Skip to content
Archived version, not the version in force today

Privacy policy

Version 25 September 2026

View the version in force today All documents in this version
Digest of this document · SHA-256
9a9f25627898c1febbe3515eeaadad2ef406e9db8fe2be680acb6fb05f472863
Note: This English text is provided for convenience only. The Arabic version is the authoritative and binding text; in the event of any discrepancy or conflict of interpretation, the Arabic text prevails.
Date of issue: 1 June 2026Date of entry into force and effect: 1 June 2026Last updated: 25 September 2026

Last updated: 25 September 2026

Date of entry into force: 1 June 2026

Chapter One: General Provisions

1. Introduction

The Wthaiq platform ("the Platform", "we", "us", "our") welcomes you.

This Privacy Policy explains how Wthaiq collects, processes, uses, stores, discloses and protects personal data and technical data when you use the website, the applications, the electronic signature services or any other service provided by the Platform.

This Policy forms an integral part of the Terms and Conditions of Use, and your use of the Platform constitutes acceptance of the practices described in it, to the extent permitted by the applicable law.

We undertake to handle personal data in accordance with the principles of lawfulness, transparency, data minimisation and information security, and in a manner consistent with the regulations and rules in force that apply to the services we provide.

2. Scope of the Policy

This Policy applies to all personal data and other data processed by Wthaiq upon the use of:

  • The website.
  • The control panel.
  • The document creation services.
  • The electronic signature services.
  • The artificial intelligence services.
  • The applications.
  • The programming interfaces (API).
  • All services associated with the Platform.

This Policy does not apply to websites, applications or services owned by third parties, even if they are linked to the Platform.

3. Acceptance of the Policy

By using the Platform, the User acknowledges that he:

  1. Has read the Privacy Policy.
  2. Has understood how his data is processed.
  3. Has agreed to the practices described in it to the extent that the law requires his consent.
  4. Bears responsibility for providing the Platform with correct and up-to-date data.

In cases where the law requires obtaining express consent for the processing of certain data, such processing shall not take place except after obtaining the required consent or where another legal basis permitting it exists.

4. Definitions

For the purposes of this Policy, the following terms shall have the meanings set out against each of them:

Personal Data: any information relating to an identified natural person or a natural person who can be identified, directly or indirectly.

Processing: any operation performed on data, including collection, recording, organisation, storage, use, modification, transfer, sharing, deletion or destruction.

The User: any person who uses the services of Wthaiq.

The Platform: all websites, applications and systems of Wthaiq.

The Document: any contract, file, agreement or instrument created, uploaded, signed or stored using the Platform.

Electronic Signature: any signature effected through the electronic services provided by the Platform.

Service Provider: any external entity that provides a service assisting the Platform in operating its services.

Technical Data: the data collected automatically upon the use of the services, such as the IP address, the type of browser and device, and usage logs.

Chapter Two: The Data We Collect

5. Data Provided by the User

We may collect the data that the User provides directly upon using the Platform, including:

  1. The name.
  2. The email address.
  3. The telephone number.
  4. The encrypted password.
  5. The company name.
  6. The job title.
  7. The address.
  8. Invoicing data.
  9. Subscription data.
  10. The identity card number or passport number and the type of document, where the User enters it in his account.
  11. Images of the front and back of the identity card, or of the data page of the passport, where the User chooses to verify his account, as set out in Clause 17 bis.
  12. The company’s details and documents, where the account holder requests verification of his company.
  13. Any information the User chooses to add to his account.

The User is not obliged to provide any data that is not required for the provision of the service, unless it is necessary under the law or by the nature of the service requested.

6. Document Data

The Platform may process the data contained in the documents that the User creates, uploads, modifies or signs, including:

  • The names of the parties.
  • Contact details.
  • The contractual clauses.
  • The attachments.
  • The electronic signatures.
  • Any other data the User inserts within the document.

Such data is processed to the extent necessary to provide the service and to carry out the User's instructions.

7. Account Data

Account data may include:

  1. The date of creation of the account.
  2. The status of the subscription.
  3. The account settings.
  4. The login log.
  5. The log of devices used.
  6. The preferred language.
  7. The time zone.
  8. The User's preferences.

8. Data Collected Automatically

Upon the use of the Platform, certain data may be collected automatically, such as:

  1. The IP address.
  2. The type of browser.
  3. The operating system.
  4. The type of device.
  5. The device identifier.
  6. The language.
  7. The pages visited.
  8. The duration of the session.
  9. Access times.
  10. Performance data.
  11. Technical errors.
  12. Security data.

This data is collected for operational, security and analytical purposes.

9. Log Files

The Platform may create electronic logs containing technical information, such as:

  • The time of login.
  • The time of logout.
  • The IP address.
  • The type of browser.
  • The operating system.
  • The operations carried out within the account.
  • Technical errors.
  • Security events.

These logs are used for the purposes of:

  1. Operating the services.
  2. Protecting the security of the Platform.
  3. Detecting fraud.
  4. Investigating security incidents.
  5. Complying with legal obligations.

10. IP Address

The Platform may collect the Internet Protocol address (IP Address) upon the use of its services.

The IP address is used for the following purposes:

  1. Protecting the security of the account.
  2. Preventing fraud.
  3. Detecting intrusion attempts.
  4. Creating electronic signature records.
  5. Improving the performance of the services.
  6. Determining the approximate country in order to show prices in the country's currency and the appropriate payment gateway.
  7. Complying with legal and regulatory requirements.

