Privacy Policy

Effective date: 9 October 2026

1. Who we are

Alshaheed Adventures is the booking site and app for the attractions at Al Shaheed Park, Phase 3, Kuwait City. It is operated by TAS Children's Amusement Games Co. (شركة تي ايه اس لألعاب تسلية الأطفال), a limited liability company registered in Kuwait under commercial registration no. 478546. Its Al Shaheed Park branch is licensed by the Ministry of Commerce and Industry (licence no. 2026/16367) at Al Shaheed Park, Phase 3, Al Soor Street, Hadaeq Al Soor, Capital Governorate, unit B10.

The Alshaheed Adventures apps for iPhone and Android are native apps. They use the same booking system, the same accounts and the same records as alshaheedadv.com, and everything in this policy applies to the website and the apps alike. What the app keeps on your phone is set out under "In the app" in section 2.

The site and the apps were built, and are run for us, by our web agency, Designed Studio (Designed Value Innovation for Project Management), on a server the agency operates.

In this policy "we", "us" and "our" mean TAS Children's Amusement Games Co. ("TAS"). "You" means the person using the site or app.

2. What we collect

Your account

To book you need an account; we offer no guest checkout. When you create one we collect your name, your email address, a password and, optionally, your phone number. The password is stored only as a one-way hash; we cannot read it back.

You can save a "crew" of the people you usually book for, with a name and an optional age for each.

If you ask to reset your password we create a single-use reset link that works for one hour and email it to you.

Your booking

At checkout we collect the booker's first and last name, phone number and date of birth. Email is optional; if you leave it blank we use your account's email address for the order. The booker must be 18 or over, and we check this against the date of birth they give. Phone numbers are stored in a standard form (a Kuwaiti number as its eight digits; other countries with their dialling code) and are how we recognise a returning customer.

For each order we keep the booking reference, the attraction, the date and time, the number and type of tickets, the price, the language you booked in, the payment status and the payment gateway's reference.

Your guests, including children

Guests are named after payment, on the order's waiver page. We email the booker the link to that page as soon as the payment is confirmed. For each guest we collect their first and last name, their date of birth and, for guests aged 18 or over on the visit date, their own email address and phone number. We do not collect contact details for minors. A minor is anyone under 18 on the date of the visit.

The waiver

Every guest needs an accepted participation waiver to enter. The waiver is accepted for each guest on the order's waiver page, after payment. While a guest's waiver is still outstanding, we email the booker a reminder the day before the visit. For each guest we record the time of acceptance and a typed signature: the name typed when accepting. From these records we can produce a signed-waiver PDF for each guest, containing their name, the order reference, their sessions, the time of acceptance, who signed, and the full waiver text.

Payment

We do not take card details. When you pay, you are sent to UPayments, our payment gateway, and you enter your card details on their page, never on ours. We send UPayments the order reference, the amount in KWD, the ticket names and prices, your name, mobile number and email address, and the language you booked in. If you did not give a valid email address, our own inbox address is sent to the gateway in its place, so that gateway receipts still have somewhere to go. From the gateway we keep only its transaction reference, the time of payment and the amount.

In the app, the payment page opens in your phone's own secure browser rather than inside the app. So that we can bring you back to the app afterwards, the address we ask the gateway to return you to carries your booking reference and a signature of ours. It carries nothing about you.

Technical data and cookies

• A session cookie that keeps you signed in. It holds only a random session ID; the session itself is a row in the site's own database, not in our server's memory. The cookie and the session both last up to 30 days from the last time you used the site, and both are renewed each time you use it. They end sooner if you sign out, or if you or anyone else resets your password. Restarting or updating our server does not end them.
• A language cookie that remembers whether you chose English or Arabic, kept for one year.
• Your IP address, used to limit repeated sign-in attempts and to throttle the booking API, and recorded in the web server's standard access logs.
• Server logs that record errors, the fact that an email was sent to your address, and guest names and booking references as each guest is registered with the venue's ticketing system.
• Your basket lives in your browser's local storage (the tickets you have picked, with no personal details) and is cleared when your ticket page loads.
• On your first visit your browser's language setting decides whether you see English or Arabic; nothing is stored until you choose a language yourself.
• The site's fonts are loaded from Google Fonts, so your browser sends your IP address to Google when it fetches them.

