DiscGo Business Merchant Privacy Notice

Version v1.1 | Effective 22 September 2026

1. Who We Are

DISCGO TECH - FZCO, registration no. 82978 and licence no. 89743 issued by the Dubai Integrated Economic Zones Authority – DSO, of DSO-THUB-G-D-FLEX-G103B, THUB, Dubai Silicon Oasis, Dubai, UAE (DiscGo, we or us), is the controller of the personal data described in this Notice. We process personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. You can reach us about privacy at hello@discgo.co.

This Notice applies to the people behind a merchant: owners, representatives, staff, payers and anyone who uses the merchant portal or contacts us on a business’s behalf, and to individuals who appear in content a merchant gives us. Use of the DiscGo consumer app is covered by the consumer privacy notice at https://www.discgo.co/privacy-policy. The examples in this Notice illustrate what we describe and do not limit it.

If you give us personal data about another person, you must be entitled to do so and must make this Notice available to them.

2. What We Collect

Depending on how you deal with us, we may collect:

  • your name, job title and business contact details, your connection to the merchant, and records of who accepted our terms and when;

  • verification information: the business’s trade licence and the details recorded from it, such as the licence number, issuing authority, legal form, activities, dates and the names of the owners, partners or manager stated on it; an identity document (Emirates ID) for the person registering the business; and the record of the check we carry out before approval;

  • account and portal data: your account email and any name you give, the merchant and venues linked to your account, your role, sign-in and session records, IP address, browser and device type, and the actions you take in the portal;

  • subscription and payment data: subscription, invoice and payment records, the billing name and email given at checkout, billing country and postal code, payment method type, the last four digits and expiry of a card, and the references our payment provider gives us; we never receive or store a full card number, security code or bank credentials;

  • communications: anything you send us or we send you by email, WhatsApp, the portal, our website or any other channel, and our notes of those contacts;

  • content you supply: any personal data in listings, offers, menus, photographs and other material given to us for publication; and

  • any other information you choose to give us in the course of our relationship.

When verification through UAE PASS becomes available, we will also receive the identifier, verified name and Emirates ID number that UAE PASS returns for the person registering the business, and keep it as the record of who registered.

We obtain this data from you, from the merchant and its authorised users, from our payment provider, and from your use of the portal, our website and our services. Payment details entered on our payment provider’s pages are processed by that provider. Where we set up a listing on a merchant’s behalf, its representative’s name, email address and mobile number are also kept in our own internal systems in the UAE.

3. How We Use It

We use personal data for the following purposes:

  • to respond to you and take the steps you ask for;

  • to set up, verify, run and evidence merchant accounts, listings and subscriptions, and to publish approved content;

  • to check, before publishing a listing and while it is live, that the business is licensed and that the person acting for it is authorised;

  • to process payments, issue invoices and keep accounting and tax records;

  • to provide support and send service notices;

  • to run, secure and improve the portal and our services, including through aggregated analysis;

  • to prevent and investigate misuse, handle complaints, and establish, exercise or defend legal claims;

  • to meet our legal obligations; and

  • for any other purpose we tell you about when we collect the data, that is compatible with the purposes above, or that the law requires or allows.

Where you are personally a party to a subscription, we rely on the contract for the processing needed to enter into and perform it. For company representatives, portal users and people who appear in merchant content, we process personal data on the basis of documented consent or a specific exception under the law, which we record. Where you have given consent, you may withdraw it at any time; this does not affect processing completed beforehand.

We do not make decisions with legal or similarly significant effects on you by automated means alone. Applications to join DiscGo Business, and decisions to approve, change, reject or suspend a merchant, a listing or an offer, are made by a person.

4. Who We Share It With

We share personal data only as needed, and only with:

  • service providers that host our database, store documents, host and back up the portal, provide sign-in and security, send our emails, process payments or run our business and support tools;

  • professional advisers bound by confidentiality;

  • a buyer or successor of the relevant part of our business; and

  • courts, regulators and other authorities where the law requires.

Our providers are engaged under contracts that protect your data, and we do not sell personal data. We identify providers by category; their names are available on request to the person concerned or to a competent authority. Reports we give merchants contain aggregated counts and do not disclose personal data of DiscGo app users.

5. Where Your Data Is Kept

Verification documents are stored in the United Arab Emirates. Other personal data is processed outside the UAE, mainly in Singapore, where our merchant database is hosted, and in the other countries where our providers operate, including the European Union and the United States. No adequacy decision covers those countries under UAE law, so we rely on contractual safeguards with each provider.

6. How Long We Keep It

We keep personal data only for as long as the purposes above require. In general, we keep:

  • account, acceptance and correspondence records, the trade licence and the details recorded from it, for the length of our relationship and two years after it ends;

  • payment, accounting and tax records for five years from the end of the relevant tax period, or longer where the law requires;

  • an identity document until you have re-verified through UAE PASS and, in any event, no longer than 24 months from its upload;

  • a portal account that never registers or claims a business for six months from sign-up, after which it is deleted;

  • content you supply until it is removed or the listing ends, with backup copies deleted within 90 days;

  • the anonymous identifier created when someone opens a venue’s DiscGo web page from its venue code without an account, and the record of venues opened, for six months from the last activity unless it is linked to an account first, as explained on that page; and

  • consent and privacy-request records for two years.

Data may be kept longer where the law, a regulator, a dispute or a legal hold requires. When it is no longer needed, personal data is deleted or irreversibly anonymised.

7. Security

We apply technical and organisational measures appropriate to the data and the risks of processing it. If a personal-data breach occurs, we will investigate, contain and fix it, and notify the UAE data protection authority and affected individuals where the law requires.

8. Your Rights

Subject to the conditions and exceptions in the law, you may ask for information about our processing and access to your data; ask us to correct, complete, erase or restrict it; object to processing; exercise your data-portability and automated-decision rights; and withdraw consent. Write to hello@discgo.co. You may also complain to the UAE Data Office through the channels published on its official website.

9. Changes

We may update this Notice when our processing or legal obligations change. The current version and its effective date are published at https://www.discgo.co/business/privacy-policy. Where the law requires, we will notify affected individuals of material changes before they take effect.