Privacy Policy
Effective 29 August 2026 Last updated 29 August 2026 Version 1.0
In short. We collect the details you give us when you join our loyalty programme — your name, mobile number and the purchases you make with us — so we can run your points account, send you the offers you sign up for, and improve our stores.
We do not sell your personal data. You can ask us at any time to show you what we hold, correct it, stop using it for marketing, or delete your account.
Contents
About this policy
This Privacy Policy explains how Qamar Al Madina Supermarket LLC (“Qamar Al Madina”, “we”, “us”, “our”) collects, uses, shares and protects personal data when you:
- join or use our loyalty programme, Tohfa;
- use our mobile application, Tohfa (the “App”);
- shop in our stores and present your loyalty account at the till;
- visit our website; or
- contact our customer care team.
We are the controller of the personal data described here, which means we decide why and how it is processed.
This policy is written to meet the requirements of Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the UAE Personal Data Protection Law, or “PDPL”) and its implementing decisions, together with the other laws of the United Arab Emirates that apply to us, including the Consumer Protection Law and the laws on electronic transactions and cybercrime.
Please read this policy together with our Terms & Conditions, which govern your membership of the loyalty programme.
Who we are
| Legal entity | Qamar Al Madina Supermarket LLC |
|---|---|
| Trade licence | |
| Registered address | Dubai, United Arab Emirates |
| Privacy contact | QamarAlMadeenasupermarket@gmail.com |
What personal data we collect
Data you give us
- Identity and contact details — your name, mobile number, email address, gender, date of birth or year of birth, and preferred language.
- Account details — your loyalty account number, the branch you registered at, your one-time password (OTP) verification history and your account preferences.
- Legacy card details — the number printed on a physical loyalty card issued to you before the App, where you ask us to move that card onto a mobile number.
- Correspondence — the messages, complaints, feedback, ratings and supporting documents you send to our customer care team.
- Household or family details — only where you choose to give them to us, for example to receive offers relevant to your household.
Data created when you shop with us
- Transaction data — the date, time, branch and till of each purchase, the items and quantities on the bill, the bill total, the payment method type (we do not store your full card number), and any discounts applied.
- Loyalty data — points earned, points reversed after a refund, points redeemed, vouchers issued and used, and your current balance.
- Returns and refunds — the details of goods you return or exchange.
Data collected automatically
- Device and technical data — device model, operating system version, App version, device identifiers, push notification token, IP address, language and time zone.
- Usage data — the screens you open in the App, the offers you view or tap, crash reports and diagnostic logs.
- Location data — your approximate or precise location, but only while you have given the App permission to use it. See Location data.
Special categories of data
We do not ask you for sensitive personal data — data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, criminal records, biometric data or health data. Please do not send us such data unless we specifically ask for it. Your shopping basket may indirectly suggest a dietary or health preference; we do not use it to infer any sensitive characteristic about you.
How we collect it
- Directly from you — when you register, update your profile, contact us, or take part in a promotion or survey.
- From our point-of-sale systems — when you identify your loyalty account at the till, the bill is linked to your account so that points can be calculated.
- Automatically from the App and our website — as described above.
- From service providers acting for us — for example our SMS gateway confirming that a one-time password was delivered.
If you do not give us the information we ask for at registration, we may not be able to open or maintain a loyalty account for you.
Why we use your data, and our legal basis
Under the PDPL we must have a lawful basis for every use of your personal data. The table below sets out what we do and why we are allowed to do it.