The country is determined on the Platform's own servers using a local database, so the IP address is not sent to any party for this purpose. Database source: IP Geolocation by DB-IP, under the Creative Commons Attribution licence (CC BY 4.0).

The IP address is not used on its own to identify the User conclusively, and it may differ according to the internet service provider or the network used.

11. Cookies

The Platform uses cookies and similar technologies to improve the User experience, operate the services and analyse performance.

Cookies may be used in order to:

  1. Log in.
  2. Remember preferences.
  3. Improve performance.
  4. Analyse usage.
  5. Protect accounts.
  6. Detect misuse.

The use of cookies is regulated in greater detail in the Platform's Cookies Policy.

12. Device and Browser Data

We may collect information about the device used to access the Platform, such as:

  1. The type of device.
  2. The manufacturer.
  3. The operating system.
  4. The version of the system.
  5. The type of browser.
  6. The screen resolution.
  7. The time zone.
  8. The language.
  9. Other technical identifiers necessary for operating and improving the services.

This data is not used to identify the User directly unless that is necessary for security or legal purposes.

Chapter Three: The Specialised Data Processed by the Platform

13. Electronic Signature Data

Upon the use of the electronic signature services, the Platform may process certain data necessary to provide the service and to evidence the electronic operations, which may include:

  1. The name of the signatory.
  2. The email address of the signatory.
  3. The telephone number, if used in verification.
  4. The IP address.
  5. The time of sending the signature request.
  6. The time of opening the document.
  7. The time of signature.
  8. The time of completion of the signature process.
  9. Device and browser data.
  10. The log of events relating to the signature process.
  11. The means of verification used.
  12. The Timestamp.
  13. The status of the signature process.

This data is processed in order to operate the electronic signature service, improve its security, and create technical records associated with the process.

The retention of this data does not mean that the Platform guarantees the legal validity of the signature in all countries or before all authorities.

14. Artificial Intelligence Data

If the User uses the artificial intelligence services provided by the Platform, the following may be processed:

  1. The Prompts.
  2. The questions.
  3. The texts entered.
  4. The documents sent to the service.
  5. The outputs generated by the artificial intelligence.
  6. The usage data associated with the service.

This data is used to provide the requested service, improve the quality of performance, detect malfunctions, and comply with legal obligations, in accordance with the appropriate legal basis.

The Platform does not use the User's data to train its own artificial intelligence models unless this is expressly stipulated, or it has obtained the necessary consent, or this is permissible under the law.

15. Technical Support Data

Upon contacting the support team, we may collect:

  1. The name.
  2. The email address.
  3. The telephone number.
  4. The account number.
  5. The content of the messages.
  6. The attachments.
  7. The conversation logs.
  8. Technical information relating to the problem.

This data is used to provide technical support, verify requests, and improve the quality of the services.

16. Subscription and Payment Data

If the User subscribes to a paid service, the following data may be processed:

  1. The type of subscription.
  2. The date of subscription.
  3. The date of renewal.
  4. The value of the subscription.
  5. The currency.
  6. The status of payment.
  7. The invoice number.
  8. The payment record.

As a general rule, the Platform does not retain full payment card data where it is processed by approved external payment providers.

Where the User agrees, on the bank's page, to save the User's card for subsequent payments, the bank keeps the card data in its secure vault; the Platform does not retain the card number or the security code, but retains a reference to the card issued by the bank, the card's brand and network, its last four digits, its expiry date and the cardholder's name as entered on the bank's page, in order to display them to the User and to use the card for payment at the User's request. The User may remove the card from the account at any time, whereupon it ceases to be used and the bank is asked to delete its reference. Where the holder of a team account authorises the members of the team to make purchases with the default card in accordance with the Subscriptions and Billing Policy, every such transaction is recorded in the name of the member who made it and the account holder is notified of it.

17. Identity Verification and Biometric Data

When the sender of a document enables the "identity verification" step for a particular document or signature, the Platform engages an external provider specialising in identity verification to check an image of an official identity document (national ID card or passport) and match it against a live image of the signatory's face (Face Match). A live facial image constitutes biometric data within the meaning of the Personal Data Protection Law No. 151 of 2020.

The following provisions govern this processing:

  1. Optional, not mandatory. This step is not applied to every signature; it is carried out only where the sender of the document expressly requests it for that specific document or signatory.
  2. Disclosed to the signatory beforehand. Before the step begins, the signatory is notified that it is required and that it is performed by an external provider; it does not start without an action by the signatory.
  3. The Platform retains only the verification outcome (the decision status), linked to the signature record and the document concerned. The images of the official document and of the face captured during this step are processed by the provider in accordance with its own policy and are not retained by the Platform. This provision is limited to confirming the identity of a signatory for a particular document; the verification of an account by its holder is governed by Clause 17 bis.
  4. Purpose limitation. The purpose is confined to establishing the identity of the signatory for that document. This data is not used for any other purpose, is not used for marketing or for training any system, and is not shared with anyone other than the identity verification provider referred to in this clause and the parties to the document, to the extent necessary to prove the signature. What reaches the parties to the document is the verification outcome alone: it reaches the other party through the "Identity verification" badge in the completion certificate, and it reaches Application Programming Interface (API) clients through the signer.identity_verified event.
  5. Retention period. The retention period for the verification outcome is the same as that applied to the audit log and signed contracts, as set out in Chapter Nine.
  6. Signatory rights. The rights set out in Chapter Ten apply to this data, even where the signatory does not hold an account on the Platform.

