Your card doesn't know your name.That's by design.

01Who we are

ORVA Loyalty (“ORVA”, “we”) is a technology platform operating in the Sultanate of Oman. It runs stamp loyalty programs for shops, kept in Apple Wallet and Google Wallet, with no app and no sign-up.

It is operated by [registered name — to be added], entered in the Commercial Register of the Sultanate of Oman under number [number — to be added].

This policy explains what data we collect, why, where we keep it, for how long, and how you can exercise your rights over it. It covers orvaloyalty.com, the loyalty cards we issue, and shop accounts.

We are the controller of the data described here. To contact us about your data, including our personal data protection officer, write to [email address — to be added].

02The three groups of people

We deal with three groups of people, each with different data:

• Card holders: anyone who adds a shop's loyalty card to their phone's wallet. We don't know who they are, and we don't need to (section 03).
• Shop owners and their staff: whoever runs a shop's program, and whoever stamps cards at the till (section 04).
• Website visitors: anyone who browses orvaloyalty.com or sends the demo request form (sections 05 and 11).

03Card holders: what we keep and what we never ask for

The card is designed to work without telling us who you are. What we keep about it:

• A random serial number and code that identify the card and reveal nothing about you. The card shows only the code's last 4 characters.
• The card's balance: its stamps, and the rewards ready and redeemed.
• A record of every stamp and reward: the time, the branch, the device, and the number of the staff member who gave it.
• If you add the card to Apple Wallet: an identifier your phone issues for its wallet, and a notification token, so we can send the card's update to your phone after each stamp. We delete both when you remove the card from your wallet.
• A one-way fingerprint (an HMAC) of the network address the card was added from, never the address itself, to stop cards being issued in bulk. It is erased after 24 hours.
• Your phone's language as it sends it with the request, so we can write the card in it.

What we never ask for: your name, phone number, email address, date of birth, location or bank card details. You need no account and no password. And we don't know what you bought or for how much: a stamp is given by scanning your card at the till, without linking it to the receipt.

The copy of the card in your phone's wallet, and its backups, are governed by Apple's or Google's policy, not this one.

04Shop owners, their staff and the stamp record

Shop owners: their name and email address, the shop's name in Arabic and English, its business type and branches, and the subscription and trial details. For signing in: the email address, a password that is only ever stored encrypted, and the two-step verification method.

Sign-in records: for every sign-in attempt we keep the network address, the approximate country and city, the browser type and the outcome, to detect break-in attempts and warn the account's owner. They are deleted after 90 days.

Staff: their name as the shop enters it, a 4-digit staff number, a 6-digit PIN that we only ever store encrypted in a way that cannot be reversed and that nobody sees after it is issued, and the count of wrong attempts that locks it. Devices: each stamping device's name, branch and state.

The stamp record, and why we keep it: every stamp and every reward redeemed is written to a record that is never changed or deleted: which card, which device, which staff member, and when. The reason is to prevent fraud. In a stamp program the stamp is given separately from the payment, so the biggest risk is someone stamping a card they hold themselves with other customers' purchases. A fixed record lets the shop and us notice unusual patterns, such as a staff member stamping far more than their colleagues, or a new card stamped by the same person again and again.

People review these alerts. They never stop a stamp and never make an automated decision about anyone. They carry only the staff number, the device's name and the card's last 4 characters.

05The demo request form

When you request a demo on the “Contact us” page we keep what you enter: your business type, number of branches, name, phone number and shop name, and your consent. With it we keep a one-way fingerprint of your network address, never the address itself, to turn away repeated automated requests.

We use this data only to contact you about the demo. Our team is notified of the request; your phone number stays hidden in the admin panel and is shown only when we need to call you, and every time it is shown is recorded.

If the page needs to reload before you send it, your browser keeps what you typed in that tab only, for 30 minutes at most, and then erases it.

06How we use data, and that we never sell it

We use data for these purposes only:

• Issuing cards and updating them after each stamp or reward.
• Preventing stamp fraud and protecting accounts from break-ins.
• Running shop accounts: invitations, two-step verification, the subscription and security alerts.
• Answering demo requests and support questions.
• Meeting what the law requires of us.

We don't sell or rent data, we don't use it for advertising, and we don't build profiles of card holders. We send marketing messages only with your explicit consent, and you can stop them at any time.

Each shop sees only its own program's cards: the last 4 characters of the card's code, its stamps and their times. No shop sees another shop's cards, or what else your wallet holds.

07Legal basis

We process personal data under the Personal Data Protection Law issued by Royal Decree 6/2022 and its amendments, and its Executive Regulation issued by Ministerial Decision 34/2024. Each processing rests on one of these bases:

• Your explicit consent: when you send the demo request form after ticking the consent box, and when you add the card to your wallet after being told about this policy next to the add button.
• Performing the contract: the shop's subscription and the terms of use, for the data of shop owners and their staff and for the stamp record. The terms state that this processing follows the law.
• A legal obligation: when a law, judgment or decision requires us to keep or disclose data.

