Battuta (BATTUTA) Privacy Policy

Last updated: 25 October 2026

This policy explains how personal data is collected, processed and protected when you use the Battuta (BATTUTA) website, request a quote, book a service or contact us on WhatsApp.

Battuta is a Saudi service that arranges drivers, private cars and guides for travellers in Azerbaijan. The service may be carried out by a local driver or service provider in Azerbaijan, whom we call the “ambassador”.

1. Who are we?

The data controller is:

• Legal name: MESAFER ALAMI Digital Marketing Company (limited liability company), operating as Battuta (BATTUTA)
• Commercial registration: 2055146003 (unified no. 7040490901)
• Address: 7245 Al Huda 1 Street, Jubail 35819, additional no. 2650, Saudi Arabia
• Email: privacy@battutago.com
• Official WhatsApp number: +14155238886

For privacy questions or to exercise your rights, you can contact us by email privacy@battutago.com or WhatsApp +14155238886.

“Battuta”, “we” and “us” in this policy mean the entity named above, unless stated otherwise.

2. Scope

This policy applies to:

• Using the Battuta website.
• Requesting a quote or booking a service.
• Contacting us through our official WhatsApp number.
• Sending messages, attachments or transfer receipts to Battuta.
• Asking for support or making a complaint about a booking or trip.

It does not apply to the websites or services of technology providers, drivers or independent service providers that have their own privacy policies. However, we require the service providers we share your data with to use it only as needed to carry out and protect your trip.

3. Data we collect

We collect only the data needed to provide the service, which may include:

a. Contact details

• The name you choose to give us.
• Your WhatsApp or phone number.
• Your email address, if you choose to use it.
• Any other details you write in your messages or the booking form.

b. Trip and booking details

• The type of service requested.
• The trip date and time.
• Pick-up place and destination.
• Number of passengers.
• Flight number, when needed to track arrival or coordinate.
• Luggage details or special requests needed to deliver the service.
• Booking reference and the record of the quote, the price and your acceptance.

c. Payment details

If you pay the deposit by bank transfer, we may receive a photo of the transfer receipt or its details to verify payment, such as the sender’s name, amount, date and transfer reference.

If you pay the deposit by card through the payment link, you enter your card details in the form of the payment gateway HyperPay, which processes them; they do not reach us. We receive from the gateway the result of the payment, its reference, amount and card type, linked to your booking reference.

We do not ask for or store card details. Please hide anything on the receipt we do not need before sending it, such as full account numbers, balances or any information unrelated to the transfer being verified.

d. Children and special requests

We may ask for the number of children and their approximate age group when a child seat or suitable equipment is needed.

We do not ask for children’s names or documents unless this is necessary and explained to you in advance. Please do not send health information or unnecessary medical details. If the service requires knowing about a special need, we ask for the minimum necessary and limit access to the people who need it to carry out the trip.

e. Messages and attachments

We keep the messages, conversations and attachments you send us through our official channels as needed to provide the service, confirm the booking, handle complaints, prove acceptances or payments, and protect the rights of Battuta and its customers.

f. Technical data

The website may automatically collect limited technical data, such as IP address, browser and device type, visit time, pages opened, error data, and the booking reference or local storage data needed to run the site and prevent duplicate requests.

We do not use technical data for advertising or to track you across other websites, unless we add a tool that requires it, disclose it in this policy and obtain consent where required.

4. How do we collect data?

We collect data through:

• The booking form or page on the website.
• Your messages on WhatsApp or by email.
• Attachments you send us.
• Your contact with our support team.
• Technology providers that run the website, booking system or communication channels, as needed to provide the service.
• A person booking on your behalf, such as a family member or trip organiser.

If someone else gives us your data on your behalf, they must make sure they are allowed to do so, and we will use it for the purposes described in this policy.

5. How do we use your data?

We use your data to:

• Prepare a suitable quote for your request.
• Calculate the quote according to Battuta’s approved pricing rules and fees.
• Communicate with you and answer your questions.
• Create and confirm the booking, and change its details at your request.
• Arrange the trip with the driver or service provider who will carry it out.
• Track your flight number when you give it to us, as needed for coordination.
• Verify the deposit, paid by bank transfer or by card, and record it for accounting.
• Send updates about the booking, timing or pick-up place.
• Handle complaints, requests, refunds or claims when they arise.
• Protect the website and services and prevent fraud or misuse.
• Meet legal, accounting or judicial obligations.
• Prove acceptances, quotes, bookings and payments when needed.
• Improve our processes and customer service, using the minimum data necessary and reducing identifiability where possible.