Analytics and advertising measurement (website only)

On the website, and not in the app, we use Google Tag Manager to run Google Analytics 4 and Google Ads conversion measurement. They record how the site is used: the pages you visit, the adventures and tickets you look at or add to your basket, the steps of checkout, and a completed purchase with its order reference, its value in KWD and the items bought. These events never include your name, email address, phone number or date of birth. Nothing is measured on our staff and venue pages, on ticket and waiver links, on the payment return pages or on the password-reset link. Google receives these events, your IP address and the identifiers stored in its cookies (see section 9).

Through the same Google Tag Manager we also run the Meta Pixel, for our ads on Facebook and Instagram. We send it these events: a page view; viewing an adventure; adding to your basket, starting checkout and going to the payment page, each with the basket's value in KWD; creating an account; tapping WhatsApp on our private events page; and a completed paid purchase with its value in KWD and its order reference. The events we send it never include your name, email address, phone number or date of birth, the items you bought or a promo code. The pixel also reads, directly from your browser, the full address of the page you are on and of the page you came from, your IP address, information about your device and browser, and the identifiers stored in its own cookies (see section 9). Meta may link a visit to a Facebook or Instagram account used in the same browser, and it uses what it receives to measure our ads and to show them, including to people who have visited the website.

In the app

The app keeps a few things on your phone itself:

• Your language choice and your basket (the tickets you have picked, with no personal details).
• While a payment is in progress, the link it uses to check the payment's result and the items being paid for, in your phone's secure storage. They are removed once the result is known.
• Your sign-in, as the same session cookie described above.

If you allow notifications, the app schedules your booking and waiver reminders on the phone itself, from your bookings. They are not sent through a push-notification service. The app contains no analytics, advertising or tracking software.

At the venue

When staff admit your group at the gate we record how many people were admitted, when, and which staff member did it. Ticket links are signed so they cannot practically be guessed; the ticket page shows the booker's name.

Staff can also issue access passes (for example to pro flyers) that carry the holder's name and, optionally, an email address the pass is sent to.

The waiver you accept also states that the venue is monitored by CCTV for safety and security, and includes a release allowing photographs and recordings taken during your visit to be used for promotional and marketing purposes. This policy covers the site and app; cameras and photography at the venue are governed by the waiver and the venue's own rules.

3. Why we use it, and on what basis

We do not use your name, email address, phone number or date of birth for marketing, and we do not give them to advertising platforms. What those platforms do receive from the website is set out in section 2: usage events and, for a paid purchase, its value and order reference. We do not ask for marketing consent, and none is passed to the venue's systems. The only other marketing-related permission is the photography release in the waiver (see "At the venue" above).

