Privacy notice

Why this data is collected

Chinese regulations require the organisers of WAFI 2026 to report every foreign guest to the relevant authorities in advance. The organisers have set 13 August 2026 as their deadline for receiving those details. Providing this information is what makes attendance possible; it is not an application to join the delegation, and it does not commit anyone to travelling.

Controller

CIV Middle East, operating the WAFI Middle East Office, is the data controller. Contact: wafi@civme.com.

What we collect, and why each field

• Full legal name, sex, date of birth — matched against your travel document by the host authorities.
• Nationality, passport number, passport expiry — required fields of the guest report.
• An image of the passport photo page — the filing requires the document image so the authorities can verify the typed details against it. This page also shows issue date, issuing authority, place of birth and your signature; those are incidental to the image and are not used for anything else.
• Organisation and job title — identifies the capacity in which you attend; printed on your badge.
• Mobile number and email — delegation logistics and travel coordination.
• Portrait photo and short bio — delegate badge and the delegation programme.
• IP address, browser and submission time — retained as evidence of consent, as PDPL expects a controller to be able to demonstrate it.

No other personal data is collected. There is no home address, no ID document scan beyond the portrait, no health data, and no marketing.

Legal basis

Your explicit consent, given when you submit the form, together with the necessity of the processing for the purpose you're asking us to carry out — registering you as a foreign guest of WAFI 2026.

Who receives it

CIV Middle East and the WAFI Middle East Office; our China-based ground operator; the WAFI 2026 organising committee; and the relevant Chinese host authorities. It is used only for guest registration and delegation participation. It is not sold, and it is not shared with anyone else.

Transfer outside Saudi Arabia

The programme takes place in Pinggu, Beijing. Your details, including your passport details, are therefore transferred to China. We transfer only what the filing requires, and only to the recipients above.

How it is protected

• Passport numbers, portrait photos and passport page images are encrypted at rest with AES-256-GCM.
• The administration page shows passport numbers masked; revealing one is deliberate and recorded.
• Passport page images are never shown by default — each one has to be opened deliberately, and each opening is logged.
• Every sign-in, reveal, passport-page view, export and deletion is written to an access log.
• Access is limited to the WAFI Middle East Office staff responsible for the filing.
• The whole site is served over HTTPS only.

How long it is kept

For the duration of the programme plus a short period afterwards for post-trip reporting — by default 120 days after submission — after which records are deleted. We delete sooner on request.

Your rights

Under PDPL you may ask to access your data, correct it, have it deleted, or withdraw your consent. Email wafi@civme.com, quoting the reference number issued when you submitted. We'll respond within 30 days.

Withdrawing consent before the trip means we remove you from the filing. The only consequence is that your guest registration can't be completed, so joining the delegation would no longer be possible. There is no other penalty.

If you believe your data has been mishandled, you may also complain to the Saudi Data & AI Authority (SDAIA).