Privacy Policy

Last updated: 6 July 2026

This Privacy Policy explains how MIWI ("MIWI", "we", "us", or "our") collects, uses, discloses, stores, and protects personal data when you visit miwi.mv, create or use a MIWI workspace account, participate in a trial or subscription, communicate with us, or otherwise interact with the MIWI hospitality and business software platform (the "Platform").

The legal entity operating MIWI is the company identified on your subscription invoice, order form, or commercial agreement with us (the "Service Provider"). If you need our registered name or address, contact us using the details in Section 15.

By using the Platform, you acknowledge that you have read this Privacy Policy. Where we rely on consent, you may withdraw consent as described below without affecting the lawfulness of processing before withdrawal.

Important — roles under the law

For account, billing, support, and platform-operation data relating to workspace administrators, staff users, and prospective customers, MIWI is generally the data controller.

For guest, visitor, employee, and other end-user data that a subscribing organisation enters into its workspace, that organisation is generally the data controller and MIWI acts as a data processor on its instructions. That organisation is responsible for providing its own privacy notice to its end users.

This Policy is prepared in accordance with the Personal Data Protection Act of the Republic of Maldives, the Cyber Security Act (Law No. 17/2023), the Consumer Protection Act (Law No. 12/2020) (where applicable to consumer-facing interactions), the Electronic Transactions Act (Law No. 2/2022), and recognised international data-protection best practices.

1. Scope

This Policy applies to personal data processed by MIWI in connection with:

the public website and marketing pages at miwi.mv;
self-serve onboarding, trials, subscriptions, and billing;
workspace authentication, administration, and support;
platform security, monitoring, and service improvement; and
communications with prospective and existing customers.

It does not replace the privacy notices that our customers must provide to their own guests, employees, or other data subjects when they use MIWI to run their business.

2. Personal data we collect

We collect only personal data that is adequate, relevant, and necessary for the purposes described in this Policy.

2.1 Account and identity data

name, email address, phone number, job title, and organisation name;
login credentials and authentication factors (including multi-factor authentication records);
workspace role, permissions, and tenant membership;
invitation and onboarding status.

2.2 Business and subscription data

company or property profile, branch details, billing profile, and tax identifiers you provide;
subscription plan, enabled modules, usage metrics, invoices, and payment status;
communications with sales, support, or account management.

2.3 Platform usage and technical data

IP address, device and browser type, operating system, and approximate location derived from IP;
session identifiers, cookies, and similar technologies;
audit logs, access logs, security events, and error diagnostics;
preferences such as language, timezone, and notification settings.

2.4 Customer-entered operational data (processor role)

Where you use MIWI modules, your organisation may enter personal data about third parties, including:

Hospitality / booking: guest names, contact details, identification references, stay history, preferences, folio and payment records;
HR and workforce: employee profiles, attendance, leave, payroll-related information, and compliance records;
POS / CRM / inventory: customer or supplier contacts and transaction-related details;
Communications: messages sent through integrated channels.

We process this data only to provide the Platform to your organisation under our agreement with you.

2.5 Payment data

Card and wallet payments are handled by our payment partners (for example, BML Connect or MIB GlobalPay). We receive limited payment metadata such as transaction status, amount, currency, and partial card or payment-method identifiers needed for reconciliation, fraud prevention, and support. We do not store full payment card numbers on MIWI servers.

2.6 Special categories of personal data

Some modules may involve sensitive personal data (for example, health-related notes in HR, government identification references, or financial information). Processing of special categories is permitted only where allowed under the Personal Data Protection Act and our agreement with you, such as with explicit consent, for employment-law compliance, or other recognised lawful grounds. Customers must ensure they have a valid legal basis before entering such data.

3. How we collect personal data

We collect personal data:

directly from you when you register, complete onboarding, update settings, contact us, or make a purchase;
from your organisation when an administrator invites you or assigns roles;
automatically through cookies, logs, and similar technologies when you use the Platform;
from integrated services you or your organisation connect (for example, channel managers, payment providers, or messaging gateways), subject to your configuration; and
from payment and fraud-prevention providers when you pay for a subscription.

4. Purposes and lawful grounds for processing

We process personal data only for specific, explicit, and legitimate purposes. Our principal lawful grounds under the Personal Data Protection Act include:

Purpose Examples Typical lawful ground Provide and operate the Platform account creation, tenancy isolation, module delivery, backups performance of contract / service Security and fraud prevention access control, MFA, abuse detection, audit trails legitimate interests / legal obligation Billing and tax compliance invoicing, GST records, payment reconciliation performance of contract / legal obligation Support and communications helpdesk, service notices, product updates performance of contract / legitimate interests Product improvement diagnostics, aggregated analytics, reliability testing legitimate interests Legal and regulatory compliance responding to lawful requests, record-keeping legal obligation Marketing (where permitted) product information to business contacts who have not opted out legitimate interests / consent

We do not use personal data for purposes incompatible with those for which it was collected unless we notify you and, where required, obtain consent.

5. Automated processing

MIWI may use automated systems for security monitoring, fraud detection, usage metering, and workflow suggestions. We do not make decisions producing legal or similarly significant effects solely by automated means without appropriate human oversight, except where permitted by law and disclosed to you.

6. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember preferences, protect the Platform, and understand how our website is used.

You can control cookies through your browser settings. Disabling essential cookies may prevent some parts of the Platform from working. Where non-essential cookies require consent, we will request consent before placing them.

7. How we share personal data

We do not sell personal data. We disclose personal data only as described below.

7.1 Within your organisation

Authorised users in your workspace can access data according to role-based permissions configured by your administrators.

7.2 Service providers and processors

We use vetted third parties who process personal data on our instructions, including providers of:

cloud hosting and infrastructure;
email and notification delivery;
payment processing;
customer support tooling;
security monitoring and backup services.

