GDPR & Your Data Rights
Last updated: August 17, 2026
This page explains how maw3ad meets the EU General Data Protection Regulation (GDPR) and the UK GDPR. It sits alongside our Privacy Policy, which describes what we collect; this one covers the lawful bases we rely on, how long we keep things, who else processes your data, and how to exercise each of your rights.
1. Who is responsible for your data
maw3ad is the data controller for your account, your use of the platform, and everything you do across the service as a whole.
A business you book with is a separate controller for its own records of you as its customer — the appointments you have had with it, the notes it keeps, what you paid at its counter. We provide the software; the shop decides how it runs its own book. If you want that record changed or removed, ask the business directly. We will help you reach them, and we will act on anything held on our side.
For anything a business does with our software on its own behalf, we act as its processor and only on its instructions.
2. Why we are allowed to process your data
Every piece of processing we do rests on one of these lawful bases:
- Contract — creating your account, taking and confirming bookings, sending the confirmation and the reminder for an appointment you made. Without this we cannot provide the service you asked for.
- Legitimate interests — keeping the platform secure, preventing fraud and abuse, understanding which features are used, and improving the product. We weigh these against your rights, and you can object at any time.
- Consent — location (to show places near you), push notifications, and any marketing email. Given freely, withdrawn just as freely.
- Legal obligation — records we are required to keep, and responses to lawful requests.
3. Your rights, and how to use them
You can exercise any of these by emailing privacy@maw3ad.com. We answer within 30 days, and we do not charge for it. We may ask you to confirm your identity first — that check exists to stop somebody else exercising your rights over your data.
- Access
- Ask for a copy of the personal data we hold about you, and the reasons we hold it.
- Rectification
- Have anything inaccurate corrected. Most of it you can edit yourself from your account.
- Erasure
- Ask us to delete your account and personal data. You can start this yourself in the app under Account, and the website account menu.
- Restriction
- Ask us to pause processing while a complaint or a correction is being resolved.
- Objection
- Object to processing we carry out on the basis of legitimate interests, including any direct marketing. Marketing objections are always honoured.
- Withdraw consent
- Where we rely on consent — location and push notifications — you can withdraw it at any time in your device settings, without affecting anything done beforehand.
- Complain
- Lodge a complaint with your local supervisory authority if you believe we have handled your data unlawfully.
4. How long we keep things
We keep personal data only as long as it is doing a job. When that job ends it is deleted, or anonymised where a record has to survive without naming you.
| Data | Kept for |
|---|---|
| Account details (name, email, phone) | For as long as the account is open. Deleted 30 days after you request deletion — the delay is a grace period so an account cannot be lost to a mistaken tap. |
| Bookings and appointment history | Kept while the business you booked with needs them for its own records and legal obligations, then removed. Deleting your account anonymises your name from them rather than erasing the business's books. |
| Payment records held by a business | Retained by that business for as long as its own tax and accounting duties require. maw3ad never takes or stores card details. |
| Reviews you have written | Kept while published. On account deletion they are anonymised, because removing them entirely would rewrite a business's public rating. |
| Support conversations | Up to 24 months, so a repeat problem can be understood in context. |
| Security and audit logs | Up to 12 months. These are what let us investigate abuse of an account, so they outlive an ordinary session. |
5. Who else processes your data
We use a small number of processors to run the service. Each is bound by a data processing agreement and may only act on our instructions:
- Cloud hosting and database infrastructure
- Transactional email delivery (confirmations, reminders, verification codes)
- Push notification delivery
- File and image storage
- Error monitoring, to find and fix crashes
- Maps and geocoding, to place businesses on a map
We do not sell your personal data, and we never have.
6. International transfers
maw3ad operates from Lebanon and some of our processors are outside the European Economic Area. Where personal data covered by the GDPR is transferred out of the EEA, we rely on the European Commission's Standard Contractual Clauses together with additional technical measures — encryption in transit and at rest, and access limited to the people who need it.
7. Automated decisions
We do not make decisions with legal or similarly significant effects about you by automated means alone, and we do not profile you for that purpose. Where the platform automates something — for example spreading walk-ins across available staff — a person can always override it.
8. If something goes wrong
If a personal data breach is likely to result in a risk to your rights and freedoms, we notify the relevant supervisory authority within 72 hours of becoming aware of it, and we tell affected users directly where the risk is high.
9. Contact
Data protection enquiries: privacy@maw3ad.com. For anything else, our support page is the fastest route. You also have the right to complain to your local data protection authority at any time.