Privacy policy

Who we are

Voucheriser is a product of Digiten Technologies LLC-FZ, a company registered in the Meydan Free Zone, Dubai, United Arab Emirates (registration number 2306345.01), with its office at Meydan Free Zone, Meydan Hotel, Ground Floor, Dubai, United Arab Emirates. In this policy, "we", "us" and "our" mean Digiten Technologies LLC-FZ.

Voucheriser lets businesses run digital loyalty cards, stamp cards, vouchers, prepaid packs and receipt raffles for their customers. This policy explains how we handle personal data when you visit our website, when a business uses Voucheriser, and when you use a card in the Voucheriser wallet.

We follow the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and other laws that apply to us.

Two kinds of users, two roles

Businesses. When a business signs up, we decide how its account data is used, so we are responsible for it as the controller. This covers the owner's and staff members' names, email addresses, logins and billing details.

Customers of a business. When you join a business's loyalty program, the business decides what its program collects and why. For that data we act on the business's behalf, as its processor, and we only use it to run the program for them. If you have a question about how a particular business uses your data, ask that business first. We will help it answer you.

What we collect

From businesses:

Account details: business name, owner name, email address, phone number, country, language and password.
Staff details: names, email addresses and logins created by the business.
Billing details: the plan, invoices and the billing country. Card details are collected and stored by Stripe, not by us.
Content the business adds: card designs, logos, offers, pack terms and texts.

From customers of a business (members):

Your name and email address, and optionally your phone number, birthday and preferred language.
Your activity with each business: stamps, points, vouchers, rewards, pack purchases and pack visits, with the date, time and location.
If the business has connected its Shopify store, the orders that add a pack or points to your card, matched by your email address.
If you enter a business's raffle: the photos of your receipts, what we read from them (shop, date, amount and receipt number), your tickets, and whether you won.

From everyone who visits:

Technical data our servers record, such as your IP address, browser, device type and the pages you open. We use it to keep the service secure and working.
The cookies listed below.

We do not use advertising trackers, and we do not sell personal data.

Why we use it

To provide the service: to show your cards, record stamps, points and pack visits, and let businesses run their programs.
To run raffles: to read receipts so the business's staff can check entries faster, give tickets, and draw winners.
To send messages you need, such as sign-in codes, receipts, reward and pack updates, and important notices about your account.
To bill businesses for their plan.
To keep the service secure, prevent fraud and abuse, and fix problems.
To meet our legal obligations, for example keeping invoices for tax purposes.
To send a business owner news about Voucheriser. They can opt out at any time.

Marketing emails from a business to its own members are sent on that business's instructions. Every such email has an unsubscribe link.

We share personal data only with service providers who help us run Voucheriser, and only as far as they need it:

Stripe, to take payments for business plans.
Our email delivery provider, to send sign-in codes and notifications.
Google, when a member chooses to save a card to Google Wallet.
Shopify, when a business connects its store.
OpenAI, for two things. When a business uses the AI writing assistant, only the text the business is drafting is sent. When you enter a raffle, the photos of your receipts are sent so the amount, date and receipt number can be read. We ask OpenAI not to keep a copy of the receipts, and we do not let it use them to train its models.
Our hosting provider, which runs our servers in the United Arab Emirates, or in another region a business has chosen for its data.

A business sees the data of its own members only. It never sees members of other businesses.

We may also disclose data when the law requires it, to protect our rights or the safety of others, or as part of a sale or merger of our business, in which case this policy continues to apply.

Where your data is stored

Our servers are in the United Arab Emirates, and data is stored there by default.

A business may ask us to store its data, including the data of its members, in another country or region. When we agree, we store it there on that business's instructions, and that business is responsible for making sure the region it chose meets the laws that apply to it and its members. If you are a member and want to know where a business keeps your data, ask that business.

Some of the providers listed above may process data in other countries. When that happens, we rely on safeguards the law allows, such as the provider's contractual commitments to protect the data.

Cookies

We use a small number of cookies that the site needs to work:

A session cookie that keeps you signed in and protects forms from misuse.
Preference cookies that remember your language, region, currency and light or dark theme.

We do not use advertising or cross-site tracking cookies. Where the law requires it, we show a cookie banner and ask for your consent before setting any cookie the site does not strictly need. You can delete cookies in your browser settings, but you may then need to sign in and set your preferences again.

How long we keep it

Business account data is kept while the account is open. After an account is closed, we delete or anonymise it within a reasonable period, except for what we must keep by law.
Invoices and billing records are kept for as long as tax law requires.
Member data is kept while the member has a relationship with at least one business, or until the member deletes their account.
Raffle receipt photos and what we read from them are deleted after the keep period the business chooses, between 1 and 36 months after entries close. The record of each draw and its winners is kept so the result can be checked later.
Server logs are kept for a short time for security and then deleted.

Your rights

Depending on the law that applies to you, you can ask to access the personal data we hold about you, correct it, delete it, restrict or object to how it is used, or receive a copy in a common format. You can also withdraw any consent you have given.

Members can do much of this themselves in the wallet: download their data, leave a business's program, or delete their account. Businesses can update their details and close their account from their dashboard.

For anything else, write to us at [email protected]. We may need to confirm your identity before we act. If you are a member of a business's program, we may pass your request to that business, since it decides how its program data is used.

If you are not happy with our answer, you can complain to the data protection authority in your country. In the UAE, that is the UAE Data Office.

Security

We protect data with encrypted connections, hashed passwords, separate logins for businesses, staff and members, and strict separation between businesses. No system is perfectly secure, so we also limit who on our team can access personal data and review that access.

If a breach affects your personal data in a way that puts you at risk, we will tell you and the authorities as the law requires.

Children

Voucheriser is not meant for children under 13. We do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy when our service or the law changes. We will change the date at the top, and if the change is significant, we will tell businesses by email or in their dashboard before it takes effect.