Privacy Policy — Sky Cashback POS

This Privacy Policy describes how Sama for Investments, the operator of Sky Cashback, collects, uses, stores, and protects personal information through the Sky Cashback POS application (the "POS App"). The POS App is the point-of-sale application used by stores that Sky Cashback has authorized to sell its vouchers. By using the POS App, you agree to the practices described in this Policy.

This Policy covers the POS App only. The Sky Cashback customer application has its own Privacy Policy.

• Operators: the owners and authorized staff of stores approved by Sky Cashback as points of sale, who sign in to the POS App.
• Customers: registered Sky Cashback users to whom a point of sale sells vouchers. The POS App handles a limited amount of their information, described in section 4.
• Point-of-sale accounts are created by Sky Cashback. There is no self-registration in the POS App.

3.1 Account Information

• Full name and mobile number.
• A password, used with the mobile number to sign in (stored encrypted).
• Store identifiers: the store (company) ID and your user ID.
• Store profile details, such as the store name and contact details, as registered by Sky Cashback.

3.2 Usage-Generated Information

• Records of vouchers bought by the store, including denominations, amounts, dates, and the payment method used.
• The store's total vouchers value.
• Records of voucher cards sold, including the denominations, date, and the customer the card was issued to.
• Reports built from these records: cards sold and the transactions report.

3.3 Payment Information

• Voucher purchases are processed by the payment provider you choose. Sky Cashback keeps the transaction record (amount, date, method, reference, and status), not full card numbers.
• For MTN Cash or Syriatel Cash, the paying phone number, which is sent to the provider to request the payment.

3.4 Security and Device Information

• Sell PIN: if you switch on the sell PIN, it is verified by our servers and is never shown in the App.
• One-time verification codes (OTP) sent by SMS to your registered phone to change or recover the sell PIN.
• Firebase Cloud Messaging (FCM) device token, to send notifications.
• Notification-tap events, recording when a notification is opened, to help us understand whether notifications are useful.

• To sell a voucher card, the operator enters the customer's mobile number or scans the "Receive" QR code shown in the customer's Sky Cashback app.
• Our servers look up that number and return the customer's name and account identifier, so the card can be issued to that customer only.
• The customer's phone number is never shown on the card.
• This information is used only to issue that card and to keep the record of the sale. Operators must not copy, keep, or use it for any other purpose.
• Customers' personal information is otherwise governed by the Sky Cashback customer Privacy Policy.

We request the following permissions only when they are needed for a feature you use:

• Camera: only to scan QR codes. The code is processed on your device; we do not record or store images or video.
• Photo library (save only): to save the image of a voucher card when you choose to save it. The App does not read your photo library.
• Notifications: to send push notifications about your store's vouchers and activity.

Each permission is optional and can be managed at any time from your device settings.

• The POS App does not access your location, your contacts, or your microphone.
• The POS App does not include crash reporting.
• The POS App does not contain any advertising network or third-party tracking SDK.

We use the information we collect for the following purposes:

• Account Management: to operate the point-of-sale account, verify operators, and authenticate sessions.
• Buying Vouchers: to process the store's voucher purchases and add the vouchers to the store's total vouchers value.
• Selling Vouchers: to issue each voucher card to the registered customer it is sold to, and to keep the record of the sale.
• Reports: to show the store its cards sold and its transactions.
• Communication: to send notifications, for example when the store's vouchers are added.
• Security and Fraud Prevention: to verify the sell PIN and to detect, prevent, and address fraudulent or unauthorized activity.
• Legal Compliance: to comply with applicable laws, regulations, and legal obligations.

We do not use personal information for third-party advertising.

We do not sell personal information. We share information only with the following parties and only to the extent necessary:

• Payment Providers: the information required to process a voucher purchase through the method you choose — Paymera for bank card payments, MTN Cash, Syriatel Cash, or Sham Cash. Card details are entered directly in Paymera's secure page; we do not store full card numbers.
• SMS Provider: phone numbers, to deliver one-time verification codes.
• Google (Firebase): your device push token, for Firebase Cloud Messaging notifications.
• Legal Authorities: when required by law, court order, or government regulation, or to protect the rights, property, or safety of the Company, its users, or the public.

• The POS App does not contain any advertising network or third-party tracking SDK.
• We do not track activity across other companies' apps or websites, and we do not share data for cross-app advertising or data brokerage.
• We do not sell personal information.

• Personal data is stored on secure servers protected by industry-standard security measures.
• We use encryption for data transmission (SSL/TLS) and secure storage practices.
• Access to personal data is restricted to authorized employees who need it to perform their duties.
• Despite our efforts, no method of electronic storage or transmission is 100% secure. We cannot guarantee the absolute security of data.

• We retain personal information as long as the point-of-sale account is active and to the extent necessary to fulfill the purposes described in this Policy.
• Transaction records are kept for the period required by applicable financial and commercial laws in the Syrian Arab Republic.
• After account closure, we may retain certain information as required by law or for legitimate business purposes (such as dispute resolution and fraud prevention).

You have the right to:

• Access: request access to the personal information we hold about you.
• Correction: request correction of inaccurate or incomplete information. Store profile details are changed by contacting the administrator.
• Account Closure: point-of-sale accounts are not deleted from within the App. To close the account and request deletion of personal data, contact support@sky-cashback.com. The account is also closed when the store's authorization as a point of sale ends. Transaction records that we are required to keep are retained as described in "Data Retention".
• Restriction of Processing: request restriction of processing of your personal information under certain circumstances.
• Withdrawal of Consent: withdraw consent to notifications, camera, or photo library access at any time through your device settings.

To exercise any of these rights, contact us at: support@sky-cashback.com

• We use Firebase Cloud Messaging (FCM) to send notifications about the store's vouchers and account activity, for example when the store's vouchers are added.
• You can manage notification preferences through your device settings at any time.

• We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws.
• We will notify you of material changes through the App or via your registered communication channels.
• Continued use of the App after changes constitutes acceptance of the updated Policy.

For any questions, inquiries, or requests regarding this Privacy Policy, contact us via:

• Email: support@sky-cashback.com
• Phone: 0995116600
• Landline: 2130100
• Address: Damascus – Customs Square – Free Zone – Sky Building – Ground Floor