Privacy and terms
The plain summary is here. The full documents are issued with your merchant agreement and are available from your account manager on request.
Privacy, in short
Effective 24 September 2026 · RFM Loyalty Co LLC, Office 1201, Control Tower, Motor City, Dubai, United Arab Emirates
1. Who we are
RFM Loyalty Co LLC (“RFM Loyalty”, “we”, “us”) is a payments and loyalty services company registered in the United Arab Emirates, with its office at Office 1201, Control Tower, Motor City, Dubai. We supply payment terminals, point of sale software, the Partners Points loyalty program and digital receipt services to businesses across the UAE, with card processing carried out through Network International.
For the personal data described in this policy, RFM Loyalty Co LLC is the data controller within the meaning of UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”). This policy explains what we collect through rfmloyaltyco.ae, the merchant platform at platform.rfmloyaltyco.ae, the Merchant Hub used on our terminals, and the services themselves.
2. The data we collect
Merchant applications. When you apply for our services we collect the details you enter: your name, business trade name, mobile number, email address, emirate, what you sell and your approximate monthly card volume. If your application proceeds, we collect the documents required to open a merchant account, including trade licence details, Emirates ID or passport details of the authorised signatory, and bank account details for settlement.
Account and platform data. When you use the merchant platform or the Merchant Hub we collect your sign-in email address, the requests you raise (support tickets, paper roll orders, terminal requests), the messages you send us, delivery addresses, and technical records of your sessions such as sign-in times.
Transaction data. Terminals and gateways we supply process payment transactions. We hold transaction records such as amounts, timestamps, terminal identifiers, masked card numbers and settlement data. We do not store full card numbers, PINs or card security codes; card data is handled by our processing partners under the PCI DSS standard.
Partners Points members. When a customer joins Partners Points at a participating merchant, we collect the mobile number they enrol with, their points balance and their redemption history within the program.
Careers applications. When you apply for a role we collect your name, contact details, CV and anything else you choose to include.
Website data. Our marketing website does not use advertising trackers. The merchant platform uses limited analytics to understand how the product is used and to fix problems.
3. Why we use it and our legal grounds
We use personal data to assess and open merchant accounts, to provide and support the services, to process and settle transactions, to operate the Partners Points program, to send service communications such as application confirmations, sign-in codes and ticket updates, to meet our legal and regulatory obligations, and to protect the security of our systems.
Under the PDPL we rely on: performance of a contract, or steps taken at your request before entering one, for applications, accounts and support; compliance with legal obligations, including anti-money-laundering and know-your-customer requirements under UAE Federal Decree-Law No. 20 of 2018 and Central Bank of the UAE rules; our legitimate interests in running, improving and securing the services; and consent, where the law requires it, which you may withdraw at any time without affecting processing already carried out.
We do not sell personal data, and we do not use it for third-party advertising.
4. Who we share it with
We share personal data only where the services require it: with Network International and the card schemes to process and settle payments; with our banking partners for settlement; with the service providers that run our infrastructure, including cloud hosting, database and transactional email providers, who act on our instructions as processors; with regulators, law enforcement and courts where the law requires; and with professional advisers under confidentiality.
Participating merchants in the Partners Points program can see program activity relating to their own outlets, such as points issued and redeemed there. They cannot see a member's activity at other businesses.
5. International transfers
Some of our service providers store or process data on infrastructure located outside the UAE. Where personal data leaves the UAE we rely on the transfer grounds in Articles 22 and 23 of the PDPL, including transfers to jurisdictions with adequate protection and contractual safeguards that hold our providers to standards equivalent to this policy.
6. How long we keep it
We keep merchant account data for the life of the relationship and afterwards for the periods UAE law requires; records connected to anti-money-laundering obligations are retained for at least five years after the relationship ends. Applications that do not proceed are kept for up to twelve months and then deleted. Careers applications are kept for up to twelve months unless you ask us to delete them sooner. Partners Points member data is kept while the membership is active and deleted or anonymised after a sustained period of inactivity.
7. Security
Personal data is protected with encryption in transit, access controls that limit data to staff who need it for their role, audit logging on our internal systems, and one-time sign-in codes instead of stored passwords for merchant accounts. Card data security is governed by PCI DSS through our processing partners. No system is perfectly secure, and if a breach occurs that puts your rights at risk we will notify the UAE Data Office and affected people as the PDPL requires.
8. Your rights
Subject to the conditions in the PDPL, you have the right to ask what personal data we hold about you and to receive a copy, to have inaccurate data corrected, to have data deleted where there is no legal basis for us to keep it, to restrict or object to certain processing, to receive data you provided in a portable format, and to withdraw consent where processing is based on consent.
To exercise any of these rights, email sales@rfmloyaltyco.ae from the address on your account, or write to us at the office address above. We respond within the timeframes the PDPL sets. If you are not satisfied with our response you may complain to the UAE Data Office.
9. Cookies
The marketing website uses only the cookies needed for it to function. The merchant platform uses cookies to keep you signed in and limited first-party analytics cookies to understand product usage. We do not use cross-site advertising cookies.
10. Children
Our services are for businesses and adult consumers. They are not directed at anyone under 18, and we do not knowingly collect personal data from children.
11. Changes to this policy
When we change this policy we update it on this page with a new effective date. If a change materially affects how we use your data, we tell account holders by email before it takes effect.