All the agreements and policies governing your use of the Wthaiq platform, in one organised place.
Last updated: 1 June 2026
Effective date: 1 June 2026
This document sets out the framework followed by Wthaiq (the "Platform", "we", "us") for compliance with the Personal Data Protection Law issued in the Kingdom of Saudi Arabia ("PDPL") and its Implementing Regulations, to the extent that the Law applies to the personal data processing activities carried out by the Platform.
This document does not constitute an acknowledgement that the Law applies to all users or to all processing operations; rather, it explains the approach to compliance where the Law applies.
This document applies to personal data processing operations that are subject to the Saudi Personal Data Protection Law and its Implementing Regulations.
The applicability of the Law is determined in accordance with the relevant statutory provisions, the nature of the processing, its location, and the persons to whom the data relate.
This document is to be read together with:
In the event of any conflict, precedence shall be given to the mandatory provisions contained in the Saudi Law and its Implementing Regulations, to the extent of the conflict.
The terms used in this document shall have the meanings ascribed to them in the Saudi Personal Data Protection Law and its Implementing Regulations, including:
Where the Law applies, Wthaiq undertakes to observe the statutory principles relating to the processing of personal data, including:
Wthaiq processes personal data in accordance with the appropriate legal basis, which may include, as the case may be:
Wthaiq undertakes to collect only the personal data necessary to achieve the specified purpose, and avoids collecting data for the processing of which there is no legitimate or statutory need.
Wthaiq takes reasonable measures to maintain the accuracy of personal data and to update it where necessary, and the data subject may request the correction of his data in accordance with the Law.
If the Saudi Personal Data Protection Law applies to a particular processing operation, Wthaiq undertakes to respect the rights afforded to data subjects in accordance with the Law and its Implementing Regulations.
The rights may include, as determined by the Law:
The data subject may exercise his rights through the official channels of communication designated by Wthaiq.
Requests are subject to identity verification procedures and to the exceptions and restrictions permitted by the Law.
Wthaiq works to handle requests within the statutory periods, or within a reasonable period where the Law does not specify a particular period, in accordance with its internal procedures and the statutory requirements.
Where the Law applies, Wthaiq undertakes to apply appropriate technical, organisational and administrative measures to protect personal data from:
These measures may include, according to the nature of the service:
Wthaiq undertakes to preserve the confidentiality of personal data, and takes appropriate measures to ensure that the persons authorised to access it are subject to statutory or contractual obligations to preserve its confidentiality.
Wthaiq works to assess and manage the risks relating to the processing of personal data in a manner proportionate to the nature of its services, and seeks to review the security controls periodically in order to improve the level of protection.
If the nature of the service requires personal data to be transferred or processed outside the Kingdom of Saudi Arabia, this shall be carried out in accordance with the controls and requirements laid down by the Personal Data Protection Law and its Implementing Regulations.
No transfer shall be carried out except where the legal basis and the required safeguards are in place, wherever these are applicable.
Wthaiq may engage service providers or sub-processors inside or outside the Kingdom in order to provide certain technical services.
Wthaiq undertakes to conclude appropriate contractual arrangements with such providers, to the extent required by the Law or by the nature of the service.
Wthaiq takes reasonable measures to ensure the continued protection of personal data during its transfer or its processing by service providers, in accordance with the statutory requirements.
If a security incident occurs that affects personal data, Wthaiq deals with it in accordance with its internal procedures, and in a manner consistent with the applicable statutory obligations.
Wthaiq may cooperate with the competent regulatory, judicial or governmental authorities wherever this is required under the Law or pursuant to a binding legal request.
Where Wthaiq processes personal data on behalf of a client, it shall provide, to a reasonable extent, the assistance necessary to enable the client to fulfil its statutory obligations, in accordance with the Data Processing Agreement (DPA).
Wthaiq may retain the records and documents relating to the processing of personal data and to compliance procedures, to the extent necessary to demonstrate compliance with the Law, to defend its rights, or to comply with the statutory requirements.
Where the client is the controller of the personal data, it remains responsible for:
Where Wthaiq acts in the capacity of a data processor, it undertakes to process personal data in accordance with:
Wthaiq shall not bear liability for any breach of the Law arising from:
Wthaiq may review its data protection policies and procedures periodically in order to ensure their continued conformity with the Personal Data Protection Law, its Implementing Regulations, and the best practices appropriate to the nature of its services.
Wthaiq works to promote awareness of the protection of personal data among the persons authorised to process it, through internal policies, guidance or appropriate training, according to the nature of the business.
Wthaiq may update its compliance procedures or its technical or organisational controls if statutory amendments or technical or security developments so require.
Wthaiq may amend this compliance document at any time in order to keep pace with amendments to the Law or its Implementing Regulations or any other regulatory requirements.
Amendments take effect from the date of their publication or from the date specified in them.
This document is intended to explain Wthaiq's approach to compliance with the Personal Data Protection Law.
It does not, of itself, create any additional rights or obligations beyond those laid down by the Law or by the agreements concluded between the parties.
If any provision of this document is found to be invalid or unenforceable under the Law, this shall not affect the validity or enforceability of the remaining provisions.
This document shall be construed together with the Privacy Policy, the Data Processing Agreement (DPA), the Data Subject Requests Policy, the Data Retention Policy, the Data Deletion Policy, and the Terms and Conditions of Use, as an integrated framework for data governance at Wthaiq.
If any provision of this document conflicts with any mandatory provision contained in the Personal Data Protection Law or its Implementing Regulations, precedence shall be given to that mandatory provision to the extent of the conflict.
Users, clients or data subjects may contact Wthaiq through the official channels of communication published on the website for enquiries relating to data protection or the exercise of statutory rights.
This document enters into force as from the date shown at its beginning, and remains in effect until it is amended or replaced.
The User or the client acknowledges that he has reviewed the Saudi Personal Data Protection Law compliance document, and understands that it explains the framework followed by Wthaiq where the Law applies, and that the application of certain provisions depends on the nature of the service, the role of Wthaiq in processing the data, and the applicable statutory requirements.
This document shall be governed by and construed in accordance with the laws of the Arab Republic of Egypt, and the competent Egyptian courts shall have jurisdiction to determine any dispute arising out of or relating to it, and any arbitration — if agreed upon by the two parties — shall be conducted within the Arab Republic of Egypt and in accordance with its laws, without prejudice to any mandatory rights afforded to the User under the applicable laws of his country of residence.