WeyQi Data Deletion Policy and Instructions

1. About this policy

This Policy explains how Indura Tech FZCO, operating WeyQi ("WeyQi," "we," "us" or "our"), handles requests to delete personal data and content, close accounts, disconnect social accounts, and address content removed from a connected platform. Our address is Dubai Silicon Oasis, Dubai, United Arab Emirates.

It covers our websites, accounts, campaign pages and microlinks, participation and loyalty programs, referrals, rewards, user-generated content ("UGC"), moderation, verification, scoring, reporting and related services. It includes Facebook and Instagram where those integrations are enabled, and other supported social platforms subject to their applicable rules.

This Policy also covers relevant information about people who have not registered with WeyQi or joined a program, including people whose social content is collected through a permitted service or who appear in that content. Collection of a post does not, by itself, mean its author has joined a program or granted promotional reuse rights.

Read this Policy with the WeyQi Privacy Policy, particularly its retention and privacy-rights provisions, and any relevant program notice, content-rights agreement or Data Processing Addendum ("DPA"). This Policy does not grant new content rights, expand an existing licence or waive a mandatory privacy right. Applicable law and binding platform requirements prevail over inconsistent retention or reuse wording.

WeyQi handles requests concerning data for which it determines the purposes and means of processing. Where a Brand, Agency or other customer controls the relevant processing and WeyQi acts on its behalf, we coordinate with that customer as explained in Section 16. You may contact us for help identifying the responsible organisation.

2. How to request deletion

Contact and scope

Step 1: Email privacy@weyqi.com. You may use the subject "Data Deletion Request," but no particular subject line, form or legal terminology is required. We also recognise a clear request received through another communication channel, including verbally where applicable, and route it for handling.

Step 2: Identify the information you want deleted. Provide the details available to you:

• Your name or relevant display name, WeyQi account email, social handle, former handle or another identifier you already know.
• The Brand, Agency, campaign, loyalty program or other service concerned, if known.
• Whether your request concerns a particular post or file, data from a social connection, participation records, your WeyQi account, or all personal data we hold about you.
• Relevant post links or other locating details, if available.
• A contact method for our response and any request reference already issued.

Explain if you are acting for someone else or if the request involves an urgent privacy or safety concern. You do not need to obtain a technical account identifier from a platform to make a request.

Step 3: Respond to any necessary clarification or verification request. Missing optional details do not invalidate your request. If its scope is unclear, we will help clarify it without requiring unnecessary information. You may request deletion even if you never registered with WeyQi or cannot access the original social account.

Where a deletion control is available within the relevant WeyQi service, you may use it. You may also use a supported deletion-request mechanism offered by the connected platform. A request we receive through such a mechanism does not require a duplicate email.

Verification and representatives

We may ask for proportionate information to verify your identity, control of the relevant account or content, or authority to act for another person. We use information already held where practical. We do not routinely require a government identity document and do not ask for a social media password, access token or full payment-card details.

If additional evidence is necessary, we explain what is needed and provide an appropriate route. Verification information is used only for handling the request, preventing unauthorised disclosure or deletion, and meeting applicable obligations. Its retention is limited accordingly.

An authorised representative may submit a request with evidence of authority where required. A parent or guardian may contact us about a child. We protect information about other people when verifying and answering a request.

WeyQi does not charge a fee for submitting or handling a deletion request.

3. What your choices mean

These actions are related but have different effects:

Deleting one social post does not, by itself, request closure of your entire WeyQi account. Equally, we do not require a separate email where a platform notification, loss of a permitted purpose or another applicable rule already requires us to act.

Removing a connection does not necessarily end another independently permitted processing activity. We assess the scope of each request and the obligations applying to the relevant data, rather than treating disconnection as permission to retain all previously collected information.

4. When deletion is initiated

We initiate deletion, or an appropriate restriction where permitted, when a valid request or applicable obligation requires it, when a retention period ends, or when information is no longer needed for its permitted purpose. This may arise from account closure, consent withdrawal, the end of a program or customer service, unlawful collection, or a binding legal or platform instruction.

