Wanas Payroll Privacy Notice

1. Who we are

Wanas Apps FZ-LLC ("Wanas Apps", "we", "us") is a free zone limited liability company licensed by the Ras Al Khaimah Economic Zone Authority (RAKEZ), licence number 47012090, United Arab Emirates, with an office in Cairo, Egypt. Wanas Apps is a Zoho Premium Partner and the operator of Wanas Payroll.

Contact for privacy questions and requests: egypt@wanasapps.com.

2. Our two roles

Customer Data: the company that subscribes to Wanas Payroll (the "customer", usually the employer) decides why and how its employees' data is used. The customer is the controller and Wanas Apps is the processor: we process employee and payroll data only on the customer's documented instructions, to provide, secure and support the service.

Our own data: for the data of the people who sign in, billing, the Zoho Partner Store subscription records, the partner program, support, security logs, product analytics and the public website, Wanas Apps decides the purposes and is the controller.

3. Whose data we process

Users of the customer organisation (administrators, payroll officers, approvers and employees who sign in to see their own payslips and requests); employees and other workers of the customer whose data is imported from Zoho People or entered by the customer; HR partners and payroll bureau staff who use the partner portal or the bureau console; contacts of customers who pay or receive our e-mails; and visitors to the public pages.

4. The data we process

The table lists the main categories. We process only what the service needs; salaries, loans, garnishments and identity numbers are held for payroll calculation, statutory filings, payslips and bank transfer files.

5. Where the data comes from

From the customer (data entered, uploaded or approved by its users); from the customer's Zoho People organisation, read-only, through the permissions the customer's administrator grants (profiles, custom fields, attendance, leave, holidays); from Zoho when you sign in (name, e-mail, Zoho ids); from the customer's optional integrations (Zoho Books, Zoho CRM, WhatsApp, e-mail); from you directly; from Stripe; from the Zoho Partner Store (our own customers' subscriptions); and automatically from your browser and device.

6. Purposes and legal bases

Where we are the processor, the customer is responsible for having a lawful basis for the employee data it processes (usually performance of the employment contract and the employer's legal obligations under Egyptian labour, social-insurance and tax law). Where we are the controller, we rely on the following.

7. Recipients and sub-processors

We share personal data only with the providers below, and with government authorities when the customer instructs the service to submit a filing. We remain responsible for our sub-processors. We give at least 30 days' notice of a new sub-processor, as set out in section 16.3 of the Subscription Terms.

8. Artificial intelligence

The only AI model inside the service is Cloudflare Workers AI, used in the optional Zoho Books "Suggest mapping" step. It receives account names, types, codes and slot descriptions, never employee, salary or pay run data, and if it fails the service falls back to a rules matcher. Wanas Apps does not use Customer Data to train AI models.

The service also offers an API and an MCP server. If a customer connects an AI assistant of its choice, the customer decides what that assistant may read, within the permissions of the API key or sign-in, and is responsible for that provider. National ID and IBAN numbers are not returned through the MCP server.

9. International transfers

Wanas Apps FZ-LLC is established in the United Arab Emirates and the service runs on Cloudflare's global network, so personal data, including data of employees in Egypt, may be processed outside Egypt and outside the United Arab Emirates. We apply the safeguards that applicable law requires for such transfers, for example contractual protections with our providers and the security measures in section 11. Customers, as controllers, remain responsible for any licence, permit or notification that applicable law requires of them.

10. How long we keep data

The periods below describe how the service behaves today.

11. Security

We use measures appropriate to the risk, including: logical isolation of each organisation's data; encryption in transit (TLS); AES-GCM encryption of national ID, passport, IBAN and account numbers and of access tokens before storage; role-based access control; maker-checker approval of pay runs; an audit log of sensitive actions with their source; scoped, revocable API keys; two-factor authentication for partner accounts; least-privilege access for our staff; and hosting on Cloudflare's infrastructure. No system is completely secure. We have not claimed any security certification for Wanas Payroll.

If a personal data breach affects Customer Data, we notify the affected customer without undue delay and, where feasible, within 72 hours of becoming aware of it (Subscription Terms 16.2). The customer, as controller, decides whether and how to notify employees and the authorities, and we help.

12. Your rights

Depending on the law that applies to you, you may have the right to be informed, to access your personal data, to have it corrected, to have it erased, to restrict or object to its processing, to receive it in a portable form, to withdraw consent at any time, and to complain to the competent authority (in Egypt the Personal Data Protection Centre; in the United Arab Emirates the UAE Data Office). Payroll is calculated by rules and approved by the employer's authorised users; the service does not take automated decisions about people.

Employees: your employer is the controller of your payroll data. Please contact your employer's HR or payroll team first. If you write to us, we will forward your request to the employer and help it respond; we cannot change or delete payroll records on our own, because the employer must keep them for legal reasons.

Account users, partners and website visitors: write to egypt@wanasapps.com. We aim to reply within 30 days. We may need to verify your identity first.

13. Cookies and local storage

Essential items are needed to sign in and keep you secure and do not need consent. Preference items store your settings on your device. Analytics items are used only if you accept analytics. The service does not use advertising cookies.

14. Your analytics choice

Zoho Apptics is off until you accept it in the notice shown on your first visit. If you accept, Zoho Apptics records the data listed in section 4 (product analytics) and, when you are signed in, your name, e-mail, company, plan, language and time zone, plus device and approximate location added by its SDK. It never receives salaries or employee data. If you decline, nothing is loaded or sent. You can change your mind at any time with "Share usage analytics" in the user menu, and the SDK also honours your browser's Do Not Track setting.

15. Children

Wanas Payroll is a business service for employers and their authorised staff. It is not directed at children, and we do not knowingly collect data from children, except where an employer lawfully processes the payroll data of a young worker.

16. Laws

We aim to meet the requirements that apply to us under the Egyptian Personal Data Protection Law No. 151 of 2020 and the United Arab Emirates Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and their implementing regulations as they enter into force, as controller for our own data and as processor for Customer Data.

17. Changes to this notice

We will update this notice when the service or the law changes, change the version and date above, and for material changes tell customers through the service or by e-mail. Earlier versions are available on request.

For visitors to the Wanas Apps company website (wanasapps.com), a separate website privacy policy applies; it is linked in the footer.