Who we are and scope
FOXATVs is operated by شركة السنور الأسود للاستثمار, registered in Oman under Commercial Registration 1388378. This policy describes data use for www.foxatvs.com visitors, customers, participants and people contacting our website, WhatsApp, phone, email and official social accounts, booking systems, customer portal and enabled services. The company is the controller determining processing purposes and means. Use of a channel or service does not authorise unspecified purposes.
Data and sources
From customers, participants, authorised representatives or booking providers we collect names, contact details, country, language, age information necessary for verification, booking, vehicle and companion details, payment amounts and status, acknowledgements, consents, correspondence and complaints. Licence or identity details may be recorded where verification is necessary, together with emergency contacts, incident reports and operational photographs. We collect device, IP, session and security logs, and optional browsing data when the relevant tools are enabled under required choices. Conversations include text, files or voice messages supplied by users; any voice transcription is explained before use. Calls are not recorded without notice and consent where required.
Purposes and processing basis
Data supports enquiries, bookings and payment, eligibility checks, adventure organisation and acknowledgements, support and operational notices, delivery of adventure media, security, incident investigation, claims and regulatory duties. Processing necessary for a contract or legal obligation is confined to its applicable scope; explicit, evidenced consent is obtained where required. Optional analytics, marketing and publicity have separate notices, purposes and consents where required. Emergency contact information is not used for marketing.
Operational and marketing communications
Operational messages include confirmation, schedule changes, meeting locations, required payment, safety guidance and adventure media links. We use appropriate customer-selected channels subject to channel rules and required permissions. A new promotional offer is not inserted into an operational message to bypass a customer’s choice.
Offers and news about seasons, adventures and events are sent through WhatsApp, email or SMS only after clear, documented written or electronic marketing consent specifying the selected channels. Personalisation may use language, supplied interests and adventure history within the scope explained at consent. An enquiry, phone number, booking or payment is not marketing consent. Refusing marketing does not prevent booking. Promotions stop immediately and without charge on an opt-out request through “إيقاف”, “STOP”, an unsubscribe link or direct contact. A minimal suppression and consent record is retained to prevent accidental re-enrolment.
Automated chat and artificial intelligence
We may use chat systems and AI assistants to answer enquiries, suggest adventures based on supplied interests, summarise support requests and follow up bookings. We explain the assistant’s automated nature at entry and how to request staff. The provider may process contact information, conversation content and necessary booking data on our behalf under the notice, provider schedule and applicable consents. Chat consent is not a general permission for later sharing.
Sensitive responses concerning eligibility, safety, compensation and complaints are reviewed by appropriate staff. A final participation refusal or damage settlement is not based solely on automated assessment. The assistant does not make medical decisions. Do not send payment card numbers, verification codes, full identity copies or medical reports through general chat; a suitable channel is identified when needed.
We do not permit identifiable customer data to train general-purpose models as part of ordinary chat service. Any separate training project requires assessment, notice, a lawful basis and separate consent where required before it begins. We do not enable a provider whose settings and commitments are inconsistent with this policy.
Providers and data sharing
Sharing is limited to what is needed for a specified purpose with operational staff and guides; booking, CRM, hosting, chat, AI and messaging providers; payment providers; and fulfilment partners identified in the booking. Necessary information may be disclosed to authorities, advisers, insurers or rescue services on a lawful basis. A provider schedule available before processing identifies providers, roles, data categories, purposes and relevant processing locations. Processors are subject to confidentiality, purpose, access, retention and deletion controls, and we oversee our responsibilities for processing on our behalf. We do not sell data or give contact details to partners or sponsors for independent marketing without specific separate consent.
Payments and account protection
Payments are handled by the authorised provider shown at checkout, such as Thawani. We retain necessary transaction reference, amount, status and invoice information, and do not request storage of full card numbers or CVV in booking or chat systems. Login may use email verification or a temporary link depending on the service. Do not share access codes and report suspected unauthorised use.
