Privacy Policy & Confidentiality of Information – Rekaz Platform

Service Provider data (Account owner / Establishment): Rekaz Platform is often a "data controller" with respect to account creation, management, and platform operation data.

Service Provider's customer data (End Customers): Rekaz Platform is often a "data processor" on behalf of the Service Provider with respect to the Service Provider's customer data that is entered or collected through booking interfaces, while the Service Provider remains primarily responsible for the purpose of collecting and using such data within their business.

Naturally, Rekaz Platform seeks to retain information in a manner that preserves user privacy, and it retains such information only for operating the platform, improving quality, delivering services, and facilitating them.

As a general rule:

• Only a limited number of platform operators who require access for their work can view data, with defined permissions and under administrative and technical oversight.
• Data is not sold, rented, or shared for commercial purposes outside the scope of providing the service and a unified user experience.

Rekaz Platform strives to maintain the confidentiality of users' information by:

• Applying appropriate security and technical controls to protect data from unauthorized access.
• Periodically updating protection procedures as needed.

However, since the internet cannot be guaranteed 100%, Rekaz Platform advises users to:

• Keep login credentials confidential and not share them.
• Use strong passwords, update them periodically, and avoid reusing them across multiple services.

If a security breach results in unauthorized access to or tampering with personal data, the platform is committed to taking the necessary measures to address the incident, notify competent authorities, and inform affected parties according to applicable legal requirements.

The user expressly acknowledges and agrees that in some cases Rekaz Platform may need to share certain relevant information with third parties (service providers) to enable service delivery, such as:

• Payment solution providers (for collections, issuing payment links, or settlements).
• Messaging/notification providers (e.g., WhatsApp/SMS/email) when reminders or notifications are enabled.
• Hosting and cloud infrastructure providers to operate the platform and store data.
• Specialized operational integration providers (e.g., gate/access device integrations for clubs, if enabled).

Such sharing occurs only to the extent necessary and for a legitimate purpose related to the service, in accordance with Saudi Arabia's Personal Data Protection Law. Rekaz Platform also commits to ensuring service providers adhere to confidentiality and do not use information outside the scope of the service.

Some data may be processed or stored with providers outside the Kingdom of Saudi Arabia; this occurs to the minimum extent necessary and under appropriate protection safeguards consistent with the relevant regulations.

The Service Provider may send promotional or marketing messages to their customers. The End Customer can stop or re-enable them at any time from their account page in the booking interface (My Account → Privacy → Promotional messages), and sending stops immediately once disabled. Notifications related to fulfilling bookings and orders (such as booking confirmations or order status) are not marketing messages.

Rekaz Platform retains personal data while the account is active or as needed to fulfill the purposes described in this policy. Upon the data subject's request (through the delete account option or by contacting us), their data is destroyed or anonymized so that they can no longer be identified, subject to the statutory periods required for retaining financial records and invoices.

Rekaz uses Google APIs to provide authentication and advertising features. When you connect your Google account, we may access basic profile information (such as name and email) and, if applicable, Google Ads data.

We use this data only to:

• Authenticate users
• Manage user accounts
• Enable advertising features (such as campaign management and reporting)

We do not sell or share Google user data with third parties.

Google user data is stored securely and retained only as long as necessary to provide our services. Users may request deletion of their data at any time by contacting us at privacy@rekaz.io.

Rekaz's use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Rekaz Platform is keen to provide mechanisms to exercise rights related to personal data in accordance with relevant regulations, including:

• Right of access: view the personal data held by the platform.
• Right to obtain a copy: request a copy of data during the subscription period.
• Right to correction: edit and update data from the account settings page in the booking interface or the dashboard.
• Right to destruction: the End Customer can permanently delete their account and data from their account page in the booking interface (My Account → Privacy → Delete account).
• Right to withdraw consent: stop marketing messages at any time as described in the "Marketing messages" section.
• Anonymity option: the End Customer can choose not to display their full name in publicly shown reviews from the privacy settings in their account.

Requests to exercise these rights are handled within the statutory periods.