All the agreements and policies governing your use of the Wthaiq platform, in one organised place.
Last updated: 1 June 2026
Effective date: 1 June 2026
This Data Processing Agreement (the "Agreement" or the "DPA") forms an integral part of the Terms and Conditions of Use, the User Agreement and any services agreement concluded between Wthaiq (the "Processor") and the Customer (the "Controller") where Wthaiq processes personal data on behalf of the Customer.
The purpose of this Agreement is to regulate the processing of personal data in accordance with the applicable laws and regulations, including, where applicable, the General Data Protection Regulation (GDPR), the Saudi Personal Data Protection Law (PDPL), the Emirati legislation relating to data protection, and any other applicable laws.
This Agreement applies where Wthaiq processes personal data on behalf of the Customer in the course of providing the services, whether the processing is carried out directly or through approved sub-processors.
For the purposes of this Agreement, the following terms shall have the meanings set out against each of them:
Processing: any operation carried out on personal data, whether by automated or non-automated means, such as collection, recording, organisation, storage, use, transfer or erasure.
Personal data: any information relating to an identified or identifiable natural person, in accordance with the applicable law.
Sub-Processor: any third party engaged by Wthaiq to process personal data on behalf of the Customer.
Personal data breach: any incident leading to the destruction, loss, alteration or disclosure of personal data, or to unauthorised access to it.
If a conflict exists between this Agreement and any other document governing the processing of data, priority shall be given to this Agreement in relation to the processing of personal data, unless the law requires otherwise.
Wthaiq processes personal data on behalf of the Customer for the purpose of providing the digital services requested by the Customer, including the creation of documents, their management, electronic signature, the retention of records, and any other services provided by the system.
The processing of the data continues throughout the period during which the services are provided, or throughout any additional period required by the laws, the contractual obligations or the data retention policies.
The processing may include, depending on the service used:
The personal data processed may include, depending on the nature of the Customer's use:
Wthaiq processes personal data solely on the basis of the documented instructions issued by the Customer, unless the law requires otherwise of it.
In that case, Wthaiq shall, if the law so permits, inform the Customer before carrying out the processing.
The Customer acknowledges that it is responsible for:
Wthaiq bears no responsibility for any unlawful instructions, or instructions contrary to the law, issued by the Customer.
If Wthaiq reasonably considers that one of the Customer's instructions may contravene an applicable law, it may notify the Customer and request clarifications, or suspend the implementation of those instructions until the issue is resolved, without this constituting a breach of its contractual obligations.
Wthaiq, in its capacity as data processor, does not determine the purposes or means of the processing of the Customer's data except within the limits imposed by the nature of the service, the law or the documented instructions issued by the Customer.
Wthaiq undertakes to ensure that the persons authorised to process personal data:
Wthaiq undertakes to implement reasonable and appropriate technical and organisational measures, proportionate to the nature of the data and the risks associated with its processing, with the aim of protecting personal data from:
These measures may include, depending on the nature of the service:
Access to personal data is confined to the persons who need it in order to perform their functions or to provide the services, and to the minimum permissions necessary.
Wthaiq does not use personal data for any purpose falling outside:
Wthaiq may engage sub-processors to provide certain services, such as:
In particular: (a) Wthaiq uses the Google Drive service (Google LLC) to retain an archival copy of the content of the documents which the Customer creates on the Platform, within a limited access scope (drive.file) inside the Google Drive account of the Platform's operator. (b) Wthaiq uses the Didit service for identity verification, and this takes place only where the sender or the signatory requests the activation of an identity confirmation step on a particular document or signature; this includes the processing of an image of the official document (identity card/passport) and face-matching data (biometric data) for the purpose of verifying the identity of the signatory exclusively. The result of this verification is retained linked to the signature record and the document concerned, and is subject to the same retention period applied to the audit log and to signed contracts.
When engaging a sub-processor, Wthaiq undertakes to conclude appropriate contractual arrangements imposing on that processor data protection obligations which are, in substance, no less than the obligations set out in this Agreement, and that to the extent required by law.
Wthaiq may add, replace or remove any sub-processor where operational, technical, security or commercial necessity so requires.
Where appropriate, customers shall be notified, or an updated list of sub-processors shall be published, in accordance with what the applicable laws or agreements provide.
Wthaiq bears no responsibility for the independent acts or failures of external service providers outside the scope of its reasonable control, without prejudice to any responsibility imposed on it by law in its capacity as data processor.
Wthaiq shall provide, to the extent permitted by the nature of the service and in a manner consistent with the law, reasonable assistance to the Customer in responding to data subjects' requests relating to their rights, such as:
If Wthaiq receives a direct request from a data subject relating to data processed by the Customer in its capacity as controller, it may:
The two parties shall cooperate, each within the limits of its role and responsibilities, in order to carry out the obligations relating to data subjects' rights and to comply with the applicable laws.
Wthaiq provides assistance to the extent that is technically possible and commercially reasonable, and is not obliged to take measures that go beyond the nature of the agreed services or that the law imposes on the controller alone.
If Wthaiq becomes aware of the occurrence of a personal data breach affecting the data which it processes on behalf of the Customer, it shall exert reasonable efforts to notify the Customer without undue delay, to the extent permitted by law.
This notification shall not be deemed an admission of liability, of fault or of contractual breach.
Where possible, the notification shall include information such as:
Wthaiq shall cooperate, to the extent reasonable and proportionate to the nature of the service, with the Customer in investigating the data breach and limiting its effects, without prejudice to confidentiality obligations or to the rights of other parties.
Wthaiq or its service providers may process or store personal data in different countries where this is necessary for the provision of the services.
Any transfer of data shall be carried out in accordance with the applicable laws, and using the appropriate legal safeguards where required.
Where the law requires the provision of specific safeguards for cross-border data transfers, Wthaiq may rely on the means permitted by law, including by way of example:
Wthaiq may change the locations of data processing or hosting where operational, security or commercial necessity so requires, provided that compliance with the applicable legal requirements continues.
Upon termination of the services, and based on the Customer's instructions or in accordance with what the service allows, Wthaiq shall, to the extent permitted by law, do the following:
If the retention of certain data is required under a law, a judicial order or a regulatory obligation, Wthaiq may retain it throughout the period necessary for that purpose, while continuing to apply the appropriate security measures.
Wthaiq may provide the Customer with the reasonable information which demonstrates its compliance with its obligations under this Agreement, to the extent that this does not result in a breach of the confidentiality of information, the security of its services or the rights of other customers.
If the law or the agreement concluded with the Customer grants a right of audit, any audit shall be carried out:
Wthaiq may confine itself to providing independent audit reports or compliance certificates where these reasonably achieve the required purpose.
Wthaiq may amend this Agreement where that is necessary in order to comply with the laws, to improve the services or to keep pace with regulatory requirements.
The amendments enter into force from the date of their publication or from the date specified in them, as permitted by law.
The Customer acknowledges that it has read the Data Processing Agreement, has understood the roles and responsibilities prescribed for each of the controller and the processor, and agrees to be bound by its provisions when using Wthaiq's services which involve the processing of personal data on its behalf.
This document is governed by and shall be construed in accordance with the laws of the Arab Republic of Egypt, and the competent Egyptian courts shall have jurisdiction to determine any dispute arising out of or relating to it, and any arbitration — if agreed upon by the two parties — shall be conducted within the Arab Republic of Egypt and in accordance with its laws, without prejudice to any mandatory rights conferred on the User under the applicable laws of his country of residence.