We also review relevant records when we learn that source content has been deleted, access has been withdrawn, or the source account has changed or closed. We apply the relevant platform rules and the distinctions in Sections 7 to 9. A normal retention maximum is not permission to wait until that maximum expires after an earlier deletion obligation arises.

For Meta Platform Data, deletion is required as soon as reasonably possible when:

• The information is no longer necessary for a permitted purpose.
• WeyQi stops operating the relevant product or service.
• Meta requires deletion.
• A user requests deletion or no longer has an account with WeyQi, as covered by Meta's terms.
• A customer requests deletion or no longer has an account with WeyQi where the applicable technology-provider terms require deletion.
• Applicable law or regulation requires deletion.

We retain information beyond such a trigger only where the applicable Meta terms permit retention, as explained in Section 12. Where Meta Platform Data is received in error, we report the issue to Meta and delete the affected information as its terms require.

Content awaiting promotional reuse permission

Social content collected for possible promotional reuse is held only while a permitted review or rights-request purpose continues. As a WeyQi retention limit, if we have not recorded the necessary reuse permission, we delete that copy and the associated data held for that purpose within 90 calendar days of collection, or sooner when no longer needed or when law or platform rules require it.

This maximum does not authorise promotional use before approval or establish that the initial collection was permitted. A later registration, opt-in or rights grant does not retrospectively authorise earlier processing that lacked a required basis or permission.

Approval does not override later deletion duties or extend the retention periods in the Privacy Policy. Copying, exporting or moving content does not restart its retention period. Any separate record retained for another purpose must independently satisfy the applicable legal, platform and retention requirements.

5. How we handle requests

We record the request, identify its scope, complete any necessary verification and determine which records WeyQi controls and which require coordination with a customer. We act on separable parts that can be resolved without waiting unnecessarily for other parts.

We identify relevant content and data across the services and copies we control, including versions derived from the original records. Where appropriate, we restrict public display, further sharing, downloads or other affected uses while a deletion or rights concern is resolved.

We delete the data that must be deleted. We use genuine anonymisation only where it lawfully satisfies the relevant obligation and the source-platform rules permit it. We direct service providers to take the required action and communicate with other recipients as described in Section 10.

We respond by email or another appropriate channel and explain the outcome, including:

• The scope of deletion or restriction completed.
• Any limited information retained and the reason.
• Any permitted period for removing residual backup copies.
• Any part requiring action by another responsible organisation.
• Any refusal or limitation and the available complaint or appeal route, unless a lawful restriction prevents disclosure.

We do not describe a request as fully completed while relevant deletion remains pending without explaining that limitation.

To check progress, reply to our acknowledgement or email privacy@weyqi.com with any reference number we or the platform supplied. You can still contact us if you do not have a reference number.

6. Timeframes and updates

We acknowledge and act on requests without undue delay and within the applicable legal or platform deadline. Our service target is to resolve routine requests within 30 calendar days after receipt. This target does not extend a shorter obligation or permit us to postpone action that can be taken sooner.

Where the EU GDPR or UK GDPR applies, the usual response deadline is one calendar month. An extension of up to two further months is available only where the applicable law permits it, with the required explanation within the initial period. Other jurisdictions may have different response, acknowledgement or appeal periods, which we will follow.

We seek missing verification information promptly. We do not automatically restart the response period when an account is closed, a request is assigned internally or additional information is supplied. Any pause or extension must be permitted by the applicable rules. A permitted response extension does not automatically extend a separate platform deletion deadline.

The following periods have different starting events and must not be combined:

These are WeyQi's stated service targets or retention limits except where an applicable requirement establishes a particular deadline. They are not universal permissions to retain platform data for those periods.

7. Facebook, Instagram and other connections

Disconnecting and requesting deletion

To remove a Facebook connection, open Facebook settings and look for Apps and Websites or Business Integrations, as relevant to your connection. Select the connection used for WeyQi and remove its access.

