1.1 Introduction

Tourise is an initiative between Saudi tourism authority and Ministry of tourism.TOURISE is a global platform shaping the future of tourism, main streams are event programs, sponsorship, guest management, knowledge partner, marketing and communication (MarComm). This Privacy Policy explains how that personal data is collected, used, disclosed, stored, and protected. It also explains the rights individuals may have in relation to their personal data and how those rights may be exercised.

For the purposes of this Policy, personal data means any data, regardless of its source or form, that may identify an individual directly or indirectly.

1.2 Scope of This Policy

This Policy applies to personal data processed through the TOURISE website and the digital services, forms, communications, cookies, tools, and features made available through it, including the TOURISE Awards nomination process.

It applies whether the personal data is provided directly by an individual, collected automatically through the Platform, or received when an individual communicates with TOURISE.

This Policy does not apply to third-party websites, platforms, or services that are not controlled by TOURISE. Where the Platform links to or integrates with third-party services, the privacy practices of those third parties may apply to their own processing activities.

1.4 Related Policies and Terms

This Policy should be read together with the TOURISE Terms and Conditions, Cookie Policy, and any privacy notices, consent notices, or specific terms presented at the point where personal data is collected.

Where there is third-party integration then their privacy notice and/or terms of conditions applies.

The Saudi Tourism Authority determines the purposes and means of processing personal data in accordance with the provisions of this Privacy Policy.

2.1      Data Processor

The personal data will be processed by the Saudi Tourism Authority

2.3 Privacy Contact Details

Individuals should be able to contact TOURISE regarding privacy matters, data subject rights requests, consent withdrawal, complaints, and other questions relating to personal data through:

• Data Governance Office
  Phone Number: +966920022554
  E-mail: DGO-DPO@sta.gov.sa
• Saudi Tourism Authority

2.5 Last Updated Date and Update Record

The Privacy Policy was last updated on [10 Sep 2026]. You can review the previous policy at this link

TOURISE collects personal data that is relevant to the way an individual uses the Platform or interacts with TOURISE. The categories of personal data may differ depending on the service, form, feature, or communication channel used.

Subscription Data

When an individual subscribes to receive TOURISE updates, TOURISE collects the information provided through the subscription form. This may include and not limited to: Name, phone number, email address, subscription date, consent-management records, unsubscribe or preference records connected to the subscription. This information might be shared with 3rd party when sending communication with you and/or to run any checks required for you to attend the event.

3.2 Marketing campaigns and communication

where applicable your data may be processed for marketing campaigns and communication purposes.

3.3 TOURISE Awards Nomination Data

When an individual submits a nomination for the TOURISE Awards, TOURISE collects the information provided in the nomination form.

This may include nominator name, position, organization or affiliation, email address, phone number and country code, nominated destination name, nominated destination country, selected award category and supporting nomination description.

Where the nomination form includes an option to agree to follow-up contact, TOURISE may also record that preference.

3.4 Communication and Correspondence Data

When an individual contacts TOURISE, TOURISE may process the information included in that communication.

This may include sender name, email address, organization or professional details, subject line, message content, attachments and any other voluntarily provided information.

3.5 Noura AI Assistant Data

When an individual chooses to interact with the Noura AI assistant (Large language Model AI) made available through the Platform, information entered into the assistant may be processed to provide and personalize the interaction.

This may include:

• name and email address, where login is used.
• prompts, messages, or other content entered by the individual.
• conversation-related information.
• feedback submitted on assistant responses.
• favorites, bookmarks, or itinerary-related information, where those features are used. and
• information needed to provide and personalize the assistant’s experience.
• Your voice when using the Voice Chat functionality

All chats, conversations and calls/voices will be reviewed for security and enhancement purposes.

3.6 Technical and Usage Data

When an individual uses the Platform, TOURISE may collect technical and usage data generated through that use. This may include Cookie Data: such as information collected via web logs, technologies, cookies, or similar technologies and IP Address data includes the IP address details and details of the web browser version used.

