Ubuy

Privacy Policy

This Privacy Policy (the “Policy”) sets out the grounds on which we collect and use your personal data, which may be collected directly from you or obtained via other sources in connection with your access to and use of the Platform or any services we provide (including newsletters and any social media functions on the Platform, collectively the “Services”). We recognize the importance you place on your personal data and are committed to protecting and respecting your privacy. Please read this Privacy Policy carefully to understand our practices regarding your personal data. Your use of the Platform and Services signifies your consent to our collection and processing of your personal data in accordance with this Privacy Policy. For the purposes of this Policy, “personal data” means and includes the categories of data set out in Clause 2 below.

References to “user”, “you”, “your” and similar expressions on the Platform refer to you as an individual or the legal entity you represent.

The Platform may contain links to third-party websites, plugins and applications. Clicking such links or enabling these connections permits third parties to collect or share your data. We have no control over these third-party websites and accept no responsibility for their privacy statements or notices. When you leave our Platform, we recommend that you review the privacy notice of every website you visit.

1 We Do Not Collect Data of Minors

The Platform is not intended for persons who have not reached the age of majority as stipulated by applicable local laws. Nevertheless, we cannot prevent certain users (including minors) from gaining access to the Platform by falsely stating their age. If you are a parent or legal guardian and believe we have collected information relating to your child, please contact us immediately in accordance with the procedures set out in Clause 12 of this Privacy Policy.

2 What Categories of Personal Data Do We Collect About You?

We collect your personal data to provide and continuously improve the Platform and Services. Personal data means any information that can identify you as an individual via an identifier. It excludes anonymized data, which refers to datasets from which all personal identifiers have been removed. We collect, use, store and transmit the following categories of personal data relating to you:

• Identity Data: Details including your given name, maiden name, surname, username or equivalent identifier, gender, title, nationality, date of birth;
• Contact Data: Your residential address, email address and telephone number;
• Transaction Data: Information relating to payments received and made by you, including your payment methods, and full details of products and services you purchase from us;
• Technical Data: Your IP address, login credentials, browser type and version, operating system, mobile application version, time zone and location settings, device model, IDFA (for iOS users), and general internet usage information collected via technologies that store or access data on your device such as cookies, tracking pixels, web beacons and other web tracking tools;
• Profile Data: Your username and password, interests, preferences, feedback, preferred language and survey responses;
• Purchase History Data: All historical orders and purchases linked to your user account, redemption records, order fulfillment information, and page view data provided by service providers supporting brand promotions, order fulfillment and other operations on the Platform;
• Browser Interaction Data: Information recording how you interact with our website, products and Services;
• Marketing and Communications Data: Your preferences for receiving marketing materials from us and third parties, as well as your communication settings.

In addition, we collect, use and share statistical or demographic information (“Aggregated Data”). Aggregated Data is derived from your personal data but processed to remove all personal identifiers such that it cannot directly or indirectly reveal your identity. For example, we may aggregate browser-collected personal data to calculate the percentage of users accessing a specific Platform feature.

3 How Do We Collect Your Personal Data?

We obtain your personal data through the following channels:

Direct Collection

We gather personal data directly from you during your use of the Platform when you:

• Register on the Platform or complete associated sign-ups (e.g., social media login), subscribe to any of our Services, or publish content on the Platform;
• Submit payment methods, refund preferences and payment channels;
• Participate in competitions, promotions or opt into exclusive programs;
• Leave reviews, testimonials or feedback;
• Raise support tickets, refund requests, fraud reports, product exchange applications or other service inquiries;
• Contact us via phone, email or other channels (we retain records of all communications);
• Browse the Platform and conduct other on-site activities.

Indirect Collection

We also obtain your personal data from third parties:

• Friends or relatives placing orders on your behalf;
• Our suppliers and third-party service providers enabling seamless delivery of our Services, including:
  • Logistics and delivery partners;
  • Marketing service providers;
  • Interactions with us via external platforms such as Facebook and Google;
  • Payment service providers.

If you share the personal data of any third party (friends, relatives, colleagues or other individuals) with us when using our Services, you warrant that you have obtained the relevant individual’s consent to share their personal data with us in compliance with this Privacy Policy.

Automatic Collection

When you use our Services, certain personal data is automatically collected via log files, cookies and other unique tracking identifiers. Log files store usage metrics including IP address, browser type, entry/exit pages, operating system, date/time stamps and related metadata.

