Scope and legal framework
The WAFQ platform ("the platform") is committed to protecting its users' personal data under the Personal Data Protection Law issued by Royal Decree No. (M/19) dated 9/2/1443 AH and its Implementing Regulations.
This policy explains how your personal data is collected, processed, stored and protected when you use the platform's services, including digital services and the Raje service (government transaction follow-up).
By using the platform, you confirm that you have read this policy and agree to your data being processed under it.
Personal data we collect
We collect the following personal data on a clear legal basis (the data subject's consent or performance of the service contract):
Registration data:
- Full name, email address and mobile number
- Date of birth (optional)
- Profile picture (optional)
Provider data:
- National ID or residence number, and an image of the ID document, reviewed manually by the platform team
- City, specialization, experience and bio
- Commercial registration (for businesses)
- Bank account details (IBAN) and the document that proves them, for payouts
Transaction data:
- Order details and financial transaction history
- Documents and files uploaded to perform services
- Content of conversations in the messaging system
Technical data collected automatically:
- IP address, browser type, operating system and device, for each sign-in session
- Cookies needed for the session (see the cookies section)
Legal basis for processing
We process your personal data on one or more of the following legal bases under the Personal Data Protection Law:
Performance of the contract:
- Processing your orders and connecting you with providers
- Processing payments and transfers through the escrow system
- Managing your account and contacting you about your orders
Explicit consent:
- Any processing beyond performing the service, such as promotional messages or sharing your data with a third party for anything other than the service, happens only with your consent
Legitimate interest:
- Tracking technical errors to fix them and improve the platform's performance
- Detecting fraud and protecting the security of accounts and the platform
Legal obligation:
- Responding to the requirements of regulatory and judicial authorities in the Kingdom
- Complying with anti-money-laundering and anti-fraud requirements
- Keeping accounting and financial records under the applicable laws
Security measures
We apply the following measures to protect your personal data:
- Encrypting the connection between your browser and the platform (HTTPS)
- Storing passwords hashed with bcrypt, so no one can read them, not even the platform team
- Role-based permissions: only the admin account can reach the admin tools
- Recording sensitive operations in an audit log, such as sign-ins and failed attempts, password changes, payments and withdrawals
- Temporarily blocking sign-in after repeated failed attempts
- Not storing card details, which are entered on the payment gateway's page
If your personal data is breached, we notify the competent authority and you as the law requires.
Data retention
We keep your personal data for as long as needed for the purpose it was collected for, or as the law requires:
- Account, order and file data: for as long as your account exists
- When you ask to delete your account: your sessions end at once, and we delete or anonymize your personal data after 30 days, except what the law requires us to keep
- Financial and accounting records: for the period the law requires
- You can ask by email to delete specific data sooner, and we do it unless a legal obligation prevents it
Your rights
The Personal Data Protection Law gives you the following rights, and we are committed to letting you exercise them:
Right to be informed:
- To know the purpose of collecting your data and the legal basis for processing it
Right of access:
- To get a copy of the personal data we hold about you, in a readable electronic format
Right to correction:
- To edit your data from your account settings, or ask us to correct what you cannot edit
Right to destruction:
- To ask for your personal data to be deleted when the purpose of collecting it no longer applies, subject to legal obligations that may require keeping it
Right to withdraw consent:
- To withdraw your consent to processing at any time, without affecting the lawfulness of processing before the withdrawal
To exercise any of these rights, email us at the address at the bottom of the page. We answer your request within 30 days of receiving it.
Minors' data
The platform is intended for people aged 18 or over, and we do not knowingly collect personal data from minors.
If we find that we have collected data from someone under the legal age, we will delete it and close the related account.
If you are a guardian and believe a minor in your care has created an account on the platform, please contact us so we can take the appropriate action.
Changes to this policy
We may update this policy from time to time to follow changes in the law or in the platform. We publish every change on this page and update the "Last updated" date at the top; we recommend checking it periodically.
Contact and questions
For any question about this policy or to exercise your rights, email or call us through the channels at the bottom of the page. We answer every request within 30 days at most.
Address: WAFQ platform, Riyadh, Kingdom of Saudi Arabia.