Who we are and the scope of this policy
AYLA Bidiyah, located in Wilayat Bidiyah in the Sultanate of Oman, is responsible for the personal data processed through this website and through direct booking and guest communications. This policy applies to website visitors, account holders, prospective guests, guests, and people who communicate with us.
This policy is designed with reference to the Oman Personal Data Protection Law issued by Royal Decree 6/2022 and its Executive Regulation issued by Ministerial Decision 34/2024. It should be read together with our Terms and Conditions.
Data we collect
We collect only information reasonably needed to operate AYLA Bidiyah, respond to you, and provide requested services.
- Account data: name, username, email address, phone, WhatsApp number, country, profile image, account provider, and account identifiers.
- Google sign-in data: the Google account identifier, name, email address, and profile image supplied by Google after you choose to sign in.
- Booking data: selected room, stay dates, adult and child guest counts, special requests, booking status, invoices, taxes, payment status, and communications.
- Guest and compliance data: identification or travel document details when required at check-in by applicable law, licensing requirements, security procedures, or competent authorities.
- Technical data: IP address, browser and device information, security logs, session cookies, language preference, and approximate activity on the website.
- Information you voluntarily provide through messages, telephone, WhatsApp, email, reviews, or other support channels.
Why and how we use personal data
- To create and secure your account and authenticate you, including through Google OAuth.
- To receive, review, confirm, amend, or cancel booking requests and issue invoices or confirmations.
- To provide accommodation, meals, transport, activities, guest support, safety information, and special assistance requested by you.
- To communicate service notices and respond to inquiries and complaints.
- To prevent fraud, misuse, security incidents, and unauthorized access.
- To comply with accounting, taxation, tourism, consumer protection, public health, security, and other legal obligations in Oman.
- To improve our services using aggregated or de-identified information where practical.
- To send marketing only where legally permitted and, when required, after obtaining your express consent. You may opt out at any time.
Consent and choices
Where consent is required, we will seek a clear and specific choice before processing. You may withdraw consent by contacting us, without affecting lawful processing completed before withdrawal. Some information is necessary to create an account, process a booking, comply with law, or protect guests; if it is not provided, we may be unable to provide the relevant service.
Cookies and online services
The website uses essential session and remember-me cookies to keep you signed in, protect forms, remember language choices, and maintain security. We may also use limited technical logs to diagnose errors and protect the service. Essential cookies cannot be disabled through the website because the requested features would not function correctly.
Third-party services such as Google Sign-In and embedded Google Maps operate under their own privacy terms and may set or read cookies when you use them.
Sharing and service providers
We do not sell personal data. We disclose it only when reasonably necessary and subject to appropriate confidentiality and security expectations.
- Hosting, email, communications, accounting, payment, IT security, and website support providers.
- Google for account authentication and map services when you choose to use those features.
- Transport, activity, tour, or hospitality providers where necessary to fulfil a service you requested.
- Professional advisers, insurers, auditors, and competent Omani authorities where required by law or to establish or defend legal rights.
- A successor operator in a lawful merger, restructuring, or transfer of AYLA Bidiyah, subject to applicable safeguards.
International transfers
Some providers, including Google and infrastructure or communications providers, may process data outside Oman. Where an international transfer occurs, we seek the consent required by Omani law and assess or require safeguards intended to provide protection consistent with the Personal Data Protection Law and its Executive Regulation. Sensitive personal data is not intentionally transferred abroad without any additional approval required by law.
Retention
We retain account information while the account remains active and for a reasonable period afterwards to resolve requests or protect legal rights. Booking, invoice, tax, complaint, and transaction records are retained for the periods required by applicable Omani laws and legitimate business recordkeeping. Data is deleted, anonymized, or securely archived when it is no longer required, subject to lawful preservation obligations.
Security and data breaches
We use proportionate administrative, technical, and physical safeguards, including access controls, protected sessions, restricted credential files, validation, and security monitoring. No internet system can be guaranteed completely secure. If a breach creates the risk or serious harm described by Omani law, we will notify the Ministry and affected data subjects within the legally required timeframe, including the 72-hour period where applicable.
Your rights
Subject to the conditions and exceptions in Omani law, you may submit a written request to:
- Access or obtain a copy of personal data we process about you.
- Correct, update, block, or erase inaccurate or unnecessary data.
- Withdraw consent and object to direct marketing.
- Request transfer of data to another controller where applicable.
- Receive information about a qualifying personal data breach.
- Submit a complaint to us or to the competent Personal Data Protection Department at MTCIT.
Children and minors
Accounts and bookings should be made by an adult with legal capacity. Where personal data relating to a child or a person lacking legal capacity must be processed, we require the explicit consent of the parent, guardian, trustee, or legally authorized representative and apply the additional safeguards required by Omani law. Adults submitting child guest information confirm that they have authority to do so.
Contact and policy updates
For access requests, corrections, deletion requests, consent withdrawal, privacy complaints, or questions, contact AYLA Bidiyah at aylabidiyah@gmail.com or through the contact details published on this website. We may request reasonable identity verification before acting on a request.
We may update this policy when services, providers, or legal requirements change. The current version and its update date will remain available on this page.