1. Introduction
1.1 This Privacy Policy explains how SoukPay Rewards Tech Ltd (“SoukPay”, “we”, “our”, “us”) collects, uses, stores, shares, and protects personal data when you use the SoukPay Customer App, the SoukPay Merchant App, the SoukPay Merchant Web Portal, the SoukPay website, or otherwise interact with SoukPay.
1.2 SoukPay is a company incorporated in the Dubai International Financial Centre (DIFC) with registered address at DIFC Innovation Hub, Level 1, Gate Avenue – South Zone, Dubai, United Arab Emirates. SoukPay is the data controller for the personal data described in this Policy.
1.3 SoukPay processes personal data in accordance with the DIFC Data Protection Law No. 5 of 2020 (the “DIFC DP Law”) and, where applicable to individuals in the UAE outside the DIFC, the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”). Where the two frameworks differ, SoukPay applies the standard that provides the higher level of protection.
1.4 This Policy applies to: (a) customers who register and use the SoukPay Customer App (“Customers”); (b) individuals associated with merchants participating in the SoukPay platform, including business owners, managers, and staff (“Merchant Users”); and (c) visitors to the SoukPay website and individuals who contact SoukPay.
2. Personal Data We Collect
2.1 Customers
2.1.1 Registration data: first name, last name, mobile phone number, and email address, together with verification records (OTP confirmation of phone and email).
2.1.2 Transaction data: transaction amount, date and time, merchant and outlet, payment method type, card brand and last four digits, refund and dispute status, and your SoukPay Credits ledger (pending, available, redeemed, reversed, and expired Credits).
2.1.3 Payment card data: your full card details are collected and stored by Stripe, our payment service provider, not by SoukPay. SoukPay stores only a tokenised reference, the card brand, the last four digits, and the expiry month and year, for display and payment-selection purposes.
2.1.4 Location data: with your permission, your device location while the app is in use, solely to show you nearby merchant outlets. SoukPay does not collect location data in the background or when the app is closed. You can withdraw location permission at any time in your device settings; merchant discovery by location will then be unavailable but all other app functions continue.
2.1.5 Device and usage data: device type, operating system, app version, language preference, and technical logs generated in the operation of the app (such as error reports and security events).
2.1.6 Communications data: your correspondence with SoukPay support and your marketing preferences.
2.2 Merchant Users
2.2.1 Business contact data: name, role, business email address, and business phone number of merchant owners, managers, and staff added to the platform.
2.2.2 Onboarding and verification data: business and identity information you provide during onboarding is collected by Stripe directly through Stripe’s own KYB verification flow. SoukPay receives the verification outcome and limited business profile information from Stripe, not the underlying identity documents.
2.2.3 Commercial data: outlet details, tier selection, transaction volumes, rewards ledger, settlement and refund history, and contract records.
2.3 Data We Do Not Collect
2.3.1 SoukPay does not collect: full payment card numbers or CVV codes (held by Stripe only); Customer identity documents; Customer date of birth; or any biometric data. Customers confirm they are 18 or older at registration; SoukPay does not verify age through documentation.
3. How We Use Personal Data and Our Lawful Bases
3.1 Operating your account and the platform — creating and managing your account, authenticating you, processing payments, operating the SoukPay Credits programme, handling refunds and disputes, and providing customer support. Lawful basis: performance of our contract with you.
3.2 Service communications — sending payment receipts, refund confirmations, security notifications, Credits expiry reminders, and notices of changes to our terms. Lawful basis: performance of our contract and compliance with legal obligations.
3.3 Marketing communications — sending offers, new merchant announcements, and promotional campaigns, only where you have opted in. Lawful basis: your consent, which you may withdraw at any time in the app settings or via the unsubscribe mechanism in any marketing message.
3.4 Safety, security, and fraud prevention — monitoring for fraudulent activity, programme abuse, unauthorised access, and misuse of the platform. Lawful basis: our legitimate interests in protecting the platform, our merchants, and our customers.
3.5 Legal and regulatory compliance — maintaining records required under UAE tax law and other applicable law, and responding to lawful requests from courts and authorities. Lawful basis: compliance with legal obligations.
3.6 Platform improvement and analytics — understanding how the platform is used in order to improve it. Where possible we use aggregated or anonymised data for this purpose. If in the future we deploy in-app analytics tools that process personal data, we will update this Policy before doing so and, where required, seek your consent. Lawful basis: legitimate interests, and consent where required.
4. Who We Share Personal Data With
4.1 Stripe — our payment service provider. Stripe processes payment card data, conducts merchant KYB verification, and processes transactions, refunds, and disputes. Stripe acts as an independent controller for the payment data it processes under its own privacy policy, and as our processor for certain platform services.
4.2 Service providers acting as our processors, under contracts that restrict their use of personal data to providing services to SoukPay:
- (a) Amazon Web Services — cloud hosting of the SoukPay platform and database;
- (b) SMSGlobal — delivery of SMS messages, including OTP verification codes and service notifications;
- (c) Twilio SendGrid and Resend — delivery of transactional email, including OTP verification codes, receipts, and service notifications;
- (d) HubSpot — customer relationship management for merchant onboarding and sales communications (Merchant User business contact data only);
- (e) PandaDoc — electronic execution and management of merchant contracts (Merchant User signatory data only).
