In plain terms: a first name, a mobile number, and a visit history
A Waya loyalty card stores what a client enters at enrollment — a first name and a mobile number — plus a visit history built from staff scanning her card over time: stamps or points added, rewards redeemed, and the dates those happened. That's the core of what a salon's loyalty program collects and uses to run the program itself.
This is not a legal opinion on Saudi Arabia's Personal Data Protection Law (PDPL) or a substitute for advice from a qualified lawyer — a salon handling client data under PDPL should get guidance specific to its own situation. What follows is a plain description of what Waya's loyalty system itself stores and shows, so an owner knows the starting point before asking a professional about compliance specifics.
Where that data shows up and who can see it
The client's name, number, and visit history appear on the salon's own dashboard, visible to staff with Cashier or Branch Manager access — the same roles used to add stamps and run the shop day to day. The client herself sees her own card's stamp or points count and any messages sent to her, but not other clients' data.
Data tied to a specific client's card stays associated with that client across every branch on a multi-branch dashboard, which is part of how the loyalty program follows her from one location to another rather than resetting at each branch.
| Data point | Collected at | Used for |
|---|---|---|
| First name | Enrollment | Personalizing messages and identifying the card |
| Mobile number | Enrollment | Linking enrollment and, if applicable, contact |
| Visit / stamp history | Every staff scan | Tracking progress toward the reward and return-rate reporting |
| Messages sent | Triggers and campaigns | Notification history visible to the salon |
The limitation, stated honestly: this is a description, not legal advice
It's important a salon owner doesn't treat this page as a compliance checklist — PDPL obligations depend on specifics (how data is processed, retained, and whether it's shared) that go beyond what a general description of a software feature can responsibly cover. A salon that's unsure how its use of any customer data tool fits PDPL requirements should consult a lawyer familiar with Saudi data protection law rather than relying on a product description alone.
What a salon can control on its own dashboard
A salon can export its own loyalty data from the dashboard, and staff access is limited to the roles assigned — Cashier and Branch Manager — rather than being open to anyone. Beyond enrollment (name and mobile number) and the visit history generated by scans, Waya's loyalty program doesn't collect additional personal details unless the salon itself asks for them separately outside the card.
- Enrollment collects only a first name and mobile number, nothing more, by default
- Visit history builds automatically from staff scans, not from any separate data entry
- Access on the dashboard is limited to staff with Cashier or Branch Manager roles
- Salons can export their own data from the dashboard
A sensible starting point for most small salons
For most small salons, being upfront with clients at enrollment — a name and number are collected to run the loyalty card, and messages will come through the wallet, not a separate marketing list — covers the basic transparency most clients expect, though it's not a substitute for understanding the formal PDPL requirements that apply to your specific business. If your salon handles other client data outside the loyalty card (medical intake forms at a medical spa, for instance), those fall outside what this loyalty system covers and need their own separate consideration.
Where to go from here
If you're setting up a salon's loyalty program for the first time, the platform pillar guide covers the full setup process, and it's a reasonable moment to also have a short conversation with a professional about how your specific use of client data fits Saudi PDPL requirements before you launch broadly.
- Step 1: enroll clients with the standard two fields
Collect only a first name and mobile number at enrollment, as the system is designed for.
- Step 2: limit dashboard access appropriately
Assign Cashier and Branch Manager roles only to staff who need to see client visit data.
- Step 3: be transparent at enrollment
Let clients know their name and number power the loyalty card and its messages.
- Step 4: consult a professional if unsure
For specific PDPL compliance questions, get guidance from a qualified Saudi data protection lawyer.
Frequently asked questions
What salon client data does a loyalty program store under Saudi PDPL?
Waya's loyalty card stores a first name and mobile number entered at enrollment, plus a visit history built from staff scans over time. This is a plain description of the software, not legal guidance on PDPL compliance.
Who can see a client's loyalty data at a salon?
Staff with Cashier or Branch Manager access on the salon's dashboard, and the client herself, who sees her own card's progress and message history — not other clients' data.
Does Waya's loyalty card collect more than a name and number?
No, not by default — enrollment collects only a first name and mobile number, and the rest of the client's data is a visit history generated automatically from staff scans.
Is this page a substitute for PDPL legal advice?
No. This page describes what the loyalty system stores in plain terms; it is not legal guidance. A salon should consult a qualified lawyer for specific Saudi PDPL compliance questions.
Can a salon export its own client loyalty data?
Yes — a salon can export its data from its own dashboard, and access to view that data is limited to staff assigned Cashier or Branch Manager roles.