17 bis. Account Verification and Identity Checks

An account holder may verify his identity in order to obtain the “Verified identity” badge, and the holder of the main account may, after verifying his identity, request verification of his company in order to obtain the “Verified company” badge. This verification differs from the “identity verification” step set out in Clause 17: that step concerns a particular signatory of a particular document, whereas this verification concerns the account holder himself and remains linked to his account.

The following provisions govern this processing:

  1. When verification is required. Verification is not a condition for creating an account, is not required of team members added to the account, and begins only at the request of the account holder. However, the Platform requires, as indicated in the account, that the identity of the holder of the main account or of his company be verified in order to send contracts for signature: after the sends available before verification have been used up, and from the first time for bulk sending, public signing links and sending with the company’s signature. This requirement does not apply to sending through the application programming interface (API).
  2. The data processed. The identity card number or passport number saved in the account; images of the front and back of the identity card, or of the data page of the passport, which the account holder uploads himself; and the verification outcome together with what the provider reads from the document, such as the name, the date of birth, the document number and the country of issue. For company verification: the company’s name, its country and its commercial registry number, and its tax number, notes and documents where submitted. An identity document may carry data that the law treats as sensitive, such as the religion recorded on some identity cards; such data is processed only within the limits of this clause.
  3. Verification through a third party. Identity verification is carried out through an external provider specialising in identity verification: the account holder is redirected to the provider’s page, where he captures his document, and he may be asked for a live image of his face to be matched against the image on the document; that image constitutes biometric data within the meaning of the Personal Data Protection Law No. 151 of 2020. The images captured at the provider are processed by the provider in accordance with its own policy and are not retained by the Platform; the Platform retains the verification decision and what the provider has read from the document, after stripping both of any image. The Platform does not send the provider the images that the account holder has uploaded to it.
  4. Number matching and prevention of duplication. The Platform matches the document number read by the provider against the number saved in the account, and retains a digital fingerprint of the document number, which it uses to prevent the same document from being verified for more than one account. Where the two numbers differ, where the outcome requires consideration, or where the document is already verified for another account, the Platform’s authorised staff review it before the verification is approved.
  5. Storage of uploaded images and documents. Images and documents uploaded for verification are kept in a closed store on the Platform’s servers that is not accessible through any public link, and they may be viewed only by their owner, by the holder of the main account where their owner is a member of his team, and by authorised review staff when considering a verification request or an outcome that requires review. Every viewing by staff is recorded in the audit log. Embedded metadata, such as geographic location, is removed from images upon upload wherever technically possible.
  6. Purpose limitation. The purpose is confined to establishing the identity of the account holder or of his company, granting the badge, enabling the sending of contracts for signature as set out in paragraph (1) of this clause, and preventing identity impersonation. This data is not used for any other purpose, and is not used for marketing or for training any system. What reaches anyone other than the account holder is the verification status alone, as set out in the following paragraph, not the images and not the document number.
  7. Display of the badge and of the verification status. The badge appears in its holder’s account, and in the signature certificate and on the contract verification page only for contracts that he signs after the verification is approved; it is not added to a contract signed before that. The “Verified company” badge appears on a contract where the account holder has signed it in the name of the same verified company. The sender’s verification status is shown to the person to whom a signature request is sent, in the signing invitation sent by email and on the signing page: “Verified identity” or “Verified company”, or that the sender has not yet verified his identity. The absence of verification is not shown for requests sent through the application programming interface (API), nor where the Platform does not require verification for sending.
  8. Company verification. The Platform’s staff review the company’s details and may contact the account holder to request additional papers, which they add to the request file. Upon approval of the verification, the account becomes a company account under the approved company name.
  9. Legal basis. This processing is based on the explicit consent of the account holder in accordance with the Personal Data Protection Law No. 151 of 2020, which he expresses by an action of his own: uploading the images, submitting the verification request, or starting the verification at the provider. The provisions of Clause 26 on the withdrawal of consent apply to it; withdrawal affects neither the lawfulness of the processing carried out before it nor a badge already established on a contract signed before it.
  10. Revocation of verification. The Platform may revoke the verification where it finds grounds requiring this, and notifies the account holder accordingly. Revocation does not affect a badge already established on a contract signed before it.
  11. The retention period for the images and for the record of the verification outcome is set out in Clause 39, and the rights of the data subject set out in Chapter Ten apply to this data.

18. Data Received from Third Parties

The Platform may receive certain data from external entities, such as:

  1. Login service providers.
  2. Payment service providers.
  3. Verification service providers.
  4. Email service providers.
  5. Text message service providers.
  6. Analytics service providers.

Such data is handled in accordance with this Policy and the applicable laws.

Chapter Four: Purposes of Data Processing

19. Operation of the Services

Personal data is processed in order to operate the services of the Platform, including:

  1. Creating accounts.
  2. Managing accounts.
  3. Creating documents.
  4. Sharing documents.
  5. Carrying out electronic signature operations.
  6. Storing data.
  7. Managing subscriptions.

20. Improvement of the Services

Data may be used to analyse and improve the performance of the services, including:

  1. Developing new features.
  2. Improving the speed of performance.
  3. Fixing errors.
  4. Improving the User experience.
  5. Developing the user interface.
  6. Measuring the use of the services.

Data is used for this purpose in a manner proportionate to the objective, and having regard to minimising data as far as possible.

