Privacy Policy

Key Car Rental Privacy Policy
This Privacy Policy governs the collection, use, disclosure, and protection of personal data by Key Car Rental (referred to in this Policy as “we,” “us,” or “our”) when individuals visit our websites, use our mobile applications (iOS, Android, Huawei), engage with our online forms, or interact with us through any of our digital platforms or our physical locations. We are committed to safeguarding your privacy in accordance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia and its Implementing Regulations.

Data Protection Officer (DPO)
Key Car Rental has appointed a Data Protection Officer (DPO) in accordance with the PDPL. For any inquiries related to the processing of your personal data or our data protection practices, you may contact our DPO directly at [email protected].
Key Car Rental does not provide services to individuals under the age of 18 and does not knowingly collect or process any personal data from individuals below this age threshold.

Personal Data Collection
We collect and process various categories of personal data when you interact with us through our physical locations or digital platforms. This includes information provided directly by you and information collected automatically through your device and interactions.
Individuals using our Contact Us, rental reservation, Careers Page, or other digital forms may provide personal data such as names, email addresses, phone numbers, rental preferences, and inquiry content. When applying for a position through our Careers page, applicants may be required to provide identity information, contact details, qualifications, and CVs or resumes. All recruitment-related information is used exclusively for assessing suitability for employment and for managing the recruitment process.
When you create or choose to activate an online customer account, we process the personal data you provide to maintain your account profile, facilitate faster future bookings, and display your reservation history. Your online account stores information for your convenience; however, deleting the online account does not automatically delete all personal data stored in our systems, as certain information must be retained for legal, regulatory, or operational purposes. Account holders may request access or corrections to their information as described in the “Individual Rights under PDPL” section of this Policy.

Our websites and mobile applications may collect limited technical information to support basic functionality and ensure the proper operation of our digital services. This data includes your Internet Protocol (IP) address, which identifies your Internet Service Provider (ISP) rather than you as an individual. We do not associate IP addresses with users, nor do we collect or store online identifiers or track information that can directly identify website visitors. The IP address information available to us is used solely to understand general patterns of site traffic, enhance system performance, and diagnose technical issues.
Our websites use “cookies,” which are small, encrypted text files that support the functionality, security, and performance of our digital services. Cookies help maintain session continuity, assist navigation, and provide general usage insights. We use session cookies, which are removed when you close your browser, and persistent cookies, which remain until deleted or expired.
Essential cookies are required for the website to operate. Non-essential cookies, including functional, analytics, advertising, and social media cookies, operate only with your explicit consent through our cookie preference tools. Social media and advertising cookies may be placed by approved third-party partners to enable limited sharing or measurement features.
We do not use cookies to collect personally identifiable information or to track your browsing on unrelated websites. More information about cookie types and your choices is available in our Cookie Policy.

Some vehicles in our fleet are equipped with telematics systems that collect vehicle-level operational data, such as mileage, fuel level, and location information generated by the vehicle during rental. This data relates to the vehicle’s operation and does not identify you on its own.

Special Categories of Personal Data 
In certain circumstances, such as identity verification and driving license checks, we may process data classified as 'sensitive' under the PDPL. This process is strictly necessary for the performance of the rental contract, to comply with our legal obligations, or based on your explicit consent where required. We implement enhanced safeguards for any such data
We may also collect personal data when you contact our call center or customer service teams. This may include telephone numbers, call recordings (retained for limited periods for quality assurance and training), and details of your inquiries or service requests. All such data is processed to assist with customer support and to maintain accurate service records. 
Methods and Purposes of Personal Data Collection
We collect personal data using both direct and indirect methods.

