Data Requests

Last updated: 1 June 2026

Effective date: 1 June 2026

Chapter One: General Provisions

1. Introduction

This Data Subject Requests Policy (the "Policy") governs the mechanism adopted by Wthaiq ("the Platform", "we", "us") for receiving, examining and processing requests submitted by data subjects, in a manner consistent with the applicable laws and regulations.

This Policy explains the rights that data subjects may enjoy, the mechanisms for exercising those rights, and the controls and procedures followed by Wthaiq when handling such requests.

This Policy is to be read together with the Privacy Policy, the Data Processing Agreement (DPA), the Data Retention Policy, the Data Deletion Policy and all other legal documents of Wthaiq.

2. Scope of application

This Policy applies to all requests relating to personal data processed by Wthaiq in its capacity as:

A data controller.

A data processor on behalf of its clients, within the limits permitted by law and by the contracts concluded with the clients.

3. Objectives of the Policy

This Policy aims to:

• Enable data subjects to exercise their rights.
• Ensure compliance with laws and regulations.
• Protect personal data.
• Standardise the procedures for processing requests.
• Achieve transparency in dealing with data subjects.

4. General principles

When processing data subject requests, Wthaiq undertakes to observe the following principles:

• Transparency.
• Reasonable promptness.
• Accuracy.
• Protection of identity.
• Confidentiality.
• Compliance with the law.

Chapter Two: Submission of Requests

5. Means of submitting a request

The data subject may submit their request through the channels of communication or the official forms adopted by Wthaiq.

The Platform may update the means by which requests are received at any time.

6. Information required

The applicant may be asked to provide Wthaiq with the information necessary to process the request, including:

• Name.
• Contact details.
• The email address associated with the account.
• A description of the request.
• The data to which the request relates.
• Any additional information that assists in verifying the request.

7. Identity verification

Before giving effect to any request, Wthaiq may take reasonable steps to verify the identity of the applicant.

Additional information or documents may be requested where this is necessary to prevent unauthorised access to, modification of, or deletion of the data.

8. Requests submitted by a representative

Where a request is submitted by an agent or a representative, Wthaiq may request documents evidencing the authorisation or the legal capacity before processing the request.

Chapter Three: The Right of Access

9. Access request

Where the law grants them this right, the data subject may request confirmation as to whether Wthaiq is processing their personal data, and obtain a copy of the data, in accordance with the law and the restrictions established therein.

10. Scope of the information

The information provided may include, as the case may be:

• The categories of personal data.
• The purposes of the processing.
• The sources of the data, where available.
• The categories of parties with whom the data has been shared.
• The envisaged retention period or the criteria for determining it.
• The statutory rights available to the data subject.

11. Restrictions on the right of access

Wthaiq may restrict or refuse an access request where this is necessary in order to protect:

• The rights of others.
• Trade secrets.
• Cybersecurity.
• Compliance with the laws.
• Any legitimate interest permitted by law.

12. Form in which information is provided

The requested information may be provided in electronic form or by any other means that Wthaiq considers appropriate, unless the law prescribes a particular means or the data subject requests another means that is possible and reasonable.

Chapter Four: The Right to Rectification

13. Request for rectification of data

Where the personal data is inaccurate or incomplete, the data subject may, where the law grants them this right, request its rectification or completion.

14. Verification of the request

Wthaiq may request information or documents supporting the rectification request where this is necessary to verify the accuracy of the data to be amended.

15. Limits of rectification

Wthaiq is not obliged to amend the data if:

• The data is correct.
• The requested amendment would be contrary to law.
• The amendment would prejudice the rights of third parties.
• The accuracy of the new information cannot be verified.

Chapter Five: The Right to Erasure

16. Erasure request

Where the law grants them this right, the data subject may request the erasure of their personal data in the cases permitted by law.

Erasure requests are also subject to the Data Deletion Policy and the Data Retention Policy.

17. Cases in which erasure is refused

Wthaiq may refuse or defer an erasure request where retention of the data is necessary for the purpose of:

• Compliance with the law.
• Performance of a contract.
• Protection of legal rights.
• Defence of claims.
• Cybersecurity.
• Fraud prevention.
• Any legitimate purpose permitted by law.

18. Partial erasure

Where it is not possible to erase all of the data, a partial erasure may be carried out in respect of the data that can be erased, while retaining the data that the law or a legitimate interest requires to be retained.

