Data Processing Agreement · اتفاقية معالجة البيانات

1. Roles of the parties

For Customer Personal Data, you are the Controller and Waya is the Processor acting on your behalf and only on your documented instructions. You determine the purposes and means of processing; Waya processes Customer Personal Data to provide the Service to you and as set out in this DPA. (For your own merchant-account data, Waya is the controller — see the Privacy Policy.)

You are responsible for ensuring you have a lawful basis under the PDPL for the processing and for all notices and consents required from your customers, including a separate marketing consent.

2. Subject-matter and details of processing

Subject-matter	Provision of the Waya digital loyalty platform.
Duration	For the term of your subscription, plus the limited retention periods described in this DPA and the Terms.
Nature & purpose	Issuing and updating Apple/Google Wallet passes; recording stamps, points, visits, and rewards; sending program notifications you initiate; customer-base management; support; security and fraud prevention.
Categories of data subjects	Your enrolled customers.
Categories of personal data	Contact details provided at enrollment (typically name, mobile number, and/or email), optional data you choose to collect (e.g. birthday, gender), and loyalty activity (stamp count, points balance, visit history).
Sensitive data	Not required by the Service. You must not use the Service to process sensitive personal data.

3. Waya's obligations as Processor

• Instructions. Waya processes Customer Personal Data only on your documented instructions (including those given through your use of the Service), unless required otherwise by law — in which case Waya will inform you where lawfully permitted.
• Confidentiality. Personnel authorised to process Customer Personal Data are bound by confidentiality.
• Security. Waya implements appropriate technical and organisational measures, including encryption in transit (HTTPS/TLS), access controls, and signed wallet passes, to protect Customer Personal Data.
• Assisting you. Taking into account the nature of the processing, Waya assists you, by appropriate measures, to: respond to data-subject requests (Section 6); meet your security, breach-notification, and (where applicable) impact-assessment obligations; and answer the regulator (SDAIA).
• Records. Waya maintains records of the processing it carries out on your behalf.
• No mandatory-disclosure consent. Waya will not require your or your customers' consent before complying with a disclosure that is mandatory under Saudi law.

4. Sub-processors

You authorise Waya to engage sub-processors to provide the Service. Each sub-processor receives only the data needed for its function and is bound by data-protection obligations consistent with this DPA. Waya remains responsible to you for its sub-processors. Current sub-processors:

Sub-processor	Function
Supabase	Database, authentication, file storage, and edge-function hosting
Apple	Apple Wallet pass issuance and APNs push notifications
Google	Google Wallet pass issuance and FCM push notifications
Vercel	Hosting of the trywaya.com web application
StreamPay	Merchant subscription billing
[SMS/marketing aggregator, if used]	[Sending program/marketing messages]

We will give you a way to learn of changes to this list and a reasonable opportunity to object to a new sub-processor before it begins processing Customer Personal Data.

5. Cross-border transfer of personal data

Customer Personal Data may be processed and stored outside the Kingdom of Saudi Arabia, including on infrastructure used by our sub-processors (for example, Supabase hosting regions). Where personal data is transferred outside the Kingdom, the transfer is carried out in accordance with the PDPL and the Regulation on Personal Data Transfer Outside the Kingdom, including: a permitted purpose; data minimisation; an adequate level of protection or, where that is absent, an appropriate safeguard mechanism (such as the Standard Contractual Clauses issued by SDAIA); and, where required, a documented transfer risk assessment. The parties will execute SDAIA Standard Contractual Clauses where these are required for a transfer. [Hosting region(s) to be specified.]

6. Data-subject rights

The Service provides tools for you to access, correct, export, and delete Customer Personal Data so you can respond to your customers' requests to be informed, access, obtain a copy, correct, or destroy their data, and to withdraw consent. Where a customer contacts Waya directly, Waya will, where permitted, refer them to you as the Controller and assist you in responding. These rights do not apply to data that has been irreversibly anonymised.

7. Personal-data breach

Waya will notify you without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data, and will provide the information reasonably available to help you meet your own notification obligations to SDAIA and to affected individuals. (Under the PDPL Implementing Regulations the Controller's notification to SDAIA is made within a short statutory window — commonly understood to be 72 hours — which is why prompt notice from the Processor to the Controller matters. Confirm the exact regulatory deadline before relying on a specific figure.)

8. Anonymised and aggregated data

Waya may create aggregated and irreversibly anonymised data from the processing — data from which no individual can be re-identified, including by Waya. Such data is not personal data and falls outside the PDPL, and Waya may use it to operate, secure, analyse, and improve the Service and to develop new features and machine-learning models, during and after the term. Waya will not use Customer Personal Data in identifiable form for these purposes except on your instructions and on a lawful basis. Waya does not sell personal data and does not use sensitive data (or any inference of it) for marketing.

9. Return and deletion

On termination of the Service, Waya will, at your choice and within a reasonable period, make Customer Personal Data available for export and then delete it from active systems, except where retention is required by law or permitted under the Terms (for example, to establish, exercise, or defend legal claims). Anonymised and aggregated data may be retained.

10. Audit and compliance

Waya will make available information reasonably necessary to demonstrate compliance with this DPA and will cooperate with audits as required by the PDPL, subject to reasonable confidentiality and security conditions.

11. General

This DPA is part of, and subject to, the Terms, including their governing-law, jurisdiction, language, and limitation-of-liability provisions. In case of conflict between this DPA and the Terms regarding the processing of Customer Personal Data, this DPA prevails. The Arabic version prevails for merchants in the Kingdom.