21. Protection of Security

Data may be processed in order to:

  1. Detect fraud.
  2. Prevent misuse.
  3. Protect accounts.
  4. Detect intrusions.
  5. Protect the technical infrastructure.
  6. Investigate security incidents.
  7. Prevent unauthorised access.

22. Communication with the User

The Platform may use the User's contact data in order to:

  1. Send account notifications.
  2. Send verification requests.
  3. Send signature requests.
  4. Send security notifications.
  5. Respond to support requests.
  6. Communicate regarding subscriptions and invoices.
  7. Send legal notices relating to the service.

Contact data is not used to send marketing messages where the law requires consent and it has not been obtained.

23. Legal Compliance

Personal data may be processed where this is necessary in order to:

  1. Comply with laws and regulations.
  2. Execute the orders of the competent authorities.
  3. Protect the legal rights of the Platform or the users.
  4. Respond to judicial or regulatory proceedings.
  5. Fulfil tax or accounting obligations.
  6. Prevent crimes or fraud.

24. Analytics and Statistics

The Platform may use technical data or aggregated or anonymised data to carry out analytics and statistics relating to the performance of the services, such as:

  1. The number of users.
  2. The use of features.
  3. Technical performance.
  4. Detection of malfunctions.
  5. Measurement of the quality of service.

These analytics are not intended to identify users whenever anonymous or aggregated data can be used to achieve the purpose.

Chapter Five: The Legal Basis for Data Processing

25. The Legal Basis for Processing

The Platform processes personal data on the basis of one or more of the following legal bases, according to the nature of the processing and the applicable law:

  1. Performance of the contract or taking steps at the User's request prior to entering into the contract.
  2. Compliance with a legal obligation.
  3. Protection of the legitimate interests of the Platform, the User or third parties, where the rights and freedoms of the data subject do not override those interests.
  4. The User's consent, where it is required by law.
  5. Any other legal basis permitted by the applicable regulation.

26. Withdrawal of Consent

If particular processing relies on the User's consent, he may withdraw his consent at any time, to the extent permitted by the law.

The withdrawal of consent does not affect the lawfulness of the processing carried out before its withdrawal, and it may also result in the impossibility of providing certain services which by their nature depend on that processing.

27. Data Minimisation

The Platform undertakes, whenever possible, to collect and process the data that is necessary to achieve the legitimate purposes associated with the provision of the services, and it endeavours not to collect data for which there is no operational or legal need.

Chapter Six: Sharing and Disclosure of Data

28. Sharing of Data

Wthaiq does not sell the personal data of users.

Personal data is not shared except within the limits necessary to provide the services, comply with the law, or protect legitimate rights and interests, and in accordance with what is set out in this Policy.

29. Service Providers

The Platform may share certain data with independent service providers who assist it in operating its services, including by way of example:

  1. Cloud hosting providers.
  2. Database providers.
  3. Email service providers.
  4. Text message service providers.
  5. Electronic signature service providers.
  6. Identity verification service providers.
  7. Artificial intelligence service providers.
  8. Analytics service providers.
  9. Payment service providers.
  10. Technical support service providers.
  11. Information security service providers.

These providers are not permitted to process the data except to the extent necessary to provide the contracted services, and in accordance with the applicable contractual and legal obligations.

30. Legal Disclosure

The Platform may disclose personal data if this is:

  1. Required under the law.
  2. In execution of a judicial order.
  3. In response to a request issued by a competent authority.
  4. Necessary to protect the legal rights of the Platform.
  5. Necessary to prevent fraud, crimes or security threats.
  6. Necessary to protect users or the public from imminent harm, in accordance with what the law permits.

31. Restructuring and Transfer of Business

In the event of a merger, acquisition, restructuring, sale of assets, or transfer of ownership of the Platform or part of its business, personal data may be transferred to the legal successor or the acquiring entity, provided that its processing continues in a manner consistent with this Policy or any subsequent policy providing a comparable level of protection, having regard to what the applicable law imposes.

32. Aggregated and Anonymised Data

The Platform may use or share data from which personal identifiers have been removed, or aggregated data which does not reasonably permit the identification of the User, for the purposes of:

  1. Analytics.
  2. Statistics.
  3. Improving the services.
  4. Studies.
  5. Product development.
  6. Preparing reports.

Such data is not considered personal data once it has become anonymised in accordance with the applicable law.

Chapter Seven: International Transfer of Data

33. Processing of Data Outside the User's Country

Data may be processed, stored or transferred to countries other than the country in which the User resides, where this is necessary to provide, operate or support the services.

Such processing may be carried out by Wthaiq or by its approved service providers.

34. Safeguards for International Transfer

When transferring personal data outside the country in which it was collected, the Platform endeavours to apply the appropriate safeguards as required by the law, and those safeguards may include:

  1. Entering into appropriate contractual agreements with service providers.
  2. Relying on adequacy decisions, where available.
  3. Applying the appropriate technical and organisational measures.
  4. Any other mechanisms permitted by the applicable law.

35. The User's Consent to Transfer

By using the Platform, the User acknowledges that his data may be transferred, stored or processed in other countries if this is necessary to provide the services, having regard to the applicable legal requirements and the appropriate safeguards.

Chapter Eight: Data Protection

36. Security Measures

The Platform applies reasonable technical, administrative and organisational measures intended to protect personal data from:

  1. Unauthorised access.
  2. Unlawful use.
  3. Unauthorised disclosure.
  4. Modification.
  5. Destruction.
  6. Loss.
  7. Misuse.