For an Instagram connection, use the app and website permissions or connected-integration controls available in Instagram or the linked Facebook business settings. Menu names and available controls can differ by account and device. Use any deletion-request option offered by Meta as part of removal.

You may also use a WeyQi disconnection control where that feature is available. If you cannot find the connection, cannot access the account or prefer to contact us directly, email privacy@weyqi.com. Reconnecting a social account is not a general condition for making a deletion request.

Removing a connection stops future access through that connection; it is not a guarantee that all previously collected data disappears instantly. We act on a resulting deletion request or other applicable deletion obligation without requiring a duplicate email.

Tell us if you also want deletion of other WeyQi records or closure of your WeyQi account. A platform request is handled according to the information and scope supplied through the relevant mechanism.

Platform data and credentials

Meta Platform Data includes information received through Meta's platform, directly or through a provider acting for us, such as Facebook or Instagram account identifiers, profile information, posts, media, captions, comments, engagement data and relevant derived information. The categories depend on the enabled service and permissions.

We apply Meta's requirements concerning updates, deleted information, permitted purposes and deletion requests. Data from another social platform is handled under its applicable rules. Receiving information through an intermediary does not remove source restrictions.

We stop using revoked or unnecessary access credentials and promptly remove or render them unusable. We do not preserve usable credentials under a general log, evidence or backup retention period.

We handle valid deletion requests received from Meta or another platform through the mechanisms available for the relevant integration. You do not need to send a duplicate email for a platform request we have received.

To delete a post or account held by Facebook, Instagram or another platform itself, use that platform's own controls. A request to WeyQi concerns the information and copies we hold or process.

8. Posts deleted from a social platform

A deleted post without a direct request to WeyQi

If you delete a Facebook or Instagram post but do not separately ask WeyQi to delete your information, that action does not automatically close your WeyQi account, erase every participation record or terminate a separately granted UGC licence.

When we become aware that a post has been genuinely deleted from its source platform, we promptly disable further display, downloads, export and promotional reuse of the affected platform-sourced copy within WeyQi. We delete that copy and the associated data that must be removed as soon as reasonably possible.

We reflect relevant source changes and notify relevant recipients under Section 10. A prior UGC checkbox or the absence of a separate email does not permit continued use that platform rules prohibit. Any remaining records must satisfy Sections 9, 12 and 14.

Unavailable content and detection

An unavailable post may result from deletion, changed visibility, revoked permission, an expired media link, a temporary service problem or another access restriction. We do not treat a single failed request as conclusive proof of deletion.

We restrict affected uses where appropriate, check using permitted means and apply a prompt, proportionate resolution process. An unresolved status is not permission for indefinite continued use.

Source changes may not be reported to WeyQi instantly. We use available and appropriate platform notifications and permitted checks to keep relevant records current. You can notify us directly using a post link, handle or another locating detail.

Lack of an immediate notification does not remove our obligation to respond when we become aware of a change. We do not bypass privacy settings or access restrictions to recover removed content.

Effect on other records

We assess the affected media, captions, thumbnails, source identifiers, engagement information and identifiable derivatives within the scope of the applicable change or request.

Deletion of one post does not automatically require deletion of unrelated, lawfully retained account, transaction or permission records. However, renaming a copy, keeping it in another folder, replacing a handle with a code or labelling it "licensed" does not remove a deletion obligation.

9. UGC permissions and content rights

Your UGC opt-in and the limits of the licence

A content licence concerns permission to use a work. Privacy rules separately govern processing of personal data, including a person's image, voice or identifying information. The terms of the actual licence determine its scope, duration and termination.

This Policy neither cancels a licence automatically when a social post disappears nor makes a licence irrevocable.

If you choose the UGC or content-rights opt-in on a campaign page or microlink, the permission is governed by the terms presented when you agree. The grant applies only to the content, recipients, purposes, channels, duration and other limits covered by that agreement.

