Last Updated on 08 November 2022

1. Who we are and why is this privacy policy important?

• • Watheeqa Verification Company, 6677 Almazawi St. # 1, Almaseef District, Riyadh, 12465-3515, Saudi Arabia (“Watheeqa”, “we”, “us”, “our”); supplies specialized verification solutions that assist public and private organizations to make considered hiring or registration decisions. We service our customers with assistance from a leading global verification expert – the DataFlow Group.
  • This Privacy Policy (“Policy”) applies to:
    • applicants whose personal data is submitted to us by our customers for verification purposes; and
    • applicants, visitors and others who access or use our website (watheeqa.co) and / or other websites that we may own or operate, and / or use the associated verification services.

(collectively referred to as “you” or “user”)

• We take your personal data seriously and process it in accordance with applicable laws and regulations including what has been prescribed by the National Data Management Office and other relevant authorities in this regard, in the Kingdom of Saudi Arabia.
• If you submit your personal data to us (whether directly or indirectly), access or use our website, create a verification services account and use the associated services, you must consent to our processing of your personal data as described in this Policy.
• Please read the information set out in this Policy carefully. If you disagree with our processing of your personal data in accordance with this Policy, please do not provide your consent for this Policy, provide us with any personal data (whether directly or indirectly) and / or continue to access or use our website, and the associated verification services.
• Please understand that if you do not consent to this Policy, you will not be able to submit your personal data for verification of your application or create an account and use our services on our website. We will not be liable for any damages or loss suffered by you as a result.
• If you have any questions about the contents of this Policy, please contact us at the email address given in Section ‎12 below.

2. What does this policy cover?

• • Where you submit your personal data directly to us using our website, we act as the ‘controller’ (i.e. person responsible for deciding how your personal data is processed) under applicable law. However, where your personal data is submitted to us for verification by our customer (i.e. your prospective employer), we act as a “joint-controller” with our customer and have adopted this Policy on such customer’s behalf to establish and maintain the privacy and security of your personal data as required by applicable law. This Policy explains:
    • the types of personal data we collect about you and how we collect it.
    • where we collect your personal data from.
    • the legal basis upon which we use your personal data and the purposes for which it is used.
    • how long we keep your personal data and how we dispose of it.
    • Who we share your personal data with, where it is stored and if it is transferred internationally.
    • the different rights you have when it comes to your personal data and how you may exercise them.
    • the security measures we apply to protect your personal data.
    • how you may contact us regarding this Policy.
  • We will not process your personal data except for the purposes for which it has been collected or where we are permitted to do so by law.

3. What personal data do we collect about you and how do we collect it?

• • We may collect personal data shared by you with our customers, or submitted on our website or any website you may be required to access from there. This may include:
    • Information you supply in authorisation forms (whether online or in physical form) through our customers when we provide services to them; or
    • Other information including your full name, passport details, national ID details, email address, address, telephone number, staff number / employee code, seat / roll / hall ticket number, registration / enrolment / licence number, bank account details / receipt number, former and current employers, names of educational institutions you have attended, names of licensing institutions you are licensed with, and any personal data contained within any scanned or photographed documentation, such as your gender and date of birth.
  • It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
  • If you provide us with personal data concerning your relatives, friends or other third parties, by doing so you confirm and guarantee that you have received an appropriate consent from such third parties for the disclosure of their personal data to us for use for the purposes set out in this Policy.
  • Where you access or use our website, we may also collect the following personal data:
    • Data collected automatically (log information): this may include details regarding your usage of our website, IP address, machine data (for example caches, system activity, hardware settings, browser type, date and time of visiting and the total time spent by you per session), cookies, web beacons and other similar technologies.
    • Data collected through cookies: cookies are small text files that a website downloads onto your computer or other internet-enabled devices (such as mobile phones and tablets) when you visit a website. The cookie will help the website recognise your device the next time you visit. We may use both session cookies (disappear after you close your browser) and persistent cookies (remain after you close your browser and may be accessed every time you use or connect to our website). We may collect information like user’s IP address, geographical location, browser / device type and version, operating system, referral source, device, length of visit, page views etc.

(You can block cookies by activating the setting on your browser that allow you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies), you may not be able to access all or parts of our website, or they may not function properly.

4. Where do we collect personal data about you from?

• • We receive your personal data from our customers for verification of your application, or directly from you via our website or through websites you may be required to access from there. However, we (or our processors on our behalf) may also collect such data:
    • directly from a third party (including publicly accessible sources), for example social media platforms, sanctions screening providers, criminal records databases, credit reference agencies, customer due diligence providers, news and media aggregations services, government departments in your current or previous place of residence, and public record archives.
    • from a third party with your consent, for example, former employers, educational institutions, professional bodies etc. that you listed on your application form.
    • from a third party or agency submitting the verification on your behalf.
    • from cookies on our website.

