Privacy Policy

This Privacy Policy explains how TCG Con Arabia collects, uses, and protects personal information when you use the website, purchase tickets, submit applications, or contact us.

SCOPE AND CONTROLLER

Who We Are and How to Contact Us

This Policy applies to the TCG Con Arabia website, ticketing services, vendor and sponsor applications, accounts, contact forms, and related digital services. TCG Con Arabia is a subsidiary of Con Arabia and is managed by PL1. For the purposes of the Saudi Personal Data Protection Law, we determine the purposes and means of the processing described in this Policy.

Effective date: 12 July 2026. For privacy questions or requests, contact [email protected] and use “Privacy Request” in the subject line.

INFORMATION WE COLLECT

Visitor, Buyer, and Participating Business Data

We may collect your name, email address, mobile or WhatsApp number, city, country, and language. For ticket purchases, we collect buyer and ticket-holder details, selected event day, order and invoice information, payment status, entry credentials, and scan records.

For vendor and sponsor applications, we may collect business name, commercial registration and VAT details, address, social links, authorized contact information, documents, logos, brand guidelines, and booth or placement information. We also collect account and profile data, communications and support requests, and technical information such as IP address, device type, security logs, referral source, UTM parameters, and enabled advertising click identifiers.

COLLECTION AND USE

Why We Process Data and Our Legal Bases

We collect information directly when you complete a form, create an account, buy a ticket, apply as a vendor or sponsor, contact us, or upload a file. We may also collect technical data automatically through your browser, cookies, and measurement tools, receive payment status from the payment provider, or receive entry data from event scanning operations.

We process data to perform our contract and provide services, operate the event, verify payments, issue tickets and invoices, manage capacity and admission, review applications, assign booths or placements, send notifications, prevent fraud, secure the platform, comply with law, and improve the website. Our legal bases may include contractual necessity, legal obligations, legitimate interests, and consent where required.

PAYMENTS AND INVOICES

We Do Not Store Payment Card Data

Payments are processed by Moyasar or another approved provider displayed during checkout. TCG Con Arabia does not store full payment-card numbers or CVV values. We receive transaction identifiers, status, amount, currency, and reconciliation information needed to confirm orders, match payments, and handle disputes.

We retain purchase-time snapshots of orders, prices, VAT, discounts, billing details, and invoices for accounting, compliance, and protection of the parties' rights. We may provide required information to tax, regulatory, banking, or payment authorities where legally required or necessary to verify a transaction.

DATA SHARING

We Share Only What Is Necessary

We may share the minimum necessary information with hosting and storage providers, email and messaging providers, customer-support services, enabled analytics and advertising providers, Moyasar for payments, invoicing or ZATCA integration providers, event operations contractors, and parties assisting with admission validation or service delivery.

We seek to restrict providers' use of information through appropriate instructions and legal safeguards. We may disclose data to government, judicial, or regulatory authorities, or where necessary to protect rights and safety or prevent fraud. We do not sell personal data. We do not provide contact data to vendors or sponsors for their independent marketing without an appropriate legal basis or consent.

COOKIES AND MARKETING

Responsible Measurement Without Sensitive Data

We use necessary cookies and local storage for sessions, security, language, cart state, and attribution. Where enabled, we may use Google Tag Manager, analytics tools, Meta, TikTok, Snapchat, or similar measurement services to understand performance, attribute campaigns, and deduplicate advertising events. We do not send payment-card data, QR credentials, or uploaded document contents to marketing tools.

You can control non-essential cookies through available consent settings or your browser. Disabling necessary cookies may prevent parts of the service from working. You may opt out of marketing communications through an unsubscribe method or by contacting us, while operational messages about an existing order, ticket, or application may continue.

INTERNATIONAL TRANSFERS

Additional Safeguards for International Processing

Some information may be hosted or processed inside or outside Saudi Arabia depending on the service provider. Where personal data is transferred outside the Kingdom, we apply the requirements of the Saudi Personal Data Protection Law and its Regulations, including necessity and risk assessment, data minimization, and appropriate safeguards such as standard contractual clauses or other approved mechanisms where required.

We will not transfer data where doing so would prejudice the Kingdom's national security or vital interests or violate applicable law. General information about processing locations and applicable safeguards may be requested through our privacy contact channel.

RETENTION AND DESTRUCTION

We Keep Data Only as Long as Necessary

We retain personal data only for as long as needed for the purpose for which it was collected, or as required for legal, accounting, tax, dispute-resolution, security, and rights-protection purposes. Order, invoice, payment, and audit records may be retained for applicable statutory periods, while marketing data and incomplete application data are deleted or anonymized when no longer necessary.

When the purpose and retention period end and no legal obligation, dispute, or security need remains, we securely delete, destroy, or anonymize the information. Limited copies may remain temporarily in protected backups until those backups are replaced under the normal backup cycle.

SECURITY

Practical Safeguards for Personal Information

We use administrative, technical, and organizational safeguards appropriate to the information, including access controls, administrator multi-factor authentication, protection of stored secrets, secure communications, input and upload validation, logging and monitoring, backups, and incident management.

No transmission or storage method is completely secure. If a personal data breach occurs, we assess its impact, contain and remediate it, and notify the competent authority and affected individuals where required. Users remain responsible for protecting login details and for not publishing QR credentials, payment links, or private documents.

YOUR RIGHTS

Access, Correction, Destruction, and Choice

Under the Saudi Personal Data Protection Law, you may have the right to be informed of the legal basis and purpose of processing, access your data, obtain it in a clear and readable format, request correction, completion, or updating, request destruction when it is no longer needed, and withdraw consent where processing is based on consent, subject to legal exceptions and retention obligations.

To exercise a right, email [email protected]. We may request information to verify identity and protect the account. We will handle requests within applicable legal periods and may lawfully restrict or refuse a request with an explanation. You may complain to the competent Saudi data-protection authority if your concern is not resolved appropriately.

CHILDREN AND UPDATES

Guardian Oversight and Policy Updates

The event welcomes families, but children should not create accounts, submit business information, or make payments without a parent or guardian. If a ticket is purchased for a minor, the buyer or guardian must ensure the information is accurate and authorize the processing needed to issue the ticket and provide admission. If we learn that a child's data was collected inappropriately, we will take reasonable verification and deletion steps.

We may update this Policy when services, providers, or legal requirements change. The updated version and effective date will be published on this page, with additional notice for material changes where appropriate. For questions, complaints, or rights requests, contact [email protected].