Privacy Policy

This policy explains how Wasla Solutions Ltd (Commercial Registration 1009165241, Riyadh, Saudi Arabia) collects, uses, shares and protects personal data, and the rights you have over it. We follow the Personal Data Protection Law, its Implementing Regulations and the regulations issued under it. The Arabic version of this policy prevails.

1. Scope

This policy covers the personal data of:

Account owners on the Wasla platform and the business staff who use it.
Visitors to Wasla's website and pages, and anyone who requests a quote or contacts us.
Anyone who reaches our sales or support team by WhatsApp, phone or email.

For the data of a business's own customers (for example, the customers a restaurant or shop records in the system), the business is the controller and Wasla is a processor acting on its behalf and only on its instructions, as set out in clause 27 of the Usage Agreement. The business must tell its customers this in its own privacy policy.

2. Data we collect

Data you give us

Account and identity data: name, mobile number, email address and job title.
Business data: business name, type of business, commercial registration, VAT number, address and branches.
User data: names, numbers and permissions of the business's staff, as the account owner adds them.
Billing and subscription data: your plan, the invoices we issue to you and the status of payments. We do not store full card numbers; licensed payment providers process them.
What you send us: your messages, support requests, quote requests and the forms you fill in.

Data created by using the platform

Operating data: orders, sales, invoices, inventory, reports, cashier and shift activity, and anything else the business enters.
System logs: sign-ins and sessions, an audit log of user actions, and the devices linked to the account.
Agreement acceptance records: the version of the document you accepted and its digital fingerprint, the time of acceptance, the verified mobile number, IP address, and device and browser type. We keep them to prove acceptance.

Technical and website data

Device and connection data: IP address, device type, operating system and browser, approximate location derived from the IP address, and error logs.
Cookies and similar technologies: to run the website, measure visits, understand how pages are used and measure the performance of our ads.
Where your visit came from: the page, ad or campaign that brought you, and the ad-click identifier if there is one.

Data from others

Payment providers: the status and result of a transaction, without full card details.
Zakat, Tax and Customs Authority: the results of submitting and validating e-invoices.
Services you connect to your account: such as delivery apps and WhatsApp Business, to the extent the connection requires.

3. Why we process your data, and the legal basis

Providing the service and performing the agreement: creating the account, running the platform and syncing devices and branches, issuing invoices, billing, and technical support.
Legal obligations: submitting e-invoices to the Fatoora platform, keeping accounting and tax records, and responding to competent authorities.
Legitimate interest: protecting the platform and preventing fraud and misuse, proving acceptance of agreements, improving the product through aggregated analytics, and measuring the performance of our website and ads.
Consent: marketing messages, and non-essential cookies where consent is required. You can withdraw consent at any time without affecting what came before.

We do not use your data for purely automated decisions that have a legal effect on you.

4. Who we share data with

We do not sell, rent or share your personal data with anyone to market their products. We share it only as needed with:

Service providers we rely on to operate: cloud hosting and storage, SMS, WhatsApp and email, AI models for the features you use, and analytics and advertising tools. They act on our instructions under suitable confidentiality and protection commitments.
Licensed payment and instalment providers: to complete the payments you request.
Zakat, Tax and Customs Authority: when e-invoices are issued as the law requires.
Government and judicial authorities: where there is a lawful request or legal obligation.
In a merger or acquisition: if Wasla's business or part of it passes to another entity, the data passes with it and stays under equivalent protection.

5. Transfers outside the Kingdom

Data may be hosted or processed by cloud and technology providers inside or outside the Kingdom. We transfer it outside the Kingdom only as the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom allow, with safeguards that ensure an adequate level of protection.

6. How long we keep data

Account and operating data: for as long as the subscription lasts.
After the subscription ends: you have thirty (30) days to export your data, after which it is deleted from our systems.
Inactive accounts: may be closed and their data deleted after ninety (90) days of inactivity and thirty (30) days' notice, under clause 30 of the Usage Agreement.
Backups: kept for seven (7) days, then deleted automatically.
What the law requires us to keep: invoices, accounting and tax records, and agreement acceptance records are kept for as long as the law or the proof of rights requires.
Website visit data: kept for the period set in our analytics and advertising tools.

7. How we protect data

Encryption in transit and at rest.
Fine-grained, role-based access, and an audit log of every action in the system.
A code sent to your mobile to verify sign-in.
Wasla staff access accounts only when authorised and for defined purposes, and that access is logged.
Our staff and service providers are bound by confidentiality.

No system is completely secure. If a breach affects your personal data, we notify the competent authority and you within the periods and procedures the law sets.

8. Messages we send

Service messages: verification codes, invoices, security alerts and subscription expiry. You receive them in all cases because they are part of the service.
Marketing messages: Wasla offers and news, sent only with your consent. You can stop them at any time. Details are in our marketing messages policy.

9. Cookies

Our website uses essential cookies to run it, analytics cookies to understand visits and improve pages, and advertising cookies to measure our ads. You can delete or block them in your browser settings, although parts of the site may not work properly without the essential ones.

10. Your rights

Under the Personal Data Protection Law, you have the right to:

Be informed: know how and why we collect your data, as this policy explains.
Access: see the personal data we hold about you.
Obtain a copy: in a clear, readable format.
Correct: correct, complete or update your data.
Destruction: ask us to delete data that is no longer needed, unless the law requires us to keep it.
Withdraw consent: at any time, for processing based on your consent.

We reply within the period the law sets and may ask you to verify your identity first. You may also complain to the competent personal data protection authority in the Kingdom.

11. Children

Wasla is built for businesses and business owners. We do not knowingly collect data from anyone under eighteen.

12. Changes to this policy

We may update this policy from time to time and will publish the new version on this page with its last-updated date. If a change is material, we will tell you in good time before it takes effect, by email, message or a notice in the platform.

13. Contact us

For any question about this policy or to exercise your rights, email [email protected] or use our contact page.

Wasla Solutions Ltd - Riyadh, Saudi Arabia.