We do not sell your personal data, use it for personalised advertising, or share it with independent marketing parties without a legal basis and the required consent.

6. Legal basis for processing

Depending on the processing, and as far as the law allows, we process your data on one or more of these bases:

• Carrying out your request, booking or service agreement.
• Your consent, where consent is required.
• Meeting a legal, accounting or judicial obligation.
• Protecting the rights of Battuta or its customers, people’s safety, and preventing fraud.
• A legitimate interest of Battuta, after weighing your rights and interests, and without relying on this basis for sensitive data where the law forbids it.

Some data may be optional and some may be necessary to complete a booking. Where needed, we will tell you which data is necessary and what happens if you do not provide it.

7. Our AI assistant “Yara”

You may receive automated WhatsApp replies from “Yara”, an assistant that uses artificial intelligence to understand your messages and draft initial replies.

We send our AI technology provider, Anthropic (the Claude model), the messages and data needed to produce the reply, under our approved contracts and settings. We do not send Yara data it does not need to reply, we do not send it receipt or car photos, and we avoid sending card details, documents or unnecessary sensitive data.

Pricing and Yara’s role

Battuta uses an automated system that applies pre-approved pricing rules and fees: we collect offers from the drivers available for your trip, then Battuta’s service fee is added according to fixed rules that Battuta sets in advance.

Yara does not set pricing rules, choose an amount on its own or change the approved rules. Yara may calculate the total quote automatically from the details you give us, such as the type of service, date, destination and number of people.

The price is shown to you before the booking is confirmed or any payment is made. You can ask for the quote to be reviewed or to speak to a member of staff. Battuta does not rely on Yara’s output alone to make a final independent decision to refuse a customer or take adverse action against them. A bank transfer is approved by a member of staff; a card payment confirms the booking automatically once the payment gateway confirms a successful payment of the deposit amount.

Battuta does not use customer conversations to train general AI models without first establishing a legal basis, giving appropriate notice and obtaining consent where required. Under Anthropic’s commercial terms, data sent through its API is not used to train its models.

8. Sharing data with the driver or service provider

We share with the driver or service provider who will carry out your trip the minimum data necessary, which may include:

• Name.
• Contact number.
• Trip date and time.
• Pick-up place and destination.
• Flight number, when needed.
• Number of passengers.
• Operational requests, such as a child seat.

We share your name and contact number according to our operating process, usually 47 hours before the trip, or as soon as the booking is confirmed if the trip is sooner. Before then, service providers may see operational details not linked to your name or number, as needed to check availability.

We require the driver or service provider to use the data only to carry out the trip, keep it confidential, and not copy it, use it for marketing or contact unrelated to the booking, or share it with anyone unauthorised.

9. Technology service providers

We rely on service providers that process data on our behalf or provide the technical infrastructure we need:

• Meta: to provide WhatsApp and exchange messages.
• Twilio: to carry and manage WhatsApp messages during our pilot phase.
• Anthropic: to run Yara and draft its replies.
• Google: to keep request, booking and conversation records in Google Sheets, and receipts and car photos in Google Drive without public links.
• Netlify: to host the website, run Yara and keep temporary copies of photos for sending on WhatsApp.
• HyperPay: to process card payments of the deposit (mada, Visa and Mastercard).

We update this list when our providers change and share only the minimum necessary with them. Depending on the relationship, we require them to keep data confidential, apply security measures, not use data for unauthorised purposes of their own, notify us of incidents, and return or delete data when no longer needed where possible.

10. Transfers outside Saudi Arabia and Azerbaijan

Your data may be processed or stored in Saudi Arabia, Azerbaijan, the United States or other countries, depending on where our technology providers operate.

When we transfer data outside Saudi Arabia or allow access to it from abroad, we define the purpose, data categories and recipients, comply with the applicable legal requirements and safeguards, apply suitable contractual and technical measures, limit the transfer to the minimum necessary, and carry out a risk assessment when the law requires it.

Transfers to or from Azerbaijan may also be subject to local rules on personal data protection and cross-border transfers. For up-to-date information on our providers, processing locations or safeguards, contact us using the privacy details in this policy.

