Privacy Notice

Last updated: 03/03/2026

Waada Digital Insurance Agency (hereinafter referred to as "Waada" or "we" or "our") is committed to respecting and protecting your privacy. This Privacy Notice applies to all employees, customers, visitors, and third parties (hereinafter referred to as "you" or "the user") who access or use our digital platforms, including websites, customer and employee portals, and social media pages.

This notice, together with the Terms of Use and any other referenced documents, explains the basis on which any personal data collected from you, or provided by you, will be processed by us. Your personal data will be processed strictly in accordance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia. This notice provides information on how we process your personal data and your rights as a data subject. Please read carefully to understand how we handle your personal information.

Protecting your personal data is our primary concern. We maintain physical, electronic, and procedural safeguards that comply with applicable laws and regulations to secure your information from unauthorized access, accidental or unlawful alteration or destruction, and any other unlawful processing. Our employees receive ongoing training in proper data management, including a confidentiality section requiring all employees to maintain the secrecy of business and internal information obtained during their regular work.

Information We Collect

We collect personal data to provide tailored products and services, in compliance with applicable laws. The types of information we collect include:

• Identity information: first name, last name, gender, company represented (if any).
  Purpose: Policy issuance, onboarding, identity verification, underwriting assessment, fraud prevention, and regulatory compliance.
  Legal Basis: Contractual Necessity; Legal Obligation
• Contact information: national address, email address, phone numbers.
  Purpose: Communication regarding quotations, policy issuance and servicing, renewals, claims handling, complaint management, regulatory notifications, and OTP authentication for secure access to portals.
  Legal Basis: Contractual Necessity; Legal Obligation; Legitimate Interests (service communication and security).
• Financial information: bank account numbers.
  Purpose: Premium collection, refund processing, claims settlement payments, financial reconciliation, and compliance with financial and regulatory reporting obligations.
  Legal Basis: Contractual Necessity; Legal Obligation
• Technical information: IP address, login data, browser type and version, time zone, location, OS, and other device technologies.
  Purpose: System security, authentication control, fraud prevention, session management, audit logging, performance monitoring, and protection of digital platforms.
  Legal Basis: Legitimate Interests (system security and fraud prevention); Contractual Necessity.
• Profile information: username and password for Waada portals.
  Purpose: Secure account creation, user authentication, access management, and protection of customer and agent portals.
  Legal Basis: Contractual Necessity; Legitimate Interests (system security).
• Usage information: interactions with websites, applications, and services.
  Purpose: Monitoring service performance, improving user experience, detecting suspicious activity, fraud prevention, and business analytics (anonymized where possible).
  Legal Basis: Legitimate Interests; Contractual Necessity (service optimization).
• Communication information: preferred method of contact and notification settings.
  Purpose: Sending policy-related communications including quotations, policy issuance, endorsements, renewals, claims updates, regulatory notifications, service announcements, and security alerts related to your account.
  Legal Basis: Contractual Necessity; Legal Obligation.
• Employment information: date of birth, gender, residence, nationality, qualifications, work history, personal photos, CVs, and other application data.
  Purpose: Recruitment evaluation, employment administration, payroll processing, performance management, and compliance with labor and regulatory requirements.
  Legal Basis: Contractual Necessity; Legal Obligation.
• Sensitive personal data: medical reports, death certificates, criminal or civil records (for claims, fraud detection, or anti-money laundering).
  Purpose: Underwriting risk assessment, claims eligibility determination, fraud investigation, anti-money laundering verification, and compliance with regulatory requirements.
  Legal Basis: Contractual Necessity; Legal Obligation; Explicit Consent where required under applicable regulations.
  Sensitive personal data is processed under enhanced security controls and restricted access measures.

How We Process Your Personal Data

• We use your personal information to provide our products and services, fulfil your insurance-related instructions, and manage online insurance products and associated services.
• We may send you messages such as welcome emails, billing reminders, or information about your insurance contracts.
• With your consent, we may use your personal data (e.g., email, mobile number, postal address) to provide you with direct updates, or offers that may be of interest to you.
• We may share your personal data with government systems or software platforms to comply with legal or regulatory obligations.
• We may record communications including calls, face-to-face meetings, messages, or emails for verification, quality control, and service improvement purposes.
• Occasionally, sensitive personal data may be processed for public interest purposes such as investigating fraudulent claims or anti-money laundering verification.
• We may collect device and usage statistics for system management or business analytics, which are anonymized and do not identify individuals.

