Privacy Policy

This Privacy Policy explains how Lahtha (“we”) collects, uses, shares, and protects personal data when you use the Lahtha customer and vendor applications, the lahtha.com website, and any related services (collectively, the “Services”). This Policy applies to customers, vendors, their authorised representatives, event guests whose personal data is provided by a host, and visitors to our website. The Data Controller responsible for the processing of your personal data is Manthomat Lahtha Company, Commercial Registration No. 7054367821, with its registered address at Building 3321, Abi Jafar Al Mansur Street, Al Yarmuk District, Riyadh 13251, Kingdom of Saudi Arabia (national short address RFYA3321, secondary number 7394). You may contact the Data Controller using the contact details provided in Clause 13 of this Policy. This Policy also identifies which categories of personal data are mandatory or optional to provide, together with the consequences of failing to provide mandatory personal data where applicable. This Policy has been prepared in accordance with the Personal Data Protection Law and its Implementing Regulations.

Account data: name, mobile number, email, language, market, date of birth, and gender where provided. Event data: event type, dates (Gregorian and Hijri), guest counts, budget, city, and optional map location. Guest-list data: names and phone numbers of guests you invite (see Clause 6).

Vendor data: store details, national ID for verification, commercial documents, IBAN and bank details for payouts. Transaction data: bookings, amounts, payment status, receipts, and refunds; card processing occurs at our payment partner and we do not store full card numbers.

Dana conversations: chat messages with our AI assistant and related planning context. Technical data: device identifiers, push tokens, logs, and usage analytics.

Mandatory and optional data. The following are mandatory and an account cannot be created or a booking completed without them: mobile number, email address, name, and (for vendors) national ID of the authorised representative, commercial registration, and IBAN. The following are optional and their absence does not prevent use of the Services: gender, budget, map location, and profile photograph. Guest-list data is optional and is provided at the host’s discretion.

We may collect personal data directly from the data subject, from the host in relation to guest information, from payment service providers, or automatically from the devices used to access the Platform, depending on the nature of the Services provided.

We process personal data for the following purposes: creating and securing user accounts (including one-time password verification), operating event planning and booking services, verifying vendors, processing payments, refunds, and settlements, providing Dana AI-powered assistance, sending service-related notifications, preventing fraud and misuse, complying with applicable legal and regulatory obligations including tax and e-commerce requirements, and improving our Services.

The legal bases for processing include the performance of a contract with you, compliance with legal obligations, our legitimate interests in operating a secure and reliable marketplace, and your consent where required by law (such as for marketing communications, which you may withdraw at any time). We will not process personal data for any purpose other than those described in this Policy unless there is a lawful basis permitting such processing or a new consent has been obtained from the data subject where such consent is required by applicable law.

We share personal data only to the extent necessary: with the vendor with whom you make a booking (only the event details required to provide the requested service, and never your payment information); with contracted service providers (including Tap Payments for payment processing, SMS services, push notifications, email services, Dana AI processing, Google Analytics and Adjust for usage analytics, and cloud hosting), who process personal data on Lahtha’s behalf under contractual obligations requiring them to protect personal data and to use it solely for the agreed purposes; with professional advisers; and with competent authorities where required by applicable law. Personal data will only be disclosed to the extent necessary to achieve the purpose for which it is disclosed and in accordance with applicable laws and regulations.

We do not sell personal data, and Lahtha’s consumer products do not display third-party advertisements based on your personal data. In the event of any personal data breach or other incident resulting from a service provider’s processing of personal data, the service provider shall bear responsibility for such incident in accordance with the agreements entered into with Lahtha and the applicable laws and regulations.

Platform data is hosted within the Kingdom of Saudi Arabia (primary hosting location: Riyadh Region; disaster recovery location: Jeddah Region). Personal data is transferred outside the Kingdom only in the following limited cases: (a) processing of Dana conversations by the artificial intelligence model provider, and (b) processing of usage analytics by Google Analytics and Adjust. No other category of personal data is transferred outside the Kingdom. Personal data will not be transferred outside the Kingdom unless the conditions and requirements set out under the Personal Data Protection Law, its Implementing Regulations, and the Regulations on the Transfer of Personal Data Outside the Kingdom are satisfied. Any such transfer shall be limited to the extent necessary to achieve the relevant processing purpose and shall be subject to appropriate legal safeguards.

