Weka Accounting System — Privacy Policy
Last updated: 18 October 2026 — Version 1.0
1. Who We Are and the Scope of This Policy
Digital Style Information Technology Company, the operator of Weka, is committed to protecting personal data in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its regulations.
1.1 The Company: Digital Style Information Technology Company (شركة الأسلوب الرقمي لتقنية المعلومات), Commercial Registration No. 1010343270, VAT No. 300897673300003, national address: 7306 King Fahd Branch Road, Al-Wesham District, Riyadh 12735 (RBGC7306). Data protection email: [email protected].
1.2 Scope: This Policy applies to the Weka website, the Weka accounting system and its applications, and the related support channels. It forms an integral part of the Terms and Conditions.
1.3 Our Role: We act in two different capacities, and each defines our obligations:
| Type of data | Our role | What it means in practice |
|---|---|---|
| Data about the Subscriber and its Users (name, mobile number, email, payment and billing details) | Controller | We determine the purposes of processing and bear the legal obligations toward the data subjects. |
| Data the Subscriber enters about its customers, employees, and suppliers within the system | Processor | The Subscriber is the controller; we process the data on its instructions and solely to provide the Service. |
1.4 If you are a customer of a Weka Subscriber and wish to exercise your rights over your data, please contact the business you deal with first. We will help it fulfill your request.
2. Data We Collect and Why
We collect the minimum data needed to provide the Service and meet our legal obligations, and we do not use it for any purpose other than those described below.
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Registration and account data | Contact person's name, mobile number, email, business name, commercial registration, VAT number, national address | Creating the account, verifying the business, communication | Performance of the contract |
| Subscription and payment data | Plan, subscription dates, invoices, payment status | Collecting fees and issuing tax invoices | Performance of the contract and legal obligation |
| Technical usage data | IP address, browser and device type, login times, activity logs | Security, fraud detection, troubleshooting, auditing | Legitimate interest and legal obligation |
| Support data | Content of tickets, conversations, and attachments | Resolving the Subscriber's issues and improving support | Performance of the contract |
| Subscriber operational data | Invoices, customers, suppliers, products, journal entries, employees | Providing the Service and submitting invoices to ZATCA | The Subscriber's instructions, as processor |
| Optional marketing data | Email or mobile number for newsletters and offers | Sending news and offers | Consent, which can be withdrawn at any time |
We do not collect or request sensitive data, such as health or religious data. A Subscriber may enter such data into the system only at its own responsibility and under its own legal basis.
3. Data Sharing and Sub-processors
We do not sell or lease personal data, and we share it only with the parties listed below, to the extent each one needs.
| Recipient | What it receives | Purpose | Location |
|---|---|---|---|
| Zakat, Tax and Customs Authority (FATOORA platform) | E-invoice data | Compliance with e-invoicing requirements | Saudi Arabia |
| Hosting provider | All Service data (stored with it) | Running the system | European Union |
| Cloudflare | Encrypted traffic and IP addresses | Protection against attacks and faster access | Global network |
| Payment gateway: MyFatoorah | Payment transaction data (we do not store card numbers) | Collecting subscription fees | According to the provider's operating locations |
| Email providers: Zoho and Google | Recipient address and message content | Sending notifications and invoices | According to each provider's account region |
| Disaster-recovery backup storage provider | An encrypted copy it cannot read | Service continuity | Outside Saudi Arabia |
| Official and judicial authorities | Whatever is required by law | Compliance with a binding legal request | Saudi Arabia |
We bind every sub-processor to written protection controls no less strict than this Policy. When we add a new sub-processor, we update this table and notify Subscribers a reasonable time before it goes live.
When a Subscriber enables optional integrations, such as sending invoices via WhatsApp or connecting to delivery apps, the necessary data is transferred to that party at the Subscriber's request and is also subject to that party's terms.
4. Storage Location and Transfers Outside Saudi Arabia
The system runs on servers in the European Union, and a full copy of the data is kept daily inside the Kingdom of Saudi Arabia.
