Privacy Policy

Introduction

شركة دارة التوفيق التجارية (Darat Al-toufiq Commercial Company), Commercial Registration No. 7043427595 (hereinafter "we", "the Company", or "Falcon"), is licensed to use the trademark Falcon Squash Club, registered with the Saudi Authority for Intellectual Property.

The Company operates Falcon Squash Club in Riyadh, Saudi Arabia: squash courts, professional coaching, a junior academy, group programs (including ladies-only sessions), and club tournaments. Services are offered at the club premises, on the website (falconsquash.com) and through the Falcon Squash Club mobile application. The target audience consists of customers of Falcon Squash Club.

The Company ensures a high level of privacy and security concerning personal data provided during interactions (hereinafter "you" or "the customer"). It is committed to protecting your privacy and complying with data-protection standards as set out in the Saudi Personal Data Protection Law and its Executive Regulations, including subsequent amendments.

Your use of the website, mobile application, or any of our services implies acceptance of Falcon's Terms & Conditions and this Privacy Policy.

Purposes of processing

We collect and process personal data for the following purposes, in addition to the regulatory purposes stated in the Personal Data Protection Law and its Executive Regulations:

• creating and managing your member account and, where applicable, linking it to your existing club membership record;
• booking and managing courts, coaching sessions, group programs, academy enrollment and tournament entries, including waitlists, cancellations and credits;
• processing payments and issuing service credits;
• registering and scheduling juniors in the academy at the request of their parent or guardian;
• administering tournaments, including publishing draws, schedules and results;
• sending service communications — such as verification codes, booking confirmations, reminders, schedule changes and expiry/renewal notices — via WhatsApp, SMS, e-mail and app push notifications;
• responding to your inquiries and requests; and
• complying with legal and regulatory obligations.

Personal data we collect

• Identity data: full name, date of birth, gender.
• Contact data: mobile number (verified via WhatsApp or SMS), e-mail address.
• Account data: login credentials (passwords are stored in encrypted form), language preference, device push-notification token.
• Juniors' data, provided by a parent or guardian: the junior's name, date of birth, gender, and coach-assessed training level.
• Activity data: bookings, attendance, packages and credits, program registrations, tournament entries and results.
• Payment data: transaction amount, date, method and status. We do not collect or store card numbers. Payments are processed by our licensed payment provider (Geidea) over secure connections; Apple Pay transactions are processed the same way.
• Support communications you send us.

Data collection is limited to what is necessary for Falcon to provide its services. Falcon acts as the data controller. Providing data is optional; however, some services cannot be provided without it.

Personal data is collected when you register on the website, mobile application, or at the club, and in the course of using our services.

Your rights

You have the right to access your personal data, obtain a copy of it, request its correction, completion or updating, and request its destruction once it is no longer needed — subject to the provisions of the Law and its Executive Regulations.

Storage and processing

Data is stored and processed by Falcon's technical team using reputable cloud infrastructure providers under contractual safeguards consistent with this policy.

If you wish to withdraw consent previously granted for data processing, notify Falcon at reception@falconsquash.com.

Personal data will not be processed for purposes inconsistent with its collection intent, except as stated in Article (10) of the Law.

Security

Protecting information is a top priority. Falcon maintains technical, administrative and security measures to prevent unauthorized access, alteration, destruction or disclosure of your data. Access is restricted to authorized Falcon staff and to service providers under contractual obligations of confidentiality and security — including our payment provider (Geidea), messaging providers used to deliver verification codes and service messages (including WhatsApp/Meta), cloud hosting providers, and push-notification delivery services (Apple, Google, Expo).

Disclosure

Your data will not be shared with third parties outside Falcon or disclosed except:

• by court order or request from a public authority in Saudi Arabia for public-interest, security, legal or judicial requirements;
• as necessary to fulfil a request you made via Falcon's services (including processing a payment or delivering a message to you);
• with your prior explicit consent;
• if the data was collected from publicly available sources;
• if disclosure is essential to protect public health, safety, or the life or health of an individual;
• if disclosure is limited to anonymized processing that does not reveal your identity; or
• if disclosure is required to fulfil a legitimate interest of the data controller, provided it does not infringe your rights or involve sensitive data.

Visibility to other members: if you enter a club tournament, your name appears in the tournament's entry list, draw, schedule and results, which are visible to other members in the app. If you register for certain group sessions, your first name and last initial may appear in that session's attendee list. Juniors' names are not published in rosters.

Juniors

Academy accounts are created and managed by a parent or legal guardian, who provides the junior's data and exercises the data rights above on the junior's behalf.

Your credentials

Keep your login credentials secure and do not share them. You bear responsibility for access resulting from failure to do so.

Breach notification, retention and destruction

• In the event of a personal data breach, the competent authority will be notified within 72 hours per the Executive Regulations; affected individuals will be informed where the breach could harm their data, rights or interests.
• Falcon retains records for five years to ensure availability upon request by regulatory authorities.
• Falcon destroys personal data once its purpose is fulfilled, without delay, except where a legal requirement mandates retention for a period (destroyed after the longer of the two), or where the data relates to an ongoing judicial case (destroyed after the case concludes). Anonymized data may be retained.

Cookies and similar technologies

The Falcon website and app use a small amount of locally stored data (such as your language preference and login session) to make the services work and remember your settings. The website may use cookies for the same purposes; where consent is required, you will be asked. Payment pages operated by our payment provider may use their own cookies under their own policies. Declining may limit some functionality.

Limitation of liability

*(unchanged from the lawyer's draft — warranties disclaimer, no liability for indirect losses, external links, temporary service disruptions, release of claims.)*

Modifications

Falcon reserves the right to modify this Privacy Policy at its sole discretion without prior notice. Updates will be posted on the website, application, or at the club. Your continued use of any Falcon service signifies acceptance. Please review this policy periodically.

Governing law

This Privacy Policy is governed by and interpreted in accordance with the laws and regulations of the Kingdom of Saudi Arabia.

Inquiries

شركة دارة التوفيق التجارية (Darat Al-toufiq Commercial Company) — Riyadh, Saudi Arabia E-mail: reception@falconsquash.com