All the agreements and policies governing your use of the Wthaiq platform, in one organised place.
Last updated: 1 June 2026
Effective date: 1 June 2026
This Data Subject Requests Policy (the "Policy") governs the mechanism adopted by Wthaiq ("the Platform", "we", "us") for receiving, examining and processing requests submitted by data subjects, in a manner consistent with the applicable laws and regulations.
This Policy explains the rights that data subjects may enjoy, the mechanisms for exercising those rights, and the controls and procedures followed by Wthaiq when handling such requests.
This Policy is to be read together with the Privacy Policy, the Data Processing Agreement (DPA), the Data Retention Policy, the Data Deletion Policy and all other legal documents of Wthaiq.
This Policy applies to all requests relating to personal data processed by Wthaiq in its capacity as:
A data controller.
A data processor on behalf of its clients, within the limits permitted by law and by the contracts concluded with the clients.
This Policy aims to:
When processing data subject requests, Wthaiq undertakes to observe the following principles:
The data subject may submit their request through the channels of communication or the official forms adopted by Wthaiq.
The Platform may update the means by which requests are received at any time.
The applicant may be asked to provide Wthaiq with the information necessary to process the request, including:
Before giving effect to any request, Wthaiq may take reasonable steps to verify the identity of the applicant.
Additional information or documents may be requested where this is necessary to prevent unauthorised access to, modification of, or deletion of the data.
Where a request is submitted by an agent or a representative, Wthaiq may request documents evidencing the authorisation or the legal capacity before processing the request.
Where the law grants them this right, the data subject may request confirmation as to whether Wthaiq is processing their personal data, and obtain a copy of the data, in accordance with the law and the restrictions established therein.
The information provided may include, as the case may be:
Wthaiq may restrict or refuse an access request where this is necessary in order to protect:
The requested information may be provided in electronic form or by any other means that Wthaiq considers appropriate, unless the law prescribes a particular means or the data subject requests another means that is possible and reasonable.
Where the personal data is inaccurate or incomplete, the data subject may, where the law grants them this right, request its rectification or completion.
Wthaiq may request information or documents supporting the rectification request where this is necessary to verify the accuracy of the data to be amended.
Wthaiq is not obliged to amend the data if:
Where the law grants them this right, the data subject may request the erasure of their personal data in the cases permitted by law.
Erasure requests are also subject to the Data Deletion Policy and the Data Retention Policy.
Wthaiq may refuse or defer an erasure request where retention of the data is necessary for the purpose of:
Where it is not possible to erase all of the data, a partial erasure may be carried out in respect of the data that can be erased, while retaining the data that the law or a legitimate interest requires to be retained.
Where the law grants this right, the data subject may request the restriction of the processing of their data in the cases specified by law.
Wthaiq shall examine the request in accordance with the circumstances and the applicable legal obligations.
Where the law grants the right to data portability, and where this is technically feasible, the data subject may request to obtain their data in a structured, commonly used format, or request its transmission to another party, where this is possible and reasonable.
Where the law grants them this right, the data subject may object to certain types of processing.
Wthaiq shall examine the objection and balance it against the legal obligations and the legitimate interests on which the processing is based.
Where the processing is based on the consent of the data subject, they may withdraw that consent at any time.
The withdrawal of consent does not affect the lawfulness of the processing carried out before its withdrawal, nor does it affect any processing based on a lawful basis other than consent.
Wthaiq reviews all requests in order to verify:
Wthaiq seeks to respond to requests within the periods imposed by law, or within a reasonable period where the law does not specify a particular period.
In complex cases, the response period may be extended where the law permits, with notification to the applicant where appropriate.
Wthaiq may contact the applicant to request additional information or clarifications where these are necessary to process the request.
Processing of the request may be suspended until the requested information is received.
Where it appears that a request is excessively repetitive, unfounded or abusive, Wthaiq may, to the extent permitted by law:
Where Wthaiq processes personal data in its capacity as a data processor on behalf of one of its clients, requests relating to that data may be referred to the client in its capacity as the data controller, unless the law requires Wthaiq to take direct action.
Wthaiq shall cooperate with the client, to the extent permitted by the nature of the services, in order to assist it in meeting its obligations towards data subjects, in accordance with the Data Processing Agreement (DPA) and the applicable laws.
Wthaiq shall not be liable for the decisions taken by the client in its capacity as data controller in relation to data subject requests, unless the cause of the claim arises from a breach by Wthaiq of its legal or contractual obligations.
No request may be given effect where doing so would prejudice the rights, freedoms or personal data of other persons, or would disclose information that is confidential or protected by law, unless the law permits this.
Wthaiq may amend this Policy where legal, operational or regulatory necessity so requires.
Amendments take effect from the date of their publication or from the date specified therein, in accordance with what the law permits.
If any provision of this Policy is found to be ineffective or unenforceable under the law, this shall not affect the validity or effectiveness of the remaining provisions.
This Policy shall be construed together with the Privacy Policy, the Data Processing Agreement (DPA), the Data Retention Policy, the Data Deletion Policy, the Terms and Conditions of Use and the remaining legal documents of Wthaiq, as an integrated legal framework.
The data subject may submit requests or enquiries relating to their rights through the official channels of communication published on Wthaiq's website.
The Platform may request additional information to verify the identity of the applicant before giving effect to any request.
This Data Subject Requests Policy enters into force as of the date stated at its beginning and remains in effect until it is amended or replaced in accordance with its provisions.
The User or the data subject acknowledges that they have reviewed this Policy, that they understand the rights and procedures relating to data subject requests, and agrees that requests shall be processed in accordance with this Policy, the applicable laws, and consistently with Wthaiq's role as data controller or data processor as the case may be.
This document shall be governed by and construed in accordance with the laws of the Arab Republic of Egypt, and the competent Egyptian courts shall have jurisdiction to determine any dispute arising out of or in connection with it, and any arbitration — if agreed upon by the two parties — shall be conducted within the Arab Republic of Egypt and in accordance with its laws, without prejudice to any mandatory rights afforded to the User under the applicable laws of their country of residence.