3.7 How do we protect your personal data?

To ensure the security and confidentiality of your personal data, we put in place all necessary technical and organizational means in accordance with the requirements issued by the National Cybersecurity Authority.

TOURISE collects personal data through direct methods and indirect methods. The method of collection depends on how the individual uses the Platform or interacts with TOURISE.

4.1 Direct Methods

TOURISE collects personal data directly when an individual provides information to TOURISE through Platform forms, email, phone calls or through the AI.

This may include:

• information submitted through the newsletter or updates subscription form, such as email address and related subscription preferences.
• information submitted through the TOURISE Awards nomination flow, such as nominator details, destination details, award category, supporting description, and follow-up contact preference where selected.
• information included in emails or other communications with TOURISE, such as sender details, message content, attachments, and any information voluntarily provided.
• information entered into Noura AI, such as prompts, messages, conversation content, feedback, favorites, bookmarks, or itinerary-related information where those features are used.
• information selected from available options on the Platform.
• information submitted as free-text content. and
• files, attachments, or other materials voluntarily provided.

4.2 Indirect Methods

TOURISE may also collect personal data indirectly or automatically when an individual accesses, navigates, or interacts with the Platform, or where information is made available to TOURISE through related services, partners, or sources.

This may include:

• Digital/platform sources – technical, usage, cookie, analytics, security and interaction data generated through the TOURISE website, Noura AI and other digital tools.
• Marketing and communications platforms – including campaign, audience, engagement and performance data generated through email, digital marketing and social media activity.
• Event and registration partners/service providers – where information relating to attendees, guests, speakers or other participants is provided to TOURISE through systems or partners supporting registration and event delivery.
• TOURISE partners and stakeholders – where appropriate, this could include information provided by knowledge partners, sponsors, awards partners and other organisations supporting TOURISE programmes.
• Government entities – where information is legitimately shared with TOURISE in connection with invitations, attendance, protocol, security or other event requirements.
• Representatives or agents acting on behalf of individuals – particularly relevant for senior/VIP attendees, where details may be provided by an assistant, office, protocol team or other authorised representative.

Third-party platforms may also process personal data under their own privacy notices when an individual interacts with their websites, tools, or services.

TOURISE processes personal data for clear purposes connected to the Platform, TOURISE initiatives, communications, security, and related services. The purpose depends on the context in which the personal data is collected.

• Operating the Platform: TOURISE may process personal data to operate, manage, maintain, and improve the Platform and its digital features.
• Managing Subscriptions and Updates: From a marcomm perspective data will be used to communicate with individuals regarding Tourise update and related communications and may also be used to support relevant marketing activities and camping's were applicable and subject to appropriate consent and Saudi personal data protection law (PDPL) and it’s related regulations.
• Managing TOURISE Awards Nominations: TOURISE may process nomination data to support the Tourise awards process including nomination management judging shortlisting, and winner selection as well as related communications publication media and marketing activities were applicable any additional use of nomination data including due diligence archiving or government regulator reporting should be confirmed by the relevance team and Saudi PDPL.
• Responding to Communications: TOURISE may process communication and correspondence data to manage and respond to inquiries, requests, complaints, and other messages received from individuals.
• Providing Noura AI: TOURISE may process personal data entered Noura AI for analytics purposes unless the user wants to submit a form or build a personalized plan or book something, some necessary information might be required to be processed to be able to complete the requested service.
• Analytics and Platform Improvement: TOURISE may process technical, usage, cookie, and interaction data to understand how the Platform is used and to improve its content, performance, and usability.
• Marketing, Advertising, Initiate Communication and Campaign Measurement: TOURISE will use the relevant data to support digital marketing and advertising activities, including campaign delivery and measurement, audience targeting and building, retargeting, campaign optimization, and social media marketing, where applicable.
• Security and Misuse Prevention: TOURISE may process personal data and technical information to protect the Platform, verify form submissions, prevent misuse, and maintain the integrity of its systems.
• External Links, Downloads, and Integrated Services: from a MarCom perspective, tracking relevant user interactions, such as clicks, downloads, video views, and campaign conversions, is required to support paid media measurement, campaign performance analysis, and optimization.

