Khaleeji Cup 2027 — khaleeji27events.com
Last updated: 28 August 2026
1. Who we are
This website (khaleeji27events.com) is operated by Company Richard Attias and Associates XP, registered at 3884, Al Nakheel District, Riyadh, Kingdom of Saudi Arabia, commercial registration number 7051030976 (“we”, “us”, “our”). We are the data controller responsible for personal data collected through this website.
For any privacy question or request, contact us at info@khaleeji27events.com.
2. Scope
This policy covers personal data collected through this website only. It does not cover:
- Personal data collected at the stadium or event venues, which is governed by the venue operators’ and organisers’ own notices and by the ticket terms and conditions.
- Third-party websites we link to. Once you leave this site, their policies apply.
3. What we collect
We keep data collection to a minimum. This is a single-page informational site.
Information you give us
- Contact enquiries. If you contact us through the site, we collect your name, email address, and the content of your message, together with any other details you choose to include.
- Marketing sign-ups. If you opt in to hear from us, we collect your email address and, where you opt in to WhatsApp or SMS, your mobile number — along with a record of which channels you consented to and when.
- Ticketing and registration. If you register for or purchase tickets to the tournament, the details you submit — name, contact details, nationality and identity document details where required for entry, and payment details — are collected and processed by our ticketing provider
Information collected automatically
- Server logs. Our hosting provider records standard technical information when you visit: IP address, browser type and version, device type, operating system, referring page, and the date and time of your visit. This is used for security, fraud prevention, and keeping the site running.
- Essential cookies. The site runs on WordPress. A small number of strictly necessary cookies may be set to support core functionality and security. We do not use Google Analytics, advertising pixels, or any third-party tracking or profiling technology on this site.
We do not knowingly collect personal data from children under the age of 18 through this website. If you believe a child has provided us with personal data, contact us and we will delete it.
4. Why we use your data, and our legal basis
| Purpose | Legal basis under the PDPL |
|---|---|
| Responding to your enquiries | Performance of a contract or taking steps at your request; our legitimate interest in answering people who contact us |
| Processing ticket registrations and admitting you to the event | Performance of a contract with you |
| Verifying identity and managing venue access and security | Legal obligation; legitimate interest in event safety and security |
| Sending you marketing by email, WhatsApp, or SMS | Your consent, given separately for each channel |
| Maintaining a suppression list of people who have opted out | Legal obligation; legitimate interest in honouring your opt-out |
| Keeping the website secure and available | Our legitimate interest in protecting our systems |
| Complying with Saudi law, including any requirements imposed by the competent authorities | Legal obligation |
We do not use your personal data for automated decision-making that produces legal effects, and we do not sell your personal data.
5. Marketing communications, including WhatsApp
5.1 We only message you if you have opted in
We send promotional and event communications — tournament news, tournament invites, fixture announcements, ticket release alerts, and similar — only to people who have given us prior, specific, and freely given consent to receive them. Consent is collected through an unticked box or an equivalent clear affirmative action at the point where you give us your details. We never pre-tick consent boxes, and we never treat silence, inactivity, or the mere act of buying a ticket as consent to marketing.
Consent is collected separately for each channel. Agreeing to receive email does not opt you in to WhatsApp or SMS, and agreeing to WhatsApp does not opt you in to email. You may opt in to one, several, or none, and you may change that at any time.
Where you opt in to WhatsApp, we also collect and store the mobile number you provide for that purpose. We keep a record of when and how each consent was given, and for which channel, so that we can demonstrate it if asked.
5.2 What WhatsApp messages we send
If you opt in to WhatsApp, we may send you:
- Pre-approved message templates covering tournament invites, tournament announcements, schedule changes, and ticketing information.
- Responses to enquiries you send us on WhatsApp.
We will not send you marketing on WhatsApp outside the categories you consented to, and we do not share your number with sponsors, partners, or any third party for their own marketing.
WhatsApp is operated by Meta Platforms, Inc. When you communicate with us through WhatsApp, your message content and metadata are processed by Meta under its own terms and privacy policy, over which we have no control. Messages are routed through our business messaging provider, Taqnyat, acting on our instructions. If you would prefer not to use WhatsApp, please choose email instead — all essential ticketing and event information is available through other channels, and you will not be disadvantaged.