4. Who we share it with

• UPayments, our payment gateway: the details listed under "Payment" in section 2.
• Semnox Parafait, the venue's ticketing and gate system, for Snow Fun, Sky Tunnel, Ice Rink and Karting sessions and for Outdoor Fun activities. For every booking we create a transaction in Parafait carrying the visit date, the seats and our booking reference; its notes fields carry only fixed codes, never free text about you. Each guest is registered in Parafait as a customer with their name and date of birth; adults with their own email and phone; the booker as the "host" customer with their name, email, phone (taken from their account) and date of birth; minors are linked to the booker as their child; each record is tagged with our order reference; and everyone is attached to the booking so reception sees people rather than seat numbers. When a guest's waiver is accepted, we also record that signing in Parafait against the venue's own waiver, with an image of the typed signature, so the venue's desk and kiosk see the guest as signed. Parafait is run for the venue by Semnox.
• BMI Leisure, the karting race system. For each karting booking we send BMI the booker's name and contact details as the order's contact, with the session booked. Each driver whose waiver has been accepted is then registered for the race with their name and date of birth and, for adults, their own contact details.
• Mailgun, our email provider. Confirmation, waiver-link, reminder, welcome, password-reset and pass emails are sent through Mailgun, from "Alshaheed Adventures <hello@alshaheedadv.com>", so Mailgun receives your email address and the content of each email.
• Our web agency and hosting. Designed Studio runs the site on a virtual server rented from DigitalOcean, in DigitalOcean's Frankfurt data centre in Germany. The site's database, its logs and its backups are held on that server, so this data is stored outside Kuwait. The agency's engineers can access the database and logs in order to operate the site.
• Google Fonts receives your IP address when the fonts load.
• Google Analytics and Google Ads, through Google Tag Manager, receive the website usage events described under "Analytics and advertising measurement" in section 2, your IP address and the identifiers in their cookies. Nothing from the app is sent to them.
• Meta Platforms (Facebook and Instagram), through the Meta Pixel in Google Tag Manager, receives the website events described under "Analytics and advertising measurement" in section 2, together with what the pixel reads from your browser: the page address and the address you came from, your IP address, device information and the identifiers in its cookies. Nothing from the app is sent to it.
• Our own staff use a back office where they can search customers and bookings and export a booking report that includes the booker's name and phone number; gate staff can only scan tickets.

Google and Meta may process what they receive outside Kuwait.

We do not sell your data, and we share it with no one else.

5. How long we keep it

These are TAS's retention periods. When a period ends, the records are deleted. The site does not yet delete them automatically; it will before the first period ends.

• Booking, order and payment records: 10 years.
• Guest and waiver records, including minors' details: 5 years.
• Server access and security logs: 12 months at most. Today the web server keeps its access logs for 14 days.
• Records related to an active dispute, incident, chargeback, investigation or legal claim: kept until the matter is resolved and any applicable legal retention period has expired.
• Account data: kept while your account is active. After you delete your account, your personal account data is deleted or anonymised within 30 days, unless the law requires us to keep it. On this site it happens at once: we deactivate the account and keep the booking records. The account row itself stays, but your email address is replaced with an unusable one, your phone number and name are removed, your password is replaced with a value nothing can sign in with, your saved crew is deleted outright, and any reset link you had is destroyed. The email address you gave at checkout is replaced with that same unusable address on every booking that carried it, because the address you signed up with is freed for a new account and must not become a way in to your old orders. The bookings, orders, payments, guest records, waiver signatures and venue-system links are not deleted at once: TAS must keep them for legal, accounting, audit, security and regulatory purposes, for the periods above. TAS's policy is to remove or anonymise personal identifiers on them where reasonably possible; today the name and phone number you gave at checkout stay on those bookings, because they are what the venue's attendance figures and the sales records are built from. They are the venue's record of who came through the gate and the record of what was sold, and your old email address will not reach them. See section 6.
• Unpaid orders: the seats are released after 15 minutes; the record stays, marked expired.
• Password-reset links: expire after one hour.
• Sign-in sessions: each one is a row in the site's own database. It is deleted 30 days after you last used the site, and sooner if you sign out or if your password is reset. Restarting or updating our server does not end it.
• Database backups: the whole database is copied nightly and each copy is deleted after 30 days. A further copy is taken each time the site is updated, and is kept on the same server. Because sign-in sessions are rows in that same database, a backup contains the live sessions of the moment it was taken as well as the account and booking records.
• Venue-system call logs: one file per day for each system, recording the calls we make to the venue's ticketing system and to the karting race system. Names, dates of birth, email addresses and phone numbers are redacted from them before they are written (see section 8); booking references do appear. The site does not delete these files automatically.

