WAKI Information Systems Technology Company is fully committed to applying the highest standards of personal data protection and privacy in accordance with the Saudi Personal Data Protection Law (PDPL), issued by Royal Decree No. (M/19) dated 09/02/1443 AH and amended by Royal Decree No. (M/148) dated 05/09/1444 AH, together with its Implementing Regulations issued by the Saudi Data & Artificial Intelligence Authority (SDAIA).
National Registration Certificate
WAKI Information Systems Technology Company is registered in the National Register for Personal Data Protection maintained by the Saudi Data & Artificial Intelligence Authority (SDAIA) under registration number 3240000564, issued on 17 September 2024. The certificate confirms WAKI's status as a registered data controller in the Kingdom of Saudi Arabia.
The official record lists WAKI's registered address as 3080, 9046-23442, Jeddah, Kingdom of Saudi Arabia, with the official email waki@waki.sa and official contact number 920014101.
About the PDPL
The Personal Data Protection Law (PDPL) is the regulatory framework governing the collection, processing, storage, and transfer of personal data in the Kingdom of Saudi Arabia. It safeguards the rights of data subjects and defines the obligations of data controllers and processors. The PDPL came into effect on 14 September 2023, with full enforcement from 14 September 2024, in alignment with Saudi Vision 2030.
Our Commitment
WAKI processes personal data only for legitimate, defined purposes — primarily to deliver school payment, attendance, identification, and operations services to schools, parents, students, vendors, and partner businesses. We do not sell personal data, and we do not process it for purposes incompatible with those for which it was collected.
PDPL Principles We Apply
- Lawfulness & transparency: Personal data is collected and processed on a clear legal basis, with notice to the data subject.
- Purpose limitation: Data is used only for the specific purposes disclosed at collection.
- Data minimization: We collect only what is necessary to deliver the requested service.
- Accuracy: Data is kept accurate and up to date; data subjects may request correction at any time.
- Storage limitation: Data is retained only for the period required by the service or by law.
- Integrity & confidentiality: Encryption, access control, and audit logging protect data at rest and in transit.
- Accountability: WAKI maintains records of processing activities and conducts periodic compliance reviews.
Your Rights as a Data Subject
- Right to be informed of the legal basis and purpose for which your data is collected.
- Right of access to your personal data held by WAKI.
- Right to rectification of inaccurate or incomplete personal data.
- Right to erasure of personal data when no longer needed or where processing is no longer lawful.
- Right to data portability — to receive your data in a readable format.
- Right to restrict or object to certain types of processing, including direct marketing.
- Right to withdraw consent at any time, without affecting prior lawful processing.
- Right to lodge a complaint with SDAIA if you believe your rights have been infringed.
Lawful Bases for Processing
WAKI processes personal data on one or more of the following bases recognised by the PDPL: the data subject's consent; the performance of a contract to which the data subject is a party (e.g. school subscription, parent wallet); compliance with a legal obligation; the protection of vital interests; and legitimate interests of WAKI or a third party that do not override the rights of the data subject.
Data Categories We Process
- Identification data (name, national ID/Iqama, date of birth, photo for face recognition).
- Contact data (phone, email, address).
- Account and payment data (wallet balance, transactions, card tokens — full PAN is not stored by WAKI).
- School operations data (attendance, dismissal, canteen orders, subscription plans).
- Technical data (device identifiers, log data, usage analytics).
Cross-Border Data Transfer
Personal data is hosted within the Kingdom of Saudi Arabia. Any transfer outside the Kingdom is performed only where permitted by the PDPL and its Implementing Regulations, with appropriate safeguards in place and, where required, prior approval from SDAIA.
Data Retention
Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal, accounting, or reporting obligations, or to resolve disputes. When the retention period ends, data is securely deleted or anonymised.
Security Measures
WAKI applies organisational and technical safeguards aligned with SDAIA guidance and relevant Saudi cybersecurity controls (NCA ECC), including encryption in transit and at rest, role-based access control, segregation of environments, secure software development practices, periodic vulnerability assessments, and an incident response process. In the event of a personal data breach, WAKI notifies SDAIA and affected data subjects within the timeframes required by the PDPL.
Children's Data
Many WAKI services are used by school students. WAKI processes children's data only on the lawful basis provided by the parent/guardian or the school acting in its educational capacity, and applies enhanced protections appropriate to the sensitivity of such data.
Exercising Your Rights / Contacting the DPO
To exercise any of your rights under the PDPL, or for any privacy-related inquiry, please contact our Data Protection Officer:
- Email: care@waki.sa
- Phone: 920014101
- Address: 3080, 9046-23442, Jeddah, Kingdom of Saudi Arabia
We respond to verified requests within the periods set by the PDPL. If you are not satisfied with our response, you may lodge a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA) via sdaia.gov.sa.
Last updated: April 2026.
