Clause (1): Introduction and scope

1. Madar Al-Ibtikar for Software (hereinafter "the Establishment" or "we") is committed to protecting personal data in accordance with the provisions of theJordanian Personal Data Protection Law No. (24) of 2023and the regulations and instructions issued under it, the Electronic Transactions Law No. (15) of 2015, the Cybercrime Law in force, and all other relevant legislation in the Hashemite Kingdom of Jordan. This does not prejudice any stronger right or protection granted to you by a mandatory provision of the law of your country of residence, and those rights remain available to you.

2. This policy sets out the data we collect, the purposes of collecting and processing it, the legal basis for doing so, the parties with whom it may be shared, the periods for which it is retained, the measures taken to protect it, and the data subject's rights and how they are exercised.

3. This policy applies to: the platform's marketing website, the dashboard, the applications and programming interfaces (API), and every subscription package, including digital stores, brochure sites, landing pages, the restaurant and café module and the reservations service where made available.

4. This policy does not apply to the sites and stores that subscribers create using the platform's tools as regards their relationship with their own shoppers. Each subscriber undertakes to publish their own privacy policy on their store in accordance with Clause (16) below.

Clause (2): Our legal capacity when processing data

1. The Establishment acts in two different capacities depending on the type of data being processed, and each capacity carries a different scope of responsibility:

2. The Establishment — in its capacity as processor — does not use the subscriber's shoppers' data for its own purposes, does not sell it, does not rent it, does not transfer it to third parties, and does not merge it with the data of other subscribers. Its processing of that data is confined to what is necessary to operate and secure the service, in accordance with the subscriber's documented instructions and what the applicable legislation requires.

3. In its capacity as processor, the Establishment complies with Article (12) of the Personal Data Protection Law, including: not exceeding the specified purpose and duration of processing, erasing the data once the processing period ends or delivering it to the controller, and refraining from any act that makes the data or the results of processing available except in cases permitted by law.

Clause (3): Definitions

The terms used in this policy have the meanings assigned to them in the Personal Data Protection Law No. (24) of 2023, and in particular:

• Personal data:any data or information relating to a natural person that is capable of identifying them directly or indirectly, whatever its source or form.
• Sensitive personal data:data indicating origin, race, opinions, political affiliations or religious beliefs, or relating to financial position, health, physical, mental or genetic condition, biometric prints, or a criminal record, together with anything the Council determines to be sensitive.
• Processing:any operation performed on data by any form or means, such as collection, recording, storage, organisation, use, transmission, making available, transfer, encoding, erasure, amendment or disclosure.
• Data subject:the natural person whose data is being processed.
• Controller:the natural or legal person in whose custody the data is held.
• Processor:the natural or legal person responsible for processing the data.
• Supervisor:the natural person appointed to oversee databases and processing in accordance with the provisions of the law.
• Recipient:any person inside or outside the Kingdom to whom data is transferred or with whom it is exchanged.
• Profiling:the automated processing of data to identify a data subject's tendencies, inclinations, choices or behaviour.
• Breach of data security and integrity:any unlawful access, or any unauthorised operation, transfer or action affecting the data.
• The Unitandthe Council:the regulatory unit responsible for personal data protection at the Ministry of Digital Economy and Entrepreneurship, and the Personal Data Protection Council formed under the law.

Clause (4): The data we collect

First: data we collect in our capacity as "controller"

• Identity and contact data:full name, establishment name, the establishment's national number or commercial register number where applicable, email address, telephone number, and the address of the business.
• Account data:username; the password in an encrypted form the Establishment cannot recover as plain text; verification codes (OTP); access keys (API Keys); and account settings and the permissions granted to sub-users.
• Subscription and billing data:the package subscribed to, renewal dates, the record of invoices and payments, and the last four digits of the payment method, its type and the authorisation code issued by the payment service provider.We do not store full card numbers or verification codes (CVV) under any circumstances.
• Technical data and usage logs:the internet protocol address (IP), device, browser and operating system type, display language, login and logout dates and times, the pages viewed, session identifiers, and error and performance logs.
• Support and contact data:the content of correspondence, tickets and conversations, the attachments you send, and call recordings where these exist and after you have been informed of them.
• Marketing data:your preferences about receiving promotional messages, how you arrived at the platform, and your engagement with our messages.

Second: data we process in our capacity as "processor" on behalf of the subscriber

• The subscriber's shoppers' data: name, telephone number, email address, delivery address and geographic coordinates where enabled.
• The content of orders, their details, values, status and history, and the shopper's notes and special instructions.
• Data on reservations, tables, loyalty and points programmes and vouchers, and shoppers' ratings and comments.
• Records of the messages the subscriber sends to their shoppers through the platform's tools.

