Privacy Policy

For personal data of Employees processed to deliver the Widd benefits app (offers, rewards, redemption, wallet balance, in-app activity), Widd acts as the data controller.

For personal data of Employees that an Employer uploads or instructs us to process for the Employer’s own administrative purposes (for example, seat allocation, HR reconciliation, or offboarding), the Employer is the controller and Widd acts as data processor on the Employer’s documented instructions.

Account data: full name, mobile number, work email, employer name, job title where provided, and language preference.

Authentication data: one-time passcodes, device identifier, session tokens, and login timestamps.

Benefit-usage data: offers viewed, offers redeemed, redemption timestamps, redemption amount and merchant, reward points earned and spent, gift card balances, and savings calculated per redemption.

Device and technical data: device model, operating system, app version, IP address, crash logs, and diagnostic events strictly needed to operate the app.

Optional profile data that the Employee chooses to provide (for example, city or interests) to receive more relevant offers.

We do not intentionally collect sensitive personal data (health, religious belief, biometric identifiers, credit data) through the Widd app.

Company details: legal name, commercial registration number, VAT number where applicable, billing address, and the name and contact details of the Employer’s designated administrator.

Roster data provided by the Employer to activate seats: Employee name, work email or mobile, employment status, and department where the Employer chooses to share it.

Billing data: subscription tier, invoice history, and payment method reference (Widd does not store full card numbers; payment credentials are handled by a payment processor).

Performance of a contract with the User — to create the account, deliver offers, process redemptions, issue reports, and provide customer support.

Compliance with a legal obligation — including tax, accounting, anti-fraud, and record-keeping obligations under Saudi law.

Legitimate interests of Widd — to secure the service, prevent abuse, measure aggregate usage, and improve the product, balanced against the rights of the data subject.

Consent — for optional processing that is not necessary for the service, for example marketing communications. Consent can be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

The Employer sees only aggregate indicators about its workforce, such as: number of seats activated, percentage of active Employees, total redemptions in the period, total savings delivered to Employees, most-used offer categories, and top-performing rewards campaigns.

The Employer does not see which individual Employee redeemed which offer, does not see individual purchase amounts, does not see individual wallet balances, and does not see individual browsing behavior in the app.

The only per-Employee data returned to the Employer is data the Employer originally provided (roster and seat status) plus a per-Employee “activated / not activated” flag needed for seat administration.

Partner merchants receive only the minimum data required to honor a redemption — typically a redemption code, the offer identifier, and, where the offer requires it, a masked reference to the Employee. Merchants do not receive Employee contact details unless the Employee explicitly shares them at point of sale.

We use processors to host the service, deliver one-time passcodes, process payments, send transactional messages, monitor errors, and support customers. Each processor is bound by a written data processing agreement and is permitted to process personal data only on Widd’s instructions and for the purposes described in this policy.

A current list of subprocessors is available on request from privacy@widd.sa.

Widd stores personal data primarily on infrastructure located in the Kingdom of Saudi Arabia. Where a specific processor is located outside the Kingdom, we transfer data only under the conditions permitted by PDPL and its Implementing Regulations, including transfers necessary to perform the contract with the User and transfers based on appropriate safeguards or specific authorizations issued by the competent authority.

Employee account data is retained for the duration of the seat and for a further 12 months after the seat is deactivated, to support disputes, refunds, and the Employee’s right to reactivate.

Redemption and financial records are retained for the period required by Saudi tax and commercial law, currently 10 years from the date of the transaction.

Support communications are retained for 24 months from the date of the last exchange.

Aggregated and de-identified statistics that no longer identify a User may be retained indefinitely.

Subject to the conditions and exceptions set out in PDPL, Employees and Employers have the right to: be informed about the processing of their personal data; access their personal data; request correction of inaccurate data; request destruction of personal data no longer needed for the original purpose; and withdraw consent for processing based on consent.

To exercise any of these rights, contact privacy@widd.sa from the email address on file. We respond within the period required by PDPL. If you believe your rights have not been respected, you may file a complaint with the competent Saudi authority (SDAIA).

We apply administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, alteration, disclosure, or destruction. These include encryption in transit, access controls on our internal systems, logging, and periodic review of who can access what.

No system is perfectly secure. If we become aware of a personal data breach affecting Users, we will notify affected Users and the competent authority in accordance with PDPL.

Data protection questions and rights requests: privacy@widd.sa.

General inquiries: hello@widd.sa.

Postal address will be added once the commercial registration is finalized.

We may update this policy from time to time. Material changes will be notified in-app or by email to the Employer’s designated administrator, with a reasonable period before the changes take effect.