Your data has a purpose and limits

01Who we are and what this covers

Formendure Company (Commercial Registration 7055152826) operates Watad and is responsible for processing your personal data on watadx.com, the Watad app, the web portal at portal.watadx.com and the related services. For anything about your data: [email protected].

02The data we process

Account and business

• Your mobile number, account type and role, your name, and business details such as the trade name, commercial registration, VAT number and addresses.
• Verification documents a supplier or a business uploads, and the bank account details needed to settle a supplier’s dues.

Requests and transactions

• Requests for quotation, their attachments and delivery locations, offers, orders, delivery proof, disputes and reviews.
• Payment amounts, statuses and references. Watad never stores a full card number or its security code; card details are entered with the payment provider directly.

Technical and contact

• Your network address, device and session identifiers, security logs, and error reports carrying only the browser and operating-system family.
• Your location only when you choose it: a point you set on the map, or your current location when you tap “Use my current location”.
• Your messages to support, and the notification token if you turn notifications on.

03Why we use it

• To provide the service: opening the account, verifying the number and the business, matching requests with suitable suppliers, and handling orders, payments, settlements, statements and disputes.
• To communicate: verification codes, service notifications and support.
• To protect: preventing fraud and abuse, securing accounts and investigating violations.
• To meet legal, accounting and tax obligations and lawful requests from authorities.
• To improve the service, using aggregated or de-identified data where possible.

We rely on performing our contract with you, a legal obligation, a legitimate interest that does not override your rights, or your consent where the law requires it. We do not sell your data or use it for targeted advertising.

04Who we share it with

The parties to an order

Each party sees only what the transaction needs. A supplier sees neither competing offers nor the buyer’s contact details before its offer is chosen, and location metadata is removed from request photos before upload. Each party’s messages in a dispute go to the Watad team only.

Service providers

They process data on our behalf, only as their service needs: Cranl hosts the service and its database in the Riyadh region; Cloudflare routes and protects the website and the portal and stores files; Moyasar processes payments; Authentica sends verification codes by WhatsApp; Apple provides the app, Apple Pay and notifications; Google provides the maps on the portal’s location pages.

Authorities

We disclose data when the law requires it, on a lawful request from a competent authority, or to protect rights and prevent fraud.

Transfers outside the Kingdom

Some providers, such as Cloudflare, Google and Apple, may process data outside Saudi Arabia; this follows the Personal Data Protection Law and its regulation on transfers outside the Kingdom.

05Cookies

The web portal uses only the cookies it needs to work: a session identifier (up to 7 days), a browser identifier, and your choices of language, appearance, calendar, digits and the last business you opened (400 days). The page cannot read them, and none is used for analytics or advertising. The public website sets no Watad cookies; Cloudflare may set strictly necessary security cookies to protect it. Deleting them signs you out of the portal and does not affect your account.

06Retention and deletion

• We keep data while your account exists, for as long as tax, accounting and commercial laws require, or until an open claim or dispute ends.
• Error reports are deleted after 90 days; a portal session ends after 60 minutes without activity or 7 days after sign-in.
• When you delete your account, access stops at once and we delete or anonymize your data, except what the law requires us to keep. See account deletion.

07How we protect it

We encrypt connections, store sessions encrypted, limit access by role and ownership, keep files in private storage behind short-lived links after a malware scan, and log sensitive actions. No method guarantees absolute security; if you suspect unauthorized access, tell us at once.

08Your rights

Under the Personal Data Protection Law you may learn how we process your data, ask to access it and receive a copy, correct it, have it destroyed when it no longer has to be kept, and withdraw consent where consent is the basis. Send your request from your registered number or email to [email protected]; we answer within 30 days and may ask you to verify your identity. You may also complain to the Saudi Data and AI Authority (SDAIA).

09Minors

Watad is for people aged 18 or over and for authorized representatives of businesses. We do not knowingly collect minors’ data and delete it when we learn of it.

10Changes and contact

We may update this policy when the service, the law or our providers change. We publish the version and its effective date and tell you in the service about any material change before it takes effect.