Privacy Policy

THAMRH EVENTS L.L.C S.P.C, based at SW5, 52, Khalifa City, Abu Dhabi, United Arab Emirates, is the organisation responsible for personal information processed for the NAMAA services described in this policy. In this policy, ‘NAMAA’, ‘we’, ‘us’ and ‘our’ refer to that company and its NAMAA service.

You can contact us about privacy at info@thamrh.com. Please use the subject ‘NAMAA Privacy Request’. Our company website is https://thamrhevents.com/.

This policy covers the NAMAA iOS and Android apps and our handling of associated membership, transaction, enquiry and support information. It does not automatically cover every activity on the company’s wider website or the independent activities of schools, merchants, event organisers or other services you choose to use. Those activities may have their own privacy notices.

NAMAA accounts are intended for adults aged 18 or over. Adults may manage family memberships, including permitted information about children, as explained in Section 5. Children should not create an independent NAMAA account.

If you provide another adult’s information, you must have authority to do so, tell them how NAMAA will use it, and direct them to this policy. For a child, you must be their parent or legal guardian, or otherwise have the authority and consent required by law. Provide only information relevant to the service you are requesting, and keep it accurate.

The information involved depends on the features you use. We receive information from you, an authorised family account manager, your device, sign in and payment services, and the merchants or other partners involved in your transactions or enquiries. Not every field below is required for every account or action.

Account and profile information

This includes your name or nickname, mobile number, email address where provided, date of birth where provided, profile photograph, referral code, account identifiers and account status. We also process verification and sign in information used for one time codes, PIN based access and account authentication. If you choose Sign in with Apple or Google, we receive the identity information and authentication credentials that the relevant service supplies, such as an identifier, name or email address, according to your choices and that service’s rules.

Family profiles and digital membership cards

Family information can include a member’s name, relationship to the account holder, date of birth, optional contact details and photograph, membership identifiers, card appearance and membership status. Digital cards and associated records can include a member name, photograph, member or QR identifier, expiry information and, depending on the card, age or contact details.

Memberships and transactions

We process membership plans, subscription and payment status, selected interests, favourites, searches and filters, and offers or coupons you claim or redeem. Redemption records can include the merchant, coupon, transaction date, original bill amount, discount, final amount and relevant member identifier. Family features use these records to show membership activity, spending and savings.

Payments and saved payment methods

Stripe processes payment card information for payments made through NAMAA’s Stripe payment features. We use payment references, payment status and saved method details such as a payment method identifier, card brand, masked card number, expiry date and cardholder name, together with related membership and billing records. Information handled by Stripe is also subject to its applicable privacy information.

Location information

With the relevant device permission, NAMAA can obtain your current location, including precise latitude and longitude, to find nearby merchants, offers, schools and events. We also process a location you select on a map. A suggestion for a new store or reward can include the store name, coordinates and a map link. When you use nearby search features, the app sends the coordinates used for the search to our systems. Map features also communicate with the relevant mapping provider.

Photographs and information you choose to share

If you choose a profile or family photograph, we receive the image you select or take through the app. Optional card saving, sharing and wallet features handle the information included in that card. Selecting or taking a photograph is a separate action from giving permission to access a camera or photo picker.

Enquiries and correspondence

School enquiries can include the chosen school, your name, phone number or email address, message and preferred contact method. We process the enquiry’s status, replies and related correspondence. Enquiry records and replies may also include attachments and related file information, such as filenames, file types and sizes. We also receive information you send when asking for support, making a complaint or exercising a privacy right. Please avoid including unnecessary information about children or sensitive matters in free text messages.

Device and communication information

The app processes device identifiers, device model or name, operating system, app version, platform and push notification tokens. It also processes language, interests, notification preferences and notification read status. Network connections disclose an IP address to the services contacted, and operating those connections can involve request, connection and error information. Firebase Cloud Messaging supports push delivery. These technical functions are separate from the family spending and savings summaries.

Where the UAE Federal Personal Data Protection Law applies, we process personal information with consent unless a specific exception permitted by that law applies. We assess the ground for the particular activity; accepting this policy or buying a family membership does not authorise every use of every person’s information.