11. How long we keep data

We keep data for as long as needed for the purpose it was collected for, then delete it or make it no longer identifiable, unless there is a legal basis to keep it or it is needed for a claim, dispute, audit, or accounting or judicial obligation.

In general:

• Incomplete requests: one year from the last contact.
• Completed bookings: one year from the last contact or the end of the trip, whichever is later, unless a legal reason or open claim requires keeping them longer.
• Transfer receipts and accounting records: for the period required by the applicable accounting or legal obligation.
• Yara and WhatsApp conversations: as long as needed to serve the request, handle complaints and prove the booking, then deleted or made less identifiable under our deletion cycle.
• Complaints and claims: until they are closed and no longer legally or operationally needed.
• Temporary photo copies on the website servers: deleted automatically after 30 days.
• Some data may remain in backups until the technical deletion cycle ends, with restricted use and no access for normal operations.

Moving data to an archive does not mean it has been deleted.

12. Information security and breaches

We apply appropriate organisational, administrative and technical measures to protect data, including, depending on the system:

• Limiting access to data to the people who need it.
• Using individual accounts and multi-factor authentication where available.
• Protecting data in transit and at rest by suitable means, including an encrypted connection to the website (HTTPS).
• Never making receipt photos or customer files public; temporary photo links are signed and expire within 15 minutes.
• Reviewing permissions and service providers regularly.
• Training staff and contractors on confidentiality and data protection.
• Keeping records of requests, incidents and corrective actions.

No transmission or storage method is completely secure. If a breach, loss or unauthorised access occurs, we assess the incident immediately and take steps to contain and fix it, and notify the competent authority or affected people when the law requires.

13. Cookies and local storage

The website uses your browser’s session storage (sessionStorage, named battuta_ref) to keep your booking reference temporarily and prevent duplicate requests. It is kept only until you close the page.

The website sets no cookies and uses no analytics or advertising trackers, and its fonts are served from the site itself.

If we add analytics, advertising or other non-essential tracking tools, we will update this policy and provide suitable settings or consent where the law requires.

14. Your rights

Depending on the law and the circumstances, you can ask to:

• Know whether we process your data and for what purpose.
• Access the personal data we hold about you.
• Get a clear, readable copy of your data, where applicable.
• Correct, complete or update your data.
• Destroy data that is no longer needed, subject to legal exceptions.
• Withdraw your consent where processing is based on it.
• Object to or restrict processing where the law allows.
• Have a person review an automatically calculated quote or price.

If you withdraw consent, we may stop the processing based on it. This does not affect processing carried out before the withdrawal, and may mean we cannot complete a booking that needs that data.

15. How to exercise your rights

Send your request by email privacy@battutago.com or WhatsApp +14155238886, and include:

• Your name or the contact details linked to the booking.
• Your booking reference, if any.
• The right you wish to exercise.
• Any details that help us identify the data concerned.

We may ask for reasonable information to verify your identity before acting on the request. We record requests and handle them within the applicable legal time limits. We may refuse or limit a request if fulfilling it would breach a legal obligation, affect someone else’s rights, put data security at risk, or relate to an active booking, claim or dispute, and we will explain why where permitted.

If you are not satisfied with how we handled your request, you can first contact us by email privacy@battutago.com or WhatsApp +14155238886, and you may complain to the competent authority in Saudi Arabia (the Saudi Data & AI Authority, SDAIA) or the competent authority in Azerbaijan, depending on where the processing or the matter took place.

16. Minors

Bookings are made by adults. If you book on behalf of a child, you confirm that you are allowed to provide the required data and will send only the minimum necessary.

We do not ask children to contact us directly, and collect their data only as needed to deliver the service, such as the number of children or their approximate age group when a child seat is needed.

17. Changes to this policy

We may update this policy when our services, technology providers, data processing or legal requirements change. We will publish the new version on this page with its updated date.

If a change is significant and requires new consent, we will ask for it in the appropriate legal way.

18. Contact us

For any question or request about this policy or your personal data, contact us at:

• Legal name: MESAFER ALAMI Digital Marketing Company (limited liability company), operating as Battuta (BATTUTA)
• Commercial registration: 2055146003 (unified no. 7040490901)
• Address: 7245 Al Huda 1 Street, Jubail 35819, additional no. 2650, Saudi Arabia
• Email: privacy@battutago.com
• Official WhatsApp number: +14155238886

For questions about this page or your data, message us on WhatsApp: Battuta on WhatsApp