You can withdraw your consent at any time, without affecting what was done before. Removing the card from your wallet stops its updates and deletes your device's identifier.

We process no sensitive categories of data, such as health or biometric data, and we make no automated decisions about you.

08Service providers

We use service providers who process data on our behalf, only to provide their service to us. We list them here by category:

• Website and database hosting: the application servers, the database and its backups.
• Digital wallet services: Apple Wallet and Google Wallet, which keep the card on your phone and deliver its updates. They receive the card's content (the shop's name, your stamps, your reward) and the notification token, and nothing the card does not carry.
• Email and notification service: for shop owners' invitations, verification codes, security alerts, and telling our team about demo requests.
• Visitor verification service: tells people from bots on the sign-in pages.

We work only with providers committed to a level of protection no lower than Omani law requires, and they may not use the data for any other purpose. We disclose data to no one else unless a law or a court requires us to.

09Where data is kept

The database is kept, and the application servers run, in data centres in Mumbai, India, which is outside the Sultanate of Oman. Apple and Google also process wallet cards on their own servers outside Oman.

Basis for the transfer: the Executive Regulation requires the data subject's explicit consent before their data is transferred outside Oman. So we ask for it explicitly: on the demo request form, when a shop owner accepts their invitation, and next to the button that adds the card.

Before relying on any provider outside Oman we assess its level of protection and the risks of the transfer, and data travels only encrypted. We transfer no data whose transfer would harm you, national security or the higher interests of the State.

10How long we keep data

We keep each kind of data while its purpose lasts, then erase it or make it impossible to link to anyone:

• A card and its stamp record: while the shop's program runs, then 12 months after it ends or the shop's account closes, to deal with any dispute over a reward.
• Your device's identifier and notification token: until you remove the card from your wallet.
• The network address fingerprint taken when a card is issued: 24 hours.
• Sign-in records: 90 days.
• Shop owners' and staff accounts: for the subscription, then 12 months after the account closes, except what the law requires us to keep longer, such as invoices.
• Demo requests: 12 months from the last contact, unless they become a subscription.
• Support messages: 12 months from the last reply.
• Technical server logs: a few days at most.

11Cookies and local storage

We use no advertising or analytics cookies, and we don't track you across websites. What we keep in your browser is only what the site needs to work:

• orva-theme: remembers your choice of the light or dark theme, for one year.
• Session cookies: only for shop owners and the ORVA team once signed in, to keep them in their accounts securely.
• The demo request draft: in that tab's storage only, for 30 minutes at most (section 05).
• orva-card-<shop code>: after you press “Add to Apple Wallet”, keeps the number of the card issued to you for one hour, so a second press doesn't issue another card.

The visitor verification service runs on the sign-in pages only, and only to verify. If you block or delete these files the site still works, but it won't remember your theme and you won't be able to sign in.

12Data security

• Data is encrypted in transit, and in the database and its backups.
• Each shop's data is separated inside the database itself, so no account can reach another shop's data.
• Passwords, PINs and device pairing codes are stored with encryption that cannot be reversed.
• Two-step verification is required for shop owners and the ORVA team, and accounts lock automatically against break-in attempts.
• The keys that sign the cards are kept in a separate service and never leave it.
• Records of sensitive operations are never changed or deleted.

If data suffers a breach that may put its owners' rights at risk, we notify the Ministry within 72 hours of learning of it. If it may cause you serious harm we notify you within the same time: shop owners by email, and card holders, whom we have no way to contact, with a message on the card itself and on this page.

13Your rights and how to use them

The law gives you these rights over your data:

• To withdraw your consent to processing.
• To ask for your data to be corrected, updated or blocked.
• To get a copy of the data we process about you.
• To have your data transferred to another controller.
• To ask for your data to be erased.
• To be told of any breach of your data and of the measures we took.

To use any of these rights, write to [email address — to be added]. Because we don't know who holds a card, give us the shop's name and the four characters shown under your card's code, and we will ask for proof that you hold it, such as a screenshot of it in your wallet, before we hand over or erase anything.

Requests are free, and we answer within 45 days of receiving them. We may refuse a request that is repeated without reason or would take unusual effort, or a request to erase data the law requires us to keep, and we will give you the reason in writing within the same period.

If you believe your data is being processed against the law, you may complain to the Ministry of Transport, Communications and Information Technology, the authority for personal data protection in the Sultanate of Oman, within 30 days of learning of the breach of the law, following the Executive Regulation's procedure.

14Minors

The card asks for nothing that identifies its holder, and we don't ask for anyone's age. Even so, if you are under 18, ask your parent or guardian before adding the card: the law allows a child's data to be processed only with their guardian's consent or in the child's best interest.

Shop accounts are for people aged 18 or over only. If we learn that we hold a child's data without their guardian's consent, we erase it.

15Changes and governing law

We may change this policy when our service or the law changes. We update the “last updated” date at the top of the page, publish any material change here 30 days before it takes effect, and tell shop owners about it by email.

This policy is governed by the laws of the Sultanate of Oman.