1. Scope
This policy explains how personal data is processed when a person uses Tazawur, creates an account, manages an event, invites guests, uses the customer, partner, or reception portal, or contacts support. Tazawur manages the processing of data related to the services provided through the platform.
2. Data we process
Data may include a name, mobile number, email address, verification status, and role; event, invitation, and design data; guest, companion, RSVP, and attendance data; partner, client, and authorization data; order, payment, discount, commission, and refund data without Tazawur storing full card details; and technical and security data such as session, device, browser, sign-in attempt, error, audit, and message-delivery information.
Data identified as required is necessary to perform the requested function, which may be unavailable if it is not provided. Optional data does not have to be provided.
3. Data sources and responsibility
We collect data directly from you; from an event owner or partner when they add client or guest data at that person's request or with their authorization; from use of the platform, invitation links, and access flows; or from operational results of services connected to the platform.
Anyone who adds another person's data must keep it accurate, inform that person where required, and have appropriate authority or another lawful basis for its use.
4. Processing purposes
We use data to create, verify, and protect accounts; create events and invitations and manage guests, responses, capacity, and attendance; operate customer, partner, reception, and administration portals; process orders, payments, discounts, commissions, and refunds; send operational communications; provide support; prevent fraud and misuse; meet legal and accounting duties; and improve service reliability and performance.
5. Legal bases
Depending on the circumstances, processing is based on performing a contract or taking requested steps to enter one, consent where required, compliance with a legal obligation, protection of rights and security, or a legitimate interest that is not overridden by the data subject's rights. Consent for optional processing may be withdrawn without affecting earlier processing or processing based on another lawful basis.
6. Data sharing
Access is limited to what is necessary to operate the service. Data may be shared to the necessary extent with parties that help Tazawur operate the service; with an event owner, partner, or reception staff member within the relevant event and granted permissions; and with competent authorities where required by law or necessary to protect rights and security.
7. Data transfers
Some service functions may require data to be processed outside Saudi Arabia. Where this occurs, Tazawur applies applicable legal requirements and appropriate safeguards and limits the data to what is necessary for the purpose.
8. Data security
Tazawur uses technical and organizational controls appropriate to the data, including restricted permissions, protection of communications and accounts, attempt monitoring, audit records, and control reviews. No electronic method is entirely risk-free, so we work to minimize data, limit access, and handle incidents under applicable requirements.
9. Data-subject rights
Under applicable law, a data subject may be informed of the legal basis and purpose of processing; access their data; request it in a clear format; request correction, completion, or updating; request destruction where applicable; withdraw consent where processing relies on it; and complain to the competent authority. Some requests may be limited by legal restrictions or exceptions, and Tazawur verifies identity before acting on them.
10. Requests, children, and updates
A privacy request, question, or complaint may be sent to support@tazawur.com with a description of the request and only the information needed to verify identity. The service is not directed to children for independent account creation. If a minor's data is added to a guest list, the person adding it must have the required legal authority.
Tazawur may update this policy when the service or applicable requirements change and will request fresh consent where required by law or where a consent-based purpose changes.
11. WhatsApp messages
We use WhatsApp to send invitations and operational messages related to Tazawur services. For this purpose, we process the necessary data, such as the recipient's name and mobile number, message content and invitation links, message identifiers, and sent, delivered, read, and failed statuses and their timestamps.
The necessary data is shared with Meta/WhatsApp and operational service providers to deliver the service, resolve technical issues, and prevent duplicate sending. Read status may be processed internally even if it is not shown to the event owner. Reading a message does not confirm attendance.
12. Data deletion requests
You may request deletion of your personal data, whether you are an account holder or a guest, as follows:
1. Send your request to support@tazawur.com with the subject "Data deletion request — Tazawur". 2. Specify whether your request concerns your account, your data in an invitation, or another scope, and provide the associated mobile number or email address and the event reference if available. 3. Do not send passwords, verification codes, secret keys, or payment card details. We may request additional information only as needed to verify your identity and protect your data. 4. We aim to complete your deletion request within 7 business days of receiving it, after verifying your identity. If the request requires additional time, we will notify you of the reason and the expected completion date, while complying with applicable legal time limits. 5. We will inform you of the outcome and any effect deletion may have on your use of the service. If some data must be retained by law, we will explain which data is excluded from deletion and why it is retained, without preventing deletion of the remaining data covered by the request.
13. Retention and deletion limits
We retain data to the extent necessary for the purposes of the service and delete it when it is no longer needed or in response to a valid deletion request, except where retention is required by law.
Deletion from the operational system does not mean that backups are removed at the same moment. It also does not include deleting copies of messages or files on recipients' devices or outside Tazawur's control.