Who we are

This Privacy Policy explains how Sekkara (“we”, “us”, or “our”) collects, uses, shares, and protects personal data when you use the Sekkara loyalty platform. Sekkara is a company registered in the commercial registry under the laws in force in the Syrian Arab Republic, and operates and manages the Sekkara platform, the Sekkara consumer app, and the Sekkara POS merchant app.

For the purposes of applicable data-protection law — including Syria’s Law No. 12 of 2024 on the Protection of Electronic Personal Data — Sekkara is the data controller of the personal data described in this policy — the entity that decides why and how it is processed. Our registered address is Damascus, Syria. If you have any questions about this policy or how we handle your data, contact us using the details in the Contact section below.

Scope

This policy applies to all of the following Sekkara services (together, the “Services”):

The Sekkara consumer mobile app for individuals, used to earn, view, and redeem loyalty points and vouchers.
The Sekkara POS merchant point-of-sale app, used by Merchants and their authorized staff to publish and manage offers, scan and verify Consumer coupons, and issue and redeem Points.
Any merchant dashboard or merchant-facing pages on https://sekkara.io.

This policy complements, and does not replace, any separate merchant agreement signed between Sekkara and a Merchant. Cookies and similar technologies used on the website are described separately in our Cookie Notice.

Information we collect & why

We collect only the data we need to operate the loyalty program securely. The table below summarises each category of personal data, why we process it, and the legal basis for doing so.

Data	Purpose	Legal basis
Phone number	To create your account and sign you in. We verify your number with a one-time passcode (OTP) delivered by our approved verification provider. For Merchants, the responsible person’s verified phone number is also our official channel of communication with the business.	Performance of our contract with you (to provide the account and Services).
Profile data you provide	Optional details you add to your profile (such as name and preferences) to personalise your experience and tailor offers.	Your consent, and our legitimate interest in providing a useful, personalised service.
Merchant / business data	Trade name, commercial registration or licence number, activity type and category, business address, branches, and map location, logo and photos, and offer content — used to review and approve join requests, and to display the business and its offers to Consumers.	Performance of our contract with the Merchant, and compliance with our legal and regulatory obligations.
Device location (precise / approximate)	To show nearby partner stores and relevant offers, and — for Merchants — to place a business or its branches on the map. Only collected when you grant location permission; it is optional and does not block use of the app.	Your consent (you may grant or revoke location permission at any time in device settings).
Camera	To scan QR codes at checkout. The Sekkara POS app scans the Consumer’s coupon code; images are processed instantly and are not stored by Sekkara, and are not used for photography, recording, or any other purpose.	Your consent (you may grant or revoke camera permission at any time in device settings; note that a Merchant cannot scan coupons if this permission is withdrawn).
Transactions & points data	To operate the loyalty program: we record points issued and redeemed, and related settlement data, so balances are accurate.	Performance of our contract, and compliance with our legal and financial obligations.
Billing data	Fees due, invoices, and payment status for a Merchant’s subscription.	Performance of our contract, and compliance with our accounting obligations.
Push notification token	To deliver notifications about transactions, settlements, offer status, and invoices via Google Firebase Cloud Messaging. Can be disabled at any time in device settings.	Your consent (you may disable notifications at any time in device settings).
Diagnostics & crash data	To detect, diagnose, and fix crashes and errors and keep the apps stable and secure, via Google Firebase Crashlytics.	Our legitimate interest in maintaining a reliable, secure service.
Device information	Technical details such as device ID, model, and operating system version, used for compatibility, security, and troubleshooting.	Our legitimate interest in operating and securing the Services.
Biometric data (Face ID / fingerprint)	Used only, and optionally, to unlock the Sekkara POS app on your device. Matching happens entirely on-device using the operating system’s secure hardware; Sekkara never receives, transmits, or stores this data.	Your consent, processed locally on your device only.
Storage & media	Used only when a Merchant uploads a business logo or offer photos, or saves a report; access is limited to the files the Merchant chooses to select.	Your consent (granted via device permission).

What we don’t collect: the app does not collect Consumers’ payment-card or bank-account data, does not receive biometric data, and does not record or retain camera content beyond the instant it takes to scan and verify a coupon.

How we use information

We use the personal data described above to:

Create, review, approve, secure, and operate Consumer and Merchant accounts;
Issue, track, and redeem loyalty points and vouchers;
Show Consumers nearby partner stores and offers relevant to them, and let Merchants manage their offers and authorized staff;
Prepare reports, settlements, and invoices;
Send transactional notifications, and, with your consent, promotional offers — which you can withdraw (unsubscribe from) at any time without affecting your account or your Points;
Detect, prevent, and investigate fraud, misuse of points or coupons, and security incidents, and respond to lawful requests from competent Syrian judicial or security authorities;
Diagnose problems, improve the apps, and maintain reliability;
Comply with our legal, tax, accounting, and regulatory obligations; and
Communicate with you about support requests and changes to the Services.

