1. Who we are
WUD Trading W.L.L. (“we”, “us”) is a wholesale trading company based in Doha, Qatar, supplying toys, bicycles and sports goods to trade customers. We are registered in the Commercial Register of the State of Qatar. This notice does not print a commercial registration number, because a number has not been confirmed for publication here. The number that belongs on our invoices and business correspondence is available on request from the data-protection contact below.
We are the controller of the personal data described in this notice. We decide why and how it is processed and remain responsible for it.
Registered address: Building 8, Zone 91, Street 3117, Birkat Al Awamer, Doha, Qatar
Showroom: Building 229, Zone 91, Street 3092, Birkat Al Awamer, Doha, Qatar
E-commerce licence: This website does not take electronic payment. Wholesale invoices are issued and settled outside the catalogue through our accounts process. We do not display an e-commerce licence number on this site, and we do not represent that a separate e-commerce licence under Minister of Commerce and Industry Decision No. 25 of 2026 has been issued for this catalogue.
General contact: info@wudtrading.com · +974 4482 9328 · +974 3321 7084
Data protection contact: Muhammed UP · accounts@wudtrading.com · +974 30892571
2. What personal data we hold
Most information comes directly from you or from your company when a colleague or salesperson acts on your instructions. Some records are created as the service is used.
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, email, WhatsApp number, delivery location | You or your company |
| Account | Sign-in credentials, role, last sign-in, display language and other display preferences | You and our systems |
| Sign-in and verification | Password hashes; one-time email codes used to confirm an address or sign in; session cookies | You and our systems |
| Legal evidence | The version and cryptographic hash of the Terms of Trade and Privacy Notice you accepted, with time, IP address and browser identification | You, when you accept, and our systems |
| Trading | Price tier, credit limit, payment terms (credit days) and credit hold | Our authorised staff |
| Activity | Basket contents, orders, order history, line remarks and staff notes | Use of the service and staff acting on instructions |
| Financial | Invoice numbers, amounts, payments and outstanding balance as shown in the catalogue | Our sales records; the accounting books of record are kept in Tally outside this website |
| Technical and security | IP address, browser identification and change records | Automatically when the service is used |
| Enquiries | Name, email, company, phone and message | The public contact form |
| Careers enquiries | Name, email and message if you contact the careers address | You |
We do not ask for personal data of a special nature, such as health, ethnic origin, religious belief, marital status or criminal record. If it is sent without being requested, we will remove it where appropriate.
The careers page does not invite speculative CVs. Do not include special-category or unrelated personal information in a careers enquiry.
This is a business-to-business service. It is not directed at children and children are not permitted to register.
3. Why we process it
| Purpose | Basis |
|---|---|
| Create and administer a trade account | Performance of a contract |
| Verify that you control the email address, and allow sign-in, including by one-time email code | Performance of a contract |
| Record that you accepted the current Terms of Trade and Privacy Notice | Performance of a contract and legal obligations |
| Display account prices, take orders and arrange fulfilment | Performance of a contract |
| Raise invoices, record what is owed, manage credit days and collect debts | Performance of a contract and legal obligations |
| Keep accounting records | Legal obligation |
| Send messages about an account, basket or order, including the one-off welcome message and one-time sign-in or confirmation codes | Performance of a contract |
| Notify an assigned salesperson of account activity when that option is enabled | Legitimate interest in servicing the account |
| Protect the service and investigate misuse | Legitimate interest in security and accountability |
| Answer a contact-form enquiry | Legitimate interest in responding |
| Answer a careers enquiry | Legitimate interest in responding |
Your name, business contact details and delivery location are required to open and operate a trade account. Without them we cannot accept or deliver an order. Optional profile and notification settings are identified in the interface.
We do not run marketing campaigns, buy marketing lists, or send promotional mail to the public. We may contact existing trade customers about their own account, basket or orders. That is contract performance, not direct electronic marketing.
We do not make automated decisions about you. A staff member sets price tiers, credit limits, credit days and holds. The search assistant helps find catalogue items; it does not make decisions about a person.
