All the agreements and policies governing your use of the Wthaiq platform, in one organised place.
Last updated: 1 June 2026
Effective date: 1 June 2026
This document sets out the framework followed by Wthaiq (“the Platform”, “we”, “us”) in order to comply, to the extent that the law applies, with the provisions of UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, its Executive Regulations and any amendments or supplementary legislation thereto, in addition to any requirements specific to jurisdictions that apply independent data protection regimes such as the Dubai International Financial Centre (DIFC) or the Abu Dhabi Global Market (ADGM), where applicable.
This document does not constitute an acknowledgement that UAE legislation applies to all Users or to all processing operations; rather, it sets out the approach of Wthaiq where such legislation applies.
This document applies to the personal data processing operations that are subject to the data protection laws in force in the United Arab Emirates, in accordance with the scope of application of those laws.
The applicability of the law is determined according to the nature of the service, the place of processing, the capacity of the parties, and the relevant regulatory requirements.
This document is to be read together with:
In the event of a conflict, precedence shall be given to the mandatory provisions contained in the applicable UAE law.
For the purposes of this document, the terms shall have the meanings ascribed to them in the relevant UAE legislation, including:
Where UAE law applies, Wthaiq undertakes to observe the core principles for the processing of personal data, which include:
Depending on the nature of each processing operation, Wthaiq relies on one of the legal bases permitted by UAE law, such as:
Wthaiq takes care to collect and process only the personal data necessary to achieve the legitimate and specified purposes for which it was collected.
Wthaiq takes reasonable steps to maintain the accuracy of personal data and to update it where necessary, and the data subject may request the correction of their data in accordance with the law.
If UAE law applies to a particular processing operation, Wthaiq respects the rights granted by the law to data subjects, within the limits and subject to the conditions that it prescribes.
The rights may include, depending on the applicable law:
The data subject may exercise their rights through the official means of communication adopted by Wthaiq.
Requests are subject to identity verification procedures and to the exceptions permitted by UAE law.
Wthaiq deals with data subject requests within the periods specified by the law, or within a reasonable period where the law does not specify a particular period, taking into account the nature of the request and the regulatory requirements.
Where UAE law applies, Wthaiq undertakes to implement appropriate technical and organisational measures to protect personal data from:
These measures may include, depending on the nature of the service:
Wthaiq takes reasonable steps to ensure that employees, contractors and persons authorised to process personal data are bound by duties of confidentiality, whether under contracts or under regulatory obligations.
Wthaiq works to assess the risks associated with the processing of personal data on a periodic basis, and to take the appropriate measures to reduce those risks in a manner proportionate to the nature of the services and of the data processed.
If the nature of the services requires the transfer of personal data outside the United Arab Emirates, this shall be carried out in accordance with the requirements and safeguards prescribed by the applicable UAE law.
Wthaiq may rely, as the case may be, on the legal, contractual or regulatory safeguards permitted by the law in order to ensure an appropriate level of protection for personal data when it is transferred across borders.
Wthaiq may engage service providers or sub-processors inside or outside the United Arab Emirates in order to provide technical or operational services.
Where appropriate, Wthaiq undertakes to conclude suitable contractual arrangements with those providers in order to protect personal data.
If a personal data breach occurs that is subject to the requirements of UAE law, Wthaiq deals with the incident in accordance with its internal procedures and the applicable legal requirements.
Where notification is required under the law, Wthaiq makes reasonable efforts to notify the customer, the competent authority or the data subject, according to its regulatory role and the nature of the incident, and within the limits imposed by the law.
If Wthaiq processes personal data on behalf of one of its customers, it cooperates with that customer, to a reasonable extent, in order to assist it in meeting its legal obligations relating to data protection.
Wthaiq may retain the records relating to data processing, data subject requests, security incidents and compliance procedures, to the extent necessary to demonstrate compliance with the law, to defend its rights, or to perform its legal obligations.
If the customer is the controller of the personal data, it remains responsible for:
Where Wthaiq acts in the capacity of a data processor, it undertakes the following:
Wthaiq shall not bear liability for any contravention of UAE law arising from:
Wthaiq may review its data protection policies and procedures on a periodic basis in order to ensure their continued conformity with UAE legislation and with the best practices appropriate to the nature of its services.
Wthaiq works to promote awareness of the protection of personal data among the personnel authorised to process data, through internal policies and appropriate training or guidance, according to the nature of the business.
Wthaiq may update its technical, organisational and security controls and procedures whenever legal requirements or technical or operational developments so require.
Wthaiq may amend this document at any time in order to keep pace with legislative or regulatory amendments or to improve compliance procedures.
Amendments take effect from the date of their publication or from the date specified therein.
This document is intended to explain the approach of Wthaiq to compliance with UAE data protection laws where they apply.
It does not, in itself, create any additional rights or obligations beyond those prescribed by the law or by the agreements concluded between the parties.
If any provision of this document becomes invalid or unenforceable under the law, this shall not affect the validity or enforceability of the remaining provisions.
This document shall be construed together with the Privacy Policy, the Data Processing Agreement (DPA), the Data Subject Requests Policy, the Data Retention Policy, the Data Deletion Policy, and the Terms and Conditions of Use, as an integrated framework for data governance at Wthaiq.
If any provision of this document conflicts with any mandatory provision contained in the applicable UAE legislation, that mandatory provision shall prevail to the extent of the conflict.
Users, customers or data subjects may contact Wthaiq through the official means of communication published on the website for enquiries relating to data protection or to the exercise of the rights prescribed under the law.
This document enters into force as of the date shown at its beginning, and remains in effect until it is amended or replaced.
The User or the customer acknowledges that they have reviewed the UAE Personal Data Protection Law compliance document, and understands that it sets out the compliance framework followed by Wthaiq where UAE legislation applies, and that the application of certain provisions depends on the nature of the service, the role of Wthaiq in processing the data, and the applicable law.
This document shall be governed by and construed in accordance with the laws of the Arab Republic of Egypt, and jurisdiction shall lie with the competent Egyptian courts to determine any dispute arising out of or relating to it; any arbitration — if agreed upon by the two parties — shall likewise be conducted within the Arab Republic of Egypt and in accordance with its laws, without prejudice to any mandatory rights afforded to the User under the applicable laws of their country of residence.