IBTASIM Privacy Policy

Introduction

IBTASIM (ابتسم) is the rewards and benefits programme for active personnel of a partner organisation ("your organisation"). IBTASIM is built, owned and operated by The Entertainer FZ LLC (the "ENTERTAINER", "we", "us" or "our"), which offers it to your organisation as a service.

This Privacy Policy explains how we collect, use, share, store and protect your personal data when you use the IBTASIM mobile application for iOS and Android, the IBTASIM website and landing page at ibtasim.ae, and any related services (together, the "Platform"). It also explains your privacy rights and how to exercise them.

1. Important information and who we are

Purpose of this Privacy Policy

This Privacy Policy tells you how we collect and process your personal data when you sign in to and use the Platform, including the data we receive from UAE PASS and from your organisation to confirm that you are eligible for IBTASIM. We only use your personal data to provide the IBTASIM programme, for legitimate purposes connected with running it, and to meet legal obligations.

Please read this Privacy Policy together with any other privacy notice we give you on specific occasions when we collect or process your personal data. This Privacy Policy supplements those notices and does not override them.

Who can use IBTASIM

IBTASIM is available only to active personnel whom your organisation has confirmed as eligible for the programme, and who are 18 years of age or older. Retired personnel and family members are not eligible. The Platform is not intended for children, and we do not knowingly collect personal data relating to children. If we learn that we hold personal data about a person who is not eligible to use IBTASIM, we will delete it.

Our role and the role of your organisation

We operate the Platform and process your personal data to provide IBTASIM. Your organisation decides who is eligible for the programme and provides us with the information needed to confirm your eligibility.

Contact details

We have appointed a data protection officer ("DPO") who is responsible for questions about this Privacy Policy. If you have any questions, including any request to exercise your legal rights, please contact the DPO:

• Attention: Data Protection Officer, IBTASIM
• Email: support@ibtasim.ae

You may raise a complaint at any time with the relevant authority responsible for data protection in the United Arab Emirates. We would appreciate the chance to address your concerns first, so please contact us in the first instance.

Changes to this Privacy Policy and your duty to tell us about changes

This version was last updated on 13 November 2026 and takes effect on 13 November 2026 (the "Effective Date"). Previous versions are available on request.

It is important that the personal data we hold about you is accurate and current. Please keep your UAE PASS profile up to date and tell us if your details change.

Third-party links

The Platform may include links to merchant websites, apps and other third-party services. Selecting those links may allow third parties to collect or share data about you. We do not control these third parties and are not responsible for their privacy practices. We encourage you to read the privacy policy of every website or service you visit.

2. The data we collect about you

Personal data means any information about an individual from which that person can be identified. It does not include data from which identity has been removed (anonymous data). We collect, use and store the following kinds of personal data:

• Identity Data: your name and Emirates ID number as provided by UAE PASS, and your UAE PASS unique identifier.
• Contact Data: your email address and mobile number.
• Eligibility Data: the Emirates ID numbers of eligible personnel provided by your organisation, which we match with the Emirates ID number from your UAE PASS to confirm you are eligible, and the date your eligibility starts or ends.
• Membership Data: your IBTASIM membership number and digital membership card details.
• Usage Data: how you use the Platform, including offers viewed, saved and redeemed, outlets visited, savings history, searches and the screens you visit.
• Location Data: your device location, only if you allow it, used to show nearby offers and distances to outlets.
• Technical Data: device type and model, operating system and version, app version, device identifiers, IP address, time zone, language settings and login data.
• Diagnostic Data: crash reports and performance logs used to keep the Platform stable and secure.
• Communications Data: messages you send to customer support, feedback and survey responses, and your notification preferences.
• Reviews: ratings and reviews you write about merchants and offers, shown to other members.

We do not receive or store your UAE PASS password. IBTASIM does not take payments, so we do not collect payment card or bank details.

We also create aggregated data, such as statistical information about how members use IBTASIM, for reporting and improvement. Aggregated data does not identify you. If we combine aggregated data with your personal data so that it can identify you, we treat it as personal data under this Privacy Policy.

We do not collect special categories of personal data (such as information about your health, religious or philosophical beliefs, political opinions, or genetic or biometric data), and we do not collect information about criminal convictions or offences.

If you do not provide personal data

We need your Identity, Contact and Eligibility Data to verify your eligibility and give you access to IBTASIM. If this data is not available, we will not be able to provide the Platform to you.

3. How we collect your personal data

• UAE PASS. When you sign in with UAE PASS, UAE PASS shares your Identity and Contact Data with us with your permission.
• Your organisation. Your organisation provides us with the Eligibility Data needed to confirm who can use IBTASIM, and tells us when a person is no longer eligible.
• Directly from you. When you contact customer support, give feedback, take part in a survey or update your preferences.
• Automatically. As you use the Platform, we collect Usage, Technical, Diagnostic and (where permitted) Location Data using software development kits, server logs and similar technologies. On the IBTASIM website we use cookies, as described in Section 7.
• Merchants. When you redeem an offer, the merchant may confirm the redemption so that we can record it in your savings history.

4. How we use your personal data

We only use your personal data when the law allows us to. The table below sets out the purposes for which we use your personal data and the legal basis we rely on. We may rely on more than one basis for the same purpose; please contact us if you need details.

5. Notifications and marketing

We send you in-app and push notifications about IBTASIM offers and programme updates. You can turn push notifications off at any time in your device settings.

We do not sell your personal data, and we do not share it with third parties for their own marketing.

6. Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another compatible purpose. If we need to use your personal data for an unrelated purpose, we will tell you and explain the legal basis for doing so. We may process your personal data without your knowledge or consent where this is required or permitted by law.

7. Cookies

The IBTASIM website uses cookies that are strictly necessary for it to work, and performance cookies that help us understand how the website is used. We do not use advertising or targeting cookies. You can set your browser to refuse cookies or to alert you when websites set them; some parts of the website may not work properly if you do.

8. Location information

You can choose whether the app may use your device location through your device privacy settings. If you do not allow it, IBTASIM will still work, but it will not be able to show nearby offers or distances to outlets.

9. Disclosures of your personal data

We may share your personal data with the parties below for the purposes set out in Section 4:

• Your organisation, to confirm eligibility and to provide programme reports as described in Section 4.
• Our service providers, who provide hosting, analytics, crash reporting, notifications and customer support, and who act only on our instructions.
• Merchants, limited to the information needed to validate a redemption, such as your membership number.
• Professional advisers, including lawyers, auditors and insurers.
• Government, regulatory or law enforcement authorities, where we are required to by law.
• A successor operator appointed by your organisation to run the programme, who may use your personal data in the same way as set out in this Privacy Policy.

We require all third parties to keep your personal data secure and to treat it in accordance with the law. We do not allow our service providers to use your personal data for their own purposes.

10. Where we store your data

We store and process your personal data in the United Arab Emirates, and it does not leave the UAE. Service providers that host or process your personal data for us do so within the UAE.

11. Data security

We have put in place appropriate technical and organisational measures, including encryption in transit and access controls, to prevent your personal data from being accidentally lost, used, accessed, altered or disclosed without authorisation. We limit access to your personal data to employees, contractors and service providers who need it, and they are subject to a duty of confidentiality.

We have procedures to deal with any suspected personal data breach and will notify you and any relevant authority where we are legally required to do so.

12. Data retention

We keep your personal data for as long as you remain eligible for IBTASIM and your account is active, and afterwards only for as long as needed to meet legal, accounting or reporting requirements.

When your organisation tells us that you are no longer eligible, we deactivate your account and delete or anonymise your personal data within 30 days, unless we must keep it for longer by law.

We may anonymise your personal data so that it can no longer be associated with you, for research or statistical purposes. We may use anonymised information indefinitely without further notice to you.

13. Your legal rights

Subject to applicable law, you have the right to:

• Request access to your personal data and receive a copy of it.
• Request correction of incomplete or inaccurate personal data. Name and contact details provided by UAE PASS are corrected in UAE PASS.
• Request erasure of your personal data where there is no good reason for us to keep processing it. Please note that erasure will end your access to IBTASIM. To delete your account, see our Delete your account page.
• Object to processing that we carry out on the basis of legitimate interests.
• Request restriction of the processing of your personal data.
• Request the transfer of your personal data to you or to a third party, in a structured, commonly used, machine-readable format.
• Withdraw consent at any time where we rely on consent, for example for location access. This does not affect processing carried out before you withdraw it.

To exercise any of these rights, please contact us using the details in Section 1. We may need to ask you for information to confirm your identity before we act on your request. This is a security measure to make sure personal data is not disclosed to anyone who has no right to receive it.

If a request is clearly unfounded, repetitive or excessive, we may refuse to comply with it.

Time limit to respond

We try to respond to all legitimate requests within one month. If your request is particularly complex or you have made several requests, it may take longer; in that case we will tell you and keep you updated.

14. Glossary

• Providing the programme to you means processing your data where it is necessary to give you access to IBTASIM and its benefits.
• Legitimate interests means our interest, and that of your organisation, in running the programme securely and effectively. We balance any potential impact on you and your rights before relying on legitimate interests, and we do not use your personal data where our interests are overridden by the impact on you, unless we have your consent or are otherwise required or permitted to by law.
• Legal obligation means processing your personal data where it is necessary to comply with a legal or regulatory obligation that we are subject to.

15. Updates to this Privacy Policy

We may update this Privacy Policy from time to time to reflect legal requirements and the way we run IBTASIM. We will publish any update on the Platform and, where the change is significant, notify you in the app.

16. Legal

Without prejudice to your rights under applicable law, this Privacy Policy is not a contract and does not create any legal rights or obligations.

© 2026 The Entertainer. All rights reserved.