Those measures may include, according to the nature of the service:

  • Encryption in transit (TLS).
  • Access controls.
  • Backups.
  • Security monitoring.
  • Logging of security events.
  • Review of permissions.
  • Periodic security testing.

37. Limits of Information Security

Notwithstanding the adoption of appropriate security measures, the security of no electronic system or communications network can be absolutely guaranteed.

Accordingly, the Platform does not guarantee that data will be protected from all risks, attacks, intrusions or circumstances beyond reasonable control.

38. The User's Responsibility for the Security of His Account

The User undertakes to maintain the security of his account and his login credentials, and bears responsibility for:

  1. Protecting the password.
  2. Not sharing login credentials.
  3. Using secure devices and networks as far as possible.
  4. Notifying the Platform upon suspicion of any unauthorised use.

The Platform does not bear responsibility for any unauthorised use of the account where it arises from the User's breach of these obligations.

Chapter Nine: Retention and Deletion of Data

39. The Data Retention Period

The Platform retains personal data for a period not exceeding the period necessary to achieve the purposes for which it was collected, or to comply with legal or regulatory obligations, or to protect the legal rights of the Platform or the users.

The retention period may differ according to:

  1. The type of data.
  2. The type of service.
  3. The type of subscription.
  4. Legal requirements.
  5. Accounting or tax requirements.
  6. Cybersecurity requirements.

Website page-visit logs, which comprise the page visited, the referring page, the time and duration of the visit, the IP address, the country, the type of device, browser and operating system, the visitor identifier, and the identifier of the visitor's account where the visitor is signed in, are retained for 365 days from the date of the visit, and are thereafter deleted through a periodic deletion process that the Platform runs automatically.

Images of the identity card or passport that an account holder uploads to verify his account are kept until the verification is approved, and are then deleted. They are deleted earlier whenever the account holder deletes them himself, or upon deletion of the account. Documents submitted to verify a company are kept for as long as the account exists, and are deleted upon its deletion.

The record of the verification outcome, namely its status, its method, the date of its approval or revocation, and the name of the verified company, is kept for as long as the contracts that rely on it are kept, because it forms part of their evidence. Upon deletion of the account, the detailed data is erased from this record, such as the name the provider read from the document, the fingerprint of its number and its last digits, the provider’s decision data, and the commercial registry number and tax number; only what is needed to prove the badge on contracts already signed remains.

40. Deletion of Data

The User may request the deletion of his personal data in accordance with what the applicable laws permit.

Nevertheless, the Platform may retain certain data if its retention is necessary in order to:

  1. Comply with the law.
  2. Perform contractual obligations.
  3. Protect legal rights.
  4. Resolve disputes.
  5. Prevent fraud.
  6. Protect the security of the Platform.

41. Backups

Certain data may remain within backups for a limited period after its deletion from the operational systems, for the purposes of business continuity, data recovery or compliance with security requirements.

Such data is deleted or overwritten in accordance with the backup cycles adopted by the Platform, unless the law requires its retention for a longer period.

Chapter Ten: The User's Rights

42. The Rights of Data Subjects

In accordance with the applicable law, the User may enjoy rights relating to his personal data, including:

  1. The right to know what data is being processed.
  2. The right of access to his personal data.
  3. The right to obtain a copy of his data, where this is legally available.
  4. The right to request the rectification of inaccurate or incomplete data.
  5. The right to request the deletion of data in the cases permitted by the law.
  6. The right to request the restriction of processing.
  7. The right to object to certain types of processing.
  8. The right to withdraw consent where the processing relies on it.
  9. The right to data portability, if the law grants this right.

These rights are not absolute, and they may be subject to exceptions or restrictions determined by the applicable law.

43. How to Exercise the Rights

The User may exercise his rights through the official means of communication provided by the Platform.

The Platform may request additional information to verify the identity of the applicant before executing any request relating to personal data, in order to protect the privacy of users and prevent unauthorised access.

44. The Period for Responding to Requests

The Platform endeavours to process requests relating to personal data within a reasonable period and in accordance with the time limits prescribed by the applicable law.

In the event that the request cannot be executed or is delayed, the Platform may notify the User of the reason for the delay or the refusal if the law permits this.

Chapter Eleven: Compliance with Data Protection Regulations

45. Compliance with the General Data Protection Regulation (GDPR)

If the General Data Protection Regulation (GDPR) applies to particular processing carried out by the Platform, Wthaiq undertakes, to the extent required, to apply the requirements set out in that Regulation.

This may include, according to the case:

  1. Respecting the rights of data subjects.
  2. Applying the appropriate security measures.
  3. Using an appropriate legal basis for the processing.
  4. Applying the necessary safeguards upon the international transfer of data.
  5. Performing the other obligations imposed by the Regulation.

46. Compliance with the Egyptian Personal Data Protection Law

The processing of personal data carried out by the Platform is subject to the provisions of the Egyptian Personal Data Protection Law promulgated by Law No. 151 of 2020 and the decisions issued in implementation thereof, and Wthaiq complies with the requirements it lays down to the extent applicable to the processing, including respecting the data subjects' rights set out in this Policy, applying appropriate security measures, basing every processing on a valid legal basis, and observing the controls prescribed for transferring data outside the Arab Republic of Egypt.

47. Compliance with the Emirati Data Protection Law

If the processing of data is subject to the federal or local laws in force in the United Arab Emirates concerning the protection of personal data, the Platform undertakes to comply with the requirements applicable to it in accordance with the applicable law.

48. Divergence of Legal Requirements

The User's rights and the Platform's obligations may differ according to the country, territory or legal system to which the processing of data is subject.

