Wasal
Privacy Policy
Last updated: 14 October 2026
This Privacy Policy explains how Wasal (“Wasal”, “we”, “us”) collects, uses, stores, and protects personal data when you use Wasal SaaS Platform and related websites, portals, and services. We operate with regard to the Kingdom of Saudi Arabia Personal Data Protection Law (PDPL) and its Implementing Regulations.
1. Who we are
Wasal SaaS Platform is a multi-tenant software platform for Umrah and Hajj transport operators. Organization (tenant) workspaces are controlled by the transport company that contracted with us. For support: support@wasal.app.
2. Data we collect
Account and organization data: company name, admin and staff names, emails, phone numbers, roles, and branding settings.
Operations data you enter: bookings, passengers, drivers, vehicles, agencies, vouchers, messages, and finance records needed to run transport operations.
Technical data: device type, browser, IP address, approximate location derived from IP, cookies or similar technologies, and usage logs needed for security and reliability.
3. How we use data
To provide, host, and improve the platform; authenticate users; support bookings, dispatch, vouchers, agency portals, messaging, and billing features.
To communicate about your account, security alerts, and service notices.
To comply with applicable Saudi law, respond to lawful requests, and protect our rights, users, and the integrity of sacred-journey operations.
We do not sell personal data.
4. Legal bases (PDPL)
Processing is based on contract performance (providing the SaaS desk), legitimate interests (security, product improvement, fraud prevention), consent where required (e.g. optional cookies or marketing), and legal obligation where Saudi law requires retention or disclosure.
5. Sharing and processors
We may share data with infrastructure and messaging providers strictly as needed to run the service (hosting, email/WhatsApp delivery, analytics for reliability), under confidentiality and data-processing terms.
Organization admins control staff and agency access inside their tenant. Data in a tenant is isolated from other organizations.
We may disclose information if required by competent Saudi authorities or courts.
6. Cross-border transfer
Where personal data is transferred outside the Kingdom, we apply PDPL requirements, including appropriate safeguards and, where required, approvals or exemptions under the Implementing Regulations.
7. Retention
We retain personal data only as long as needed for the purposes above, including contract duration, legitimate operational history for bookings and finance, legal retention periods, and dispute resolution. Organizations may request deletion subject to legal holds and operational necessity.
8. Security
We use administrative, technical, and organizational measures appropriate to the risk, including access controls, encryption in transit where standard, and tenant isolation. No method of transmission or storage is completely secure; please protect your credentials.
9. Your rights
Subject to PDPL exceptions, you may request access, copy, correction, destruction, or restriction of processing of your personal data, and withdraw consent where processing is consent-based. Contact ${SAAS.supportEmail}. We may need to verify identity before acting.
You may lodge a complaint with the competent Saudi authority responsible for personal data protection.
10. Children
The platform is for business users. Passenger data may include minors traveling with guardians for Umrah/Hajj; organizations must ensure they have a lawful basis to enter such data.
11. Changes
We may update this policy. The “Last updated” date will change. Continued use after updates constitutes acceptance where permitted by law.