5. What are the legal bases and purposes of using your personal data?

• • We only collect and use your personal data after obtaining your consent to do so. This is generally the only legal basis we rely upon when processing your personal data (although, we may process it without your consent where required or permitted by applicable law). We will only use your personal data for the purposes set out in this Policy. Such purposes include:
    • to provide verification services to our customers in respect of your application.
    • to verify your personal data (including via third parties), analyse such data in relation to the results of our searches, and report to our customers on the accuracy and authenticity of your personal data.
    • to collect and compile statistical data on our user base in order to improve our services and for research and analytical purposes.
    • for use in contacting you in relation to the processing of your application.
    • for use of online services available on our website and for any direct marketing purposes
    • to operate, manage and improve our business.
    • to make any disclosures or undertake any activities required under applicable law or to assist in law enforcement purposes, investigations by local authorities, and to comply with any judicial orders.
    • to prevent and detect any crime or fraud in respect of your application or otherwise.
    • gathering and providing information required by or relating to audits, enquiries or investigations by regulatory bodies.
    • for external audits and quality checks, for example, technical accreditations, data security audits and financial audits.
    • to prevent any unauthorized access and / or modification of our systems.
    • comply with any procedures, laws, and regulations which apply to us where it is necessary for our legitimate interests or the legitimate interests of others.
    • establish, exercise, or defend our legal rights where necessary.

6. How long do we keep your personal data for and how is it disposed?

• • We keep your personal data for no longer, than necessary for the purposes for which it is processed, or when you delete your account (whichever comes first). When you delete your account, you will not be able to access the deleted data or recover it. The length of time for which we retain personal data typically depends on the purposes for which we collected and use it and/or as required to comply with applicable laws.
  • Once we no longer need to keep your personal data we will take reasonable steps to erase it from our systems and ensure it is erased from those systems where it is processed on our behalf.

7. Who do we share your personal data with?

• • To facilitate the purposes set out above, we may transfer, disclose, grant access to or share your personal data with the following parties:
    • our customers.
    • any of our affiliated companies.
    • professional advisors including lawyers, bankers, auditors and insurers.
    • relevant regulators, licensing and other authorities in connection with the verification of your application and personal data.
    • your former or current employer(s), the educational / professional institutes you attended and any licensing or regulatory bodies you are licensed, registered or certified with.
    • in the event that we are involved in bankruptcy, merger, acquisition, reorganization or sale of assets, in which case your personal data may be transferred as part of that transaction. This Policy will apply to your information as transferred to the new entity unless you are notified otherwise.
    • the DataFlow Group who assists us with the verification process
    • third party service providers we may work with including ICT providers who provide us with their products and services including, hosting, operating and maintaining our systems.
    • government authorities in response to legal proceedings; to establish and / or enforce our rights or to protect our property; to defend against legal claims; or as otherwise required by law. We may also share your personal data when we believe it is appropriate to investigate, prevent, or take action regarding illegal or suspected illegal activities.
  • By accepting this Policy you consent to the above sharing and disclosure of your personal data to the extent your consent is a requirement in order for the disclosure to lawfully take place under applicable law.

8. Storage and international transfers of your personal data

• • By accepting this Policy, you consent to the storage of your personal data inside the Kingdom of Saudi Arabia. However, when sharing your personal data with the third parties described above in Section ‎7, such data may be transferred to locations outside the Kingdom of Saudi Arabia. When your personal data is transferred internationally, you can expect a similar degree of protection as applied in the Kingdom of Saudi Arabia.
  • We will always fulfil any requirements in relation to the international transfers of personal data under applicable laws. For more information about these transfer mechanisms, please contact us using the contact details given below.

9. Security of your personal data

• • We consider the confidentiality and security of your personal data to be of the utmost importance. We take a variety of technical, administrative, and physical measures to protect your personal data from unauthorized disclosure to or access by third parties. However, please note that we do not guarantee the security of personal data, as no method of internet transmission or storage is completely secure. In the event that the security of your personal data is compromised, we will take the necessary actions required under applicable law to restore its security.

10. Changes to this policy

• • Please note that we review our privacy practices from time to time, and that these practices are subject to change. Any change, update, or modification will be effective immediately upon posting on our website. If we make a material change to the Policy, you may be provided with appropriate notice in accordance with legal requirements. You must read and accept the Policy every time it is updated. Otherwise, your access and use of our website and the associated verification services is not permitted.

11. Your rights

• • You have certain rights under in accordance with applicable law including:
    • The right to be informed of the legal basis and purposes of collection and use of your personal data. (We comply with this requirement by providing this Policy to you).
    • The right to have access to your personal data and obtain a copy of it in a clear format.
    • The right to request rectification, completion or updating of your personal data that we control.
    • The right to request the erasure of your personal data which we no longer need to process for the purposes for which it was collected.
    • The right to object to our processing of your personal data and withdraw your consent at any time unless otherwise required under applicable law.
    • The right to portability of your data i.e. having it transmitted to another data controller without hindrance from us.
  • Your rights may be subject to any exemptions permitted by applicable law or otherwise required to protect the rights of others.
  • Please contact us at the contact details below if you wish to exercise your rights in relation to your personal data. We may ask you to provide suitable identification when you seek to make any of these requests, in order to verify your identity.

12. How can you contact us?

• • If you are unhappy with how we’ve handled your personal data or have further questions on the processing of your personal data, you may contact us using the following email address: dpo@watheeq.co.