We also deploy small data files known as cookies. A cookie is transmitted to your computer or mobile device when you access our Services. Cookies serve multiple functions: enabling core Service features, saving your preferences and device information, recording browsing behavior and patterns, helping us understand user interactions with our Services, serving targeted advertisements on and off the Platform, and monitoring visitor activity and website traffic routing. Subject to your browser settings, you may configure your browser to reject all cookies or prompt you before accepting cookies from online platforms you visit. We use cookies to record your on-site activity to enhance your user experience and improve the effectiveness of advertisements and Services. If you do not consent to our use of cookies, you must discontinue use of the Platform immediately.

For further details on cookies and their usage, please refer to our Cookie Notice.

You may choose not to provide certain personal data, though this may restrict your access to many of our Services.

4 Purposes for Which We Collect Your Personal Data

We collect and process your personal data for the following purposes:

• Deliver information, products or Services you request, or content we believe may interest you (where you have consented to receive communications for such purposes);
• Provide location-based Services including targeted advertisements, customized search results and personalized content;
• Perform our contractual obligations arising from agreements between you and other Platform users, or between you and us;
• Improve our Services and deliver more tailored experiences, including communicating Service updates via phone, SMS, email, instant messaging and other channels;
• Optimize the display of Platform content for your device and browsing environment;
• Send exclusive discounts and promotional offers on special occasions such as birthdays and anniversaries;
• Notify you of material changes to our Services;
• Any other legitimate purpose we determine necessary to enhance your Platform experience;
• Administer our loyalty reward programs, process reward redemptions, facilitate prize draws and notify winners;
• Maintain core Service functionality, analyze performance, resolve technical errors and boost Service usability and efficiency;
• Comply with local legal requirements (e.g., nationality and identification documents for cross-border shipping; seller registration details and bank account information for identity verification);
• Prevent and detect fraud and abusive conduct to protect the safety of our customers, our business and third parties.

5 Legal Bases for Processing Your Personal Data

We will only process your personal data where one of the following legal bases applies:

Performance of a Contract

Processing is necessary to perform a contract we have entered with you, or to take pre-contractual steps at your request. This includes accepting applicable Terms of Service or platform-specific supplementary terms. If you decline to provide required personal data for this purpose, we may be unable to provide Services or finalize your contract, which may result in service cancellation. We will notify you if this occurs.

Compliance with Legal or Regulatory Obligations

We may collect and process your personal data to satisfy applicable laws and regulatory requirements.

Legitimate Interests

We may process your personal data based on our legitimate commercial interests and the interests of our customers, including Service improvement, fraud detection and prevention to protect users and third parties, and serving interest-based advertising.

Marketing and Communications

We may also use your personal data to send information about goods and services that may interest you, and enhance your Platform experience via service alerts, new feature updates, improvements, exclusive promotions and event notifications. We may contact you through multiple channels including email, push notifications, web notifications, post, phone, in-app messages, WhatsApp and newsletter cards. You retain the right to opt out of interest-based advertising at any time by contacting us per Clause 12, or clicking the “unsubscribe” link contained in our marketing emails and communications.

6 Third Parties With Whom We Share Your Personal Data

Your personal data is essential for delivering our Services, and we do not sell your personal data to any third party. We only share your personal data with the parties listed below, who implement data protection safeguards at least equivalent to those outlined in this Privacy Policy:

Affiliated and Partner Enterprises

To deliver our Services, we may cooperate with our affiliated entities and third-party service providers (logistics carriers, marketing agencies, payment processors, data analytics firms, etc.) and share relevant personal data with them. Other enterprises may be integrated into your transaction flow and store your personal data in digital wallets to streamline your use of our Services.

You acknowledge that these parties require access to relevant personal data to fulfill their contractual responsibilities. We ensure they will not repurpose your personal data for unrelated activities. We may also receive updated personal data (e.g., revised delivery addresses) from these partners to correct our records and fulfill future orders. All such partners are bound by written contracts requiring them to protect the confidentiality of your personal data and restrict processing to authorized purposes only.

General Third Parties

We may share your personal data with third parties to achieve the purposes outlined in Clause 5. We ensure all partner entities maintain data protection standards no less stringent than those specified in this Policy. Third-party service providers are prohibited from using your personal data for their own independent business purposes and may only process data per our written instructions for defined objectives. You may request us or relevant third parties to cease sending marketing communications at any time by adjusting your marketing preferences on the Platform, clicking the unsubscribe link in any marketing message, or contacting us directly.

Google reCAPTCHA

We deploy Google reCAPTCHA across our website to block spam and abusive traffic and secure our Services. reCAPTCHA collects hardware and software metadata (device and application information) and transmits such data to Google for analysis. Use of reCAPTCHA is subject to Google’s Privacy Policy and Terms of Service. By interacting with reCAPTCHA, your usage is governed by these Google policies.

