Privacy Policy
Last updated September 19, 2026
This policy explains what personal data Smart Wafaa collects, why, and the choices you have, for merchants and for the customers who hold cards.
1. Data we collect from merchants
Business name, commercial registration details, contact person, billing information and usage logs of the dashboard and staff app.
2. Data processed for customers
When a customer joins a programme we process the fields the merchant chooses (typically name and phone number), the card identifier and stamp, point or balance records. We never receive wallet payment credentials.
3. How we use data
To issue and update cards, run the rules engine, show merchants their activity, send transactional notifications and comply with legal obligations. We do not sell personal data.
4. Sharing
Data is shared with Apple and Google only as required to deliver cards to their wallet apps, with our hosting and messaging providers under data-processing agreements, and with authorities when the law requires it.
5. Retention
Merchant data is retained for the life of the account plus the period required by Saudi commercial and tax law. Customer card data is deleted or anonymised within 90 days of a programme being closed.
6. Your rights
Under the PDPL you may request access to, correction of, or deletion of your personal data, and object to certain processing. Contact us at the address in the footer.
7. Security
Cards are signed with platform certificates, data is encrypted in transit (TLS) and at rest, and access is role-based and logged.