Privacy Policy

This Privacy Policy describes how Wudd ("the Company", "we", "us", "our") collects, uses, and discloses your information when you use our website, web application, or mobile application (collectively, the "Service"), and explains your privacy rights and how the applicable laws protect you.

We process personal data to provide and improve the Service. By using the Service, you agree to the collection and use of information in accordance with this Policy.

Wudd is a platform registered in the Kingdom of Saudi Arabia and operated from Riyadh. For the purposes of the Saudi Personal Data Protection Law (PDPL) and the EU General Data Protection Regulation (GDPR), Wudd is the Data Controller.

"Personal Data" means any information that relates to an identified or identifiable individual, including names, national ID, Iqama, identification numbers, location data, online identifiers, or any factors specific to physical, physiological, genetic, mental, economic, cultural, or social identity.

"Usage Data" means data collected automatically, either generated by use of the Service or from the Service infrastructure (for example, the duration of a page visit).

"Service Provider" means any natural or legal person who processes data on our behalf. Under the PDPL and the GDPR, Service Providers are considered Data Processors.

While you use the Service, we may ask you to provide personal data that can be used to contact or identify you. This may include your email address, first and last name, phone number, job title, department, organization, address (city, region, country), and, optionally, a profile photo.

Your sex or gender. We may collect your sex or gender so that we can address you using the correct grammatical forms in Arabic, which differ when addressing male or female speakers.

Children's birthday data. If you choose to enable the "Occasions" feature, you or your Organization may provide us with the first name, date of birth, and sex of your child or children. The sex of the child is used only so that the birthday reminder can be phrased using the correct Arabic grammatical form (for example, the phrase "نهنأك على عيد ميلاد ابنتك ونتمنى لها عمراً مديداً" uses the feminine pronoun "لها" when the child is female).

Usage Data. We automatically collect information such as your IP address, browser type and version, the pages you visit, the time and date of your visit, the time spent on each page, unique device identifiers, and other diagnostic data. When you access the Service through a mobile device, we may collect additional information such as the type of device, device ID, mobile operating system, and mobile browser type.

We use Cookies and similar tracking technologies to operate the Service, remember your preferences, and understand how the Service is used. Cookies can be Session Cookies (deleted when you close your browser) or Persistent Cookies (remaining until they expire or are deleted).

We use Necessary Cookies to authenticate users and keep your session open, Functionality Cookies to remember your language (Arabic or English) and interface direction (RTL or LTR), and Analytics Cookies to understand how the Service is used in aggregate.

For more details, including how to manage Cookies, please see our Cookies Policy.

We use personal data to provide and maintain the Service and to monitor its usage; to manage your Account and registration; to perform the subscription contract with you or your Organization; to contact you by email, SMS, push notification, or similar channels regarding service updates, security, and support; to send you product news, offers, and information, unless you have opted not to receive such messages; to manage your requests and enquiries; to evaluate, conduct, or respond to a merger, divestiture, restructuring, or similar business transfer; and for internal analysis, to identify usage trends, assess the effectiveness of our campaigns, and improve the Service.

We share personal data with Service Providers strictly to operate the Service. This includes Tap Payments, our licensed payment service provider in the Kingdom of Saudi Arabia, for payment processing; Google Analytics for aggregated usage insights; and our cloud infrastructure providers for secure hosting and data storage.

We may also share personal data with our Affiliates, with business partners to offer you related products or services, with other users within your Organization when you post Content in shared areas of the Service (such as the recognition feed), and with your consent for any other purpose you approve.

We do not sell, rent, or trade your personal data with third-party advertising networks or data brokers under any circumstances.

We retain your personal data only for as long as is necessary for the purposes set out in this Policy. We retain and use personal data to the extent needed to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies.

Usage Data is generally retained for a shorter period, except when used to strengthen the security or improve the functionality of the Service, or when we are legally obligated to retain it for longer.

Your personal data is primarily processed within the Kingdom of Saudi Arabia, in line with Saudi data-residency expectations. It may be transferred to and maintained on servers located outside your jurisdiction only where the transfer is permitted by applicable law and is protected by adequate safeguards.

We take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Policy. No transfer takes place to an organization or a country unless adequate controls are in place, including safeguards for the security of your data.

