Privacy Policy

This Privacy Policy describes how Wazeh360(“we”, “our”, “us”) collects, uses, and protects personal data when you use the Wazeh360 eInvoicing platform at wazeh360.com, related subdomains, and associated services (collectively, the “Service”).

Wazeh360 is the product brand for this Service. Until the dedicated Wazeh360 legal entity is fully launched, the Service is operated by The Ignite Marketing FZ LLC, a company registered in Dubai, United Arab Emirates, which acts as the data controller for personal data processed through the Service. When the Wazeh360 operating company is formally established, this policy will be updated and you will be notified of material changes as described in Section 12.

We are committed to protecting your personal data in accordance with the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (“UAE PDPL”), and where applicable, the EU General Data Protection Regulation (“GDPR”).

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of the Service.

• Providing and improving the Wazeh360 eInvoicing platform
• Processing and transmitting invoices via the UAE Peppol network
• Verifying UAE FTA compliance (TRN validation, ASP appointment)
• Sending transactional emails (account verification, password reset, invoice delivery)
• Security monitoring (detecting unauthorised access, new device sign-ins)
• Sending service announcements and billing notifications
• Preventing fraud and abuse
• Fulfilling legal and regulatory obligations under UAE law

We do not sell your personal data. We do not use your data for advertising purposes. We do not train AI or machine-learning models on your invoice data.

We process your personal data on the following legal bases:

• Contract performance: Processing your account, invoice, and organisation data is necessary to deliver the Service you have contracted for.
• Legal obligation: Retention of tax invoice records for 7 years as required by the UAE Federal Tax Authority.
• Legitimate interests: Security monitoring, fraud prevention, and product analytics (where you have accepted analytics cookies).
• Consent: Analytics cookies, where you have opted in via our Cookie Preferences banner.

We share data with the following sub-processors solely to operate the Service. All sub-processors are contractually bound to process data only on our documented instructions and to apply appropriate security measures.

• Tax invoice records: Retained for a minimum of 7 years from the invoice date, as required by UAE Federal Tax Authority regulations.
• Account and profile data: Retained for the duration of your subscription plus 90 days after cancellation, unless a longer period is required by law.
• Audit logs: Retained for 2 years for security and compliance purposes.
• Server logs: Retained for 30 days, then automatically deleted.
• Analytics data: Retained for 12 months.

When retention periods expire, data is securely deleted or anonymised. Tax records required by the FTA cannot be deleted early on request; we will inform you of this obligation if you submit a deletion request.

• All data encrypted in transit using TLS 1.2 or higher
• All data encrypted at rest using AES-256 (managed by Supabase)
• Row-Level Security (RLS) policies ensure organisations can only access their own data
• Password hashing using bcrypt with a minimum cost factor of 12
• Login notifications for new device sign-ins
• Rate limiting on all authentication endpoints
• Security headers including HSTS, X-Frame-Options, and Content Security Policy
• Dependency vulnerability scanning via automated tooling

Despite these measures, no system is 100% secure. Please notify us immediately at security@wazeh360.com if you believe your account has been compromised.

As a data subject under the UAE Personal Data Protection Law, you have the following rights:

• Right of access: Request a copy of all personal data we hold about you. Use the “Export all data” feature in Settings → Security, or email privacy@wazeh360.com.
• Right to correction: Request correction of inaccurate or incomplete data. You can update most data directly in your account settings.
• Right to erasure: Request deletion of your personal data, subject to legal retention requirements (e.g., tax records).
• Right to data portability: Request your data in a machine-readable format (JSON). Available via Settings → Security → Export data.
• Right to restrict processing: Request that we limit how we use your data in certain circumstances.
• Right to object: Object to processing based on legitimate interests.

To exercise these rights, contact privacy@wazeh360.com. We will respond within 30 days. Some requests may be subject to verification of your identity.

We use a cookie consent banner on your first visit. Your preference is stored in your browser's local storage. You can change your preference at any time using the “Cookie Preferences” link in the footer.

Essential cookies (authentication sessions) are required for the Service to function and cannot be disabled. Rejecting non-essential cookies disables PostHog analytics but does not affect your ability to use the Service.

Some of our sub-processors are located outside the UAE, including in the USA and EU. Where we transfer personal data outside the UAE, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the EU Commission
• Transfers to the EU are protected by GDPR, which provides adequate protection under UAE PDPL standards
• Contractual data processing agreements with all sub-processors

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with data, please contact privacy@wazeh360.com immediately.

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by updating the “Last updated” date above. For significant changes, we will provide at least 30 days' notice before the new policy takes effect. Your continued use of the Service after the effective date constitutes acceptance.

For any privacy-related questions, rights requests, or concerns:

• Email: privacy@wazeh360.com
• Brand: Wazeh360
• Data controller (current operator): The Ignite Marketing FZ LLC, Dubai, UAE (operating Wazeh360 pending the dedicated entity launch described in Section 1)

We aim to respond to all enquiries within 5 business days and to resolve requests within 30 days.