• Providing your requested service: account access, adult membership administration, digital cards, payments, redemptions and enquiries use the information necessary to fulfil our contract with you or take steps at your request, where the applicable contractual exception permits that processing. Information about another person, including a child, requires its own valid justification.
• Optional features: photographs, precise location features, family information and optional communications are processed with consent where required. A device permission controls device access; it is not blanket consent for unrelated processing.
• Service messages: we use relevant contact and transaction details for verification codes, receipts, membership administration, enquiry replies and essential security or service notices, under the applicable service related, consent or legal ground.
• Promotional communications: where we send offers or promotions by push notification, email or SMS, we use the consent or other specific permission required by applicable law and provide a way to stop them.
• Operating and protecting the service: relevant account, device and transaction information supports reliability, troubleshooting, prevention of misuse and resolution of disputes. Under UAE law, this processing must rest on applicable consent or a specific statutory exception; a general business interest is not by itself our UAE legal basis.
• Legal requirements and claims: necessary records may be processed to meet applicable legal obligations, respond to lawful requests, and establish, exercise or defend legal claims, where the law permits.

If information is necessary for a requested service or legal requirement and you do not provide it, we may be unable to provide that service. Optional permissions and choices can be withdrawn, although the associated feature may then be limited. Additional information for people covered by European or UK data protection law appears in Section 14.

Family management features can display a member’s details, cards, claims, spending and savings to the adult who manages the family account and other people authorised to manage the relevant membership. Information added to a shared family membership should not be treated as private from its authorised managers. Please consider this before adding another person or recording activity under a shared membership.

We use children’s information only for the specific family service requested by an authorised parent or guardian and only where that use is permitted by law. The fact that an adult operates the account does not remove the safeguards applicable to a child’s information.

Where the law requires explicit, documented and verifiable caregiver consent, including applicable protections for children under 13 in the UAE, that consent is required before the relevant processing. We do not use children’s information for targeted advertising or for any commercial use prohibited by applicable child protection law.

A parent or legal guardian can contact info@thamrh.com to ask about a child’s information, correct it, withdraw consent or request deletion. We may need to verify their identity and authority. If we learn that a child has created an unauthorised account or that information was provided without required authority or consent, we will assess it and restrict or remove the information as required by law.

Your device settings let you manage NAMAA’s access to location, the camera or photo picker, and push notifications, subject to your device’s capabilities. You can change the app’s notification preferences for available communication channels. Disabling a permission can limit the feature that uses it.

You can object to direct marketing or withdraw marketing consent through the available preference controls, an unsubscribe option in the message, or by emailing info@thamrh.com. We will stop the relevant promotional processing as required by law. Necessary account, transaction, security and legal notices may still be sent where permitted. Changing a permission does not automatically delete information already lawfully received; you can also make a privacy or deletion request.

We disclose information for the purposes described in this policy and limit it to what the recipient needs for the relevant purpose. We do not sell personal information. We require third parties receiving information from us to provide protection at least equivalent to that described in this policy and required by applicable law and platform rules.

• Service providers: providers that support hosting, storage, app maintenance, support, communications, payment processing and security may handle information for the relevant service. When a provider acts on our behalf, we require appropriate instructions, confidentiality, safeguards and restrictions on its own use of the information.
• Integrated services: NAMAA uses Stripe for payment features, Firebase Cloud Messaging for push notifications, Google Maps for mapping, and Apple or Google when you choose their sign in service. These providers receive information needed for the selected feature and may have independent responsibilities for parts of their processing.
• Merchants and service partners: a merchant can receive the membership, eligibility, coupon and transaction information needed to validate a benefit or redemption. A school or other provider selected for an enquiry receives the relevant contact details and message. Any additional information needed for an event or other service should be explained when that service is requested. Partners may act independently for the services they provide and must give their own privacy information where required.
• Family managers and your chosen recipients: authorised family managers can see information described in Section 5. If you share or export a card, add it to an available Apple or Samsung wallet feature, or send information to another recipient, the selected service or recipient receives the included information.
• Legal and business recipients: we may disclose necessary information to professional advisers, regulators, courts or authorities when legally required or otherwise lawfully permitted, including to protect rights and resolve claims. A proposed or completed reorganisation or transfer of the NAMAA business may involve necessary information under appropriate confidentiality and legal safeguards. We will provide any notice or obtain any consent that the law requires.