Promotional Campaign Partners

You may be required to submit additional personal data to participate in certain marketing activities, competitions and promotions (e.g., identity verification data to confirm prize eligibility). Such data may be collected by us or our co-sponsors and suppliers solely to administer promotional events. If you refuse to provide requested personal data, you may be excluded from competitions and promotions. Should you choose to participate, we recommend reviewing the privacy policies of relevant third parties to understand their data processing practices.

Business Transfers

As our business evolves, we may acquire or divest other businesses and services. Customer personal data is generally classified as transferable assets in such transactions and will remain protected under the prevailing Privacy Policy (unless the customer objects). If our company or substantially all of our assets are acquired, customer personal data will form part of the transferred assets.

Lawful Disclosure to Protect the Platform and Third Parties

We may disclose user personal data where we reasonably believe disclosure is necessary to comply with legal obligations, cooperate with law enforcement investigations, or protect the rights, property or safety of our business, users or third parties. This includes exchanging personal data with other companies and organizations for fraud prevention and credit risk mitigation.

7 Storage Location and Retention Period of Your Personal Data

The personal data we collect may be transferred, stored and processed by our authorized staff and third-party service providers. Such personnel may process your orders, payment information and customer support requests. We retain your personal data for as long as necessary to fulfill the purposes set out in this Policy or as required by applicable law. To determine appropriate retention periods, we evaluate the volume, nature and sensitivity of personal data, potential risks of unauthorized access or disclosure, the purposes of processing, viable alternative means to achieve those purposes, and statutory tax, accounting and regulatory obligations. In certain circumstances, we anonymize your personal data (removing all identifiable links to you) for research and statistical analysis, and may use such anonymized data indefinitely without further notification to you.

8 Security Safeguards Implemented

Our systems are designed with your security and privacy as core considerations. We deploy commercially reasonable technical, administrative and physical safeguards to ensure secure processing of your personal data in compliance with this Privacy Policy and applicable laws, preventing unauthorized access, alteration, disclosure or destruction of data. For example, we use encryption to protect personal data during transmission to the Platform, and implement external and host-based firewalls to mitigate cyberattacks. Access to personal data is restricted to authorized employees, contractors and agents who require such access to perform their contractual duties. We comply with the PCI DSS standard when processing credit card information.

It is critical that you safeguard your account password and devices used to access our Services against unauthorized entry (e.g., always log out after using shared devices). While we implement robust protective measures, data transmission over the internet cannot be guaranteed as entirely secure.

9 Your Rights as a Data Subject

Subject to applicable legal provisions, you hold the following data subject rights:

1. Right to Information on Data Collection Practices

   If you have questions about how we collect and use your personal data, contact us via legal@noon.com. Most of our Services include dedicated settings allowing you to control data processing preferences.
2. Right of Access to Personal Data

   You may view various records linked to your account and Platform interactions, and update most personal data directly on the Platform. Examples of accessible data include:

• Real-time information on recent orders;
• Identity details (name, email, password, date of birth, communication and targeted ad preferences);
• Payment settings (including credit card information);
• Email notification preferences.
  Contact us for further details.

3. Right to Receive a Copy of Your Personal Data

   Where technically feasible under applicable law, you may request a readable copy of all personal data we hold about you. Submit your request by contacting our support team.
4. Right to Erasure of Personal Data

   To the extent permitted by applicable law, you may request full deletion of your personal data by contacting customer service. Please note we may decline erasure requests on specific legal grounds, and we will explain such grounds to you upon request.
5. Right to Withdraw Consent / Right to Object to Processing

   You may withdraw previously granted consent for marketing data processing at any time. Adjust your communication preferences to opt out of marketing emails via the unsubscribe link included in all promotional correspondence. You may also disable cookies through your browser settings; however, disabling cookies may impair Platform functionality and restrict or block access to some or all site features.
6. Right to Rectification of Personal Data

   You may contact us at any time to request revisions or corrections to inaccurate personal data.

Exercise of these rights is free of charge unless otherwise stipulated by law. We will respond to all valid rights requests within the timeframes mandated by applicable legislation.

10 Amendments to This Privacy Policy

Our business operations are subject to ongoing change, which may require updates to this Privacy Policy. We will notify you of all revisions by publishing the updated version on the Platform; each amendment shall take effect upon posting or on a specified “Effective Date” as communicated by us.

We may periodically send email reminders of policy updates, but you are responsible for regularly reviewing the Platform to stay informed of revisions. Your continued use of the Platform following any policy amendments constitutes your acceptance of this Privacy Policy as revised from time to time.