4. Who processes or receives it
Our authorised staff see only what they need for their work. An assigned salesperson may serve a customer, while administrative and warehouse staff handle orders, fulfilment and accounts according to their roles.
| Provider | Service and data involved | Main location |
|---|---|---|
| Supabase | Database, authentication, password hashes and one-time email sign-in or confirmation codes | A cloud region selected for lowest latency to Doha, Qatar. Hosting is outside the State of Qatar |
| Cloudflare | Website and API delivery, security, product-image storage and search assistance | Global network; processing location can depend on the request and configured service |
| Brevo (Sendinblue SAS) | Transactional email delivery using recipient name, address and message contents | European Union; primary hosting in France and Germany, with data stored on Google Cloud in Belgium |
| Company mailbox host | Receives contact/careers enquiries and operational correspondence sent to our company addresses (including info@, accounts@, sales@ and the careers address) | The mailboxes for the wudtrading.com domain, hosted outside Qatar by the domain’s mail provider |
We may disclose data where a competent authority lawfully requires it. We do not sell personal data or share it for another organisation’s marketing.
The contact page provides external Google Maps and WhatsApp links, and catalogue users may choose to share a product through their device or WhatsApp. Google or WhatsApp/Meta receives technical data—and, for a chosen share or message, the content and destination you select—only when you open or use that external service. Neither service is embedded or loaded automatically on our page. Their own privacy terms apply. Staff must use a customer's WhatsApp number only for authorised account/order communication.
5. Processing outside Qatar
The providers above process personal data outside the State of Qatar. We remain responsible for the processing and use safeguards including provider data-processing commitments, access controls, encryption in transit and at rest, and sending each provider only the information needed for its service.
6. How long we keep it
| Record | Retention |
|---|---|
| Orders, invoices and payment records | 10 years from the end of the relevant financial year |
| Account and contact details | For the trade relationship and afterwards only while needed to close the account, collect an outstanding balance, resolve a dispute, meet a legal obligation, or establish or defend a legal claim. No automatic 24-month post-closure deletion is currently implemented. |
| Basket contents not converted into an order | 12 months |
| In-app notifications | 24 months |
| Security and change records, including IP address | 36 months |
| Legal-acceptance audit records | 36 months, unless a legal hold is registered against the row |
| Contact-form and careers enquiries | The application database does not store a copy. Copies in the company mailbox and Brevo are kept only while needed to answer and follow up the enquiry, resolve a related dispute, or meet a legal obligation. The careers page does not invite speculative CVs. |
If you ask us to erase data, we remove information that is no longer needed. We must retain some commercial and accounting records; where possible, we remove or separate identifying contact details while keeping the transaction record required by law.
7. How we protect it
Measures include role-based database access, row-level security, encryption in transit and at rest, one-way password hashing, audit records, protected financial records, backups and a documented personal-data breach response procedure.
No system is perfectly secure. Where a personal-data breach creates the level of risk requiring notification, we will notify the competent authority and affected people in accordance with applicable Qatari requirements and guidance.
8. Your rights
Subject to the PDPPL and records we must keep by law, you may ask us to:
- explain how your personal data is used;
- provide access to it and a copy;
- correct inaccurate or incomplete information;
- erase information that is no longer needed or was processed unlawfully;
- stop unnecessary processing or object where there is no valid basis; and
- honour withdrawal where a processing activity relies on consent.
Customers can download account data from My Data and correct profile details in the catalogue. For another request, contact accounts@wudtrading.com. We will verify identity and aim to respond within 30 days. If we cannot fulfil a request, we will explain why.
You may complain to the National Cyber Governance and Assurance Affairs, part of Qatar’s National Cyber Security Agency, whether or not you contact us first.
9. Cookies and browser storage
We use only technology needed to operate the service: authentication/session cookies, a language cookie, and browser storage for display preferences and application state. We do not use advertising cookies or third-party analytics. Transactional messages tell Brevo that the recipient has not consented to identifiable pixel tracking; identifiable opens are therefore disabled, although Brevo may count anonymised aggregate delivery and open events.
You can clear cookies and local storage in your browser, but doing so signs you out and resets preferences.
10. Changes
We will update this notice when our processing changes. The version displayed on this page identifies the notice in effect. When we publish a new version, you will be asked to read and accept it in the catalogue before you can place another order. We do not currently send a separate broadcast email announcing the change.