| What we do | Why | Legal basis |
|---|---|---|
| Create and manage your loyalty account, verify your mobile number by OTP, and let you sign in | To provide the membership you asked for | Performance of our contract with you |
| Calculate, credit, reverse and redeem points and vouchers; show your balance and bill history in the App | The core of the loyalty programme | Performance of our contract with you |
| Answer your questions, handle complaints, and process returns, exchanges and refunds | Customer service and consumer protection | Contract; compliance with a legal obligation |
| Send you service messages — OTPs, points credited, voucher issued, voucher about to expire, account or policy changes | These are necessary to operate your account and are not marketing | Performance of our contract with you |
| Send you offers, flyers, promotions and personalised recommendations by push notification, SMS or email | To tell you about products and prices likely to interest you | Your consent, which you can withdraw at any time |
| Analyse purchase patterns in aggregate to plan ranges, pricing, stock and store layout | To run and improve our business | Our legitimate interests, balanced against your rights |
| Monitor for fraud, abuse of the programme, duplicate accounts and misuse of vouchers | To protect the programme and honest members | Our legitimate interests; prevention of fraud |
| Keep the App and our systems secure, diagnose faults and prevent outages | Information security | Our legitimate interests; compliance with a legal obligation |
| Keep tax, accounting and commercial records, and respond to lawful requests from authorities and courts | We are required to | Compliance with a legal obligation |
| Protect the life or safety of any person in an emergency | Rare, but possible | Protection of vital interests |
Where we rely on your consent, you may withdraw it at any time. Withdrawing consent does not make our earlier use of your data unlawful, and it does not affect processing we carry out on another basis — for example, we will keep sending you OTPs and points notifications because those are part of running your account.
Marketing messages and your choices
We only send marketing messages where you have agreed to receive them, or where the law otherwise permits it. Every marketing message tells you how to stop.
- Push notifications — turn them off in the App settings, or in your device’s notification settings for the App.
- SMS — reply with the stop word shown in the message, or ask our customer care team to remove you.
- Email — use the unsubscribe link at the bottom of the email.
Turning marketing off does not close your loyalty account and does not affect points you have already earned. You will continue to receive service messages about your account.
We may group members by shopping behaviour — for example, members who regularly buy fresh produce — so that the offers we send are relevant. This does not produce any legal effect for you and does not change the price you pay at the till. You can object to it at any time using the contact details in Contact us.
Location data
The App can use your device’s location to show you the nearest branch, the flyer for that branch, and offers valid where you are. Location is only collected while the App has your permission, and you can withdraw that permission at any time in your device settings without losing access to the rest of the App.
We do not track your location in the background for advertising, and we do not sell or share location data with advertising networks.
Cookies and similar technologies
Our website uses cookies and similar technologies that are strictly necessary to make the site work, keep it secure, and remember your preferences. Where we use analytics or any non-essential cookie, we ask for your consent first and you can change your choice at any time through your browser settings or the cookie notice on the site.
The App does not use browser cookies, but it does use device identifiers and a push notification token for the purposes described in this policy.
When we share your data
We do not sell, rent or trade your personal data. We share it only in the situations below, and only to the extent needed.
- Group companies and our branches — so that your membership works across the stores that take part in the programme.
- Service providers acting on our instructions — our point-of-sale and loyalty platform providers, cloud hosting and backup providers, SMS and push notification gateways, email providers, analytics and crash reporting providers, and customer support tools. They may use your data only to provide the service to us and are bound by written contracts and confidentiality obligations.
- Payment providers and banks — where a purchase, refund or co-branded offer requires it. They receive transaction details, not your loyalty profile.
- Delivery partners — where you place an order for delivery, they receive the name, phone number and address needed to deliver it.
- Professional advisers — auditors, lawyers and insurers, under a duty of confidentiality.
- Authorities — regulators, courts, police and government bodies in the United Arab Emirates where we are required or permitted by law to disclose data, or to establish, exercise or defend legal claims.
- Business transfers — if all or part of our business is sold, merged or reorganised, your data may transfer to the buyer, who must continue to protect it under terms no less protective than this policy.
Transfers outside the UAE
Some of our service providers store or process data outside the United Arab Emirates. Where that happens, we transfer your data only if one of the safeguards allowed by the PDPL is in place, namely:
- the destination country has been recognised by the UAE Data Office as providing an adequate level of protection; or
- the transfer is covered by a written contract containing the required data protection clauses, or by binding corporate rules; or
- the transfer is necessary to perform our contract with you, to establish or defend a legal claim, or to protect someone’s vital interests; or
- you have given your explicit consent to the transfer, having been told of the risks.
You can ask us for details of the safeguards that apply to a particular transfer.