In the event of a conflict between this Policy and the requirements of a mandatory applicable law, the provisions of that law shall apply to the extent that it imposes.

Chapter Twelve: Children

49. Use of the Service by Children

The services of Wthaiq are not directed at children, and the Platform may not be used by any person who does not have the legal capacity required to use the services, in accordance with the applicable law.

50. Collection of Children's Data

The Platform does not knowingly collect personal data belonging to children where the law requires special consent or prohibits its collection without satisfying the legal requirements.

If it becomes apparent to the Platform that it has collected a child's data in contravention of the law, it will take the appropriate measures to address the matter, including deleting the data where this is required.

Chapter Thirteen: Security Incidents

51. Response to Security Incidents

If a security incident occurs that may affect the confidentiality, integrity or availability of personal data, the Platform shall take the appropriate measures to investigate the incident, limit its effects and restore the services where possible.

52. Notification of Incidents

If the law obliges the Platform to notify the User or the competent authority of the occurrence of a security incident or a data breach, this shall be done within the period and in the manner prescribed by the applicable law.

No notification of the occurrence of a security incident shall be deemed an admission of legal liability for that incident.

Chapter Fourteen: Updating the Privacy Policy

53. Amendment of the Policy

Wthaiq may amend or update this Policy at any time if operational, legal, regulatory or security necessity so requires.

Amendments become effective as from the date of their publication on the Platform or from the date specified in them.

54. Notice of Amendments

Upon making material amendments to this Policy, the Platform shall make reasonable efforts to notify users by the appropriate means, such as email, notifications within the Platform, or publishing a notice on the website.

Continued use of the services after the amendments take effect is deemed acceptance of the Policy in its updated form, to the extent permitted by the law.

Chapter Fifteen: Contacting Us

55. Communication Concerning Privacy

If you have any enquiries, requests, complaints or applications relating to personal data or to the Privacy Policy, you may contact Wthaiq through the official means of communication published on the website.

The Platform may request additional information to verify the identity of the applicant before disclosing any data or executing any request relating to personal data.

56. Entry into Force

This Privacy Policy enters into force as from the date set out at its beginning, and remains in effect until it is replaced or updated in accordance with the provisions of this Policy.

Chapter Sixteen: Advanced Data Protection Provisions

57. The Principle of Data Minimisation

Wthaiq undertakes, whenever possible, to collect and process the minimum data necessary to achieve the legitimate purposes relating to the provision of the services, and works to avoid collecting data for the processing of which there is no operational or legal need.

58. Accuracy of Data

Part of the services depends on the data provided by the User.

Therefore, the User undertakes to provide the Platform with correct, accurate and up-to-date data, and is responsible for updating it upon the occurrence of any change.

The Platform does not bear responsibility for any effects resulting from the provision of incorrect, incomplete or outdated data.

59. Confidentiality of Employees

Authorisation to access personal data is restricted to the employees, contractors or service providers whose work by its nature so requires, and they are subject to contractual or statutory obligations relating to the confidentiality of information and the protection of data.

60. Processing of Data on Behalf of the User

Within the limits of the services provided by Wthaiq, the Platform may process the data contained within the documents or accounts on the basis of the User's instructions and for the purposes of operating the services only.

The Platform does not use that data for purposes other than the provision of the service unless this is required under the law, stipulated in this Policy, or with the User's consent.

61. Sensitive Data

As a general rule, the Platform does not require users to enter sensitive personal data unless this is necessary to the nature of the service.

An exception to this is what the User chooses to provide in order to verify his identity under Clauses 17 and 17 bis, since the image of the face and the identity document may contain sensitive data; such data is processed only with his explicit consent, which he expresses by an action of his own after being notified, and within the limits of the purpose set out in those clauses.

If the User chooses to enter sensitive data within the documents or files, he acknowledges that he has the legal basis necessary for its processing, and bears responsibility for entering and using it.

62. Data Relating to Third Parties

If the User enters personal data belonging to other persons, he acknowledges and warrants that he holds the legal right to share and process that data using the services of the Platform, and that he has obtained any consents that may be required under the law.

The Platform does not bear responsibility for the User's entry of data belonging to third parties without a legal basis.

63. Anonymised Data

The Platform may convert certain data into anonymised or aggregated data such that it does not reasonably permit the identification of any person.

Such data may be used for statistical, analytical, operational or research purposes, or to improve the services.

64. Privacy of Documents

Wthaiq does not claim any ownership of the documents created or uploaded by the User.

Access to those documents is restricted to the limits necessary to operate the services, provide technical support, comply with the law, or on the basis of the User's instructions, or in the other cases permitted under this Policy.

65. Activity Logging

The Platform may log certain activities carried out within the account, including:

  1. Login.
  2. Creation of documents.
  3. Modification of documents.
  4. Sending of signature requests.
  5. Signature operations.
  6. Deletion of files.
  7. Changing of account settings.
  8. Other administrative operations.

The purpose of this is to strengthen the security of accounts, improve the services, and assist in investigating security incidents.

66. Legal Precedence

If any provision of this Privacy Policy conflicts with mandatory requirements imposed by an applicable data protection law, the provisions of that law shall apply to the extent necessary to resolve the conflict, without this affecting the effectiveness of the remaining provisions of this Policy.

Chapter Seventeen: Cookies and Similar Technologies

67. Use of Cookies

Wthaiq uses cookies and similar technologies to improve the performance of the Platform and provide a more efficient and secure user experience.