We do not sell or rent Merchant or Consumer data to any third party, and we do not use it for third-party advertising.

We only share personal data in the following cases:

With Consumers: we show Consumers a Merchant’s public business information (trade name, logo, photos, address and location, category, offers and their terms, and user ratings). We do not show Consumers a Merchant’s Authorized Users’ data or its financial data.
With a Merchant, about a Consumer: a Merchant only receives the minimum data needed to complete a redemption. Merchants must keep that data confidential, must not store it outside the app, and must not use it for their own marketing (see Terms of Service).
With official authorities: where required by law, or in response to a court order or a request from a competent government authority in the Syrian Arab Republic.
With technical service providers (processors): such as our cloud hosting provider, our OTP/SMS verification provider, and Google Firebase (for push notifications and crash diagnostics) — all bound to data-protection standards and to using data only for the purpose we specify.
With your consent: in any other case where we obtain your explicit consent.

This policy is designed to align with the disclosures made in the Google Play Data Safety form for the Sekkara apps.

Data retention

We keep personal data only for as long as necessary for the purposes set out in this policy:

Account & profile data: retained for as long as an account is active, then for 6 months after it is closed, after which it is deleted or anonymised.
Coupon, points & transaction records: retained for 12 months for documentation and dispute-resolution purposes (for Merchants, this also includes subscription and billing records).
Financial and transaction records needed for legal, tax, accounting, audit, and fraud-prevention purposes are retained even after an account is deleted, for as long as required by applicable law, and are anonymised or aggregated where possible.

See Delete your account & data for details on what is deleted and what is retained.

Security

We use technical and organisational measures designed to protect your personal data, including:

Data stored on protected servers and transmitted over encrypted channels; sensitive data is encrypted at rest;
On-device biometric unlock — Face ID and fingerprint matching never leave your device and are never transmitted to us;
Internal access limited to staff whose role requires it;
A requirement that Merchants revoke a staff member’s access when their role ends.

No method of transmission or storage is completely secure, but we work continuously to protect your data and to notify affected users — Consumers and Merchants alike — within a reasonable time if a breach affects their data.

Your rights

Subject to applicable law, you (and, for a Merchant, its Authorized Users) have the right to access the personal data we hold about you, ask us to correct inaccurate data, request deletion, object to or restrict certain processing, and withdraw consent (for example, by disabling location, camera, or notification permissions in your device settings).

To delete your account and data, follow the instructions on our Delete your account & data page. A deletion request is carried out within 7 days of the request, once any amounts owed are settled and subject to the retention periods above. Consumers: for 30 days after the account is deleted, you can restore it in the Sekkara app, and everything in it comes back — including your profile, Points balance, activated Coupons, and other account data. After 30 days the deletion becomes final and unredeemed Points and activated Coupons are permanently forfeited. Deleting a Merchant Account removes its business and offers from the app and ends its Authorized Users’ accounts, without affecting obligations to Consumers or to Sekkara that arose before deletion. Uninstalling the app is not, by itself, the same as deleting your account.
To exercise any other right, contact us at privacy@sekkara.io. We may need to verify your identity before acting on a request, and we respond to data-related complaints and requests within 5 business days.
Withdrawing consent: you can opt out of promotional messages at any time (see How we use information above), and grant or revoke location, camera, and notification permissions at any time in your device settings.

Children

Sekkara POS (Merchant app): the person responsible for a Merchant Account, and any Authorized User, must be at least eighteen (18) years old and have full legal capacity under Syrian law. We do not knowingly collect personal data from anyone below that age through the Sekkara POS app.

Sekkara (Consumer app): you must be at least sixteen (16) years old to create and use a Sekkara consumer account. We do not knowingly collect personal data from anyone below that age.

If you believe a minor has provided us with personal data, contact privacy@sekkara.io and we will take steps to delete it.

International transfers

Some of our processors (such as Google, our OTP provider, and our cloud-hosting provider) may process personal data in countries other than the Syrian Arab Republic. Where this happens, we take steps to ensure the data is protected by appropriate safeguards consistent with this policy and applicable law.

Changes to this policy

Sekkara may update this Privacy Policy at any time. When we do, we increase the version number and update the “Last updated” date above. For a material change — one that reduces your rights or significantly changes how we collect, use, or share your data — we give at least 30 days’ notice in-app, or at your registered phone number or email, before the change takes effect. Non-material changes (such as clarifications) may take effect immediately once posted. Continuing to use the Services after a change takes effect means you accept the revised policy.

Contact

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:

Email: privacy@sekkara.io · support@sekkara.io · legal@sekkara.io

Address: Damascus, Syria

Website: https://sekkara.io

We respond to complaints and requests relating to personal data within 5 business days of receiving them.