Privacy policy

Who handles your information

This service is operated by Wafa. For questions about your information or to make a privacy request, contact info@wafa.krd. Participating businesses are separately responsible for information they collect through their own purchases, bookings, and services.

Business and contact enquiries

When you email Wafa, we receive your email address, message, and any name, business details, or phone number you choose to include. We use these details to reply, discuss a potential partnership, and keep a record of the conversation. You decide which details to share in your message.

Sending an enquiry does not subscribe you to a marketing list. Please avoid including passwords, payment information, or other sensitive personal details in your message.

App and card information

When you use the app, Wafa needs your account identity, name, card code, and records of your stamps, memberships, rewards, and related notifications to run the service. Sign-in providers may supply an account identifier and information you choose to share. Your wallet pass includes the identifying details and code needed to recognise your Wafa card.

Location

The app can ask for device location permission when you choose to find nearby businesses. You can refuse permission or disable it in device settings. This website does not request location access. A business’s stamp records identify the business where the stamp was issued.

Technical information and cookies

Website hosting and email services may process technical information needed to operate and protect the service, such as request time, IP address, and delivery status. This website has no contact form and does not receive enquiry submissions directly. This website does not set advertising cookies or include third-party analytics, tracking pixels, or behavioural advertising scripts. Any future use of these technologies will be described before activation.

Sharing and service providers

Email enquiries are handled through Wafa’s email provider so that Wafa can receive and reply to them. When you show your card to a participating business, that business can use your card identifier to recognise you within its programme and manage its stamps and rewards. We do not sell your personal information.

Information may be disclosed where legally required or reasonably necessary to investigate abuse, protect the service, or resolve a dispute. Providers may process information in countries outside Iraq; their safeguards and applicable privacy requirements also apply.

Retention and security

We keep information for as long as needed to operate your account, respond to an enquiry, complete the relevant follow-up, and meet applicable obligations. We use access controls and appropriate technical measures to protect it. Email correspondence and provider backups may remain after an active record is removed. No service can guarantee absolute security.

Your choices and requests

You can ask what personal information we hold, request a correction, request deletion, or withdraw permission for further enquiry follow-up by emailing us. Include enough information to identify the relevant account or enquiry; do not send your password. We may need to verify your identity before making changes.

Some records may need to remain for unresolved disputes, security investigations, or legal obligations. If that affects your request, we will explain it. You can manage device location permissions and wallet passes through your device settings.

Children and updates

Wafa is not designed to collect information from children who cannot legally consent without a guardian. A guardian who believes a child has provided information can contact us for help. We will update this page when our practices change and provide additional notice for material changes where appropriate.