1- Direct Collection

 

Direct collection occurs when you voluntarily provide personal data through our website, mobile apps, or customer support channels. Examples include completing online forms, making a rental reservation, creating a user account, contacting customer support, or applying for employment. The information collected through these interactions is used to:

• Create and manage rental contracts
• Verify identity and driving license information
• Process payments and reservations
• Maintain rental history
• Facilitate online account functionality
• Responding to inquiries and support requests
• Improve the functionality and security of our digital services
• Manage recruitment processes and assess job applications

2- Indirect Collection from Third Parties

We may also obtain personal data from authorized third-party sources, including but not limited to rental aggregators, payment processors, digital partners, corporate clients and recruitment platforms (such as LinkedIn). This collection occurs only when:

• The third party has lawfully obtained the data and is permitted to share it;
• The data subject has provided valid consent where required; or
• The data is publicly available in a lawful manner.

Indirectly collected data is used to complete or verify bookings, enhance customer service, and support recruitment and business operations. We ensure that any use of such data does not adversely affect the rights of data subjects and is consistent with PDPL requirements.

We ensure that any use of indirectly collected data respects individual rights under the PDPL and does not adversely impact personal privacy.

Data Disclosure Practices
We may disclose your personal data to trusted third-party partners who assist us in delivering and improving our services. These may include IT service providers, hosting companies, cloud service providers, analytics and advertising partners, recruitment platforms, call center service providers, insurance partners, and payment processors. All third-party partners are required to protect your data and use it only for the purposes agreed upon.

We may also disclose data to governmental, legal, or regulatory authorities when such disclosure is required under applicable laws of the Kingdom of Saudi Arabia.
Key Car Rental does not sell or rent personal data to external parties.

Legal Basis for Data Processing
We process personal data in line with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations. Our legal bases include obtaining the data subject’s explicit consent, fulfilling contractual obligations, complying with legal requirements, or pursuing our legitimate business interests (such as fraud prevention, network and information security, direct marketing of similar services to existing customers (subject to opt-out), and internal administrative purposes), provided these interests are not overridden by your data protection rights and freedoms. Where consent is used, it is obtained transparently and may be withdrawn at any time.

Automated Decision-Making
We do not use solely automated decision-making processes, including profiling, that produce legal effects concerning you or similarly significantly affect you. Should this practice change in the future, we will inform you of the logic involved, its significance, and your right to obtain human intervention, express your point of view, and contest the decision

Data Storage and Security
We are committed to protecting your personal data through robust security practices. We implement physical, technical, and organizational measures to safeguard your information against unauthorized access, alteration, disclosure, or destruction. These measures include data encryption (both in transit and at rest), strict access restrictions, multi-factor authentication, regular security testing, and ongoing staff training in data protection and privacy compliance.

Your personal data is stored either within secure facilities located in the Kingdom of Saudi Arabia or through certified cloud service providers that follow equivalent security standards and comply with applicable data protection laws. All environments in which your data is stored are continuously monitored and governed by strict security controls to prevent unauthorized access and ensure data integrity.

We regularly review and enhance our security protocols to address emerging risks, evolving technologies, and updates to legal and regulatory requirements. In the unlikely event of a personal data breach that is likely to result in a high risk to your rights and interests, we will notify you and the Saudi Data & Artificial Intelligence Authority (SADIA) without undue delay. The notification will describe the nature of the breach and recommend measures to mitigate its potential adverse effects. 

Data Sharing and Disclosure
We do not sell, rent, or otherwise disclose our personal data to external parties, except as described in this Privacy Policy. We may share your personal data with trusted third-party partners who support us in delivering, enhancing, and securing our services. These partners include technology service providers, cloud hosting companies, payment processors, customer support platforms, analytics providers, marketing service providers, vehicle telematics providers, insurance partners, and authorized business service vendors. Any data shared with such partners is limited to what is necessary for providing their services to us and is governed by strict contractual obligations requiring them to maintain confidentiality, implement appropriate security safeguards, and comply with applicable data protection regulations.

When necessary, we may also share limited rental-related information with statutory bodies or law enforcement authorities for the handling of, legal compliance, or investigations permitted by law.

In the context of recruitment, we may share candidate information with authorized assessment providers, background verification partners, and interview or talent-acquisition platforms. Such disclosures are limited to what is required to evaluate suitability for employment and to administer the recruitment process. All recruitment-related disclosures are subject to contractual safeguards requiring the protection of candidate privacy, restricting the use of personal data solely to hiring-related purposes, and ensuring compliance with the applicable data protection laws of the Kingdom of Saudi Arabia.