TOURISE processes personal data only where there is a legal basis for doing so under Saudi personal data protection law and its related regulations. The legal basis may differ depending on the type of personal data, the purpose of processing, and the context in which the personal data is collected or used.

• Processing is based on consent. You can withdraw your consent at any time without affecting processing operations carried out based on other legal bases. To this end, you can contact: DGO-DPO@STA.gov.sa.
• Processing is carried out due to a legitimate interest of the data owner, and it is not feasible or practical to contact them.
• Processing is in compliance with another legal obligation or is part of an existing agreement to which the data owner is a party.
• If the data controller is a public entity, processing is necessary for security reasons or to fulfill legal requirements.

You have several rights regarding your personal data, including but not limited to:

• Right to be informed: The data subject has the right to know how we will use his/her personal data as explained in this privacy policy.
• Right to access and obtain personal data: The data subject has the right to request a copy of his/her personal data.
• Right to rectify personal data: The data subject has the right to request the correction of his/her personal data that he/she deems inaccurate, incorrect or incomplete, and it will be reviewed and updated.
• Right to destroy personal data: The data subject has the right to request the destruction of his/her personal data in certain circumstances in accordance with the relevant regulations, unless there is a legal text specifying a specific period of retention or contractual requirements.
• Right to withdraw consent to the processing of personal data: The data subject can withdraw his/her consent to the processing of his/her personal data -at any time- unless there are legitimate purposes in accordance with the Saudi Regulations that require the contrary.

For more information, please contact us at This form or through the email address: DGO-DPO@STA.gov.sa.

TOURISE processes personal data through a controlled lifecycle designed to support the relevant purpose of processing and protect personal data throughout its use. The specific processing steps may differ depending on the service, feature, form, or communication involved.

TOURISE may review and validate personal data where needed to administer a request, process a nomination, maintain accurate records, protect the Platform, or respond to an individual.

TOURISE may organize personal data so that it can be used for the relevant purpose and managed securely.

We do not sell, trade, or otherwise disclose your personally identifiable information. Data may be shared with trusted entities and third-party processors who assist us in our operations including (Marketing and communication), subject to contractual obligations ensuring they protect your data.

The frequency of disclosure may depend on the relevant purpose and recipient. Some disclosures may occur once, some may occur only when needed, and others may occur regularly where a service provider supports ongoing Platform operations.

TOURISE uses cookies and similar technologies to operate the Platform, support security, remember choices, measure performance, understand use of the Platform, and, where applicable, support marketing and campaign measurement.

Personal data is stored inside the Kingdom of Saudi Arabia in the servers of the Saudi Tourism Authority, and its Partners these servers are protected with the best technologies in accordance with the policies and controls of the National Cybersecurity Authority and relevant laws and regulations.

We will keep your personal data either for 120 months, or for any period necessary to fulfill our operational responsibilities based on applicable laws and regulations, including but not limited to:

• Maintaining accounts
• Enhance your experience as a user of our platforms
• Deal with your enquiries and complaints,
• Ensure quality control of our services (including call center)
• Ensure security of our systems, premises, employees and visitors
• Manage customer relationships,
• Address legal claims and respond to regulatory requests.

The data will be disposed (post retention expiration) securely in accordance with the relevant laws and regulations.

If you have any Personal Data Protection Law concerns, or if we do not comply with the Personal Data Protection Law, you can file a complaint to the Data Governance Office using one of the following channels:

Email:

DGO-DPO@STA.GOV.SA

The request will be processed within maximum period of 30 days. If you are unsatisfied with how we process your complaint, you can file a complaint to the Competent Authority SDAIA.

SDAIA Address:

Kingdom of Saudi Arabia

Riyadh

Website: sdaia.gov.sa

National Data Governance Platform DGP" (dgp.sdaia.gov.sa).

TOURISE may update this Policy from time to time to reflect changes in the Platform, services, processing activities, legal requirements, or operational practices.

Where a material change is made, TOURISE will take appropriate steps to make the updated Policy available and, where required, provide notice of the change.

The date of the latest update should appear in this Policy.