The scope of this data and the purposes of processing it are determined by the subscriber alone in their capacity as its controller; the Establishment is confined to carrying out the processing technically.

Third: sensitive data

The Establishment does not request sensitive personal data and does not collect it for its own purposes. The subscriber is prohibited from using the platform's tools to collect or process sensitive data — such as health, genetic or biometric data, or beliefs or affiliations — without a legal basis and prior express consent meeting the conditions of Article (5) of the law, and bears sole and full responsibility for any breach of this.

Clause (5): Sources of collection

• Directly from you:when registering or subscribing, filling in forms, contacting technical support, or taking part in offers and surveys.
• Automatically during use:through cookies, server logs and built-in measurement tools.
• From third parties:payment service providers (as to the status of a transaction, without full card data), identity verification providers where applicable, and delivery applications and social media platforms when you choose to connect them to your account.
• From the subscriber:as regards their shoppers' data, which they upload or which is generated through their store.

Clause (6): Purposes of processing and their legal basis

Your data is processed only for a lawful, specific and clear purpose, and on one of the legal bases set out below, pursuant to Articles (4) and (6) of the Personal Data Protection Law:

We do not use your data for a purpose other than the one for which it was collected except after obtaining your prior consent, or in the cases permitted by law.

Clause (7): Prior notice of processing

Pursuant to Article (9) of the law, this policy constitutes prior written notice of the following: the data that will be processed and the date processing begins (being the date your account is created or the platform is first used); the purpose of the processing; the duration of the processing as set out in Clause (12); the processors involved in carrying out the processing as set out in Clause (10); the data security and integrity controls as set out in Clause (13); and the information relating to profiling as set out in Clause (20).

Clause (8): Prior consent and its withdrawal

1. Your consent is taken expressly and recorded electronically, specified as to duration and purpose, and in clear, simple and non-misleading language, at the time the account is created or when a feature requiring separate consent is activated.

2. You may withdraw your consent at any time without giving reasons. Withdrawal carries no financial or contractual consequence, without prejudice to rights the Establishment acquired before the date of withdrawal. Withdrawal does not affect the lawfulness of processing carried out before it.

3. Withdrawing consent for data necessary to operate the service may make it impossible to continue providing that service in whole or in part; we will tell you so before acting on your request.

4. Consent is of no effect if it was given on the basis of incorrect information or deceptive or misleading practices, or if the nature, type or objectives of the processing changed without fresh consent being obtained.

Clause (9): Cookies and similar technologies

We use cookies (Cookies), local storage and tags for the following purposes:

You may manage your preferences at any time from the cookie settings panel on the platform, or refuse or delete cookies from your browser settings, bearing in mind that disabling the strictly necessary cookies may prevent some functions from working.

Clause (10): Sharing and disclosure of data

Sharing is confined to the following categories, and only to the extent necessary to achieve the purposes set out in Clause (6):

• Infrastructure, hosting and cloud service providers:to operate the platform and to store and back up data.
• Payment service providers and payment gateways:to process the subscription fee. Card data is processed directly by them, under their own policies and approved security standards.
• Providers of SMS, email and notification services:to send verification codes and operational notifications.
• Analytics, performance measurement and error monitoring tools.
• Delivery applications, accounting systems and integrated services:where the subscriber chooses to connect them to their account, at which point a direct relationship arises between the subscriber and that service.
• Professional advisers:lawyers, auditors and accountants, within the limits of what their work requires and under an obligation of confidentiality.
• Competent judicial, regulatory and security authorities:in execution of a court order or a legal obligation, or to prevent or detect a crime.
• A legal successor:in the event of a merger, restructuring or transfer of the business, with prior notice to you and with the data remaining subject to the same level of protection.

We bind every processor and recipient by a written contract containing obligations of confidentiality and security and confining processing to the specified purpose and duration, and we keep records documenting the data transferred, the purpose of the transfer and the related consents, in accordance with Article (14) of the law.

Clause (11): Transferring data outside Jordan or outside your country

1. Some components of the platform, its backups or its operating tools may be hosted with providers outside the Hashemite Kingdom of Jordan, and therefore outside your country of residence.

2. The Establishment does not transfer data to any person outside the Kingdom where the level of protection that person provides falls below what the law prescribes, except in the cases the law permits, including the data subject's consent to the transfer after being informed that an adequate level of protection is not available.

3. Before any transfer, the Establishment verifies the level of protection at the recipient, relies on the list of approved countries and entities issued by the Personal Data Protection Council, and concludes the necessary contractual safeguards with the recipient.

4. By using the platform you are informed of, and consent to, this transfer to the extent necessary to provide the service; you may withdraw that consent in accordance with Clause (8).