4.1 Production server: The system is hosted by a hosting provider in the European Union that is subject to the EU General Data Protection Regulation (GDPR) and has no right to access or use the data for any purpose.
4.2 Copies inside Saudi Arabia: A full backup is taken daily and stored inside the Kingdom at two separate sites owned by the Company, so that Subscriber data and records remain available inside the Kingdom at all times. An additional encrypted copy is kept with a storage provider for disaster recovery, and its decryption keys remain inside the Kingdom with us alone.
4.3 Transfer safeguards: We transfer data outside the Kingdom in accordance with the Personal Data Protection Law and the Regulation on the Transfer of Personal Data Outside the Kingdom. This includes assessing risks before the transfer, applying the appropriate safeguards specified by the competent authority, such as standard contractual clauses, and limiting the transfer to what is needed to provide the Service. We stop the transfer if the competent authority determines that these safeguards are insufficient.
4.4 Encrypted traffic may pass through a global protection network to defend against attacks, without Service data being stored on it.
5. Data Retention
We keep data for the duration of the subscription and then for the periods shown in the table below, after which it is securely deleted.
| Type of data | Retention after the subscription ends |
|---|---|
| Subscriber operational data (invoices, journal entries, etc.) | 90 days available for export, then 12 months in a closed archive, then final deletion after two notices |
| Subscription invoices issued by the Company to the Subscriber and related accounting records | For as long as tax and commercial laws require of the Company |
| Login and security logs | 12 months from creation |
| Support tickets | 24 months from closure |
| Backups | Replaced automatically in their normal rotation |
| Marketing data | Until consent is withdrawn |
Note for Subscribers: the law requires you to keep your invoices and tax records for periods that may exceed how long we keep them after your subscription ends. Export what you need during the export period.
6. Data Security and Breach Notification
We apply multiple layers of technical and administrative controls and review them regularly.
- Encrypted connections between the browser and the system using SSL/TLS certificates.
- Firewalls and intrusion detection and prevention systems, with administrative ports closed to the public.
- Need-based, restricted access for our team, with sensitive operations logged.
- Encrypted daily backups with regular restore testing.
- Regular system updates and patching of discovered vulnerabilities.
- Written confidentiality undertakings from employees and contractors.
In the event of a breach: We notify the competent authority within the period prescribed by law and its regulations. We notify affected Subscribers without undue delay, explaining what happened, the data affected, the measures taken, and what they can do to protect themselves.
7. Your Rights Over Your Data
The Personal Data Protection Law grants you the following rights:
| Right | What it means |
|---|---|
| To be informed | To know what data we collect about you, why, and how we process it, as set out in this Policy. |
| Access | To view the personal data we hold about you. |
| Obtain a copy | To receive a copy of your data in a readable and clear format. |
| Correction | To request that inaccurate data be corrected, completed, or updated. |
| Destruction | To request destruction of your data once it is no longer needed, unless the law requires its retention. |
| Withdraw consent | To withdraw your consent to any processing based on consent, such as marketing messages. |
How to exercise your rights: Send your request to [email protected] from the email registered in your account. We respond within the statutory period and may ask you to verify your identity before acting, to protect your data.
Complaints: If you are not satisfied with our response, you may file a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA).
8. Final Provisions
8.1 Cookies: We use essential cookies for login and security, and analytics cookies only to measure visits to our public website. You can refuse analytics cookies in your browser settings without affecting the system.
8.2 Minors: The Service is intended for businesses and is not directed at anyone under eighteen. We do not knowingly collect their data.
8.3 Updates: We may update this Policy and will notify you of any material change thirty (30) days before it takes effect, by email and an in-app notice.
8.4 Contact: For any question about your data: [email protected] · 0530339595 · 7306 King Fahd Branch Road, Al-Wesham, Riyadh 12735 (RBGC7306).
This Policy is drawn up in Arabic; in the event of any conflict, the Arabic text prevails over this English translation.