Privacy policy

Mahfal is a platform for sending event invitations over WhatsApp and recording guests’ replies. It is operated by Namat Thabit Establishment For Information Technology (Commercial Registration 7055511450, Dhahran, Saudi Arabia), referred to as “we” or “us”. This policy explains how we handle personal data in Mahfal and on this website (getmahfal.com).

1. Our role

When an event organiser (for example an event company, or a government or private organisation) uses Mahfal, the organiser decides who is invited and why, and is responsible for the guest data (the “controller”). We process that data only on the organiser’s instructions and only to run their event (the “processor”). For the details of organiser staff we work with, and for requests sent through this website, we are the controller.

2. What we process

Guests of an event (provided by the organiser)

• Name and mobile number.
• Guest category, preferred language, and any other fields the organiser includes for the event (such as a ticket type).
• Replies to the invitation (attending or not), tickets issued, and messages exchanged with the event’s WhatsApp number.
• Delivery information from WhatsApp (sent, delivered, read, failed, and the reason for a failure).

Organisers

• Names, work email addresses and mobile numbers of the staff we work with, and the WhatsApp Business account details needed to send messages from the organiser’s own number.

People who contact us through this website

• Name, organisation, email address, mobile number, and the event details and notes you choose to send.

Visitors to this website

• This website does not use cookies, analytics or advertising tools. Our hosting provider keeps standard technical logs (such as IP address, browser type and the pages requested) to operate and secure the site.

3. Why we use it, and on what basis

• To send the organiser’s invitations, reminders, tickets, locations and follow-up messages to their guests, on the organiser’s instructions under our contract with them.
• To record guests’ replies and show them to the organiser on a private dashboard, for the same reason.
• To reply to requests sent through this website, at your request and with your consent.
• To provide support, keep the service secure and investigate delivery problems, in our legitimate interest.
• To meet our accounting and other legal obligations.

We do not sell personal data, use guest data for our own marketing, or contact guests for any purpose other than the organiser’s event.

4. WhatsApp and Meta

Messages are sent through the WhatsApp Business Platform operated by Meta, from the organiser’s own WhatsApp Business account. Meta processes message data under its own terms and privacy policy. Guests can block the organiser’s number or reply that they do not wish to receive further messages, and we will stop sending to them for that event.

5. Where data is stored and who we share it with

Event data, including invitation cards and tickets, is kept in a database and private file storage hosted in the European Union (Frankfurt, Germany). We also rely on service providers for hosting, email and, where the organiser uses one for their event, ticketing. We share with each provider only what it needs for that purpose, and we disclose data to authorities only where required by law.

This means personal data may be transferred and stored outside the Kingdom of Saudi Arabia, in line with the Kingdom’s rules on transferring personal data abroad.

6. How we protect it

• Invitation cards and tickets are kept in private storage and are never published at public links.
• Access is limited to authorised people; organiser dashboards use private links.
• Access keys are stored encrypted, and all traffic is encrypted in transit.
• Changes to events and guest records are logged so they can be traced.

7. How long we keep it

• Guest data: for as long as the organiser’s event needs it. After the event ends, we delete or anonymise it within 90 days, unless the organiser asks us to delete it sooner or the law requires us to keep it longer.
• Requests sent through this website: for as long as needed to reply and to maintain any resulting business relationship, then deleted.

8. Your rights

Under the Saudi Personal Data Protection Law, you have the right to:

• Be informed of how and why your data is collected and processed.
• Access your data and obtain a copy of it.
• Ask for it to be corrected, completed or updated.
• Ask for it to be deleted once it is no longer needed.
• Withdraw your consent where processing relies on it.
• Complain to the competent authority if you believe your data has been processed unlawfully.

If you were invited to an event, the quickest route is to contact the organiser. You can also write to us, and we will pass your request to the organiser and help them act on it.

9. Children

Mahfal is intended for organisations and their invited guests. It is not directed at children.

10. Changes to this policy

We may update this policy. The date at the top shows when it was last changed.

11. Contact

For privacy questions or requests, email us: show email address. Namat Thabit Establishment For Information Technology, Dhahran, Saudi Arabia.