Clause (12): Retention periods

We do not retain data once the purpose of processing it has ended, unless legislation provides otherwise. The adopted periods are as follows:

We may retain specific data beyond these periods, and only to the extent necessary, in order to defend a legal right or to respond to a claim or to an ongoing regulatory or judicial procedure, after which it is deleted as soon as the reason ceases.

Clause (13): Data security and the measures taken

1. The Establishment takes appropriate security, technical and organisational measures to protect data against any breach of its security and integrity, and against any unauthorised disclosure, alteration, destruction or action, including:

• Encrypting the connection over theHTTPS/TLSprotocol, and hashing passwords with one-way algorithms.
• Setting access permissions on the principle of least privilege, and reviewing them periodically.
• Logical separation between subscribers' data, so that no subscriber reaches another's.
• Regular backups and testing of restore procedures.
• Logging and monitoring sensitive operations, and enabling two-factor authentication wherever available.
• Binding staff and contractors to confidentiality and training them on data protection requirements.

2. Even so, the security of no system or transmission over the internet can be guaranteed one hundred per cent (100%). It falls to you to protect your login details and not to share them, and to notify us immediately if you suspect any unauthorised use of your account.

Clause (14): Breach of data security and integrity

1. Where a breach of data security and integrity occurs that is liable to cause serious harm to the data subject, the Establishment undertakes — pursuant to Article (20) of the law — to do the following:

• Notify the data subjects whose data was affected withintwenty-four (24) hoursof discovering the breach, and provide them with the steps needed to avoid any consequences that may follow from it.
• Notify the competent regulatory unit withinseventy-two (72) hoursof discovering the breach, of its source and mechanism, the persons affected, and any information available about it.

2. If the breach occurs within the subscriber's area of responsibility and affects data processed through the platform, the subscriber must notify the Establishment within a period not exceeding twenty-four (24) hours of becoming aware of it, and it is the subscriber, as controller, who notifies the data subjects and the Unit.

3. If the Establishment discovers a breach affecting data it processes on behalf of a subscriber, it notifies that subscriber without undue delay of the information available to it, so as to enable the subscriber to meet their legal obligations.

Clause (15): The data subject's rights and how to exercise them

1. Article (4) of the Personal Data Protection Law guarantees you the following rights:

• To know of, review, access and obtain the data we hold about you.
• To withdraw prior consent.
• To correct, amend, add to or update your data.
• To restrict processing to a specified scope.
• To erase or conceal data in accordance with the provisions of the law.
• To object to processing and profiling where they are not necessary to achieve the purposes for which the data was collected, or are excessive for those purposes, or are discriminatory, unfair or contrary to law.
• To have a copy of your data transferred from the Establishment to another controller.
• To be informed and made aware of any breach, violation or infringement of the security and integrity of your data.

2. How to exercise them:A request is submitted by email to[email protected]or through the dashboard, stating the right you wish to exercise together with proof of your identity. We may ask for additional information to verify identity, in order to protect your data.

3. Response time:We respond to your request within a period not exceedingthirty (30) daysfrom the date a complete request is received. This may be extended once, by a like period, for complex requests, with notice to you of the reasons for the extension.

4. Free of charge:Exercising your rights carries no financial or contractual consequence, pursuant to paragraph (c) of Article (4) of the law.

5. Limits on the rights:We may refuse a request in whole or in part — stating the reasons — if the processing is being carried out in accordance with Article (6) of the law, or if complying with the request would contravene a legal or contractual obligation, prejudice the rights of others, or impede the defence of a legal right.

6. If your request concerns data we process in our capacity as processor on behalf of one of the subscribers (for example, because you are a shopper at their store), we will refer your request to that subscriber as the controller of your data, and will tell you that we have done so.

Clause (16): The subscriber's obligations as controller of their shoppers' data

The subscriber acknowledges and undertakes — in their capacity as controller of the data of their shoppers and their store's visitors — as follows:

• To publish a clear privacy policy on their store setting out the data collected, its purposes, the retention periods and the data subject's rights.
• To obtain prior consent meeting the conditions of Article (5) of the law before any processing, and to record it.
• To refrain from collecting data in excess of what the purpose requires, and from processing sensitive data without a legal basis.
• To enable their shoppers to exercise their rights and to respond to their requests and complaints.
• Not to use shoppers' data for marketing without their express consent, and to provide an easy means of unsubscribing.
• To appoint a data protection supervisor if one of the cases in Article (11) of the law applies to them.
• To protect their dashboard login details and to set their staff's permissions and withdraw them as soon as their relationship with them ends.
• To indemnify the Establishment against any damage, fine, claim or regulatory action arising from their breach of the obligations set out above.

The Establishment bears no responsibility for the lawfulness of the subscriber's collection of data, for the purposes of their processing of it, or for the content of the privacy policy published on their store.