Optional third party content, such as a school’s embedded YouTube video where available, can involve a connection to that provider. Review the relevant provider’s privacy information when deciding whether to use an optional service. A provider acting independently does not become our processor merely because it is accessible through NAMAA.

Provider privacy information

• Apple
• Google
• Stripe
• Samsung

NAMAA is operated by a UAE company. Depending on the systems and providers used for a feature, information may be processed in the UAE and in other countries where those providers or their authorised personnel operate. Those countries may have different data protection laws.

Where applicable law restricts an international transfer, we must satisfy its conditions before making the transfer. Depending on the law and destination, this may require a recognised level of protection, appropriate contractual or other safeguards, or a specific lawful exception. We do not treat use of the app as unrestricted consent to international transfers. You may contact us for information about the destinations and safeguards relevant to your information.

We retain identifiable information for as long as necessary for the purpose for which it was collected, taking account of applicable legal obligations and the criteria below. The retention period depends on the record and circumstances; account deletion does not override a legal duty to retain a particular record.

• Account and family profiles: while needed to operate the account and requested membership, followed by deletion or anonymisation when no continuing lawful purpose applies.
• Membership, payment and redemption records: while needed to deliver and reconcile the service, handle refunds or disputes, and satisfy applicable accounting, tax or other record keeping requirements and relevant claim periods.
• Enquiries and support correspondence: for resolving the request and any necessary follow up, complaint or associated claim, with continued retention assessed against that purpose.
• Location and feature inputs: for the relevant discovery, map or store suggestion purpose. A submitted store suggestion may need its selected location as part of the request; device permission alone does not justify keeping personal location information indefinitely.
• Device, connection and security records: for periods justified by operation, troubleshooting, security investigation and evidence needs, according to the nature and risk of the record.
• Consent and communication preferences: while needed to respect your choices and demonstrate compliance. A limited suppression record may remain after an opt out so that we do not resume unwanted marketing.

When continued identification is no longer justified, we will delete the information or make it anonymous so that it no longer identifies you. Backup deletion follows the applicable backup cycle, with access restricted and any lawful preservation requirement respected. Completed deletion requests must be reapplied if a backup is restored. You can ask us about the retention period or criteria applying to a particular record.

We are responsible for implementing technical and organisational safeguards appropriate to the information and processing risks, including appropriate access controls, protection of communications and management of service provider access. No app, network or storage system can be guaranteed completely secure. If a personal data breach occurs, we will assess it and provide notifications to affected people and authorities where required by law.

Keep your device and sign in methods secure. Do not share a PIN or one time verification code, and take care when sharing membership cards or QR codes. Contact us promptly if you suspect unauthorised access to your account.

Depending on the law that applies and any relevant exceptions, you may be entitled to obtain information about our processing, access a copy of your personal information, correct inaccurate or incomplete information, request deletion, restrict or stop particular processing, object to certain uses, or receive or transfer information in a portable form. You may also have rights concerning decisions based solely on automated processing that significantly affect you.

Where we rely on consent, you can withdraw it using relevant controls or by contacting us. Withdrawal does not make earlier lawful processing unlawful. If another legal basis requires particular records to be retained, we will explain the relevant limit when responding.

Send requests to info@thamrh.com with the subject ‘NAMAA Privacy Request’. Include the phone number or email associated with the account and describe what you need. Do not send passwords, PINs, one time codes or full payment card details. We may request proportionate information to verify your identity or authority before acting, particularly for family or child records.

We will respond within the time required by applicable law and explain any lawful restriction, refusal or permitted extension. Where applicable law requires it, we will notify relevant recipients of corrections, deletion or restrictions and require service providers acting on our behalf to carry out the necessary action. You may complain to the competent data protection authority. You do not have to contact us first before exercising a right to complain to an authority.