Children and health information
Data necessary for a minor’s participation is processed with a parent’s or legal representative’s consent as required by law, appropriate authority checks, data minimisation and guardian consent to third-party sharing where required. We do not directly target children with marketing. Activity descriptions and instructions set age requirements; this policy does not authorise driving. Detailed health information is collected only for a specific necessity after satisfying the applicable legal basis and permit requirements, with restricted access, and is not used for marketing or commercial scoring.
Photography, video and adventure media
Separate consent is collected for optional photography and clear consent for promotional publication, with guardian consent for minors where required. Requesting adventure photographs does not authorise commercial publication. Media may be delivered through an external link such as Google Drive with its intended audience and access period explained. Albums exposing participants to one another are not shared without suitable notice and consent; restricted access is used where practicable. Future publicity may be stopped and removal from our channels requested to the extent legally and practically possible. We explain limitations on recalling previously distributed or independently reposted copies. Incident evidence is a separate purpose from promotional photography.
Cookies and tracking
Necessary session, login and security cookies support the service and are explained in privacy settings. Optional measurement and advertising tools, such as Google Analytics and Meta Pixel, are not enabled before a user’s choice where consent is required. Settings allow acceptance, refusal or revision of optional choices without disabling core booking. The tool notice identifies names, purposes, durations and providers. Browser controls may also be used. Continued browsing alone does not establish required consent.
Transfers outside Oman
Some services may involve processing outside Oman. The provider, destination, purpose and data categories are explained before transfer. We obtain explicit consent and satisfy applicable legal requirements where required, assess protection and transfer risks and implement appropriate safeguards before enabling the transfer. Nationality or website use is not consent to transfer to any country. If requirements are not met, we do not enable the transfer and explain alternatives or the impact on service.
Retention and deletion
Data is retained for defined periods proportionate to purpose. Deletion is suspended only for relevant data subject to a legal duty, claim or investigation justifying retention. Signed acknowledgements are separated from identity copies and are not automatically deleted after 30 days. The schedule is implemented following operational and legal approval, including processors and backup cycles. Data is deleted or irreversibly anonymised when no longer needed.
| Category | Baseline retention |
|---|---|
| Bookings, transactions and acknowledgements | 5 years after service ends, unless law requires otherwise |
| Identity/licence copy where a copy is necessary | 30 days after verification and activity completion, unless documented lawful retention is needed |
| Enquiry without booking | 12 months after last contact, then deletion or anonymisation |
| Incident, dispute or claim | Until resolved and applicable retention/claim periods expire |
| Marketing and suppression records | While consent and need remain; minimal suppression record after opt-out |
| Media and technical records | Period disclosed at delivery or in tool notice, with periodic review |
Your rights and requests
You may request access, a copy, correction, updating, deletion or blocking, withdrawal of consent and transfer where applicable, or object to unlawful processing. Contact info@foxatvs.com or +968 77280007 marked “Privacy request”. Identity checks are proportionate. We respond within the applicable legal period and explain any lawful reason preventing all or part of the request. Withdrawal does not invalidate earlier lawful processing and may prevent a service necessarily dependent on the data; marketing withdrawal does not prevent booking. Complaints may be submitted to the competent personal data protection function of Oman’s Ministry of Transport, Communications and Information Technology under its procedures.
Security and incidents
We apply role-based access, account, transfer, storage and backup protections, provider controls and periodic risk review. Absolute security is not promised. Data incidents trigger containment, documentation and notification to the competent authority and affected people when the relevant thresholds and statutory deadlines apply.
New services, updates and contact
Before new processing for an Adventure Passport, rewards or shared services, we explain data, criteria, recipients and correction methods and obtain required permissions. Updating this policy does not automatically expand earlier consent. The version and effective date are published and material changes notified. Contact: شركة السنور الأسود للاستثمار, CR 1388378, www.foxatvs.com, info@foxatvs.com, +968 77280007. The appointed data protection officer’s details are published in the contact notice before this policy takes effect.