These technologies may include cookies, browser Local Storage, session identifiers, measurement and analytics tools, and other similar technologies.

68. Types of Cookies

The Platform may use the following types of cookies:

  1. Files necessary for the operation of the Platform.
  2. Security and authentication files.
  3. Files that save the User's preferences.
  4. Performance measurement files.
  5. Analytics and statistics files.
  6. Files that improve the user experience.

The Platform does not use cookies for purposes that require the User's consent unless that consent has been obtained where the applicable law so requires.

69. Control of Cookies

The User may control or delete cookies through the settings of the browser or the device.

Nevertheless, disabling certain files may result in the cessation of certain features of the Platform or a reduction in the efficiency of certain services.

Chapter Eighteen: Third-Party Services

70. Third-Party Websites and Services

The Platform may contain links to or integrations with websites, applications or services owned by third parties.

Wthaiq does not control the privacy policies or practices of those entities, and does not bear responsibility for them.

The User is advised to review the privacy policies of any external service before using it.

71. Infrastructure Providers

The Platform may rely on external service providers to deliver certain functions, such as:

  1. Cloud hosting.
  2. Databases.
  3. Email services.
  4. Text message services.
  5. Payment services.
  6. Artificial intelligence services.
  7. Analytics services.
  8. Backup services.
  9. Information security services.

These providers are selected according to appropriate commercial and technical criteria, with an endeavour to bind them contractually to protect data to the appropriate extent.

71 bis. The named processors and the limits of what reaches each of them

Stating categories of providers in general terms is not sufficient, since some of them receive the title of the document, the other party’s telephone number, or a copy of the document itself. This Policy therefore names them expressly and states the limit of what reaches each of them:

  1. Meta Platforms — where a notification or a signing invitation is sent by WhatsApp, the following passes through the WhatsApp Business interface: the recipient’s telephone number, the signatory’s name, the sender’s name, the title of the document, and the signing link or the verification code. The body of the contract does not pass through it.
  2. Google LLC — where Google Drive archiving is enabled, a copy of the document is uploaded to the Drive account linked to the Platform. The feature is entirely inactive unless that account is linked.
  3. The identity verification provider — where “identity confirmation” is selected for a signatory of a document, or where an account holder verifies his account, the User is redirected to the provider and the verification takes place on the provider’s servers, not on the Platform’s servers. Neither the images of the document nor the image of the face therefore reach the Platform from the provider; only the result of the verification does: linked to the contract in the first case, and accompanied in the second case by what the provider has read from the document, such as the name and the document number. The identity card images that an account holder uploads himself to verify his account are kept by the Platform in accordance with Clause 17 bis, and are not sent to the provider.
  4. The payment gateway — it receives the transaction data and the payment instrument to the extent necessary to carry out the transaction; the card number and the security code are not stored on the Platform’s servers, and where the User agrees to save the card, the Platform retains only what Clause 16 sets out.
  5. Meta Platforms (Meta Pixel) and Google LLC (Google Ads and Google Analytics) — where a visitor to the website consents to the “Advertising and marketing” or the “Usage analytics” category in the cookie window: technical visit data such as the page address, the browser type, the IP address and cookie identifiers, together with the event name, its value, its currency and the order number upon a purchase. They receive no content of any document, no contract name, and no party’s name, email address or telephone number, and they are not loaded on the signing pages, shared documents or the dashboard, as set out in the Cookies Policy.
  6. The artificial-intelligence provider chosen by the User personally — the drafting or review assistance feature operates only with an API key that the User enters from the User’s own account. In that case the text of the document concerned is sent to the provider the User has chosen, subject to that provider’s terms. The feature is disabled unless the User enters that key.

Some of these processors are located outside the Arab Republic of Egypt. Use of the feature associated with each of them therefore entails the transfer of the data set out above outside Egypt within the limits stated, in the manner explained in the international transfer provisions of this Policy.

This list is updated whenever a provider changes or another provider that receives personal data is added.

72. Processing of Data by Third Parties

If data is processed by an external service provider on behalf of Wthaiq, that processing shall be within the limits necessary to provide the service or to fulfil legal or contractual obligations, and in a manner consistent with this Policy and the applicable laws.

Chapter Nineteen: Final Provisions

73. Independence of the Privacy Policy

This Policy constitutes a supplementary part of the Terms and Conditions of Use, and is read together with all the other legal policies published on the Platform.

In the event of a conflict, precedence shall be in accordance with the order determined by the Terms and Conditions of Use, unless the law imposes otherwise.

74. No Waiver

Wthaiq's abstention from exercising any right relating to data protection or to the enforcement of this Policy shall not be deemed a waiver of that right.

No waiver shall be effective unless issued in writing by an authorised representative of the Platform.

75. Severability of Clauses

If any provision of this Policy is found to be unlawful or unenforceable under the applicable law, this shall not affect the validity or effectiveness of the remaining provisions, which shall remain in force to the extent permitted by the law.

76. Survival of Certain Provisions

The provisions relating to information security, data retention, ownership rights, dispute resolution, legal compliance, and the other provisions whose purpose requires their continuation, shall remain in force even after the closure of the account or the cessation of use of the services, to the extent necessary.

77. The Authoritative Language

This Policy may be available in more than one language.

In the event of any difference in interpretation between the language versions, the version adopted by Wthaiq as the official version shall be the reference, to the extent permitted by the law.