When you add guests, the host undertakes that it has a lawful basis permitting it to provide Lahtha with the guests’ data, and bears responsibility for the accuracy of that data. We use guest data only to deliver invitations, record attendance for your event, and link the invitation to the guest if they later register for an account. Guests may contact us at any time to request the removal of their information from the guest list.

Dana is disclosed as an assistant operating through artificial intelligence. Your conversations with Dana are processed to generate event planning suggestions and are linked to the context of your event. You can delete your Dana chat history at any time through the application. Dana’s outputs are recommendations only, and no decision producing legal or similarly significant effects is made solely through automated processing. User conversations are not used to train artificial intelligence models except where there is a lawful basis permitting such use.

We retain personal data for as long as your account remains open and the Services are being provided to you, and thereafter for the periods required to fulfil the purposes described in this Policy, including: transaction records, invoices, and payment records for the periods required under applicable Saudi tax and commercial laws; verification records for the period necessary to comply with legal obligations; and dispute records until the dispute is resolved and any applicable limitation periods have expired. Dana chat history is retained until you delete it or your account is closed.

You may at any time request the deletion of your personal data through the contact channels in Clause 13. We will execute an approved deletion request within a period not exceeding six (6) months, save for data we are required by law to retain.

Upon expiry of the applicable retention period, personal data will be deleted, destroyed, or irreversibly anonymised in a manner that prevents it from being attributed to an identifiable individual.

Under the Personal Data Protection Law, you have the right to be informed about the processing of your personal data, to access your personal data and obtain a copy of it, to request the correction of inaccurate personal data, to request the destruction of personal data that is no longer necessary, and to withdraw your consent where processing is based on your consent. You may exercise these rights by contacting us at ksa@lahtha.com or through the in-app support channels. To protect personal data, we may request proof of the identity of the individual submitting the request before responding. We will respond to requests within the timeframes prescribed by applicable regulations, and you have the right to escalate your complaint to the competent personal data protection authority (the Saudi Data & Artificial Intelligence Authority).

We implement technical and organisational measures appropriate to the level of risk, including encrypted communications, role- and market-based access controls for employees, one-time password authentication, payment data tokenisation through our payment service provider, audit logs, and regular backups with restoration testing. No system is completely secure. If a personal data breach occurs that requires notification, we will notify the competent authority.

The Platform is intended for users aged 18 and above. We do not knowingly collect data from children, and guest-list entries are used solely for invitation delivery under the host’s responsibility.

The lahtha.com website, which serves as a landing page and hosts the digital invitation and RSVP function, uses cookies and similar technologies.

12.1 Types used. Strictly necessary cookies, which enable the website to function and which allow an invited guest to open an invitation and record an RSVP; and analytics cookies and identifiers operated through Google Analytics and Adjust.

12.2 Purposes of use. To operate the website and the invitation and RSVP function, to measure visits and usage patterns, to measure the performance of marketing campaigns and the source of application installations, and to improve performance and content.

12.3 How to control or disable them. You may accept or refuse non-essential cookies through the notice displayed on first visit, and you may at any time delete or block cookies through your browser settings. Disabling strictly necessary cookies may prevent parts of the website from functioning. Within the application, you may limit analytics identifiers through the privacy settings of your device operating system.

We may update this Policy from time to time. If we make any material changes, we will notify you within the App and indicate the effective date above. If you have any objection or complaint regarding the processing of your personal data, you may first contact us through the contact channels provided in this Policy.

Contact details. Manthomat Lahtha Company, Commercial Registration No. 7054367821, Building 3321, Abi Jafar Al Mansur Street, Al Yarmuk District, Riyadh 13251, Kingdom of Saudi Arabia (national short address RFYA3321, secondary number 7394). Email: ksa@lahtha.com. Website: lahtha.com. In-app support is available through the Support section of the application.

This Policy is issued in Arabic and English, and both texts have equal validity. In the event of any conflict or difference in interpretation, the Arabic text shall prevail.