NAWWIR Website Privacy Notice
Last updated: 2 October 2026
Version: Draft 1
DRAFT — NOT YET REVIEWED BY A LAWYER. This notice is for website review only. It must not be published as an approved legal notice until the controller identity, address, hosting settings, international-transfer position, and Arabic translation have been confirmed by a qualified Saudi privacy lawyer and a native-Arabic legal reviewer.
1. Who this notice applies to
This notice explains how the public NAWWIR marketing website handles personal data. It does not cover the NAWWIR mobile application, which has separate privacy information.
The website is currently operated by an individual using Xeplans as the name of a company that is not yet registered. The operator is Azam Hashmi, Jeddah, Saudi Arabia. Privacy questions may be sent to privacy@xeplans.com.
2. Data handled when you visit
The website does not currently provide accounts, forms, payments, comments, advertising, analytics, or profiling. Its source code does not intentionally write cookies, localStorage, sessionStorage, or IndexedDB data.
As with ordinary web delivery, the hosting and security provider may process technical request data such as:
- IP address and approximate network location;
- requested URL, date, time, and response status;
- browser, device, operating-system, language, and request-header information; and
- security, routing, performance, and diagnostic data.
The site includes email links. Selecting an email link does not submit data through the website. If you choose to send an email, your message, contact details, and attachments are processed by your email provider and the operator’s email service.
3. Why data is handled
Technical request data may be handled only as needed to:
- deliver the pages and requested assets;
- protect the site and visitors from abuse, bots, fraud, and attacks;
- diagnose failures and maintain availability; and
- comply with applicable legal obligations.
Email data is used to answer the message, manage the request, and keep any records that applicable law requires. The legal basis for each activity must be confirmed for the final operating country and production configuration before publication.
4. Service providers and transfers
Cloudflare is expected to provide website delivery, network, and security services. Email providers, including the operator’s mailbox provider, process information only when you send an email. These providers may process data outside Saudi Arabia. The final production services, processing locations, contractual safeguards, and any required transfer assessment must be confirmed before publication.
The operator does not sell website visitor data and does not currently share it for targeted advertising.
5. Retention
The website itself does not create visitor profiles. Technical logs may be retained by the hosting or security provider according to the enabled production settings; the actual retention period must be recorded and approved before publication.
Emails may be retained for up to 24 months after a request is closed unless a shorter or longer period is required for security, dispute, accounting, or legal reasons. Counsel must confirm this period before the notice becomes effective.
6. Your rights
Subject to the Saudi Personal Data Protection Law and any other applicable law, you may have rights to be informed, access personal data, request correction, request destruction when applicable, withdraw consent where consent is used, and complain to the competent authority.
To make a request, email privacy@xeplans.com. Identity may need to be verified before a request is fulfilled. The final response procedure and statutory time limits must be approved by counsel before publication.
7. Children
This public information site is not directed to children and does not intentionally ask for a visitor’s age or collect child profiles. If you believe a child has sent personal data by email, contact privacy@xeplans.com.
8. Security
Reasonable technical and organisational safeguards are used to protect the site and communications. No internet service is completely secure, so absolute security cannot be guaranteed.
9. Changes and contact
Material changes will be shown by updating the date and version on this page. Questions and privacy requests may be sent to privacy@xeplans.com or contact@xeplans.com. The operator is Azam Hashmi, Jeddah, Saudi Arabia, using Xeplans as the name of a company that is not yet registered.