If you message us on WhatsApp first without having opted in, we will reply to your enquiry, but we will not add you to any marketing list on that basis alone.
5.3 How to opt out
You can withdraw consent at any time, for any channel, and it is as easy to withdraw as it was to give:
- WhatsApp: reply STOP to any message from us, or use the block or “Unsubscribe” option in WhatsApp itself.
- SMS: reply STOP to any message from us.
- Email: click the unsubscribe link at the foot of any marketing email.
We action opt-out requests promptly and in any case within 72 hours. After you opt out we retain a minimal suppression record — your email address or phone number and the date of the request — solely to make sure we do not contact you again. We do not use that record for any other purpose.
Opting out of marketing does not stop service messages we are required to send you about a ticket you have bought, such as entry instructions, venue changes, or safety notices. Withdrawing consent does not affect the lawfulness of any processing carried out before you withdrew it.
6. How long we keep it
- Contact enquiries: 12 months after the matter is closed.
- Ticketing and registration records: retained by us and our ticketing provider for the period required for accreditation, safety, tax, and accounting purposes, generally up to 10 year where financial records are involved.
- Marketing contact details and consent records: until you opt out, or after 24 months of no engagement with our messages, whichever comes first. Consent records are kept for 24 months after consent ends, as evidence that it was validly obtained.
- Suppression records: kept indefinitely, because deleting them would mean we could contact you again by mistake.
- WhatsApp conversation history: 12 months from the last message.
- Server logs: 90 days.
Where we are required to keep records for longer under Saudi law, we do so, and we delete or anonymise personal data once the retention period ends.
7. Who we share it with
We share personal data only where necessary, and only with:
- Service providers acting on our instructions — our website developer and host, our ticketing provider, our email and WhatsApp messaging providers, and IT and security suppliers. They may process your data only for the purposes we specify.
- Tournament stakeholders where required to deliver the event, including the relevant football federations, venue operators, and accreditation bodies.
- Government and regulatory authorities, including law enforcement and the Saudi Data & Artificial Intelligence Authority, where we are legally required to disclose.
- Professional advisers such as auditors and lawyers, under confidentiality obligations.
8. Transfers outside Saudi Arabia
Our website hosting, ticketing, and messaging providers may store or process personal data outside the Kingdom of Saudi Arabia. In particular, WhatsApp messages are processed by Meta Platforms, Inc. on infrastructure located outside the Kingdom. Where that happens, we transfer data only in accordance with the PDPL and its Implementing Regulations, and we put appropriate safeguards in place — including contractual protections requiring the recipient to apply a level of protection no lower than that required in the Kingdom.
You can request details of the safeguards that apply to a specific transfer by writing to info@khaleeji27events.com
9. Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS), access controls, and contractual security obligations on our providers. No system is completely secure, and we cannot guarantee the security of data transmitted over the internet. If a personal data breach occurs that is likely to cause harm, we will notify the competent authority and affected individuals as required by law.
10. Your rights
Under the Saudi PDPL you have the right to:
- Be informed about how and why we process your personal data.
- Access your personal data held by us.
- Obtain a copy of your personal data in a readable and clear format.
- Request correction of data that is inaccurate, incomplete, or out of date.
- Request destruction of your personal data where it is no longer needed for the purpose it was collected for.
- Withdraw consent, where our processing is based on consent.
To exercise any of these rights, email info@khaleeji27events.com. We will respond within the period required by law, normally within 30 days. We may ask you to verify your identity first. There is no charge, unless a request is manifestly excessive or repetitive.
If you are not satisfied with how we have handled your request, you may lodge a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA).
Visitors from the European Economic Area and the United Kingdom. Where the GDPR or UK GDPR applies to our processing of your data, you additionally have the right to object to processing based on legitimate interests, the right to restrict processing, the right to data portability, and the right to lodge a complaint with your local supervisory authority.
11. Changes to this policy
We may update this policy as the tournament approaches and as our processing changes. The current version is always published at this URL, with the “last updated” date at the top. Material changes will be flagged prominently on the site.
12. Contact
Company Richard Attias and Associates XP
Email: info@khaleeji27events.com