Privacy Policy

1. Who we are

WAK Training & Consulting operates the Service and is the controller of the personal data described in this policy. You can reach us at any time using the details in section 16, or through our Contact Us page.

2. Information we collect

We only collect data that the Service needs in order to run training programs and issue recognised certificates. We do not buy personal data from third parties and we do not build advertising profiles.

• Account and identity data — your full name, email address, mobile number, gender, date of birth, preferred language, national identity number (for trainees, because certificates are issued against it), and the company or training provider you belong to.
• Account credentials — your password, which is stored only as a one-way cryptographic hash and is never visible to us or to your employer.
• Training records — the courses and programs you are enrolled in, attendance, session schedules, exam and assessment results, practical evaluations, skill evaluations, questionnaires, withdrawal or transfer requests, and the certificates issued to you.
• Documents and files — identity documents, training materials and any file you or your organisation uploads to your record, together with the profile photo you choose to add.
• Communications — messages you send through the in-app messaging and support screens, and any message you send us through the contact form on this website.
• Device and notification data — when you enable notifications, we store a push notification token, your device platform (iOS or Android), the app version and your language, so that alerts about your training reach the right handset.
• Technical and usage data — your IP address at sign-in, the time of your last login, and standard server logs used to keep the Service secure and available.

3. Device permissions the mobile app asks for

The mobile app requests the following permissions. Each one is optional, is requested only at the moment the related feature is used, and can be withdrawn at any time in your device settings — the rest of the app keeps working without it.

• Notifications — to alert you about upcoming sessions, exam windows, results and messages.
• Camera and photo library — only if you choose to set a profile photo or upload a document or training material.
• Files and storage — only to save a certificate or training material you have chosen to download.

4. What we do not collect

The Service does not collect your GPS or precise device location, does not access your contacts, calendar, microphone or health data, and does not track you across other companies' apps or websites. Any "location" shown in the app is the address of a training venue entered by an administrator, not a reading from your device.

5. How we use your information

We use personal data only for the purposes below:

• To create and secure your account and authenticate you when you sign in.
• To enrol you in training programs, schedule sessions and record attendance.
• To deliver exams and evaluations and to record their results.
• To issue, verify and reissue training certificates.
• To send you operational notifications about your training — schedule changes, exam windows, results, and messages from trainers or administrators.
• To report training progress and completion to the training provider and to the company sponsoring your training, where one is involved.
• To respond to your support requests and to the messages you send us.
• To keep the Service secure, detect misuse and troubleshoot faults.
• To meet legal, regulatory and accreditation obligations that apply to vocational training in the Kingdom of Saudi Arabia.

6. Our legal basis

We process personal data under the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations, on the basis of: performance of the training contract or enrolment you or your employer entered into; compliance with our legal and accreditation obligations; our legitimate interest in operating and securing the Service; and, where required, your consent — for example, before we send push notifications.

7. When we share your information

We do not sell your personal data and we do not share it for advertising. We share it only in these situations:

• Your training provider — the training company delivering your program can see your enrolment, attendance, assessment results and certificates.
• Your sponsoring company or employer — if a company enrolled you or is paying for your training, its authorised administrators can see your attendance, progress, results and certificates for that training. They cannot see your password or your private messages with support.
• Service providers — hosting, email delivery and push notification providers that process data strictly on our instructions and under a written agreement.
• Regulators and authorities — where accreditation bodies or a competent authority lawfully require training records, or where disclosure is required by law or to establish or defend a legal claim.

8. How long we keep your data

We keep your account and training data for as long as your account is active. After your account is closed, we keep training records and issued certificates for as long as the applicable accreditation and record-keeping rules require them to remain verifiable, and then delete or anonymise them. Server and security logs are kept for a short period and then discarded. Support messages are kept only as long as needed to resolve and audit the request.

9. How we protect your data

All traffic between your device and the Service is encrypted in transit (HTTPS/TLS). Passwords are stored only as one-way hashes. Access is controlled by role, so an administrator, a trainer and a trainee each see only what their role requires. Uploaded documents and certificates are held on private storage and are served only through authenticated, permission-checked links — they are never left openly downloadable. We keep an activity log of significant changes to records.

No system can be guaranteed perfectly secure. If a personal data breach occurs that puts your rights at risk, we will notify the competent authority and affected users as required by the PDPL.

10. Your rights

Under the PDPL you have the right to:

• Be informed about how and why your personal data is processed.
• Request access to your personal data and obtain a copy of it.
• Request correction of data that is inaccurate, incomplete or out of date.
• Request deletion of your personal data, unless we are required to keep it — for example, a certificate that must stay verifiable.
• Withdraw consent you have given, such as consent to push notifications, at any time.
• Object to processing, and complain to the competent supervisory authority in the Kingdom of Saudi Arabia.

11. Deleting your account and your data

You can ask us to delete your account and the personal data associated with it at any time. Email privacy@waktraining.com from the address registered on your account, or use the form on our Contact Us page, with the subject "Account deletion request".

We verify the request, then delete your profile, contact details, uploaded documents, profile photo, messages and device push tokens. We respond within 30 days. Training records and issued certificates required by accreditation or legal rules are retained for the mandated period, unlinked from your contact details where possible, and then deleted.

12. Children

The Service is intended for adult vocational training and is not directed at children under 13. Where a trainee is under the age of legal majority, enrolment is arranged by their guardian, employer or training provider. If you believe a child has provided us with personal data directly, contact us and we will delete it.

13. Cookies and local storage

The website uses strictly necessary cookies only: a session cookie to keep you signed in, a security token to protect forms against cross-site request forgery, and a cookie remembering your language choice. We do not use advertising or third-party tracking cookies. The mobile app stores your session token and preferences locally on your device so you do not have to sign in each time.

14. Where your data is held

Your data is hosted on servers operated for us under contract. Where data is processed outside the Kingdom of Saudi Arabia, we do so only under the conditions the PDPL allows and with appropriate safeguards in place with the provider.

15. Changes to this policy

If we change this policy we will update the "Last updated" date at the top of this page and, where the change is significant, notify you in the app or by email. Continuing to use the Service after a change means you accept the updated policy.

16. Contact us

For any question about this policy, or to exercise any of the rights above, contact us at: