IMPORTANT: This Privacy Policy explains how Rewardo Digital Services FZCO processes personal data through Orood. It is intended to operate alongside applicable UAE data-protection, consumer-protection and electronic-transactions laws.
1. Who We Are and Scope
Orood is a rewards, offers and merchant-services platform operated by Rewardo Digital Services FZCO, a company established in Dubai, United Arab Emirates. In this Privacy Policy, “Orood”, “we”, “us” and “our” refer to Rewardo Digital Services FZCO where it determines the purposes and means of processing personal data.
This Privacy Policy applies equally to the Orood mobile application and the Orood website at https://orood.online, including customer registration and accounts, merchant onboarding, merchant and administrative web dashboards, rewards, offers, vouchers, coupon codes, payments, payouts, customer support and every other Orood service that links to or expressly adopts this Privacy Policy.
A participating merchant may independently process information relating to its own sale, service, booking, fulfilment or customer relationship. Where a merchant determines its own purposes for processing, that merchant is responsible for its own privacy obligations.
2. Eligibility and Age Requirement
Orood is intended exclusively for persons aged 18 years or older. You must not create or use a customer or merchant account if you are under 18.
We do not knowingly seek to collect personal data from persons under 18. If we reasonably determine that an account belongs to a person under 18, we may suspend or close the account and delete or restrict the related data, subject to any legal retention obligations.
3. Personal Data We May Collect
3.1 Account and identity data
- Full name, email address, mobile number, date of birth or age confirmation, username and account identifiers.
- Authentication and security information, including verification status, OTP events, password-reset events, login history and session information.
- Profile details and preferences that you choose to provide.
3.2 Rewards, offers and transaction data
- Orood Points, Stars, reward balances, earning and redemption history.
- Offers viewed, activated or redeemed, voucher activity, coupon-code activity and merchant interactions.
- Order, payment, refund, cancellation, redemption and reconciliation information where applicable.
3.3 Payment and payout data
- Payment amount, currency, transaction reference, payment status and payment-provider references.
- Bank name, account holder name, IBAN or account information where you voluntarily provide bank details for an eligible payout or withdrawal.
- Records of withdrawal requests, manual review, transfer status and completion.
Card numbers, Apple Pay credentials, Google Pay credentials and similar payment credentials may be processed directly by payment-service providers. Orood may receive tokenised, masked or transaction-status information necessary to confirm and reconcile payments.
3.4 Merchant and business data
- Business name, trade name, business category, business address, branch details and contact information.
- Trade licence or other business-document information, where required for onboarding or compliance.
- Details of authorised representatives, owners, staff or account administrators submitted by or for a merchant.
- Offer, campaign, settlement, payout, redemption and merchant-support information.
3.5 Device, usage and technical data
- IP address, browser type, device type, operating system, app version and language.
- Login timestamps, session information, security events, crash or diagnostic information and server logs.
- Device or application identifiers where generated or made available for security, functionality, analytics or fraud prevention.
3.6 Location data
Where a location-based feature is available and you grant the relevant permission, Orood may process location information to provide nearby merchants, branches, offers or location-dependent functionality. You can control device location permissions through your device settings.
3.7 Communications and support data
We may process emails, support requests, complaints, feedback, merchant enquiries and other communications you send to us, together with information needed to investigate and respond.
4. How We Obtain Personal Data
- Directly from you when you register, update your profile, enter bank details, submit a merchant application, redeem an offer, request support or otherwise use Orood.
- From participating merchants when they validate or report a redemption, transaction or merchant-service activity.
- From payment processors, banks or payment networks in connection with payment status, refunds or reconciliation.
- Automatically from the app, website, servers and security systems when you use Orood.
- From service providers acting on our behalf, where legally permitted.
5. Why We Process Personal Data
We may process personal data for the following purposes:
- To register, authenticate and administer customer and merchant accounts.
- To verify email addresses, mobile numbers and account ownership, including sending OTPs and security messages.
- To operate Orood Points, Stars, vouchers, coupon codes, rewards, promotions and merchant offers.
- To process or confirm payments, refunds, redemptions, withdrawals and payouts where available.
- To review merchant applications, activate merchant accounts and manage merchant access.
- To send transactional notices such as welcome emails, merchant onboarding emails, offer-status notifications, payment confirmations, voucher notices and payout updates.
- To provide customer support and resolve complaints or disputes.
- To prevent fraud, abuse, account takeover, duplicate redemptions, unauthorised transactions and other misuse.
- To maintain security, audit trails, availability, backups and system integrity.
- To analyse and improve functionality, performance and user experience.
- To comply with accounting, regulatory, legal, tax, record-keeping and law-enforcement obligations.
- To establish, exercise or defend legal claims and enforce our agreements.
6. Legal Grounds for Processing
Depending on the activity and applicable law, our processing may be based on your consent, performance of a contract with you, steps taken at your request before entering into a contract, compliance with legal obligations, protection of legitimate interests, fraud prevention, protection of rights and security, or another lawful basis recognised under applicable UAE law.
Where we rely on consent, you may withdraw consent at any time, without affecting processing already carried out before withdrawal. Withdrawal of consent may prevent us from providing a feature where the relevant data is necessary for that feature.
7. Payments and Financial Information
Orood may use third-party payment processors, payment networks and wallet providers. These parties may process your payment information under their own terms and privacy practices. Orood processes payment-status and reconciliation data necessary to operate the service, investigate disputes, prevent fraud and maintain financial records.