A public post, hashtag, tag, social-account connection or marketing-message consent is not, by itself, that promotional reuse opt-in. The opt-in does not waive mandatory data-protection rights or authorise a use prohibited by Meta or another source platform.

For the UGC workflow covered by this Policy, WeyQi obtains content from supported social platforms and records the applicable reuse permissions. A recorded licence does not change how a file was obtained. Continued storage and use require an effective licence where needed, a valid privacy basis, compliance with applicable platform terms, and no binding removal obligation.

A creator's approval covers only rights that the creator may lawfully grant. Copyright, privacy, publicity, music, likeness and other third-party permissions must cover the intended use. Permission to post content on a social platform does not establish that every element is cleared for a Brand's separate promotional use.

Permission evidence and rights status

We keep a proportionate record of the source of collected content and the permission relied on. The record identifies the relevant content and creator, Brand and program, permission wording and version, acceptance date and method, and applicable purposes, channels, territory, duration and rights status.

We record relevant expiry, withdrawal or other changes. An "approved" or similar rights status records permission within its stated scope. It does not transfer ownership, guarantee clearance of every third-party right or provide permanent permission for unrestricted use.

Permission records support assessment of a deletion or reuse concern. They do not authorise retention of the full content after a deletion duty arises. Section 12 and the Privacy Policy govern their retention.

Copying, downloading, exporting, moving or relabelling a platform-sourced file does not change its source or remove applicable restrictions.

Withdrawal, termination and disputes

You may contact privacy@weyqi.com to withdraw a consent on which processing relies, raise a content-rights concern or ask how to exercise a termination right under the relevant licence. Identify the affected content or use where possible.

We assess the request under the actual permission, applicable privacy law, platform rules and relevant agreement. Where processing depends on consent and consent is withdrawn, we stop the affected consent-based use. We do not retrospectively substitute a different basis simply to continue the same processing against that withdrawal.

A separate lawful purpose may justify limited records, such as evidence of a permission previously relied on, only under the restrictions in Section 12. Continuing a copyright licence does not override a mandatory privacy right, source-platform restriction or valid takedown requirement.

If continued use is not supported, we stop the affected use and take the required deletion and recipient-notification steps.

10. Content supplied to customers and their systems

If WeyQi has supplied affected content or personal data to a Brand, Agency, service provider or another recipient, we identify the relevant recipients and promptly communicate required deletion, restriction or rights changes.

This includes copies downloaded from WeyQi, copies supplied to a customer-designated asset-management or content-library system where that functionality is enabled, and copies passed on to other authorised recipients.

Any such transfer must be permitted by the applicable data-protection requirements, content permissions and source-platform rules. A customer instruction, UGC licence or destination system does not independently authorise an otherwise prohibited disclosure.

Customer asset systems and permission records

Where content and associated permission records are supplied to an authorised customer system, the applicable purpose, licence limits, expiry and source restrictions continue to apply. Transfer does not extend the permitted retention period or restart it.

We communicate relevant subsequent rights changes and required restrictions or removals through the available integration or another appropriate communication route. An earlier permission record or approval label must not be treated as continuing authorisation after a relevant restriction takes effect.

Where required, our notice directs recipients to stop the affected use, remove covered copies and notify their own recipients. Covered copies may include previews, edited versions, exports and publications within the scope of the relevant obligation.

We instruct our processors and service providers to act and obtain appropriate confirmation. Where a recipient's action remains unresolved, we follow up and do not describe the affected part as completed without explaining the limitation.

Independent customer responsibilities

Where a customer acts as an independent controller, we notify it of the issue and applicable restrictions, require action within our contractual authority and seek confirmation. It remains responsible for its own processing and response obligations.

We follow up on unresolved action and take any further steps required by applicable law or platform rules. A client's preference to keep content does not override a binding restriction. A file downloaded from WeyQi remains subject to the restrictions attached to its source and permission record.

