Sovereignty & Digital Security

Privacy & Data Protection Policy

At RMZOS, we adhere to the highest institutional standards of data protection, banking-grade confidentiality, and compliance with laws of the Kingdom of Saudi Arabia.

Last Updated: April 2026

Compliant with Saudi PDPL Regulations

Encrypted 256-bit Cloud Infrastructure

1. Introduction & Scope

This Privacy Policy describes how RMZOS collects, processes, stores, and protects data and personal information provided by our clients (Hotels, Travel Agencies, and Serviced Apartments) and their guests. Operations comply strictly with the Saudi Personal Data Protection Law (PDPL) promulgated under Royal Decree No. (M/19) and regulations issued by SDAIA.

2. Data We Process

To provide integrated operations for reservations and finance, the platform processes data strictly necessary for hotel and travel management:

Organization & Account Data: Commercial name, CR number, VAT ID, assigned subdomain, and admin credentials.

Guest & Reservation Data: Guest names, national IDs/passports, nationalities, stay dates, and assigned unit numbers.

Financial & Ledger Data: Tax invoices, journal entries, bank transfer reference numbers, and uploaded bank statements.

Rmz AI Inputs: Scanned payment receipts, statement PDFs, and front-desk audio recordings processed to extract structured booking data.

3. Data Sovereignty & Physical Multi-Tenancy

RMZOS operates a strict physical database-per-tenant isolation architecture. Every organization has an independent, physically isolated cloud database instance. Under no architectural condition can data leak across tenants.

Data Isolation & Security: The platform and databases are hosted in secure cloud infrastructure with physical DB isolation per property and comprehensive encryption.

Absolute Ownership: Your organization retains 100% intellectual and legal ownership of all guest, financial, and operational records. We never sell, rent, or monetize your data.

4. Rmz AI Data Security Safeguards

Rmz AI processes incoming documents, audio, and reconciliations through isolated, encrypted APIs:

AI Data Pledge: Your data and guest records are NEVER used to train public or foundational AI models. All operations execute inside private tenant boundaries, and human approval remains mandatory before any entry is finalized.

5. Sovereign Regulatory Integrations

Data is transmitted to authorized sovereign entities only when the client activates the respective integration:

Shomous Security Platform: Automated guest check-in/check-out transmission per Ministry of Interior regulations.

NTMP Tourism Monitoring: Automated synchronization of occupancy rates and ADR with the Ministry of Tourism.

ZATCA E-Invoicing: Generation of compliant XML invoices with QR codes per Phase 2 technical specifications.

6. Encryption, Cloud Defense & Backups

We enforce AES-256 encryption at rest and TLS 1.3 in transit, protected by Cloudflare Enterprise application firewalls. Automated encrypted daily snapshots ensure zero transaction or reservation loss.

7. Data Subject Rights & Contact

You maintain the right to export your complete database in standard formats (Excel/CSV/JSON), modify records, or request account data purge upon termination. For privacy inquiries, reach our Data Protection Officer at:

privacy@rmzos.com

Have Questions Regarding Privacy?

Our legal compliance and data protection team is ready to answer any questions from your enterprise.

Contact Data Protection Team