Data Processing Addendum

The processor is maksab alwala aldhaki Company For Media Services, Unified National Number 7055014174, at 7234 Aswan Street, Al Wadi District, secondary number 3003, postal code 22518, Jeddah, Kingdom of Saudi Arabia(“Nuqtaty”). The controller is the merchant that accepted Nuqtaty's terms and determines the loyalty programme's purposes, rules and requested data (“Merchant”).

If the Merchant processes for another controller, it must ensure its instructions to Nuqtaty are lawful and authorised.

Nuqtaty processes data while the Merchant uses the service and as needed to configure the programme, register customers, issue and update Wallet passes, record stamps, points, balance and redemption, deliver configured messages, prevent fraud and provide authorised records and support.

Documented instructions are the Merchant's settings, authorised-user actions, lawful support requests and this addendum. If an instruction appears unlawful, Nuqtaty pauses the affected part and tells the Merchant unless prohibited by law.

Data subjects: loyalty customers, passholders, referrers and invitees.

Data: merchant-selected identity and contact fields, custom answers, marketing preferences, referral data, stamps, points, balance, visits, rewards, Wallet identifiers and update tokens, plus limited technical and security data such as IP, device, network-derived approximate location and join source.

The service is not designed for health, criminal, detailed financial or other sensitive data. Merchants must not enter it into free-text fields without written approval and the necessary legal basis and controls.

• Set a lawful purpose and basis and request only necessary data.
• Give a clear notice, handle rights requests and respond to complaints.
• Obtain separate, freely given and recorded marketing consent where required and make withdrawal easy.
• Never treat a QR scan, pass installation or store visit as marketing or location-tracking consent.
• Manage staff permissions and credentials and report suspected misuse promptly.
• Handle prepaid value, rewards and deletion without extinguishing an outstanding customer entitlement.

• Process only on documented lawful instructions and to supply the service, unless law requires otherwise.
• Limit access to personnel who need it and bind authorised personnel to confidentiality.
• Apply and review technical and organisational measures appropriate to the risk.
• Assist, using available information and product functions, with rights requests, impact assessments, incidents and legal duties.
• Not sell Merchant customer data, market Nuqtaty to those customers or disclose it to another merchant.
• Return available data or delete it on lawful instruction after termination, subject to legal exceptions and backup cycles.

Controls include TLS, managed authentication and one-way password storage, roles and permissions, database-level isolation where applicable, service key protection and operational controls and logs for incident response. Nuqtaty does not claim that every backup uses content encryption managed by Nuqtaty; backup protection also depends on the infrastructure provider and contract.

The Merchant generally authorises the following providers for the service. A named region does not describe every possible support, log, backup or provider-subcontractor processing location.

The current list is published at Service providers. Nuqtaty reviews and updates the list before a provider materially changes processing. Merchants needing individual contractual notice should contact us.

Some listed services require processing outside Saudi Arabia. Nuqtaty assesses data scope, purpose, country, provider, safeguards and applicable PDPL transfer requirements. The observed Frankfurt regions do not promise that every record, backup or support operation remains in Germany. The Merchant must disclose any additional mandatory restriction before entering affected data.

Nuqtaty notifies the Merchant without undue delay after confirming an incident affecting its data and shares available information about its nature, categories, impact and containment. Reasonable updates continue so the Merchant can assess notification duties within its statutory deadline. This is not a promise that a full investigation will finish within 24 hours.

The Merchant remains responsible for controller notifications. Nuqtaty may notify the competent authority directly where law requires this in Nuqtaty's own role.

A verified passholder can correct details and marketing preferences, download available data as JSON or delete it from the pass page. Histories beyond display limits may require a further copy from support. Nuqtaty refers decisions requiring controller authority to the Merchant and assists through available information and functions.

Staff deletion does not delete the business. A sole-owner deletion may include the business and its customers after showing the impact and resolving prepaid value and legally required records. Nuqtaty does not promise one automatic 30-day or 90-day purge for all records.

On termination, Nuqtaty deletes or de-identifies live data no longer needed after a lawful instruction, except limited billing, tax, dispute, fraud or legally required records. Backups expire through the provider's cycle and are not returned to ordinary use after deletion.

Nuqtaty provides reasonable information needed to demonstrate this addendum. Audits are coordinated in advance, protect platform security, confidential information and other merchants' data, and first use available reports and documents before an on-site inspection.

Liability, term and termination follow the main terms to the extent permitted by law. Saudi Arabian law governs. Data-protection contact: info@nuqtaty.com.

See the Privacy Policy, Terms and the authoritative Arabic addendum.