WeyQi can remove content from systems it controls and disable further access it provides. We cannot directly erase every file already downloaded to another organisation's device or every third-party publication.

We take the legally and contractually required steps to notify recipients, require action where we have that authority, and follow up. Where required, we explain relevant recipients and any unresolved part of the request to you.

Earlier and continuing uses

A later deletion or withdrawal does not automatically make an earlier lawful use unlawful. Ongoing advertisements, digital publications and retained copies still require assessment and any necessary removal.

Previously publishing or paying for content does not create a general exemption from a deletion or takedown obligation. Treatment of previously distributed print materials and other copies depends on the applicable right, agreement and law.

11. Systems and copies covered

Deletion covers relevant personal data in the systems and files within our control, including account and participation databases, stored media and previews, operational content libraries, search indexes, identifiable analytics, relevant working files, support records, and copies held by service providers on our behalf.

We include derived records where they remain personal data or are otherwise covered by a platform deletion obligation. This may include affected scores, classifications or other results linked to an identifiable person or source record.

We apply appropriate deletion, restriction and cache-removal measures to prevent deleted content from remaining available through our own links or ordinary service functions.

A hidden interface record, disabled account or inaccessible download link alone is not treated as permanent deletion from the relevant systems. The backup process in Section 13 applies to residual recovery copies.

12. Retention exceptions and evidence

We may retain only the particular information for which a valid exception or separate lawful retention purpose applies. Examples can include required accounting or tax records, evidence necessary for a specific legal claim or binding legal hold, and proportionate records demonstrating a consent, rights grant, request or compliance action.

We assess whether the applicable platform rules also permit that retention. A legal basis for processing personal data does not, by itself, establish an exception to a separate platform deletion obligation.

For Meta Platform Data subject to deletion, a general business interest, possible future dispute, client request, ordinary backup cycle or content licence does not create an exception. Where Meta's terms allow retention because applicable law or regulation requires it, we retain evidence of that requirement and keep only the required information for the required purpose and period. We comply with any applicable obligation to provide that evidence or notify Meta.

For records that may lawfully be retained, we document the category, purpose, legal basis or requirement, access restrictions, and review or end date. We do not continue promotional reuse from an evidentiary archive.

We review extended retention at least annually and remove records when the justification ends. We explain a refusal or limitation where required, unless a lawful restriction prevents disclosure.

The Privacy Policy's schedule applies to these records. Necessary consent, content-rights and privacy-request evidence may be retained while relied on or while a request is handled, then for up to five years after withdrawal, expiry, last reliance or request closure, as applicable.

This is a maximum subject to necessity and earlier deletion requirements. It is not an automatic period for keeping the full image, video, social profile or other underlying content. Any justified different period follows the Privacy Policy's exception process.

13. Backups and recovery

After deletion from active systems, residual copies may remain temporarily in restricted backups until removed through the established backup rotation.

The normal maximum is 90 days after active-system deletion, unless a shorter legal or platform requirement applies. This period is not a universal exception to a deletion duty.

Residual backup data is kept beyond ordinary use and is not made available for ongoing analytics, scoring, marketing, content downloads or client reuse.

If a backup must be restored, we reapply relevant deletion and restriction records before the restored data returns to ordinary service. A legally required retained copy is separately restricted and reviewed under Section 12.

We explain any applicable residual-backup period in our response where relevant. Completion of active-system deletion and completion of backup removal are identified separately when necessary to give an accurate account of the request.

14. Anonymous statistics and prevention of recollection

We may retain genuinely anonymous statistical results only where applicable law and source-platform terms permit.

Removing a name, hashing an identifier, retaining a content fingerprint or using a coded record is not sufficient if the information can still identify or be linked to a person, account, browser or device. Where an obligation requires deletion rather than anonymisation, we delete.

We take reasonable measures to prevent routine imports, synchronisation or recovery processes from reintroducing records that must remain deleted.