The security of your personal data is important to us, but no method of transmission over the internet, or method of electronic storage, is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

We apply organizational and technical security measures, including access controls, encryption in transit, and regular security reviews, designed to protect against unauthorized access, accidental loss, or destruction of your data.

If you are located in the Kingdom of Saudi Arabia, the processing of your personal data is governed by the Personal Data Protection Law issued under Royal Decree No. M/19 dated 9/2/1443H, as amended (the "PDPL"), and its Implementing Regulations issued by the Saudi Data and Artificial Intelligence Authority ("SDAIA").

We process personal data only where at least one of the following applies: your consent; performance of a contract with you; compliance with a legal obligation; or legitimate interests that do not override your rights and freedoms.

Subject to the conditions and exceptions in the PDPL, you have the right to be informed of the legal justification for collecting your personal data, to access your personal data, to request a readable copy of it, to request correction of inaccurate data, and to request destruction of your personal data when it is no longer required for the purpose for which it was collected.

To exercise any of these rights, please contact us using the details in section 17. We may ask you to verify your identity before responding, and we will respond within the timelines required by the PDPL. You also have the right to file a complaint with SDAIA if you believe our processing violates the PDPL.

If you are located in the European Economic Area, the European Union, or the United Kingdom, the following rights apply under the General Data Protection Regulation (GDPR) and, where applicable, the UK GDPR.

We may process your personal data on the basis of your consent, performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a task in the public interest, or our legitimate interests.

You have the right to request access to your personal data, to request correction of inaccurate data, to object to processing, to request erasure, to request the transfer of your data in a structured and machine-readable format, and to withdraw your consent at any time where processing is based on consent.

You may exercise these rights by contacting us. We will respond within the timelines required by the GDPR. You also have the right to complain to a Data Protection Authority in the EEA about our collection and use of your personal data.

The Service is not directed at, and is not intended to be used by, anyone under the age of 18. We do not knowingly allow anyone under 18 to register an Account or use the Service.

As part of the Service's Occasions feature, you (as an employee) or your Organization may provide us with the first name, date of birth, and sex of your child or children. We use this information solely to send you a courtesy reminder on the child's birthday, so that you do not forget the date. We do not create an account for the child, do not contact the child, do not market to the child, and do not share the child's information with any third party except as strictly necessary to operate the reminder (for example, with our cloud infrastructure provider).

The legal basis for processing this information is either your explicit consent as the parent when you enter the data, or performance of the contract between your Organization and the Company where the Organization collected this information from you with your consent. You may request deletion of this information at any time from your Account settings or by contacting us, and it will be deleted promptly.

If you are a parent or guardian and you become aware that your child has directly provided us with personal data beyond the Occasions data described above, please contact us so that we may remove that information from our servers.

The Wudd mobile application may request access to your device's camera, microphone, and photo library, solely to enable features you explicitly choose to use, such as updating your profile photo or sending a voice message in the Connect chat.

Camera access is used only when you choose to take a photo for your profile or to share in a conversation. We do not access your camera in the background.

Microphone access is used only when you choose to record and send a voice message. Recordings are not stored on our servers beyond the transmission required to deliver the message.

Photo library access is used only when you choose to select an image from your device to upload or share.

The Wudd Connect feature allows employees to exchange text messages, images, voice recordings, and documents within the workplace environment.

All content shared through Connect is stored securely on our servers and is accessible only to the intended participants and to the authorized administrators of your Organization.

We do not scan, analyze, or monetize the content of private conversations. Chat data is retained for the duration of your Organization's subscription and is permanently deleted on account termination.

The Service may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the privacy policy of every site you visit. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites or services.

We may update this Privacy Policy from time to time. We will notify you of any material change by posting the new Policy on this page and updating the "Last updated" date at the top, and, where appropriate, by email or a prominent notice on the Service before the change becomes effective.

You are advised to review this Privacy Policy periodically. Changes to this Policy are effective when posted on this page.

If you have any questions about this Privacy Policy or wish to exercise any of your rights, please contact us at hello@wudd.net for general enquiries, or help@wudd.net for support. You may also write to us at Wudd, Riyadh, Kingdom of Saudi Arabia.