Your data has a purpose and limits.

01Scope and data controller

Formendure Company operates Watad, its website, app and related services, and determines the purposes and means of processing personal data within the platform. For privacy enquiries, contact [email protected].

02Data we process

Account and identity data

• Mobile number, account type and role, account and session identifiers, and activity times.
• Individual or business information you provide, such as your name, legal or trading name, commercial registration, tax number where applicable, address and verification information.
• Supplier information needed for verification and operations, including service areas, statutory documents and bank information shown in masked form in the interface.

Request and transaction data

• Quotation requests, descriptions, quantities, delivery locations and attachments you choose to upload.
• Supplier offers, selections, orders, fulfilment statuses, delivery evidence, disputes and reviews.
• Amounts, payment statuses, financial references, invoices and settlement records. Watad does not store full card numbers or card security codes.

Communication and technical data

• Support messages, attachments you send voluntarily, and operational correspondence with the administration team.
• IP address, request identifiers, error types, security and audit events, and technical information needed to operate the service and prevent abuse.
• A device notification token when external notifications are activated and permission is granted. This processing is not enabled until Firebase and APNs are ready.

03How we collect data

• Directly from you when you register, create your profile, upload a request or document, submit an offer, fulfil an order or contact support.
• Automatically when you use the service, to the extent needed for sessions, security, diagnostics and audit.
• From payment, invoicing, messaging and notification providers when activated, to the extent needed to reconcile the local status with the provider’s result.
• From lawful or trusted verification sources when permitted by law and required for the service.

04Why we use data

• To create accounts, verify mobile numbers and business identity, and manage sessions and permissions.
• To publish quotation requests, match them with suitable suppliers, receive supplier offers and fulfil orders.
• To process payments, settlements, invoicing, refunds and disputes according to the status recorded on the server.
• To provide support, send operational notifications, prevent fraud and abuse, and protect accounts.
• To meet legal, accounting and tax obligations, and document and review sensitive decisions.
• To improve reliability, performance and user experience using aggregated or de-identified data where possible.

05Legal basis for processing

Depending on the circumstances, processing is based on performing a contractual relationship or taking steps at your request, fulfilling a legal obligation, protecting vital interests or rights, a permitted legitimate interest balanced against your rights, or your consent where required. You may withdraw consent for processing based on it. Withdrawal does not affect lawful processing before withdrawal or processing required on another basis.

06Who we share data with

Between order participants

Each party sees only what is needed to complete the order. Suppliers do not see competing offers or buyer contact details before selection. Buyer and supplier dispute messages reach the administration team separately and do not form a shared conversation between the parties.

Service providers

We may process limited data through Cloudflare for website hosting and protection, Oracle or the approved infrastructure provider for service operations, Moyasar for payments, Zoho Books for invoicing, Unifonic for messaging, Firebase and Apple for notifications, and Sentry for crash reporting, only when each service is activated and approved. Providers must apply protection at least equal to the requirements applicable to Watad. They are not given the right to use data for independent purposes unless those purposes are disclosed to you and permitted by law.

Competent authorities

We may disclose data when required by law, in response to a valid request from a competent authority, or to protect rights, prevent fraud or investigate a violation.

Any transfer of data outside Saudi Arabia is subject to the Personal Data Protection Law, its regulations and data transfer controls. Transfers are not made merely for operational convenience.

07Retention and deletion

We retain data for the period needed for its collection purpose, while the account is active, or for periods required by legal, tax, accounting, claims resolution and fraud prevention obligations. Retention varies by record type; we do not apply an inaccurate single period to all records.

When the purpose ends and no retention requirement remains, we delete or securely destroy the data, or permanently remove its association with you. Limited copies may temporarily remain in protected backups until their replacement cycle ends, and are not returned to normal operational use.

Account deletion stops access, revokes sessions and deletes or anonymises eligible data. Only records required by law or to protect rights are retained. See the account deletion page.

08How we protect data

We use role- and ownership-based permissions, encrypted communications, private file storage, short-lived download links, audit logs for sensitive actions, and controls against duplicate actions and status manipulation. We do not log verification codes, passwords, session tokens, card numbers or private file links.

09Your rights and choices

Under applicable law, you may have the right to know the basis and purpose of collection, access your data, obtain it in a clear format, correct, complete or update it, request destruction when it is no longer needed and no retention requirement applies, and withdraw consent where consent is the basis.

To exercise a right, email [email protected] using your registered contact method. We may request appropriate verification to protect the account. If your concern remains unresolved, you may contact the competent Saudi data protection authority through its official channels.

10Data relating to minors

The service is intended for parties legally able to enter transactions or authorised business representatives. Watad does not intentionally seek to collect minors’ data. If you believe a minor’s data was submitted without an appropriate basis, contact us so we can review it and take lawful action.

11Updates and contact

We may update this policy when the product, legal requirements or service providers change. We publish the new version and effective date, and request fresh consent where required. Material changes are not applied retroactively on an impermissible basis.