Privacy Policy

1. Who we are and policy scope

The WaliERP platform operator controls personal data collected through the WaliERP website and customer portal to manage the service relationship. We may act as processor for personal data your organisation places in a company workspace; your organisation remains responsible for lawful collection and processing instructions.

This policy applies when you visit the site, send a form, subscribe to the newsletter, create an account, use a company workspace or contact support. It does not govern external sites and services that maintain separate policies.

2. Data we process

• Identity and contact data: name, email, mobile number and authorised-representative details when provided.
• Organisation data: company name, identifier, logo, address, city, country, contact, VAT number and commercial-registration number when entered.
• Authentication data: a securely hashed password, email-verification status, and Google or Apple subject identifier and verified email when external sign-in is selected. We do not receive your provider password.
• Subscription and transaction data: plan, period, status, order, invoice, amount, currency and payment reference when payments are enabled. We do not retain full card details.
• Technical usage data: network address, session identifier, browser, device, timestamps, requested pages and security and error logs.
• Company content: operational, accounting and other records and files entered by authorised users.
• Communications and preferences: support messages, sales requests, form responses, language preference and newsletter consent.

3. Sources of data

We obtain data directly from you, an authorised user at your organisation, automatically through service use, a sign-in or payment provider you select, or a lawful source where business verification or legal compliance requires it. Users should not provide data the service does not need or that they are not authorised to process.

4. Purposes and lawful bases

Where processing relies on consent, withdrawal does not affect earlier lawful processing and may not apply to processing needed for a contract or legal duty. If required account or service data is not supplied, we may be unable to provide the relevant feature.

• Creating accounts and workspaces, operating subscriptions, supporting users and fulfilling requests: contract performance or steps you request before contracting.
• Verifying identity, protecting accounts, preventing fraud and managing logs and incidents: our legitimate interest in service security and continuity, balanced against your rights.
• Producing financial records and meeting authority, tax and accounting requirements: legal obligations.
• Sending optional newsletters or offers and using non-essential cookies if introduced: consent, which you can withdraw.
• Improving performance, user experience and feature reliability: legitimate interests using limited or aggregated data where possible.

5. Data in your company workspace

Your organisation determines the purpose and means of processing data it enters about employees, customers, suppliers and others, and is responsible for notices, consent or another lawful basis. We process it to provide the service under authorised instructions, security controls and legal duties.

Each workspace is created with a unique data environment. Access and operational isolation controls limit one company’s access to another’s data. The Customer must manage user permissions and remove access when responsibilities change.

6. Data sharing

We do not sell personal data. We may share the minimum required data with hosting, infrastructure, email, support, security, sign-in and payment providers, acting as processors or independent controllers depending on the service and subject to appropriate confidentiality and protection terms.

We may disclose data in response to a valid legal request, to protect rights and security, prevent misuse, or as part of a legitimate reorganisation with continuing safeguards and notice where required. We do not expose company content to an advertiser for targeting the people recorded in it.

7. Transfers outside Saudi Arabia

If a technology provider or integration requires processing outside Saudi Arabia, we transfer data under the Personal Data Protection Law and its regulations after assessing purpose, necessity and protection and applying an appropriate safeguard or lawful exception. You can request general information about provider categories and processing locations through the contact page.

8. Retention and destruction

We retain data for its collection purpose, account and subscription operation, settlement of requests and disputes, and legal periods, then securely destroy or anonymise it. The period depends on the data category, relationship and accounting and security requirements.

External sign-in states are short-lived and single use; verification and recovery links expire under their security settings. Protected copies may remain in a limited backup cycle until automatically replaced and are used only for recovery or legal duties during that period.

9. How we protect data

No electronic method is entirely risk free. If credentials may have been exposed, change the password, notify us promptly and do not send account secrets through an unsecured message.

• Encrypted transport when the service operates over HTTPS, password hashing and no retrievable plain-text account passwords.
• Need-based access restrictions, sensitive-event logging and review of unusual access attempts.
• Company-data separation, request validation, anti-forgery controls and protection against authentication-token replay.
• Backup, maintenance and incident-response practices proportionate to service risk.

10. Cookies and similar technologies

We use essential cookies and sessions for sign-in, language choice, request-forgery protection and form continuity. They are necessary for the site and portal. If non-essential measurement or marketing tools are introduced, we will identify them and provide consent choices where required. Blocking essential cookies may prevent forms or sign-in from working.

11. Your data rights

Subject to the Saudi Personal Data Protection Law and applicable limits, you can know why and on what basis data is collected, access it, receive a clear copy, correct or complete inaccurate data, request destruction when retention is no longer justified, and withdraw consent where consent is the basis.

Use the contact page, identify the request as a “Privacy Request” and describe the right and account involved. We verify identity and authority to protect the data and respond within the statutory period, generally 30 days and extendable where regulations permit with notice. You may complain to the competent authority if your concern is not resolved satisfactorily.

12. Choices and communications

You can unsubscribe from marketing through the unsubscribe method or a direct request; operational and security messages required for the account may continue. You can edit profile and company details in the portal where available or request help. We do not currently use solely automated decisions that produce legal or similarly significant effects on you.

13. Children

The service is for organisations and professional representatives and is not intentionally directed to anyone under 18. If we learn that a minor’s data was collected without an appropriate basis or authority, we will take reasonable steps to restrict or destroy it as required.

14. Personal-data incidents

We assess confirmed security incidents and take containment, remediation and documentation steps. We notify the competent authority and affected people when statutory thresholds are met, explaining the incident, likely effects and recommended steps to the extent available.

15. Policy changes and contact

We may update this policy when services, practices or legal requirements change. We publish the effective date and version and highlight a material change or request renewed consent where needed. For questions or a privacy right, use Contact Us and include the account email without sending a password or access code.