Privacy Policy

Who we are and the scope of this policy

Wuzmiq is the controller of the personal data described in this policy — the party that decides why and how that data is processed, within the meaning of the Personal Data Protection Law. Our head office is in Riyadh, Kingdom of Saudi Arabia.

The policy applies to data collected through our website, trading platform and mobile applications, and through your correspondence with our Client Care team. Questions about it can be sent at any time to [email protected].

Personal data we collect

We follow the principle of data minimisation and collect only what the purposes in this policy require:

• Identity and contact data: first name, last name, email address and mobile number, provided when you complete the account-opening or Client Care form.
• Verification data: a copy of your national ID, Iqama or passport and proof of address, collected when you activate a live trading account, to meet know-your-customer, anti-money-laundering and counter-terrorist-financing requirements.
• Financial and trading data: your chosen funding method (mada, bank transfer, credit card or digital assets), deposit and withdrawal history, executed orders, and the risk settings and strategies you select. Full card details are not stored on our servers; they are handled by specialist payment providers.
• Technical data: your IP address and the approximate country derived from it, device, browser and operating-system type, the pages you visit and the time of your visit.
• Referral data: reference identifiers and campaign parameters contained in the link that brought you to us.
• Correspondence: the content of your messages to Client Care and a record of our communications with you.

Legal bases for processing

We process personal data only where the PDPL provides a lawful basis for doing so, namely:

• Consent: when you voluntarily submit your details through our forms or opt in to marketing messages. You may withdraw your consent at any time.
• Performance of an agreement: when processing is necessary to deliver services you have requested, or to take steps at your request before your account is opened.
• Legal obligation: when laws in force in the Kingdom require us to process or retain specific data, such as anti-money-laundering rules.
• Legitimate interest: when processing non-sensitive data is necessary to protect the platform and its clients from fraud and unauthorised access, or to improve our services, provided it does not harm your rights and interests.

How we use your data

We use your data for the following specified purposes only and never process it further in a way that is incompatible with them:

• Receiving your account application and contacting you to complete activation and identity verification.
• Operating your account, executing orders under the strategies and risk limits you set, and processing deposits and withdrawals in Saudi riyals.
• Answering your enquiries and providing support through Client Care.
• Sending essential service and security notifications, and marketing messages where you have agreed to receive them.
• Detecting and preventing fraud and suspicious activity, and safeguarding the security and integrity of the platform.
• Improving the website and the AI engine using aggregated statistics that do not identify you.
• Complying with applicable law and responding to lawful requests from competent authorities.

Cookies and local storage

Our website relies on a small number of cookies and browser-storage technologies, none of which is used to build an advertising profile of you. The main ones are:

• The wuzmiq_ticker cookie: a functional cookie that caches the digital-asset prices shown in the price ticker for 24 hours, so pages load faster and repeat requests are avoided. It holds no personal data.
• Sign-up form hand-off: when you submit the account-opening form, the details you entered are held briefly in your browser's local storage so they can be carried to the confirmation page, which then transmits them to our client-application system. They are removed from your browser as soon as the transfer succeeds.
• Campaign reference identifiers: local storage may retain the identifier of the campaign through which you arrived, so your application is attributed to the right source and campaign effectiveness can be measured.
• Strictly necessary cookies: required for the website to run securely; disabling them may affect its core functions.

You can delete or block cookies and stored data through your browser settings at any time. Please note that doing so may disable certain features, such as the price ticker or completion of the sign-up process.

Disclosure and processors

We do not sell or rent your personal data. We disclose it, to the minimum extent necessary, only to:

• Hosting, cloud-infrastructure and client-relationship-management providers we use to receive and follow up on account applications.
• Identity-verification and payment-processing providers, and the banks through which deposits and withdrawals are made.
• Supporting technical providers, such as the IP-based country lookup that pre-selects your international dialling code on our forms, and advertising measurement tags when you reach us through a campaign.
• Competent government and judicial authorities, where a legal obligation or official request so requires.
• Any entity that acquires all or part of our business through a restructuring or merger, provided it maintains an equivalent level of protection.

Every processor acting on our behalf is bound by a written agreement to process data only on our instructions, to keep it confidential and to apply appropriate security controls.

Transfers outside the Kingdom

Wherever practicable, we process and store your data within the Kingdom of Saudi Arabia. Where delivering the service requires data to be transferred or disclosed to a party outside the Kingdom — a technology provider or an international liquidity venue, for example — we comply with the PDPL and the regulations governing transfers of personal data outside the Kingdom, including by:

• limiting each transfer to the minimum data needed for its purpose;
• confirming that the recipient offers an adequate level of protection, or putting appropriate safeguards in place, such as standard contractual clauses;
• carrying out a transfer risk assessment wherever the regulations call for one; and
• ensuring that no transfer prejudices national security or the vital interests of the Kingdom.

Data retention

We keep personal data only for as long as the purpose for which it was collected requires:

• Account, trading and verification data: for the duration of our relationship, then for the period required by applicable law after the account is closed, including anti-money-laundering and record-keeping rules.
• Incomplete applications: for a shorter period proportionate to the purpose, after which the data is destroyed or anonymised.
• The wuzmiq_ticker cookie: expires automatically 24 hours after it is set.
• Sign-up data in local storage: deleted from your browser as soon as it has been transferred successfully.

When a retention period ends, we destroy the data securely so that it cannot be recovered, or anonymise it so that it can no longer be linked to you.

Data security

We apply organisational, administrative and technical measures proportionate to the nature and sensitivity of the data, including:

• 256-bit SSL/TLS encryption in transit, and encryption of data stored on our servers.
• Mandatory two-factor authentication for account access.
• Need-to-know access controls, with audit logs for every access event.
• Independent security reviews and penetration tests every three months.

Should a breach or unauthorised access occur that may affect your data, we will notify the competent authority and inform you within the timeframes and procedures set by law. No transmission over the internet, however, can be guaranteed to be completely secure.

Your rights under the PDPL

The PDPL gives you a set of rights over your personal data, which you may exercise at any time:

• Right to be informed: of the legal basis and purpose for collecting your data, which this policy provides.
• Right of access: to view the data we hold about you and obtain a copy in a clear, readable format.
• Right to correction: to have inaccurate data corrected, incomplete data completed or outdated data brought up to date.
• Right to destruction: to request that your data be destroyed once it is no longer needed, unless the law requires us to keep it.
• Right to withdraw consent: for any processing based on consent, without affecting the lawfulness of processing carried out before the withdrawal.
• Right to complain: to the competent supervisory authority, the Saudi Data & Artificial Intelligence Authority (SDAIA), if you believe your data has been processed in breach of the Law.

To exercise any of these rights, write to [email protected]. We may ask you to verify your identity before acting on a request, and we will respond within the timeframes set by the Implementing Regulations.

Children's privacy

Our services are intended solely for individuals aged 18 and over, and we do not knowingly collect personal data from anyone younger. If we learn that we have received a minor's data without a guardian's consent, we will destroy it promptly and close any related application.

Changes to this policy and how to reach us

We may revise this policy from time to time to reflect changes in our services or in legal requirements, and the date of the latest revision always appears at the top of this page. If we make a material change, we will tell you by email or through a clear notice on the platform before it takes effect.

For any question about this policy or the way your data is handled, contact us at [email protected]. Our Riyadh-based team is available Sunday to Thursday, 9:00–18:00 Riyadh time (GMT+3).