We may disclose personal data to regulatory or legal authorities when such disclosure is required under applicable laws or in response to lawful requests, court orders, or government directives. All such disclosures are made in accordance with PDPL requirements and are limited to what is strictly necessary to comply with legal obligations.
Key Car Rental requires all third-party partners who receive personal data to use it only for the purposes for which it was shared, to maintain the confidentiality of such data, and to apply reasonable and appropriate technical and organizational security measures to protect the rights and privacy of individuals at all times.

International Data Transfers
We operate with affiliates and vendor partners, who may operate in third countries, which means Personal Data may be stored and processed by Us or Our service providers. 
By providing Personal Data for any of the purposes stated above, you acknowledge that Your Personal Data may be transferred to or stored in third countries outside of the Kingdom and We will take necessary measures to safeguard Personal Data in accordance with the contractual obligations and data protection requirements applicable to the provision of services.
Your Personal Data will only be transferred if We or our vendor partners:

• Process it in a territory which the Kingdom has determined provides an adequate level of protection for Personal Data; or
• Implement appropriate safeguards as approved by SDAIA, such as Binding Rules or Standard Contractual Clauses, to ensure an adequate level of protection for your Personal Data

Should future business requirements necessitate international data transfers, we will ensure appropriate safeguards are in place to protect your data and will inform you of any such changes.

Individual Rights Under the PDPL
Under the Personal Data Protection Law of the Kingdom of Saudi Arabia, you have specific rights concerning your personal data. These include the right to be informed, the right to access your data, the right to correct or update it, the right to request its erasure (“right to be forgotten”), the right to obtain a copy of your data, and the right to withdraw your consent at any time.
We are committed to enabling you to exercise these rights. You may submit a request by email to [email protected]. To protect your privacy, we may request specific information to verify your identity. We will respond to valid requests without undue delay and within thirty (30) days of receipt. For complex requests, this period may be extended as permitted by PDPL. There is no fee for exercising your rights unless a request is manifestly unfounded or excessive

Data Security Measures
We have implemented reasonable technical and organizational measures designed to protect your personal data against unauthorized access, accidental loss, or intentional destruction. Our security framework includes both physical and digital safeguards to ensure the confidentiality, integrity, and availability of your personal information.

Data Retention Period
We retain your personal data for a period of ten years from the date of collection or last interaction, whichever is later. Certain information collected through technology platforms, including call recordings for quality assurance and customer service, is retained for shorter, purpose-specific periods. This retention period enables us to provide consistent service, maintain accurate rental and account records, support customer service needs, and comply with our legal, regulatory, and financial obligations under the laws of the Kingdom of Saudi Arabia.

Unsuccessful candidate applications are retained only for the period necessary to fulfill recruitment purposes (typically not exceeding 1 year) and are then securely deleted or anonymized. Applicants may request earlier deletion of their personal data, subject to any legal or regulatory obligations requiring retention.

Once the applicable retention period has expired, we will securely delete or anonymize your personal data using methods designed to prevent unauthorized access, recovery, or reconstruction. All retention and disposal activities are carried out in accordance with our internal Data Classification and Retention Policy and the requirements of the Personal Data Protection Law

Privacy Notice Updates
We may update this Privacy Policy from time to time to reflect changes in our practices, service offerings, or legal requirements. Any updates will be published on our website and mobile applications, and the “Last Updated” date will be revised accordingly. We encourage you to review this Privacy Policy periodically.
To File a Complaint

If you have any concerns regarding how we handle your personal data or believe we may have breached applicable data protection laws; you are encouraged to contact our team by emailing [email protected] 

If you are not satisfied with our response or if we do not respond within thirty (30) days, you may escalate your concern to our

Data Protection Officer using the contact details provided below:
Data Protection Officer
Email: [email protected]

Alternatively, you have the right to file a complaint with the relevant Competent Authority.