78. Acknowledgements

The User acknowledges that he:

  1. Has reviewed the Privacy Policy.
  2. Has understood how his data is processed.
  3. Is aware of his rights relating to personal data.
  4. Has provided the data with which he supplies the Platform correctly, to the best of his knowledge.
  5. Bears responsibility for any data belonging to third parties that he enters into the Platform.

79. Details of the Contact Officer

Wthaiq may designate an officer or a team specialised in privacy and data protection enquiries.

The official means of communication for this purpose are published on the website when available.

80. Updating Contact Details

The User undertakes to keep the contact details of his account up to date so that the Platform is able to send notifications relating to privacy, security or the account when needed.

81. Final Entry into Force

This Privacy Policy enters into force as from the date specified at its beginning, and remains in effect until it is amended or replaced in accordance with its provisions; and continued use of the services of Wthaiq after any update takes effect is deemed acceptance of the Policy in its amended form, to the extent permitted by the applicable law.

Chapter Twenty: Advanced Data Governance Provisions

82. The Principle of Privacy by Design

Wthaiq endeavours, whenever this is technically and operationally possible, to have regard to the principles of data protection and privacy in the design and development of its services and its new features, in a manner proportionate to the nature of the service and the potential risks.

83. Privacy by Default

The Platform adopts, where appropriate, default settings intended to limit the processing of personal data to the extent necessary to provide the service, without prejudice to the essential functions of the Platform.

84. Review of Access Permissions

The Platform periodically reviews the permissions of access to personal data within its systems, with the aim of limiting access to data and restricting it to the persons whose work by its nature so requires.

85. Maintenance of Processing Records

The Platform may maintain internal records relating to personal data processing operations, for the purposes of compliance, risk management, improving governance, and fulfilling legal obligations where necessary.

86. Risk Assessment

The Platform may carry out periodic assessments of the risks relating to information security and data protection, and take the appropriate measures to address those risks in accordance with the nature of the services and the technologies used.

Chapter Twenty-One: Provisions Specific to Artificial Intelligence

87. Data Used with Artificial Intelligence Services

Upon the use of the artificial intelligence services, the User should avoid entering any personal or confidential data that is not necessary to achieve the intended purpose.

The User remains responsible for assessing the nature of the data he chooses to enter into those services.

88. Review of Outputs

The outputs generated by the artificial intelligence services are not considered part of the data verified or adopted by the Platform.

The responsibility for reviewing those outputs before using, sharing or relying on them rests with the User alone.

89. Improvement of the Services

The Platform may use anonymised or aggregated usage data to analyse and improve the performance of the artificial intelligence features, without using the data in a manner that permits the identification of the User, unless there is a legal basis permitting this.

Chapter Twenty-Two: Additional Final Provisions

90. Portability Between Policies

The Privacy Policy is interpreted together with the remaining legal policies of the Platform as an integrated system, and the invalidity or amendment of any policy does not affect the effectiveness of the remaining policies, unless the law requires otherwise.

91. No Sale of Personal Data

Wthaiq does not sell the personal data of users to third parties for monetary consideration.

Any sharing of data takes place in accordance with this Policy and for the legitimate purposes associated with the provision of the services or compliance with legal obligations.

92. No Creation of Additional Contractual Rights

This Privacy Policy is not intended to create contractual rights or obligations beyond what the law imposes or what is expressly stipulated in the Terms and Conditions of Use.

93. Interpretation

The provisions of this Policy are interpreted so as to achieve the protection of personal data, having regard to the nature of the services provided by Wthaiq and the applicable legal requirements.

94. Survival of Certain Provisions

The provisions relating to data retention, legal obligations, responding to the requests of the competent authorities, dispute resolution, and the other provisions whose purpose requires their continuation, remain in force after the termination of the account or the cessation of use of the services, to the extent necessary.

95. Official Means of Communication

Wthaiq adopts the means of communication published on its website as the official means for receiving requests and enquiries relating to data protection and privacy.

96. Updating the User's Information

The User undertakes to update his personal data whenever a change occurs to it, in order to ensure the accuracy of the information associated with his account and to enable the Platform to provide the services and communicate with him correctly.

97. Repetitive or Unjustified Requests

The Platform may, to the extent permitted by the law, refuse, postpone or impose reasonable fees on requests that are excessively repetitive or unjustified, or that are shown to involve an abuse of the rights relating to data protection.

98. Identity Verification Before Disclosure

The Platform may request additional information or documents to verify the identity of the applicant before executing any request relating to personal data, in order to protect the privacy of data subjects and prevent unauthorised disclosure.

99. Application of the Policy

This Policy applies to all data processing operations carried out by Wthaiq as from its date of entry into force, unless the law requires the application of different provisions to particular processing.

100. The Official Version

Wthaiq maintains the official updated version of the Privacy Policy on its website, and it shall be the authoritative reference in the event of a difference between versions published in other places.

101. Final Acknowledgement

By using the services of Wthaiq, the User acknowledges that he has reviewed this Privacy Policy, has understood how his personal data is collected, used, disclosed and protected, and consents to its processing in accordance with the provisions of this Policy and to the extent permitted by the applicable law.

Governing Law and Jurisdiction

This document shall be governed by and construed in accordance with the laws of the Arab Republic of Egypt, and jurisdiction shall lie with the competent Egyptian courts to determine any dispute arising out of or relating to it; and any arbitration — if agreed upon by the two parties — shall be conducted within the Arab Republic of Egypt and in accordance with its laws, without prejudice to any mandatory rights afforded to the User under the applicable laws of his country of residence.