Clause (17): Provisions specific to the restaurant and café module

1. Additional, operational data is processed through this module, including: order data, items and values; delivery addresses and geographic coordinates; reservation and table data; loyalty and points programme data; and point-of-sale, shift and invoice records.

2. The subscriber (the restaurant or café owner) is the controller of this data, and the Establishment acts solely as processor.

3. When the module is connected to any delivery application or order intermediary, the necessary order data is shared with that application under its own terms and privacy policy. The relationship then arises directly between it and the subscriber, and the Establishment is not answerable for its processing of the data.

4. Any audio or video recording or surveillance feature inside the premises is not provided by the Establishment and is not processed through it; the subscriber alone bears responsibility for its lawfulness and for giving notice of it.

5. Data recorded while operating offline (Offline) is treated to the same standard of protection as soon as it is synchronised, and the Establishment does not guarantee the completeness of the synchronisation of anything recorded during the period of disconnection.

Clause (18): Data of children and persons lacking capacity

1. The platform is not directed at anyone under eighteen (18) years of age, and subscription accounts are created only for those with full legal capacity to contract.

2. The data of a person lacking legal capacity is processed only with the consent of one of their parents or their guardian, or with the consent of a judge upon the Unit's application where the best interest so requires, in accordance with Article (5) of the law.

3. If it becomes apparent to us that we have collected a minor's data without the required basis, we take steps to delete it as soon as we become aware. If you are a parent or guardian and believe that the data of someone in your care has been collected contrary to this, write to us at the data protection email.

Clause (19): Marketing and promotional messages

1. We send marketing messages only on the basis of your express prior consent, and you can unsubscribe from them at any time through the unsubscribe link in the message, from your account settings, or by writing to us.

2. Unsubscribing does not cover the necessary operational notifications about your account, your billing, the platform's security and amendments to the terms, as those are sent in performance of the contract.

3. Your data may not be transferred to third parties for the purpose of marketing products or services without your consent, pursuant to Article (14) of the law.

Clause (20): Profiling and automated decision-making

1. We may use limited automated processing for operational purposes, such as suggesting the package best suited to your usage, or detecting suspicious patterns in order to prevent fraud and misuse.

2. We do not take purely automated decisions that produce a legal effect concerning you or significantly affect you without human intervention, save for urgent security measures necessary to protect the platform or its subscribers; in that case you have the right to request human review of the decision.

3. You have the right to object to profiling in accordance with Clause (15).

Clause (21): The data protection supervisor and point of contact

1. The Establishment undertakes to appoint a data protection supervisor whenever one of the cases set out in Article (11) of the law applies to it. The supervisor carries out the duties prescribed there, including acting as liaison officer with the Unit, overseeing the periodic examination of processing systems, and receiving requests and complaints.

2. For any enquiry, request or complaint relating to this policy or to your personal data:

• Email:[email protected]
• Official email:[email protected]
• Telephone:0785461954
• Address: Amman — Al-Muqabalain — opposite the Greater Amman Municipality — Hashemite Kingdom of Jordan

Clause (22): Complaints and the competent regulator

1. We recommend writing to us first at the data protection email so that your complaint can be resolved amicably within thirty (30) days.

2. In all cases you retain the right to lodge a complaint withthe regulatory unit responsible for personal data protection at the Ministry of Digital Economy and Entrepreneurshipor withthe Personal Data Protection Council, as well as your right to bring a civil claim for compensation for damage suffered as a result of a breach of the provisions of the law, pursuant to Article (21) thereof.

Clause (23): External links and services

The platform may contain links to, or integrations with, websites, applications and services that the Establishment neither owns nor operates. This policy does not apply to those parties, and the Establishment bears no responsibility for their practices in collecting, processing or protecting data. You are advised to review their own privacy policies before using them.

Clause (24): Amending this policy

1. The Establishment reserves the right to amend or update this policy, and the amended version takes effect from the date it is published on the platform.

2. Where a material amendment is made that affects your rights or the nature, type or objectives of the processing, we notify you at least thirty (30) days before it takes effect, by registered email or through the dashboard, and we obtain fresh consent from you wherever the law requires it.

3. The date of the last update is shown at the top of this page. Previous versions are kept by the Establishment and may be requested.

Clause (25): Governing law and jurisdiction

1. This policy is governed by, and construed in accordance with, the laws of the Hashemite Kingdom of Jordan. This does not prejudice any stronger right or protection granted to you by a mandatory provision of the law of your country of residence, and those rights remain available to you.

2. The regular courts of Amman have jurisdiction over any dispute arising from or relating to this policy, without prejudice to any right granted by a mandatory provision to apply to the legally competent authority in your country of residence.

3. This policy was drawn up in Arabic. Where a translation into any other language exists, the Arabic text alone prevails in the event of a difference of interpretation.