We require processors to implement appropriate confidentiality, security, and data-protection obligations by contract.

7.3 Integrations you enable

If your organisation connects third-party services (OTAs, accounting tools, messaging providers, hardware devices, etc.), data may be shared with those services according to your configuration. You are responsible for reviewing their privacy practices.

7.4 Legal and safety disclosures

We may disclose personal data where required by applicable law, court order, or lawful request by a public authority, or where necessary to protect the rights, safety, and property of MIWI, our users, or others.

7.5 Business transfers

If we are involved in a merger, acquisition, restructuring, or sale of assets, personal data may be transferred subject to confidentiality and continued protection consistent with this Policy.

8. International and cross-border transfers

Your data may be processed in the Maldives and in other countries where our infrastructure or service providers operate.

Cross-border transfers are carried out only where permitted under the Personal Data Protection Act, including where:

the recipient jurisdiction provides an adequate level of protection as determined by the Data Protection Authority;
appropriate safeguards are in place (such as contractual data-protection clauses approved or recognised by the Data Protection Authority); or
another lawful transfer mechanism applies.

We take steps to ensure that personal data transferred outside the Maldives receives a comparable level of protection.

9. Data retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including to:

provide the Platform and honour our contract with you;
comply with legal, tax, and accounting obligations (including GST and invoice retention requirements under Maldivian law);
resolve disputes and enforce our agreements; and
maintain security and audit records.

Indicative retention periods:

Data type Retention approach Active workspace operational data for the subscription term and a limited export window after termination Account and billing records as required for tax, audit, and commercial law (typically several years) Security and audit logs for a defined period based on security and compliance needs Marketing enquiries until the enquiry is concluded or you opt out Temporary export files deleted automatically after download or within a short fixed period

When retention ends, we delete or anonymise personal data unless further retention is required or permitted by law.

10. Security

We implement reasonable administrative, physical, and technical measures designed to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage, consistent with the Personal Data Protection Act and the Cyber Security Act. Measures include, where appropriate:

tenant-scoped access controls and role-based authorisation;
encryption in transit and encryption for sensitive data at rest;
multi-factor authentication and step-up controls for sensitive actions;
logging, monitoring, and vulnerability management;
staff confidentiality obligations and security training;
incident response procedures.

No method of transmission or storage is completely secure. You are responsible for safeguarding your credentials and configuring access within your organisation appropriately.

11. Personal data breaches

If we become aware of a personal data breach that is likely to give rise to a real risk of serious harm, we will notify the Data Protection Authority and affected data subjects within the timeframes required by the Personal Data Protection Act (generally within seventy-two hours of becoming aware, where notification is required).

If you believe your workspace has experienced a security incident involving personal data, contact us immediately at privacy@miwi.mv.

12. Your rights

Subject to the Personal Data Protection Act, you may have the following rights in relation to personal data for which MIWI is the controller:

Right to information — receive clear notice about processing (this Policy and related notices).
Right of access — request access to personal data we hold about you, covering at least the prior twelve months where applicable.
Right to rectification — request correction of inaccurate or incomplete data.
Right to object — object to processing based on certain lawful grounds other than consent.
Right to withdraw consent — where processing is based on consent, withdraw it at any time.
Right to restriction / suspension — request restriction of processing in specified circumstances.
Right to erasure — request deletion where permitted by law (subject to legal retention requirements).
Right to data portability — receive certain data in a structured, commonly used electronic format where technically feasible.

To exercise these rights, email privacy@miwi.mv with sufficient information to verify your identity. We will respond within a reasonable period and explain any grounds for refusal.

If you are an employee, guest, or other end user of a customer organisation, please contact that organisation first. We will assist our customer as required by our agreement and applicable law.

If you are dissatisfied with our response, you may lodge a complaint with the Data Protection Authority established under the Personal Data Protection Act (administered through the National Centre for Information Technology).

13. Children and minors

The Platform is intended for business use and is not directed at children. We do not knowingly collect personal data from minors without appropriate authority. If you believe we have collected a minor's personal data without proper consent, contact privacy@miwi.mv.

14. Direct marketing

We may send service-related and, where permitted, product information to business contacts. You may opt out of non-essential marketing at any time by using the unsubscribe link in an email or contacting privacy@miwi.mv. Service, security, and billing notices may still be sent.

Where personal data is shared for commercial direct marketing by a data-sharing arrangement, we will provide the information required by the Personal Data Protection Act and obtain consent where required.

15. Contact and data protection representative

Privacy enquiries privacy@miwi.mv General support via your workspace or sales@miwi.mv Website https://miwi.mv Registered address available on request and on tax invoices issued by the Service Provider

We have designated personnel responsible for monitoring compliance with data-protection law. You may request the identity of the relevant contact when you submit a privacy request.

16. Dhivehi language

Under the Consumer Protection Act, service providers should make key price and condition information available in Dhivehi where services are offered in the Maldives. A Dhivehi summary of this Policy may be requested by emailing privacy@miwi.mv. In the event of inconsistency between translations, the English version prevails unless Maldivian law requires otherwise.

17. Changes to this Policy

We may update this Policy to reflect legal, technical, or business changes. We will post the updated version at miwi.mv/privacy with a revised "Last updated" date. For material changes, we will provide additional notice (for example, by email or in-product notice) where required by law or contract.

Continued use of the Platform after the effective date of an update constitutes acceptance of the revised Policy, except where further consent is required by law.

18. Legal review

This Policy is designed to align with Maldivian law and common international practice for SaaS platforms. Organisations with specific regulatory obligations (for example, tourism operators, employers, or financial service providers) remain responsible for their own compliance when using MIWI.