Privacy Policy

Introduction

urwave Company (Commercial Registration No. 7052775355), operating under the trade name "urWave" ("Company", "we", "us", or "our"), is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (urwave.com), use our mobile applications, or engage with our SaaS platforms and services (collectively, the "Services"). We are registered in the Kingdom of Saudi Arabia and comply with the Saudi Personal Data Protection Law (PDPL), GDPR for European users, and other applicable data protection regulations. By accessing or using our Services, you consent to the practices described in this Privacy Policy. If you do not agree with this policy, please do not use our Services.

Information We Collect

We collect information you provide directly to us, including: Personal Identifiers (name, email address, phone number, postal address, national ID where required by law); Account Information (username, password, account preferences); Payment Information (credit card details, billing address - processed securely through PCI-DSS compliant third-party payment processors); Communication Data (messages, support requests, feedback); Professional Information (company name, job title, industry, commercial registration number for business accounts). We also automatically collect: Device Information (IP address, browser type, operating system, device identifiers); Usage Data (pages visited, features used, time spent, click patterns); Location Data (country, city based on IP address); Cookies and Tracking Technologies (session cookies, persistent cookies, pixels, web beacons).

How We Use Your Information

We use your information to: Provide, maintain, and improve our Services; Process transactions and send related information including invoices and VAT documentation; Create and manage your account; Respond to your comments, questions, and support requests; Send promotional communications (only with your explicit opt-in consent, which you can withdraw at any time); Monitor and analyze trends, usage, and activities to improve user experience; Detect, investigate, and prevent fraudulent or unauthorized activities; Personalize and improve your experience; Comply with legal obligations under Saudi law and enforce our terms; Communicate about updates, security alerts, and administrative messages.

How We Share Your Information

We do not sell, rent, or trade your personal information to third parties for marketing purposes. We may share your information with: Service Providers (hosting, analytics, payment processing, customer support - all vetted for compliance); Business Partners (with your explicit consent for integrated services); Legal Requirements (to comply with Saudi Arabian laws, PDPL regulations, court orders, or government requests from authorized authorities); Business Transfers (in connection with mergers, acquisitions, or asset sales, with prior notice to affected users); With Your Consent (when you explicitly authorize sharing). All third-party service providers are contractually obligated to protect your data, maintain confidentiality, and use it only for specified purposes in compliance with applicable laws.

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and store information. Types of cookies we use: Essential Cookies (required for basic functionality and security - cannot be disabled); Analytics Cookies (help us understand how visitors use our site - you can opt out); Marketing Cookies (used to deliver relevant advertisements - require your consent); Preference Cookies (remember your settings and language choices). You can manage cookie preferences through our cookie consent banner or your browser settings. Disabling certain cookies may limit functionality of our Services. We also use Google Analytics (with IP anonymization enabled) for website analytics. For detailed information, see our Cookie Policy.

Data Security

We implement industry-standard and Saudi National Cybersecurity Authority (NCA) compliant security measures to protect your personal information, including: SSL/TLS encryption for all data in transit; AES-256 encryption for sensitive data at rest; Regular security assessments and penetration testing by certified professionals; Role-based access controls and multi-factor authentication; Employee training on data protection and cybersecurity awareness; Incident response procedures compliant with Saudi PDPL notification requirements; Secure data centers with physical and logical access controls. While we strive to protect your information, no method of transmission over the Internet is 100% secure. We are committed to promptly notifying affected users and relevant authorities of any data breaches as required by law.

Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. In accordance with Saudi PDPL and international standards, when determining retention periods, we consider: The nature and sensitivity of the data; Legal and regulatory requirements (including 7-year retention for financial records as per Saudi Commercial Law); Business and operational needs; Your preferences and consent. When data is no longer needed, we securely delete or anonymize it using industry-standard methods in accordance with our data retention policies.

Your Rights and Choices

Under the Saudi Personal Data Protection Law (PDPL), GDPR, and other applicable regulations, you have the following rights: Access (request a copy of your personal data we hold); Rectification (correct inaccurate or incomplete data); Erasure (request deletion of your data, subject to legal retention obligations); Restriction (limit how we process your data); Data Portability (receive your data in a structured, commonly used format); Object (opt-out of certain processing activities including direct marketing); Withdraw Consent (revoke previously given consent at any time); Lodge Complaints (with the Saudi Data & AI Authority (SDAIA) or relevant supervisory authority). To exercise these rights, contact us at privacy@urwave.com. We will respond within 30 days as required by law. EU/EEA residents have additional rights under GDPR.

Legal Basis for Processing

We process personal data based on the following legal grounds as recognized under Saudi PDPL and GDPR: Contractual Necessity (to provide our Services as agreed); Legitimate Interests (to improve our Services, prevent fraud, ensure security); Legal Obligations (to comply with Saudi Arabian laws, tax requirements, and regulatory obligations); Consent (for marketing communications, cookies, and optional data processing); Vital Interests (in emergency situations to protect life or safety); Public Interest (when required for public health or safety). For Saudi residents, processing complies with PDPL requirements. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

International Data Transfers

Your information may be transferred to and processed in countries other than the Kingdom of Saudi Arabia. These countries may have different data protection laws. When we transfer data internationally, we implement appropriate safeguards as required by Saudi PDPL and GDPR, including: Standard Contractual Clauses (SCCs) approved by relevant authorities; Adequacy decisions where applicable; Binding Corporate Rules for intra-group transfers; Your explicit consent when required. We ensure that recipients of your data provide protection equivalent to that required under Saudi law. Data transferred to the European Economic Area is protected in accordance with GDPR requirements.

Children's Privacy

Our Services are not intended for children under 18 years of age in Saudi Arabia, or under 16 years in other jurisdictions. We do not knowingly collect personal information from minors without parental consent. If we learn that we have collected personal information from a child without appropriate consent, we will take steps to delete that information promptly. If you believe we have collected information from a minor, please contact us immediately at privacy@urwave.com.

Third-Party Links and Services

Our Services may contain links to third-party websites, applications, or services that are not operated by us. This Privacy Policy does not apply to third-party services. We encourage you to review the privacy policies of any third-party services you access. We are not responsible for the content, privacy policies, or practices of third-party services. Any integration with third-party services (including social media platforms like Meta/Facebook) is subject to those platforms' own privacy policies.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by: Posting the updated policy on our website with a new "Last Updated" date; Sending email notification to registered users for significant changes; Displaying prominent notice within our Services. Changes are effective 30 days after posting for existing users. Your continued use of our Services after the effective date constitutes acceptance of the updated Privacy Policy. If you disagree with changes, please discontinue use and contact us to delete your data.