Privacy Policy

1. The Three Roles

• The Company is the controller of Center account and billing data, and the processor of children’s data on behalf of the Center.
• The Center is the controller of children’s data (name, health information, photos, attendance). It decides what is entered and why.
• The guardian grants child-specific consents (photos, trips, medication handover, emergencies) and holds the rights in Section 10 below.

2. Data We Process

• Account data: name, phone number, email, in-app role.
• Basic child data: name, date of birth, attendance/pickup records.
• Sensitive (health) data: allergies, medical conditions, medications, blood type. These are treated as sensitive data requiring the guardian’s explicit consent.
• Photos: of the child, per the guardian’s consent and its scope.
• Messages: in-app communication between Center and guardian.
• Subscription and billing data: Center’s commercial data, subscription statement data, payment records.

3. Purposes

Providing Wasl App to the Center and enrolled families’ guardians; managing the account and subscription and issuing the subscription statement; operational communication between Center and guardian; keeping the Center’s operational records (attendance, health, consents); technical support; and compliance with applicable law; and marketing messages and offers, after obtaining your independent consent specifically for this purpose (see Section 12).

4. Legal Basis and Consent

Ordinary data processing rests on performing the contract with the Center and delivering the service. Processing of sensitive data (health, photos) rests exclusively on the guardian’s explicit consent. Legitimate interest is never used as a basis for sensitive data, consistent with the PDPL Implementing Regulation. Each purpose has its own consent, withdrawable at any time via the channels below, without affecting the lawfulness of prior processing.

5. Who We Share Data With

We do not sell your data or use it for marketing beyond providing the service without consent. Data is shared only with: cloud infrastructure providers (hosting and running the app) and notification-service providers, under a contractual obligation to protect data and process it only to provide our service.

6. International Data Transfer

Part of your data may be processed by specialized cloud-infrastructure providers whose operations may include processing outside the Kingdom of Saudi Arabia, under appropriate contractual safeguards. This arrangement is under continuing review as part of the compliance plan, including a future in-Kingdom hosting option.

7. Retention and Deletion

We retain your data for as long as needed to provide the service, and thereafter for as long as applicable law requires (e.g., accounting and zakat records). When the relationship with a Center ends or deletion is requested, personal data not legally required to be kept is destroyed without undue delay.

Financial-ledger exception: the app keeps an append-only financial ledger (corrections are reversing entries, never deletion of the original entry), consistent with accounting/zakat record-keeping requirements, and independent from personal-account deletion.

8. Security Measures

• Independent privacy per organization: no Center can see another Center’s data.
• Role-based access: each user reaches only what their role permits within their Center.
• Restricted access to children’s data: child data and photos are reachable only by authorized Center staff and the family’s account, per granted permissions and consents.
• Clear audit trail for changes to sensitive data.
• Encryption in transit between the app and servers using modern standards.

9. Breach Notification

In the event of an incident affecting your data, the Company commits to notifying the competent authority (SDAIA) within 72 hours of becoming aware, and notifying you without undue delay if the incident may cause you harm, describing scope, risks, and measures taken. If the incident affects data connected with the e-store, the Company also commits to notifying the Ministry of Commerce within three business days of becoming aware, under e-commerce regulations, a separate obligation from the SDAIA timeline above, not a substitute for it.

10. Your Rights

You have the right to: know how your data is processed, access it, request a copy, correct it, request its destruction, and withdraw consent at any time. To verify and process your request, contact us via the channels below. We aim to act on your request without delay, and in any case within the statutory period set by the PDPL Implementing Regulation for rights requests (typically 30 working days, extendable once by a similar period with notice to you).

To submit a request (including account deletion or exercising any of the rights above) or to file a complaint without logging in, use the requests-and-complaints page; you will get a request number on submission to follow up with.

Requests & complaints page

11. Children’s Data

Processing a child’s data rests on the guardian’s consent. A child never holds an independent account in Wasl App and never has login credentials of their own; registration and account use are restricted to adults (the Center, its staff, and guardians). The source of a child’s data is their guardian: the guardian provides the data and grants documented explicit consent for each processing purpose, and Center staff (acting on the guardian’s behalf and on the basis of that consent) record it in the system. The Center is the controller of this data and is responsible for its accuracy and purpose. Photos are, by default, available only to the child’s own guardian; any wider availability requires documented, scope-limited consent.

12. Marketing Messages and Offers

The Company does not use your contact data (such as phone number or email) to send marketing messages or offers except after obtaining your consent. This consent is optional and fully independent; it is not a condition for creating the account, for continuing the service, or for using the app, and it is not pre-checked. It is offered to you during account or Center setup via a clear, un-prechecked option ("I agree to receive marketing messages and offers from Wasl"), and one consent covers all communication channels used for this purpose.

You may withdraw your consent at any time from the app’s settings via a clear stop option, in addition to a direct, easy stop option within each marketing message where the channel allows it. On withdrawal, marketing messages stop immediately, and the Company keeps an internal record of the grant and withdrawal of consent for documentation and accountability.

Withdrawing marketing consent does not affect essential service messages (such as security, login, subscription, payment, and operational notices), which continue regardless of your marketing consent.

13. Cookies and Similar Technologies

The website may use essential local-storage technologies to run the page and remember language preference, not for advertising tracking.

14. Updates to This Policy

This policy may be updated as the service or applicable law evolves; the last-updated date will appear at the top of the page.