Legal Basis for Processing

• The primary legal bases we rely on for processing your personal data are:
• Explicit Consent – when you have given us clear consent for a specific processing activity. You may withdraw consent at any time by contacting us.
• Contractual Necessity – to perform or take steps to enter a contract with you.
• Legitimate Interests – where processing is necessary to achieve our legitimate interests or those of a third party, which do not override your data protection rights.
• Legal Obligation – to comply with applicable legal or regulatory requirements.
• Public Interest – where processing is necessary for reasons of substantial public interest as provided by applicable law.

Purpose Limitation and Alignment

• Waada processes personal data strictly for the specific and explicit purposes described in this Privacy Notice and in accordance with Article 11 of the Personal Data Protection Law (PDPL).
• Personal data will not be processed for purposes incompatible with the original purpose of collection unless a valid legal basis is established in accordance with Article 10 of the PDPL or explicit consent is obtained from the data subject where required.
• The purposes described in this Notice are aligned with Waada's internal Record of Processing Activities (RoPA), Data Inventory, and Lawful Basis Register to ensure consistency, transparency, and accountability.

Cookies and Similar Technologies

Waada uses strictly necessary cookies and similar technologies that are essential for the secure operation and proper functioning of its website and digital platforms. These cookies are used for purposes such as:

• Maintaining secure sessions.
• Enabling authentication and login functionality.
• Protecting against fraudulent or malicious activity.
• Ensuring website security and stability.

These cookies do not collect information for analytics, advertising, or marketing purposes.

Retention: Strictly necessary cookies are session-based or retained only for the duration required to ensure secure system operation.

Waada does not deploy analytics, marketing, or tracking cookies.

Web beacons or tracking pixels may also be used in combination with cookies to monitor website or email interactions.

Sharing Your Personal Data

We may share your data with third parties to provide better products and services, in accordance with laws and regulations. This may include:

• Protecting Waada’s rights or property, including enforcing agreements.
• Acting in urgent situations to protect the safety of our customers or the public.
• Service providers, IT and payment systems, and customer management platforms.
• Governmental or regulatory authorities.

Data Security

• Personal data security is a priority. We implement reasonable technical, procedural, and administrative safeguards to protect data from misuse, loss, unauthorized access, or disclosure.
• We ensure that our employees and affiliates adhere to confidentiality and standard encryption practices when processing personal data.

Data Retention

Waada retains personal data only for as long as necessary to fulfil the specific and explicit purpose for which it was collected, in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia. Retention periods are determined based on one or more of the following criteria:

• The duration of the contractual relationship between Waada and the data subject;
• Applicable regulatory and legal requirements in the Kingdom of Saudi Arabia;
• Statutory limitation periods for potential legal claims;
• Financial, accounting, and audit recordkeeping obligations;
• Fraud prevention, dispute resolution, and security monitoring requirements.

Where required, personal data may be retained for a longer period if it is subject to an ongoing legal claim, regulatory investigation, or formal dispute. Waada maintains internal retention controls and procedures to ensure that personal data is not retained longer than necessary and is securely deleted, anonymized, or disposed of once the applicable retention period expires.

Personal data may also be retained to the extent necessary to comply with legal and regulatory obligations, resolve disputes, enforce contractual rights, and adhere to instructions issued by competent authorities, including the Insurance Authority and the Saudi Data and Artificial Intelligence Authority.

Collection from Minors

If you are a resident of Saudi Arabia under 18 years of age, or under the applicable age of majority in your jurisdiction, we may not contract with you directly. A legal guardian must provide consent on your behalf for the collection and processing of personal data.

Your Rights

• Right to Know / Information Request – You have the right to know our contact details, the purpose of data collection, how we collect data, and whether your data will be shared or sold.
• Right of Access / Copy – You may request access to your personal data and obtain a clear, readable copy in accordance with our records at no cost.
• Right to Rectification – You may request correction of any incomplete, inaccurate, or outdated data.
• Right to Erasure – You may request deletion of personal data if it is no longer needed or if you withdraw consent.
• Right to Restrict / Object to Processing – You may request restrictions on the processing of your personal data for specific purposes and limited periods.
• We will respond to all requests within thirty (30) days and log all data subject requests.

Data Protection Officer (DPO)

• Name: Data Office (Waada)
• Email: dpo@waada.sa

Contact Us

For questions, concerns, complaints, or to exercise your rights or withdraw consent, please contact us. We will investigate and resolve issues promptly within applicable timelines.

For privacy inquiries or to update preferences, contact our main Data/Privacy team at privacy@waada.sa

Privacy Notice Updates

This notice is effective from 03/03/2026. Waada will publish future updates or amendments on our website or application with the updated effective date. Continued use after changes indicates acceptance.