Privacy policy
This is an early draft explaining how Wafii handles data. It has not been legally reviewed yet and may change before public launch.
Who is responsible for the data
A business’s customer data (phone number, first name, visits, consent records) is controlled by that business. Wafii processes it on the business’s behalf, only to run its loyalty programme.
Data sent through the “Request a demo” form on this website is controlled by the Wafii team.
What we collect
From the website form: your name, business name, phone number, and anything you choose to add (email, city, business type, number of branches, message).
From the in-store tablet: phone number, a new customer’s first name, their acceptance of the programme terms (which include offer messages by SMS and WhatsApp) with its timestamp and text version, and a birthday if the customer shares it.
From the staff app: confirmed or rejected visits, bill amounts entered by staff, redemptions, and an audit log.
Why we use it
To run the loyalty programme: counting visits, points and gifts.
To send offer messages by SMS and WhatsApp to programme members, who agreed to them when joining, through the business’s own provider account.
To contact you about your demo request.
Consent and withdrawal
Joining the loyalty programme includes agreeing to receive offers and reminders by SMS and WhatsApp; customers accept this explicitly when they sign up.
Messages can be stopped at any time at the counter tablet or by replying STOP. Stopping them means leaving the programme; gifts already earned stay valid until they expire, and customers can re-join on any visit.
Where data is stored
The service runs on Cloudflare’s cloud infrastructure, and data is stored outside Jordan.
Security
Each business’s data is isolated, messaging provider keys are encrypted, access is role-based, and sensitive actions are logged.
Retention
[To be defined after legal review.]
Your rights
Customers can ask to access, correct or delete their data through the business they visited. People who requested a demo can contact us for the same purposes.
Applicable law
We are working towards compliance with Jordan’s Personal Data Protection Law No. 24 of 2023. Legal review is ongoing and we hold no compliance certification.
Contact
[Official contact address to be added before launch.]