Privacy Policy — Sky Cashback Merchant

This Privacy Policy describes how Sama for Investments, the operator of the Sky Cashback platform (the "Company", "we", "us"), collects, uses, stores, and protects personal information through the Sky Cashback Merchant application (the "Merchant App").

The Merchant App is used by partner merchants to record sales and returns made with Sky Cashback vouchers. Customers who use the Sky Cashback customer app are covered by the separate Sky Cashback Privacy Policy.

By using the Merchant App, you agree to the practices described in this Policy.

• This Policy covers the staff of businesses that are Sky Cashback partner merchants and that use the Merchant App on the business's behalf.
• Merchant App accounts are created by the Company when a business joins Sky Cashback as a partner merchant. The Merchant App has no self-registration.
• This Policy also describes how we handle the customer mobile numbers that merchant staff enter in the Merchant App for offline sales and returns.

• Account information: Your full name, mobile number, the name and identifier of the business you work for, and your user identifier. You sign in with your mobile number and a password.
• Transaction records you create: Sale and return amounts, descriptions typed by staff, the cashback percentage selected, dates, transaction status, and transaction codes.
• Customer mobile numbers: When you carry out an offline sale or an offline return, you enter the customer's mobile number so that a one-time code can be sent to the customer. This is information about a third party, and it is used only to complete that transaction.
• Verification codes: One-time codes (OTP) sent by SMS to reset your password, and to the customer's phone to confirm an offline sale or return.
• Device push token: Your device's Firebase Cloud Messaging (FCM) token, used to send you notifications.
• Notification engagement: When you open the Merchant App by tapping a notification, the App reports that tap to our servers, so that we can measure whether notifications are delivered and read.

• The Merchant App does not access your location, camera, photos, contacts, or microphone.
• The Merchant App does not include crash reporting tools.
• The Merchant App does not contain any advertising network or third-party tracking SDK.

• Notifications: To send you push notifications about completed payments and returns. You can turn notifications off at any time from your device settings.
• Verification code autofill: On supported Android devices, the Merchant App can offer to fill in a password-reset code from the SMS it arrives in. This happens only after you allow it on the system prompt shown for that message; the App does not read your other messages.

No other device permissions are requested.

We use the information we collect for the following purposes:

• Account Management: To give you access to your business's Merchant App account, authenticate your sessions, and reset your password.
• Transaction Processing: To create invoices and return invoices, confirm sales and returns with the customer, record the cashback associated with each transaction, and show your business its transaction history and statistics.
• Communication: To send notifications about completed payments and returns, and important account-related alerts.
• Service Improvement: To measure notification delivery and engagement, and to improve the Merchant App's features and performance.
• Security and Fraud Prevention: To detect, prevent, and address fraudulent or unauthorized transactions.
• Legal Compliance: To comply with applicable laws, regulations, and legal obligations, including accounting obligations.

We do not use personal information for third-party advertising.

• Merchants see transaction details (such as amount, cashback, date, description, and transaction code). The Merchant App does not show merchants the personal contact information of customers.
• The only exception is a customer mobile number that merchant staff type in themselves for an offline sale or return. That number is used only to send the customer a one-time code and to complete that transaction.
• Merchants must keep any customer information they see confidential and use it only to complete the transaction, as set out in the Merchant Terms and Conditions.

We do not sell personal information. We share information only with the following parties and only to the extent necessary:

• SMS Provider: Mobile numbers (yours for password reset, and the customer's for offline sales and returns), in order to deliver one-time codes.
• Google (Firebase): Your device push token, in order to deliver notifications through Firebase Cloud Messaging.
• Legal Authorities: When required by law, court order, or government regulation, or to protect the rights, property, or safety of the Company, its users, its partner merchants, or the public.

• We do not track your activity across other companies' apps or websites, and we do not share your data for cross-app advertising or data brokerage.
• We do not sell personal information.

• Personal data is stored on secure servers protected by industry-standard security measures.
• Data transmitted between the Merchant App and our servers is encrypted (HTTPS/TLS), and unencrypted connections are not permitted.
• Your sign-in credentials are stored on your device using the operating system's secure storage.
• Access to personal data is restricted to authorized employees who need it to perform their duties.
• Despite our efforts, no method of electronic storage or transmission is 100% secure. We cannot guarantee the absolute security of data.

• We retain account information for as long as the account is active and to the extent necessary to fulfill the purposes described in this Policy.
• Transaction records, including the customer mobile numbers attached to offline transactions, are kept for the period required for accounting and legal obligations under the applicable laws of the Syrian Arab Republic.
• After an account is closed, we may retain certain information as required by law or for legitimate business purposes (such as dispute resolution and fraud prevention).

You have the right to:

• Access: Request access to the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Account Closure and Deletion: Merchant App accounts cannot be deleted from within the App. To close your account and request deletion of your personal data, contact us at support@sky-cashback.com. Accounts are also closed when the business's partnership with Sky Cashback ends. Transaction records that we are required to keep are retained as described in "Data Retention".
• Restriction of Processing: Request restriction of processing of your personal information under certain circumstances.
• Withdrawal of Consent: Withdraw your consent to push notifications at any time through your device settings.

To exercise any of these rights, contact us at: support@sky-cashback.com

• We use Firebase Cloud Messaging (FCM) to send push notifications about completed payments and returns, and account-related updates.
• You can manage your notification preferences through your device settings at any time.

• We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws.
• We will notify you of material changes through the Merchant App or via your registered communication channels.
• Continued use of the Merchant App after changes constitutes acceptance of the updated Policy.

For any questions, inquiries, or requests regarding this Privacy Policy, contact us via:

• Email: support@sky-cashback.com
• Phone: 0995116600
• Landline: 2130100
• Address: Damascus – Customs Square – Free Zone – Sky Building – Ground Floor