6. Your rights

You can, at any time:

• See your bookings and orders in My account.
• Correct your name and phone number there, and add, edit or remove saved crew.
• Remove a guest from an order before that guest's waiver has been accepted.
• Limit the website measurement and advertising described in section 2: block or delete cookies in your browser's settings, and use the ad settings in your Google, Facebook and Instagram accounts to control how your activity on other websites is used to show you ads.

Under applicable Kuwaiti data protection requirements, you may also ask us to:

• Access your personal data.
• Correct or update information that is inaccurate or incomplete.
• Delete your account. You can do this yourself: open My account, then Delete your account, read what is deleted and what is kept, and confirm with your password. You are signed out on every device as soon as it is done, and the email address becomes free for a new account. What happens to your data is set out in section 5: the account is deactivated and de-identified, and the booking, order, payment, guest and waiver records are kept. Deleting your account explains the same thing on a page you can read without signing in, and if you cannot sign in, contact us as in section 11 and we will do it for you. Deleting your account here does not remove the records already held in the venue's ticketing system or the karting race system; to ask about those records, contact us as in section 11.
• Withdraw your consent, where we rely on your consent to use your data.
• Know why we collect and use your personal data: the purpose it is collected and processed for.

These requests are subject to TAS's legal, accounting, security and regulatory retention obligations (section 5). TAS may verify your identity before acting on a request.

Contact us as in section 11, and we will reply as soon as we can.

7. Children

Booking is for adults: the booker must be 18 or over, and we check this at checkout against the booker's date of birth. We do not check age when an account is created. The booker names their guests and accepts the waiver on behalf of the minors in their care; the waiver makes parents and guardians responsible for their supervision. For minors we collect a name and a date of birth, never their own contact details. Saved crew may include children's ages. When we register a minor in the venue's ticketing system, or as a driver in the karting race system, we send only their name and date of birth, and in the ticketing system we link them to the booker as their child; we send no contact details for the minor.

Where a person is under 18 and consent is required, we obtain it from their parent or legal guardian.

We never knowingly collect data from a child directly. If you believe a child has used the site without an adult, please contact us.

8. Security

• Passwords are stored as bcrypt hashes, and sign-in is designed not to reveal whether an email address is registered.
• All traffic to the site is encrypted (HTTPS). The connections to the venue's ticketing system, the karting race system, the payment gateway and our email provider are encrypted too.
• We never see or store card details.
• Payment results are verified server-to-server with the gateway, never trusted from the page you are returned to.
• The calls we make to the venue's ticketing system and to the karting race system are logged so we can prove what was sent, but the people in them (names, dates of birth, email addresses and phone numbers) are written to those logs as a redaction marker instead of their contents, and no access token or password is ever written. What stays is the method, the path, the status, the timing and the booking reference.
• The site never writes a password-reset token to its own logs and never returns it to the browser that asked for the reset; it travels only in the email. Like any address you open, the link will appear in the web server's access log.
• Sign-in starts a fresh session on every login, is rate-limited, and is protected against cross-site requests. Resetting a password ends every other sign-in for that account, so a phone that was lost or a device that was shared is signed out on its next request.
• Ticket and waiver links are signed so they cannot practically be guessed or forged.
• Secrets live only in a protected file on the server, and the site runs as a low-privilege system user.
• Staff access is role-based: gate staff see only the scanning screens.

9. Cookies

We set these cookies of our own:

On the website, Google's measurement tools also set these cookies:

On the website, the Meta Pixel also sets these cookies. They let Meta recognise your browser from one visit to the next and link a visit to an ad you clicked:

The app sets none of these. We also use your browser's local storage for your basket: ticket selections only, no personal details.

10. Changes

We will update this policy whenever what we collect, or whom we share it with, changes. The effective date at the top shows the current version.

11. Contact

• Email: hello@alshaheedadv.com

This is also the address for privacy questions and for the requests described in section 6.