Chapter Six: Other Rights

19. Restriction of processing

Where the law grants this right, the data subject may request the restriction of the processing of their data in the cases specified by law.

Wthaiq shall examine the request in accordance with the circumstances and the applicable legal obligations.

20. Data portability

Where the law grants the right to data portability, and where this is technically feasible, the data subject may request to obtain their data in a structured, commonly used format, or request its transmission to another party, where this is possible and reasonable.

21. Objection to processing

Where the law grants them this right, the data subject may object to certain types of processing.

Wthaiq shall examine the objection and balance it against the legal obligations and the legitimate interests on which the processing is based.

22. Withdrawal of consent

Where the processing is based on the consent of the data subject, they may withdraw that consent at any time.

The withdrawal of consent does not affect the lawfulness of the processing carried out before its withdrawal, nor does it affect any processing based on a lawful basis other than consent.

Chapter Seven: Processing of Requests

23. Review of requests

Wthaiq reviews all requests in order to verify:

• The identity of the applicant.
• The scope of the request.
• The applicable legal rights.
• The existence of any legal restrictions or exemptions.

24. Time period

Wthaiq seeks to respond to requests within the periods imposed by law, or within a reasonable period where the law does not specify a particular period.

In complex cases, the response period may be extended where the law permits, with notification to the applicant where appropriate.

25. Communication with the applicant

Wthaiq may contact the applicant to request additional information or clarifications where these are necessary to process the request.

Processing of the request may be suspended until the requested information is received.

26. Repetitive or unfounded requests

Where it appears that a request is excessively repetitive, unfounded or abusive, Wthaiq may, to the extent permitted by law:

• Refuse the request.
• Charge a reasonable fee for processing the request.
• Request additional information before proceeding with its processing.

Chapter Eight: Requests Relating to Wthaiq's Clients

27. Data processed by Wthaiq on behalf of clients

Where Wthaiq processes personal data in its capacity as a data processor on behalf of one of its clients, requests relating to that data may be referred to the client in its capacity as the data controller, unless the law requires Wthaiq to take direct action.

28. Cooperation with the client

Wthaiq shall cooperate with the client, to the extent permitted by the nature of the services, in order to assist it in meeting its obligations towards data subjects, in accordance with the Data Processing Agreement (DPA) and the applicable laws.

29. Limits of Wthaiq's liability

Wthaiq shall not be liable for the decisions taken by the client in its capacity as data controller in relation to data subject requests, unless the cause of the claim arises from a breach by Wthaiq of its legal or contractual obligations.

Chapter Nine: General Provisions

30. Protection of the rights of third parties

No request may be given effect where doing so would prejudice the rights, freedoms or personal data of other persons, or would disclose information that is confidential or protected by law, unless the law permits this.

31. Amendment of the Policy

Wthaiq may amend this Policy where legal, operational or regulatory necessity so requires.

Amendments take effect from the date of their publication or from the date specified therein, in accordance with what the law permits.

32. Severability

If any provision of this Policy is found to be ineffective or unenforceable under the law, this shall not affect the validity or effectiveness of the remaining provisions.

33. Integration with the legal documents

This Policy shall be construed together with the Privacy Policy, the Data Processing Agreement (DPA), the Data Retention Policy, the Data Deletion Policy, the Terms and Conditions of Use and the remaining legal documents of Wthaiq, as an integrated legal framework.

34. Communication

The data subject may submit requests or enquiries relating to their rights through the official channels of communication published on Wthaiq's website.

The Platform may request additional information to verify the identity of the applicant before giving effect to any request.

35. Entry into force

This Data Subject Requests Policy enters into force as of the date stated at its beginning and remains in effect until it is amended or replaced in accordance with its provisions.

36. Final acknowledgement

The User or the data subject acknowledges that they have reviewed this Policy, that they understand the rights and procedures relating to data subject requests, and agrees that requests shall be processed in accordance with this Policy, the applicable laws, and consistently with Wthaiq's role as data controller or data processor as the case may be.

Governing Law and Jurisdiction

This document shall be governed by and construed in accordance with the laws of the Arab Republic of Egypt, and the competent Egyptian courts shall have jurisdiction to determine any dispute arising out of or in connection with it, and any arbitration — if agreed upon by the two parties — shall be conducted within the Arab Republic of Egypt and in accordance with its laws, without prejudice to any mandatory rights afforded to the User under the applicable laws of their country of residence.