1. Who we are and the scope of this policy
This policy explains how the Mrafad platform collects your personal data and your company's data, how it uses, stores and shares that data, and what rights you hold over it. It applies to the website, both apps, the admin console and every related service.
Mrafad is a technical intermediary between companies requesting services and the providers who deliver them within the pilgrim services ecosystem, and is not a party to the contract concluded between them.
2. The data we collect
We collect only what running the service requires, in five categories:
- Account data: name, mobile number, email address, and your role within the company.
- Company data: trade name, licence number, commercial register, city, and the documents you upload for verification.
- Usage data: requests, offers, contracts, messages and ratings, along with the log of your operations on the platform.
- Device and connection data: device type, operating system, IP address, and notification identifiers.
- Payment data: transaction amounts, their status and references. We do not retain your card details — these are handled by the licensed payment gateway.
3. Why we process your data
We process your data for a defined purpose in each case:
- Running the service: creating the account, matching requests with providers, and completing contracting and payment.
- Verification and fraud prevention: confirming licences, the legitimacy of companies and the integrity of transactions.
- Money and escrow: holding, releasing and refunding amounts, issuing invoices, and complying with e-invoicing requirements.
- Operational communication: notifications about offers, contracts, payments and disputes — these reach you as part of the service itself.
- Improvement and measurement: understanding what is used so it can be improved, on aggregated data in which individuals are not identified.
- Marketing communication: carried out only with your explicit consent, per channel.
4. Legal basis for processing
We process your data on one of the following bases: performance of the contract concluded with you, a legal obligation upon us, a legitimate interest that does not override your fundamental rights, or your explicit consent where it is required, as with marketing.
6. External listings and other platforms
When results from external platforms appear inside Mrafad search, or when you publish your listing on them, that platform is governed by its own policy, not ours. Whatever happens outside Mrafad — contact, payment or agreement — is covered by neither our escrow nor our dispute resolution, and we bear no responsibility for its content.
7. Marketing communication and withdrawing consent
No marketing message reaches you without explicit consent recorded with its time and source, and each channel has its own separate consent: email, SMS, WhatsApp and app notifications.
You may withdraw consent at any time from "Communication preferences" in your account, through the unsubscribe link in every message, or by replying "STOP" to an SMS. Withdrawal takes effect within twenty-four hours.
Operational messages — such as payment confirmation, offer expiry alerts and dispute decisions — continue to reach you because they are part of the service.
8. Where data is stored and for how long
Personal data is stored inside the Kingdom of Saudi Arabia with approved hosting providers. We retain each category for as long as its purpose requires: account data while the account exists, contract and invoice records for the period accounting and tax regulations impose, and audit logs for as long as proving the integrity of transactions requires. Whatever is no longer needed is deleted or stripped of its identity.
9. Your rights
At any time you may exercise the following rights through your account or by writing to us:
- Access your data and learn how it was processed.
- Correct anything inaccurate in it.
- Request its deletion once the reason for retention has lapsed and no legal obligation prevents it.
- Obtain a copy of it in a readable format.
- Withdraw consent for any processing based on it.
- Lodge a complaint with the competent data protection authority if you consider us at fault.
10. Data protection and incident reporting
We protect data with transport encryption, encryption of sensitive fields at rest, role-based permissions, two-factor authentication for admin accounts, and an audit log that cannot be altered. If an incident affects your personal data, we notify the competent authority within seventy-two hours, and notify you whenever the incident has a serious impact on you.
11. Individual and minor accounts
Mrafad is a platform for companies, not individuals: no personal accounts are created for pilgrims, and we do not knowingly collect the data of minors. Should we learn otherwise, we delete the data.
12. Changes to this policy
We may update this policy whenever the service or the regulations change. We notify you of any material change a reasonable time before it takes effect, and the date of the last update remains visible at the top of the page.
13. How to contact us
For any question about your privacy, or to exercise your rights, write to Mrafad's data protection officer at the dedicated address; we undertake to respond within thirty days.