1. Introduction

1.1 This Privacy Policy ("Policy") explains how scme portal LLC, its subsidiaries, divisions, brands, segments, employees, directors, consultants, and affiliates (collectively "SupperClub Global," "we," "our," or "us"), collect, use, disclose, store, and protect personal information of users ("you," "your," or "user") when you access or use our website, mobile application, or related services (collectively, the "Platform").

1.2 SupperClub Global operates in compliance with the Saudi Personal Data Protection Law (PDPL), UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and, where applicable, the EU General Data Protection Regulation (GDPR).

1.3 By accessing or using our Platform, you acknowledge and agree that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

2. Data Controller and Contact Details

2.1 The Data Controller for all information processed under this Policy is:

scme portal LLC
Dubai, United Arab Emirates
Email: [email protected]

2.2 The Company has appointed a Data Protection Officer (DPO) who can be contacted at the same email address for any questions or requests related to personal data.

3. Scope and Application

3.1 This Policy applies to all users of the Platform, including members, vendors, partners, and visitors, and governs the processing of personal data collected online, through mobile applications, and in communications with SupperClub Global.

3.2 This Policy does not apply to third-party websites, applications, or platforms that may be linked through the Platform. Those are governed by their own privacy policies.

4. Data We Collect

4.1 SupperClub Global may collect and process the following categories of data:

• Identification Data: Name, email address, contact number, nationality, and account identifiers.
• Membership Data: Subscription details, account creation information, renewal dates, and membership type.
• Transactional Data: Booking history, purchases, redemption of offers, and billing details (excluding payment card data).
• Location Data: Approximate or precise geolocation for location-based offers and services.
• Technical Data: IP address, browser type, device information, operating system, and access logs.
• Communication Data: Records of communications with customer support or partners.
• Marketing Data: Newsletter subscriptions, preferences, engagement metrics, and campaign tracking (including UTM parameters).
• Optional Data: Gender or social login details (if and when enabled).
• Cookies & Analytics Data: Behavioral and session data collected through cookies and similar technologies.

4.2 We do not collect or store payment card details. All payments are handled securely by Stripe.

5. How We Collect Data

5.1 Directly from you when you:

• Create or update your account or membership.
• Make a purchase or booking.
• Communicate with our team or partners.
• Opt in to newsletters or marketing.

5.2 Automatically when you use our Platform through:

• Cookies, session tracking, and analytics tools.
• Device and network logs.
• Geolocation services (if enabled).

5.3 From third parties such as:

• Payment processors (Stripe).
• Analytics and marketing platforms (Google, Meta, Microsoft Clarity, Klaviyo).
• Partners and service providers offering discounts or services through the Platform.

6. Purposes of Processing

6.1 We process personal data for the following lawful purposes:

• To provide, operate, and maintain the Platform and its services.
• To manage memberships, subscriptions, and payments.
• To deliver offers, promotions, and benefits to members.
• To personalize content and recommendations.
• To send administrative communications, confirmations, and updates.
• To provide customer support and respond to inquiries.
• To analyze usage for improvement of our products and services.
• To ensure security, prevent fraud, and maintain integrity of systems.
• To comply with legal obligations and respond to lawful requests.

7. Legal Basis for Processing

Under PDPL, GDPR, and UAE privacy law, we process data based on:

• Consent - You have given explicit consent (e.g., through checkboxes or cookie banners).
• Contractual necessity - To fulfill a service you have requested.
• Legitimate interests - To improve services, enhance security, and personalize experience.
• Legal obligations - When required by applicable laws or regulations.

8. Cookies and Tracking Technologies

8.1 We use cookies, pixels, and session storage for functionality, analytics, and personalization.

8.2 Third-party technologies include:

• Microsoft Clarity - Heatmaps and session analytics.
• Google Analytics, Tag Manager, Search Console - Web performance analytics.
• Meta Pixel (Facebook) - Marketing and conversion tracking.
• Klaviyo - Email and automation analytics.
• Custom UTM tracking - Marketing attribution.

8.3 You can manage or withdraw cookie consent through your browser settings or via the cookie banner on our Platform.

9. Third-Party Data Processors

9.1 We engage carefully selected service providers to process data on our behalf, including:

• AWS (Amazon Web Services) - Hosting and data storage.
• Cloudflare - Content delivery and DDoS protection.
• Strapi - Headless CMS.
• MongoDB - Database.
• Zoho Mail - Email services.
• Stripe - Payment processing.
• Klaviyo - Marketing communications.
• Microsoft Clarity, Google, and Meta - Analytics and tracking.

9.2 All processors act under written data-processing agreements consistent with PDPL and GDPR standards.

10. International Transfers

10.1 Personal data may be transferred and stored outside the UAE, including AWS regions in Bahrain and Singapore.

10.2 Such transfers are protected by appropriate safeguards including Standard Contractual Clauses (SCCs) and contractual commitments ensuring equivalent data protection.

11. Data Retention

11.1 We retain your data only for as long as necessary to:

• Manage memberships and transactions.
• Fulfill contractual and legal obligations.
• Maintain records for audit and regulatory purposes.

11.2 Upon termination or expiry of membership, personal data will be deleted or anonymized unless retention is required by law.

12. Security Measures

12.1 We implement robust technical and organizational measures to secure data, including:

• Encrypted connections (TLS 1.3).
• Access control, firewalls, and intrusion detection.
• Anti-bot protection
• Encrypted data in transit and storage.
• Regular vulnerability assessments and monitoring.

12.2 While we strive for complete security, no electronic transmission is entirely secure. Users share information at their own risk.

13. User Rights

13.1 Under PDPL and GDPR, you have the following rights:

• Access - Obtain confirmation and a copy of your data.
• Rectification - Correct inaccurate data.
• Erasure - Request deletion where lawful.
• Restriction - Limit processing in specific cases.
• Portability - Receive data in a machine-readable format.
• Objection - Object to certain types of processing or marketing.
• Withdrawal of Consent - Withdraw consent at any time.

13.2 To exercise your rights, contact: [email protected]

13.3 We will respond within the statutory timeframe under applicable law.

14. Marketing Communications

14.1 We may send newsletters, promotions, and offers with your consent.

14.2 You may unsubscribe anytime via link in emails or through account settings.

15. Children's Data

15.1 The Platform is not intended for minors under 18 years of age.

15.2 We do not knowingly collect data from children. Accounts identified as belonging to minors will be deleted without notification.

16. Changes to This Policy

16.1 We may amend this Policy to reflect changes in technology, law, or business operations.

16.2 The "Last Updated" date will indicate the most recent revision.

17. Governing Law and Jurisdiction

17.1 This Policy is governed by the laws of Dubai, United Arab Emirates.

17.2 Any dispute shall be subject exclusively to the Dubai Courts.

17.3 All monetary references are in AED (United Arab Dirhams).