Effective date: 12 October 2026

This Privacy Policy explains how Havera For Loyalty Card Services CO. L.L.C S.O.C ("Havera", "we", "our"), registered in Dubai under DET Licence No. 1588905, handles personal information in connection with the Havera website, mobile applications, participant accounts, organisational campaign services and related support (the "Services"). Our registered office is Office 43-44, Dubai Municipality Property, Al Fahidi, Bur Dubai, Dubai, United Arab Emirates. Contact us at h@havera.xyz or +971 50 613 6613.

Havera determines the purposes and means of processing for its own accounts and platform operations. Organisations commissioning campaigns may also determine purposes for campaign participation information. The respective responsibilities depend on the activity and applicable agreements; contact us if you need clarification about a particular campaign.

Depending on how you use the Services, the following may be processed:

1. Account and profile: name, display name, email, telephone, account identifiers, photo, settings, region information and authentication information. Passwords, where used, should be protected through appropriate authentication controls; we do not ask you to send passwords by email.
2. Campaign participation: campaign and quest enrolments, activity records, questionnaires and knowledge-challenge answers, attendance, QR check-ins, timestamps, submitted text, photos or other proof, review and moderation decisions, XP, badges, leaderboards and eligibility or reward-redemption status.
3. Location and regional context: home or selected region, country and city; where enabled and permitted, device location or information supplied to verify a physical visit. Selecting a region is not necessarily the same as continuous GPS tracking.
4. Organisation and commercial contacts: organisation and representative details, commercial correspondence, campaign specifications, billing-related information and authorised-user activity.
5. Device and service information: device identifiers, application diagnostics, IP address, security logs, usage information and push tokens where the relevant technologies are active.
6. Support and preferences: enquiries, communications, notification choices and consent records where collected.
7. Optional connected accounts: identifiers, authorisations and data made available by a third-party platform when an account connection is actively offered and you choose to use it. Exact permissions and retention depend on the enabled integration.

We collect information directly from you, through your use of the Services, from authorised organisations operating a campaign, and from relevant service or identity providers where applicable.

We process information to establish and secure accounts; deliver campaigns, quests and activities; verify eligible participation; calculate recognition or rewards; respond to requests; administer organisation services; measure campaign performance; investigate abuse; maintain service quality; and meet legal obligations. Optional marketing, precise location, connected-account features and personalised experiences are used only where an appropriate lawful basis and required permissions apply.

We do not describe XP and badges as a financial balance. Havera does not sell personal information as a standalone data product. Personalised advertising or sponsored recommendations, if introduced, require updated disclosures and applicable consent or other lawful basis before activation.

The legal basis for processing depends on the purpose, relationship and applicable law. It may include performing a contract, complying with legal requirements, consent where required, and other bases permitted under applicable data-protection legislation. Consent for optional uses can be withdrawn using available controls or by contacting us, without changing the lawfulness of prior processing. Not all necessary service processing can be withdrawn while the associated account or campaign service remains active.

Where you join an organisation's campaign, relevant authorised personnel may have access to information needed to administer and evaluate participation, potentially including your display name or identifier, enrolment, responses or submitted evidence, completion, verified attendance, XP and reward eligibility. The information accessible depends on the campaign, configuration and permissions. Leaderboards or public campaign displays may reveal a display name and score to other users when enabled. Do not submit sensitive personal information in public fields unless explicitly requested and appropriate safeguards are provided.

We may disclose information to organisations responsible for a campaign; service suppliers supporting hosting, databases, communications, notifications, security, analytics or other enabled platform functions; professional advisers where necessary; regulators or authorities where lawful; and recipients involved in a permitted corporate transaction. Access is limited to what is reasonably necessary for the relevant purpose and subject to applicable controls.

Service providers we use include Amazon Web Services (hosting and storage), MongoDB Atlas (database hosting), Google Firebase (push notifications), Twilio (SMS verification codes), Sentry (error monitoring), OpenAI (AI-assisted features, where enabled) and Meta Platforms (WhatsApp messaging and optional Facebook or Instagram connections, where enabled). They process information only on our instructions and under contract.

Some supporting systems or providers may store or access information outside the United Arab Emirates. Where applicable, international transfers must satisfy the relevant legal requirements, including suitable transfer mechanisms or other permitted exceptions. Please contact us for further information about processing arrangements relevant to your data.

We retain information for as long as reasonably necessary for its purpose, including providing accounts and campaigns, preserving legitimate campaign evidence, resolving disputes, protecting the Services and complying with legal obligations. Different categories may have different retention periods. We delete or anonymise information when it is no longer needed, subject to lawful exceptions and technically applicable backup cycles. Where an organisation connects its own Facebook Page or Instagram professional account to publish campaign posts, we read comments on those posts only to count engagement; commenter identifiers are stored in hashed form and deleted after 30 days.

Subject to applicable law, you may request access to information about you, correction, deletion, a copy of certain data, restrictions or objections to processing, and withdrawal of consent where relevant. Contact h@havera.xyz with sufficient detail for us to locate your records and verify the request safely. We will assess and respond according to applicable law and may retain information where a lawful exemption or obligation applies. You may also make a complaint to a competent supervisory authority where that right is available.

You can delete your Havera account at https://www.havera.xyz/delete-account, or request closure and deletion of eligible personal information by emailing h@havera.xyz from your registered email address. Closing an account does not automatically remove campaign records we are legally entitled or required to retain, nor does it revoke access you granted directly to an external provider. If you linked a Facebook or Instagram account, you can unlink it in Havera and also remove Havera's access in that provider's settings (for Facebook: Settings › Apps and Websites).

We apply organisational and technical controls appropriate to the information and risks involved, including account and access controls, and measures designed to protect information in transit and in storage. No online service can guarantee absolute security. We assess security incidents and provide required notifications in accordance with applicable law.

Havera is intended only for persons aged 18 or over, and users declare that they meet this age requirement by registering (see Terms of Use §2). We do not knowingly collect personal information from anyone under 18. If we learn that an account was created by a person below the required age, we will assess the account and associated information and take appropriate action under applicable law.

The website or apps may use necessary session technologies and, where enabled, analytics or other tracking tools. We will provide notices and choice mechanisms where required for non-essential technologies. Essential operational messages relating to your account or participation may be sent as permitted by law; optional promotional communications and WhatsApp messaging require the relevant permissions and opt-out methods.

We may update this Policy to reflect changes in services, law or processing practices. We will publish the updated text and effective date and provide additional notice when applicable law requires it.

Havera For Loyalty Card Services CO. L.L.C S.O.C · Dubai DET Licence No. 1588905 · h@havera.xyz · +971 50 613 6613 · Registered office: Office 43-44, Dubai Municipality Property, Al Fahidi, Bur Dubai, Dubai, United Arab Emirates.