You can start an account deletion request in the NAMAA app by opening My Profile, selecting Delete Account and following the confirmation steps.

You can also request deletion without installing or signing in to the app. Email info@thamrh.com with the subject ‘NAMAA Account Deletion’ and provide the phone number or email associated with the account. If you cannot access that phone number or email, explain this so we can arrange another proportionate verification method. Never send your password, PIN, one time code or full card details.

After verifying a request, we will delete the account and associated personal information, except for limited records whose continued retention is necessary for a specific lawful purpose described in Section 9 and consistent with applicable platform requirements. Deletion covers linked profile and family information, service provider copies, communications and membership records, subject to those limited exceptions and the separate account considerations below. We will explain any categories retained, the reason and applicable retention period or criteria. If deletion is not immediate, we will tell you the expected completion time and confirm when it is complete.

Deletion can remove access to digital cards, family management, enquiry history and other account features. Information belonging to another person or connected with a separate account may require separate assessment. A child’s parent or legal guardian can request removal of that child’s information without necessarily requesting deletion of every family member’s account.

Uninstalling the app does not delete your account. If you have an active paid membership, also check its cancellation and renewal arrangements; you can contact us to confirm that future charges are addressed. Contacting support about billing is not an additional condition for using the in app account deletion process. Information another person has already received, and records held by a school, merchant or payment provider for its own lawful purposes, may require a request to that independent organisation. We will explain the outcome of your request and any necessary further steps.

The mobile app uses device storage for functions such as keeping sign in state, device and notification identifiers, language and app preferences. Device storage and app permissions are different from a website cookie setting. Logging out, changing a permission or deleting the app does not necessarily remove information held by our systems or an independent provider.

Links, maps, payment tools, sign in services, wallets and optional embedded content may be governed in part by their providers’ own privacy notices. If you leave NAMAA for a partner website or external app, check its notice. Any additional website cookie or tracking practices should be disclosed at the website where they occur.

This section applies only when the relevant processing falls within the scope of the EU General Data Protection Regulation or applicable UK data protection law. It does not mean that every user or every activity is governed by those laws.

For processing covered by those laws, we rely on contractual necessity for the account, adult membership, payment, redemption and enquiry services you request, to the extent necessary to perform a contract with you or take steps at your request. We rely on consent for optional uses that require it, including the relevant child information, precise location and promotional activities. Where legally appropriate, necessary reliability, security and misuse prevention processing is based on our legitimate interests, after assessing necessity and balancing those interests against your rights. Processing required for applicable accounting, tax and other statutory duties is based on legal obligation. A contract with an adult does not automatically provide a contractual basis for processing a child’s information.

Where applicable, you may object to processing based on legitimate interests, object to direct marketing at any time, withdraw consent, and exercise rights of access, correction, erasure, restriction and portability subject to legal conditions. Search and filtering functions can use the preferences, location or membership information relevant to your request. If processing involves a solely automated decision with legal or similarly significant effects, we must provide the information, legal justification and safeguards required by the law that applies, including review rights where required.

International transfers subject to these laws require the applicable transfer mechanism or lawful exception. You may ask for information about the relevant safeguards. You can complain to your EEA supervisory authority or the UK Information Commissioner’s Office, as appropriate. EEA authority details are available at the EDPB authority directory and UK complaint information at the ICO complaints page.

We may update this policy when NAMAA’s features, data practices or legal requirements change. We will publish the updated version with its effective date and provide an additional notice of significant changes where appropriate or legally required. If a change requires fresh consent, we will obtain it before carrying out the relevant new processing. Publication of an updated policy does not, by itself, provide that consent.

Responsible organisation

THAMRH EVENTS L.L.C S.P.C

App

NAMAA

Email

info@thamrh.com

Privacy requests

use the subject ‘NAMAA Privacy Request’. Account deletion: use ‘NAMAA Account Deletion’.

Telephone

+971 50 492 9979

Postal address

SW5, 52, Khalifa City, Abu Dhabi, United Arab Emirates

Company website

https://thamrhevents.com/