A minimal suppression or request record may be retained only where necessary and permitted, with limited access and periodic review. Such a record is not used to continue promotional contact, reconstruct deleted content or maintain an otherwise prohibited profile.

Renewed connection or participation does not automatically authorise restoration of previously deleted information or revival of expired content rights.

15. Participation scores and rewards

Deleting a post, closing an account or withdrawing access may affect our ability to validate an entry, refresh a score, display a leaderboard result or complete a reward claim.

Any effect on eligibility is determined by the disclosed program terms, the information still lawfully available, and applicable law. We explain a material consequence where relevant.

We do not automatically treat post deletion as fraud, cancel an earned reward solely because someone exercises a privacy right, or make deletion conditional on surrendering a mandatory right.

A genuine dispute about eligibility, payment or misuse is assessed separately. You may raise a concern about an affected score or eligibility decision using privacy@weyqi.com, and we provide any review required by applicable law and the relevant program terms.

We retain only the evidence that may lawfully be kept. An eligibility review does not create blanket permission to preserve all affected content or to delay an otherwise required deletion.

16. Customer-controlled data and offboarding

Where WeyQi acts as a processor or service provider for a Brand, Agency or other customer, we promptly pass the relevant request to the responsible customer, explain that route where appropriate and assist with the required action.

We follow lawful documented instructions under the applicable DPA. We also fulfil obligations that apply directly to WeyQi and do not delay them solely because a customer has not responded.

The roles of WeyQi, the customer and any customer-designated system provider depend on their actual processing responsibilities. Storing a copy in another system does not, by itself, change those responsibilities or remove an applicable deletion obligation.

A customer may require a shorter or longer retention period than the Privacy Policy's fallback schedule only where the instruction is lawful, necessary, proportionate, supported by the required basis and notices, and consistent with platform restrictions.

The agreed period applies only to the covered data. It cannot defeat a deletion right or justify indefinite retention. We seek clarification of instructions that appear inconsistent with these requirements and do not implement an unlawful instruction.

At the end of the relevant services, we return or delete customer personal data under the DPA and agreed offboarding arrangements, subject only to valid retention requirements.

We do not use an export or transition period to delay a deletion that must already occur. Closing a WeyQi account does not itself close a separate Brand loyalty account or erase data independently held by that Brand.

17. Children and third-party rights

If you believe WeyQi holds a child's information unlawfully, or content infringes your privacy or other rights, contact privacy@weyqi.com with available locating details.

You do not need to be the person who uploaded the content. We assess the concern, verify authority only as necessary, and take appropriate restriction, deletion or other action.

A creator's permission does not waive the independent rights of another identifiable person appearing in the content. We consider those rights when assessing whether content may remain available or be reused.

18. Complaints and regional rights

If you disagree with our handling, reply to the request response or email privacy@weyqi.com, explaining the concern and including any reference number. We will review it and provide an appeal process and response within the applicable period where the law requires one.

We do not unlawfully discriminate against you for exercising a privacy right.

Rights and exceptions depend on the processing and applicable jurisdiction. They may arise under UAE Federal Decree-Law No. 45 of 2021, the EU GDPR, UK GDPR, applicable US state laws or other relevant local laws.

The regional provisions of the Privacy Policy supplement this Policy. No general timing or exception here reduces a stronger mandatory local protection. A legal basis or exception available in one jurisdiction is not automatically available in another.

You may complain to the competent privacy or data-protection authority and seek any available judicial remedy. For UAE matters this may be the competent UAE Data Office or other authority where the relevant mechanism is available. For EEA or UK matters it may be the relevant supervisory authority.

Contacting WeyQi first is not a condition for exercising that right.

19. Changes and contact

We may update this Policy to reflect changes to services, practices, law or platform requirements. We update the date and provide further notice where required.

A later change does not retrospectively expand a content licence or remove a right attached to a request already made.

Related documents include the WeyQi Privacy Policy, applicable Creator Terms and program-specific terms, the relevant Brand or Agency privacy notice, and the applicable Data Processing Addendum.