Privacy Policy

This policy applies to personal data processed by Wasal in connection with our public website, sales inquiries, and platform operations where Wasal acts as a service provider.

When a school or operator uses Wasal under its own brand, that organization is typically the data controller for student, parent, and staff data inside its tenant workspace. End-user privacy for those apps is also governed by the customer’s own privacy notice, which may be linked inside their branded application.

We may collect the following categories of information:

• Contact details you submit through demo, quotation, or contact forms (name, email, phone, organisation, message).
• Business information such as organisation type, estimated student volume, and notes you choose to provide.
• Technical and usage data when you browse getwasal.com, including IP address, browser type, device information, pages viewed, and referral source.
• Communications you send to us by email or other channels.
• Platform operational data processed on behalf of customers, including account credentials, trip records, location events, check-in/out logs, and billing records, as configured by each customer.

We use personal data to:

• Respond to demo, quotation, and support requests.
• Provide, secure, maintain, and improve the Wasal platform.
• Send service-related communications and, where permitted, product updates.
• Analyse website performance and protect against abuse, fraud, or security incidents.
• Comply with legal obligations and enforce our agreements.

Depending on context, we rely on one or more of the following: your consent, performance of a contract or steps prior to entering a contract, legitimate interests (such as operating and securing our services), and compliance with legal obligations. We align with applicable data protection laws in the markets we serve.

We do not sell personal data. We may share information with trusted service providers that help us operate our website and platform, such as hosting, email delivery, analytics, and payment partners engaged by customers. These providers may process data only under our instructions and appropriate safeguards.

We may also disclose information where required by law, to protect rights and safety, or in connection with a merger, acquisition, or asset sale subject to continuity protections.

Marketing inquiry records are retained for as long as needed to manage the sales relationship and comply with legal or accounting requirements.

Platform operational data is retained according to customer configuration and contract terms. By default, location history may be retained for up to 90 days unless a customer configures a different period. Customers may request deletion of end-user data in line with applicable law and product capabilities.

We implement administrative, technical, and organisational measures designed to protect personal data, including encryption in transit, tenant isolation, role-based access controls, and audit logging for administrative actions. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Subject to applicable law, you may have the right to access, correct, delete, restrict, or object to certain processing of your personal data, and to withdraw consent where processing is consent-based. You may also have the right to lodge a complaint with a supervisory authority.

To exercise rights relating to data processed by Wasal directly, contact us using the details below. For data processed inside a customer’s branded tenant, please contact that organisation first; we will assist the customer where required.

Wasal’s platform may process information about students on behalf of schools and transport operators. We do not knowingly collect personal data directly from children through the marketing website. Student data in the platform should be provided with appropriate parental or institutional authority, as determined by the customer acting as controller.

Wasal serves customers internationally and may use infrastructure or subprocessors in multiple countries. Where personal data is transferred across borders, we apply appropriate safeguards consistent with applicable law.

Our website may use essential cookies and similar technologies required for security and basic functionality. We may also use analytics tools to understand how visitors use the site. You can control non-essential cookies through your browser settings where available.

We may update this Privacy Policy from time to time. The “Last updated” date at the top will reflect the latest version. Material changes will be posted on this page.