Where bank details are provided for a payout or withdrawal, we use them only for eligible payout processing, verification, reconciliation, fraud prevention, customer support and legally required record keeping.
8. How We Share Personal Data
We may disclose personal data to the following categories of recipients only where reasonably necessary and legally permitted:
- Participating merchants, where required to validate or complete an offer, voucher, reward, transaction or related support request.
- Payment processors, banks, payment networks and wallet providers for payment, refund, settlement or reconciliation.
- Hosting, cloud, database, email, SMS, push-notification, cybersecurity, monitoring and technology providers acting as service providers.
- Professional advisers such as auditors, accountants, insurers and legal advisers.
- Government, regulatory, judicial or law-enforcement authorities where disclosure is required or legally justified.
- A buyer, investor, lender or successor in connection with a bona fide corporate transaction, subject to appropriate confidentiality and legal safeguards.
We do not sell personal data for monetary consideration. We do not authorise merchants or service providers to use Orood customer data for unrelated purposes.
9. Merchant Access to Customer Information
A merchant may receive limited information necessary to verify an offer, voucher, redemption, payment or support matter. Merchants are expected to use this information only for authorised business purposes and to comply with applicable privacy and confidentiality obligations.
10. Cookies and Similar Technologies
The Orood website and web dashboards may use cookies, session storage, local storage and similar technologies to maintain sessions, protect against security threats, remember preferences, enable core features and measure technical performance. Where consent is legally required for non-essential technologies, Orood will seek it through an appropriate mechanism.
11. Transactional and Marketing Communications
We may send service communications that are necessary to operate or secure your account, including OTPs, password resets, account notices, merchant onboarding messages, payment confirmations, reward notices, voucher information and material service updates.
Where permitted, we may also send promotional communications about Orood, merchants, offers or rewards. You may opt out of marketing communications through the unsubscribe method provided or applicable account preferences. Opting out of marketing does not prevent essential service or security communications.
12. International Transfers
Some service providers may process personal data outside the United Arab Emirates. Where personal data is transferred internationally, we seek to use lawful transfer mechanisms and appropriate contractual, organisational or technical safeguards as required by applicable law.
13. Data Security
We use reasonable and proportionate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
- Access controls and role-based permissions.
- Encryption or protected transport for data in transit where appropriate.
- Password hashing and authentication controls.
- Security logging, monitoring and anti-abuse controls.
- Encryption or other safeguards for designated sensitive stored data.
- Backup, recovery and operational-security procedures.
No system can be guaranteed absolutely secure. You are responsible for keeping your credentials, OTPs and devices secure and for notifying us promptly if you suspect unauthorised access.
14. Data Retention
We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including provision of the service, security, dispute resolution, fraud prevention, accounting, audit and legal compliance.
Retention periods vary according to the category of data and the legal or operational reason for keeping it. When data is no longer required, we may securely delete, anonymise or irreversibly de-identify it, unless continued retention is required or permitted by law.
15. Account Deletion
If Orood permits account creation, you may request deletion of your account through the in-app account settings where available and through the public account-deletion resource made available by Orood.
When a valid deletion request is completed, we will delete or anonymise personal data associated with the account unless retention is required or permitted for legal, financial, tax, security, fraud-prevention, dispute-resolution or regulatory purposes. We will not use retained data for unrelated purposes.
Deletion of an account may permanently remove access to unused benefits, vouchers, Points, Stars, offers and other account-linked entitlements, subject to applicable law and the Terms of Use.
16. Your Privacy Rights
Subject to applicable law and any lawful exceptions, you may have rights to obtain information about processing, request access, request correction, request deletion, restrict or object to certain processing, withdraw consent, request transfer of data where applicable, and complain about the handling of your personal data.
We may request reasonable information to verify your identity and protect your account before acting on a privacy request. Requests can be sent to support@orood.online.
17. Automated Security and Fraud Controls
Orood may use automated rules, risk indicators or technical controls to identify suspicious logins, duplicate redemptions, abuse, fraud or other security risks. Where a decision produces a material effect and applicable law provides a right to human review or objection, we will provide an appropriate process.
18. Third-Party Links and Services
Orood may link to merchant websites, app stores, payment services or other third-party services. Their privacy practices are governed by their own policies. Orood is not responsible for independent third-party processing that is outside our control.
19. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in the service, law, technology or business practices. We will publish the updated version with a revised effective or last-updated date. Where law requires additional notice or consent for a material change, we will provide it.
20. Governing Privacy Framework
This Privacy Policy is intended to be interpreted consistently with applicable laws of the United Arab Emirates, including Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data and other applicable privacy, consumer-protection and electronic-transactions requirements.
21. Contact and Privacy Requests
Privacy contact:
Rewardo Digital Services FZCO Orood Dubai, United Arab Emirates Email: support@orood.online Website: https://orood.online
If you believe your privacy rights have not been respected, please contact us first so that we can investigate. You may also have the right to raise a complaint with the competent UAE data-protection authority or other competent authority.
22. App Store and Platform Disclosures
Where Orood is distributed through Apple App Store or Google Play, the privacy disclosures and data-safety information submitted to those platforms are intended to be consistent with this Privacy Policy. If Orood introduces a new category of personal-data collection or sharing, we will update the relevant disclosures as required.