to:

providing products and services that you request;

delivering advertising through marketing communications;

providing you with a better online experience and tracking website performance; and

helping us make our website more relevant to you.

Communicating with us

In case of any questions, you can contact us via the email dreamofthedesert@arsenalegroup.com, and social media or through our website.

If you are unhappy with how we’ve handled your Personal Data, or have further questions on the processing of your Personal Data, our Privacy Policy, and privacy practices, please contact us at dreamofthedesert@arsenalegroup.com. For further details regarding the processing of your Personal Data and how to exercise your rights, you can contact the Operations Officer at Dream of the Desert using the below mentioned contact details:

Operations Officer

Name: Mr. Rakan Al Mutib

Address: Building no. 3141, Anas Ibn Malik Street, 8292 AL Malqa District, 13521, Riyadh

Phone Number: +966 54 512 9157

E-mail: rakan.almutib@dreamofthedesert.com

Complaint or Objection Filing Method

If you have any concerns, or if we do not comply with the Saudi personal data protection laws, you can file a complaint to Dream of the Desert by sending an e-mail to Complaint at dreamofthedesert@arsenalegroup.com. If you are not satisfied with how we process your complaint, or if we fail to respond within 60 days, you can file a complaint to Saudi Data and Artificial Intelligence Authority as provided below:

SDAIA

Kingdom of Saudi Arabia

Riyadh

Website: sdaia.gov.sa.

National Data Governance Platform (DGP) (dgp.sdaia.gov.sa)

Disclaimer

This Privacy Policy is not intended to, nor does it, create any contractual rights whatsoever or any other legal rights, nor does it create any obligations on us in respect of any other party or on behalf of any party. When you log in to third parties’ websites, you will not be subject to or under this Privacy Policy. Moreover, we are not responsible for their websites’ content and we do not represent third parties. Therefore, When you leave our website, we recommend you to review the privacy and security policy of each website you visit.