4.3 Merchants — when you pay at a merchant outlet, the merchant sees the transaction amount, date and time, card brand, and last four digits of the card used. Merchants do not receive your name, phone number, email address, or any other personal details from SoukPay.
4.4 Authorities and courts — where required by applicable law or a lawful order.
4.5 Corporate transactions — in connection with a merger, acquisition, reorganisation, or sale of business, personal data may be transferred to the successor entity, subject to this Policy continuing to apply.
4.6 SoukPay does not sell personal data and does not share personal data with third parties for their own marketing purposes.
5. Where Personal Data Is Stored and Cross-Border Transfers
5.1 The SoukPay platform and its database are hosted on Amazon Web Services infrastructure in the AWS Frankfurt region (eu-central-1), located in Germany, in the European Union. Payment data processed by Stripe is held on Stripe’s infrastructure in accordance with Stripe’s own compliance framework. Our other service providers process data in the locations described in their respective privacy documentation.
5.2 SoukPay is established in the DIFC, and personal data collected by SoukPay is therefore transferred outside the DIFC for hosting and processing. These transfers are made to jurisdictions that the DIFC Commissioner of Data Protection has assessed as providing an adequate level of protection (including the European Union), or otherwise subject to appropriate safeguards in accordance with Articles 26 and 27 of the DIFC DP Law and the corresponding provisions of the PDPL.
5.3 SoukPay intends to migrate platform hosting to Amazon Web Services’ UAE region (me-central-1) once that region is fully operational, which would locate primary data storage within the UAE. This Policy will be updated when that migration occurs.
6. How Long We Keep Personal Data
6.1 Active accounts — we retain your personal data for as long as your account is open, because it is needed to operate your account and the platform.
6.2 Account deletion — when you delete your Customer account, it enters a 30-day deactivation window during which you can restore it by logging in. If not restored, the account is permanently deleted at the end of the window.
6.3 After permanent deletion: (a) transaction and financial records are retained for five (5) years from the end of the relevant tax period, as required by UAE tax law and other applicable record-keeping obligations; (b) records of your consents, our communications with you, and data needed to establish or defend legal claims are retained for as long as reasonably necessary for those purposes; and (c) all other personal data is deleted or irreversibly anonymised within twelve (12) months.
6.4 Anonymised data — data that can no longer identify you (for example, aggregated transaction statistics) is not personal data and may be retained without limit for analytics and business planning
7. Your Rights
7.1 Subject to the conditions and exemptions in the DIFC DP Law and the PDPL, you have the right to: (a) access the personal data we hold about you; (b) have inaccurate personal data corrected; (c) have your personal data erased in certain circumstances; (d) restrict or object to certain processing, including processing based on legitimate interests; (e) receive the personal data you provided to us in a portable format; (f) withdraw consent at any time where processing is based on consent, without affecting processing before withdrawal; and (g) not be subject to decisions based solely on automated processing that produce legal or similarly significant effects, except as permitted by law.
7.2 To exercise any of these rights, contact us at privacy@soukpay.com. We will respond within the timeframes required by applicable law (in most cases, one month). We may need to verify your identity before acting on a request.
7.3 If you are not satisfied with our response, you have the right to lodge a complaint with the DIFC Commissioner of Data Protection and, where the PDPL applies, with the UAE Data Office.
8. Cookies and Similar Technologies
8.1 SoukPay uses cookies and similar technologies on its website and, where applicable, within its digital services to operate and secure its services, remember user preferences, understand how its website and services are used, and improve performance and functionality.
8.2 Some cookies are strictly necessary for the operation and security of the website and cannot reasonably be disabled through SoukPay’s systems. Other cookies, including analytics, functionality or advertising cookies, will be used only where permitted by Applicable Law and, where required, with your consent.
8.3 Where consent is required, you may accept or reject non-essential cookies and may change your preferences at any time through the cookie settings made available on the SoukPay website. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
8.4 SoukPay may use third-party service providers in connection with cookies and similar technologies. Where those technologies involve the processing of personal data, that processing will be carried out in accordance with this Privacy Policy and Applicable Law.
8.5 Further information about the cookies and similar technologies used by SoukPay, including their purposes and applicable retention periods, may be provided through SoukPay’s cookie banner, cookie settings or Cookie Notice, as applicable.
9. Security
9.1 SoukPay implements appropriate technical and organisational measures to protect personal data, including encryption of data in transit, access controls, and the segregation of payment card data to Stripe’s PCI DSS-compliant infrastructure so that full card details never touch SoukPay’s systems.
9.2 In the event of a personal data breach likely to result in a risk to your rights, SoukPay will notify the relevant supervisory authority and, where required, affected individuals, in accordance with applicable law.
10. Children
10.1 The SoukPay platform is not directed at anyone under 18, and SoukPay does not knowingly collect personal data from anyone under 18. If we become aware that an account has been registered by someone under 18, we will close the account and delete the associated personal data.
11. Changes to This Policy
11.1 We may update this Policy from time to time. If we make material changes, we will notify you through the app or by email before the changes take effect. The version in force is the version published in the Customer App and on the SoukPay website.
12. Contact
12.1 For any privacy question or to exercise your rights, contact SoukPay at privacy@soukpay.com, or write to SoukPay Rewards Tech Ltd, DIFC Innovation Hub, Level 1, Gate Avenue – South Zone, Dubai, United Arab Emirates.