How long we keep your data
We keep personal data only for as long as we need it for the purposes described in this policy, and then delete it or irreversibly anonymise it.
| Data | Kept for |
|---|---|
| Loyalty account profile | While your account is active, and then for the period we must keep records after closure |
| Points, vouchers and balance history | While your account is active, plus the period needed to resolve disputes |
| Bills and transaction records | As required by UAE tax and commercial record-keeping law |
| Customer care correspondence | Normally up to two years after the matter is closed |
| Technical, security and access logs | Normally up to twelve months, longer where an incident is under investigation |
| Marketing consent and opt-out records | For as long as we need to prove we honoured your choice |
Where a longer period is required by law, or where data is needed for a live legal claim, investigation or audit, we keep it until that need ends.
How we protect your data
We apply technical and organisational measures appropriate to the risk, including:
- encryption of data in transit using TLS, and encryption of sensitive data at rest;
- one-time password verification of the mobile number on your account;
- role-based access control, so staff can reach only the data their job requires;
- logging of staff access to customer records, including any change made to an account;
- network protection, patching, malware controls and monitoring of our systems;
- regular backups, tested restores and a documented incident response process;
- contractual confidentiality and security obligations on every provider that handles your data.
No system is perfectly secure. Please keep your device and your one-time passwords to yourself, and tell us immediately if you think someone else has used your account. We will never ask you for your OTP, and no member of our staff will ever call or message you to request it.
Your rights
Subject to the conditions and exceptions in the PDPL, you have the right to:
- be informed about how we process your data — this policy;
- access the personal data we hold about you, and receive a copy;
- request a transfer of the data you gave us to yourself or to another controller, in a structured, machine-readable format, where technically feasible;
- correct data that is inaccurate, incomplete or out of date;
- erase your data, unless we are required or permitted to keep it — for example for tax records or a legal claim;
- restrict or object to processing in the circumstances the law allows, including processing based on our legitimate interests;
- stop processing for direct marketing at any time;
- withdraw consent you previously gave;
- object to automated decisions that produce legal effects for you. We do not make decisions about you by automated means alone that have legal or similarly significant effects; and
- complain to the UAE Data Office if you believe we have not handled your data lawfully.
How to make a request or complaint
Send your request to QamarAlMadeenasupermarket@gmail.com, or speak to the customer service desk at any of our branches. Tell us what you want us to do and give us enough information to find your account — normally the mobile number registered to it.
We may ask you to verify your identity before we act, so that we do not disclose your data to someone else. We will respond without undue delay and, in any event, within the period required by the PDPL. Our response is free of charge; if a request is manifestly excessive or repetitive we may charge a reasonable fee or decline it, and we will explain why.
You can also delete your account yourself from within the App. Deleting your account cancels any unused points and vouchers, which have no cash value and cannot be reinstated.
If you are not satisfied with our response, please tell us first so we can put it right. You may also lodge a complaint with the UAE Data Office.
Children
Our loyalty programme and App are intended for people aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has registered with us, contact us at QamarAlMadeenasupermarket@gmail.com and we will close the account and delete the data, unless we are required to keep it.
Data breaches
We maintain a documented process for detecting, investigating and containing personal data breaches. Where a breach is likely to prejudice the privacy, confidentiality or security of your data, we will notify the UAE Data Office and, where the law requires it, you — describing what happened, what data was involved, what we are doing about it and what you can do to protect yourself.
Links and services we do not control
The App and our website may link to third-party sites and services, such as app stores, payment pages, delivery trackers and social media. We do not control those services and are not responsible for their privacy practices. Read their privacy notices before giving them your data.
Changes to this policy
We may update this policy as our services, our providers or the law change. The “Last updated” date at the top of this page always shows the current version. Where a change materially affects how we use your data, we will give you notice in the App, by message, or both, before it takes effect, and where the law requires it we will ask for your consent again.
Governing law
This policy, and any dispute arising out of it, is governed by the laws of the United Arab Emirates as applied in the Emirate of Dubai. The courts named in our Terms & Conditions have jurisdiction, without prejudice to your right to complain to the UAE Data Office.
Contact us
For anything to do with your personal data, or this policy:
- Entity
- Qamar Al Madeena Supermarket LLC
- Privacy
- QamarAlMadeenasupermarket@gmail.com
- Customer care
- QamarAlMadeenasupermarket@gmail.com
- Telephone
- Hours
- Website
- https://qmggroup.com/
- Address
- Dubai, United Arab Emirates