Sawa Rewards Privacy Policy

Last revised: 1 October 2026

Version: 1.1

Aura Life Style W,L.L, CR 79012 ("Aura", "we", "our" or "us") is committed to protecting the privacy of Sawa Rewards members and users. This Privacy Policy explains how we collect, use, share and protect personal data in connection with the Sawa Rewards programme, including through the Sawa mobile application and website, at participating outlets, and by phone, email or other communications. It should be read together with the Sawa Rewards Programme Terms and Conditions (the "Terms"). We are the controller of your personal data for the purposes of Law No. 13 of 2016 on Personal Data Privacy Protection (the "PDPPL").

1. Applicability and Scope

This Privacy Policy applies to the Sawa Rewards mobile application (the "App") and the Sawa Rewards website at www.sawa.qa (together, the "Services").

Sawa Rewards is a loyalty programme owned by Aura that offers members dining, wellness and entertainment benefits and rewards (the "Programme"). The Programme aims to:

•support and grow the business of Aura and participating Aura Group companies;

•encourage regular customer engagement and visits;

•build our customer relationships and provide personalised marketing, where you have agreed to receive it; and

•provide continuous offers, rewards and prize draws.

The Programme may be operated directly by Aura or by one or more of its subsidiaries or affiliated companies appointed by Aura from time to time (each an "Authorised Operator"). Depending on its role, an Authorised Operator may process personal data on our behalf, or together with us, in connection with the Programme and in accordance with applicable law.

2. Updates to this Privacy Policy

We may update this Privacy Policy from time to time. The "Last revised" date at the top of this Privacy Policy shows when it was last changed. Where we make material changes, we will notify you through the App or by email before they take effect. We encourage you to review this Privacy Policy regularly.

3. How We Process Your Personal Data

We process your personal data only where permitted by the PDPPL and other applicable law, and in a transparent, honest and lawful manner. We rely on the following grounds:

Consent

We rely on your consent where you allow optional access or features, such as location services, push notifications or, where the App requests it, access to your contacts. You may withdraw your consent at any time through the App settings or by contacting us using the details in section 14. Withdrawing consent does not affect processing carried out before the withdrawal.

Direct marketing

With your prior consent, we may send you marketing communications about the Programme, offers, rewards and events by SMS, email, push notification and WhatsApp. Each marketing communication will identify us as the sender and give you a simple way to opt out. You may opt out or withdraw your consent at any time. We may still send you service messages about your account and Points, which are not marketing communications.

Contract

We process the personal data needed to enrol you in the Programme, manage your account and Points, and provide the Services in accordance with the Terms. If you do not provide the mandatory data, we may be unable to enrol you or provide certain Services.

Legitimate purposes

We may process personal data where this is necessary for our legitimate purposes, such as preventing fraud, securing the Services and improving the Programme, provided that this does not override your rights and interests.

Legal or regulatory obligations

We may need to collect and retain personal data to comply with legal or regulatory requirements. If you do not provide such data, we may be unable to provide the Services.

4. What Personal Data We Collect

We collect personal data directly from you, automatically through your device, and from other sources. This may include:

•Personal identification: name, date of birth, nationality

•Contact details: mobile number, email address

•Account details: username, password, Sawa membership number

•Programme activity: Points earned, redeemed, gifted and expired, membership tier, transaction history, receipts submitted for missing Points claims, followed brands, prize draw participation and survey responses

•Communication preferences: SMS, email, WhatsApp, push and in-app notifications, language

•Location data: GPS, Bluetooth/iBeacon or other location-based technologies, if you enable them

•Device and usage data: device identifiers, cookies and similar technologies, diagnostics, usage analytics and interactions with the Services

•Social account data: information you choose to share from external platforms such as Facebook, Google or Apple

Some data, such as your name and mobile number, is required to create and use your Sawa account.

Eligibility

The Services are intended only for individuals aged 18 or over. We do not knowingly collect personal data from, or provide the Services to, anyone under 18. By using the Services, you confirm that you are at least 18 years old. If we become aware that we have collected personal data from a person under 18, we will delete it and close the relevant account.

5. Enrolment and App Functionality

When you enrol in the Programme, you must provide accurate and complete information. The App may also ask for optional information to improve your experience.

You can manage App permissions for:

•location services

•push notifications

•in-app messages

•contacts & photos

Enabling these features allows us to offer a more personalised experience, such as information about nearby outlets, tailored offers and more relevant recommendations. You can change these permissions at any time in the App or in your device settings.

6. Information from Other Sources

Where you have given your consent through a third-party platform such as Facebook, Google or Apple, we may receive and process the personal data that platform makes available to us, for the purposes explained when you gave your consent. These purposes include account registration, Programme administration, customer engagement and the provision of related services.

We may also receive personal data from marketing partners and publicly available sources, where they are permitted by law to share it with us. We use this information to:

•validate and correct data;

•improve security and prevent fraud; and

•deliver relevant offers and recommendations, where you have consented to receive them.

7. Personalisation and Profiling

We may analyse information relating to your use of the Services, your preferences, transactions, reward redemptions and interactions with us, to better understand your interests and engagement with the Programme. This analysis may be used to:

•personalise rewards, offers and promotions;

•tailor communications and marketing content;

•improve the Services and your user experience; and

•enhance the relevance of recommendations and Programme benefits.

Where required by applicable law, we will obtain your consent before carrying out profiling for marketing or personalisation purposes. You may object to profiling for marketing purposes at any time by contacting us using the details in section 14.

8. Fraud Prevention and Account Security

We use automated tools and monitoring systems to help protect the Services, our users and our business from fraud, abuse and other unauthorised activity. These measures may be used to:

•detect unusual or suspicious activity;

•prevent fraudulent transactions and misuse of rewards;

•protect user accounts and maintain platform security; and

•investigate suspected breaches of the Terms or applicable law.

Where potentially fraudulent or suspicious activity is identified, the matter may be reviewed by appropriately authorised personnel and appropriate action may be taken in accordance with the Terms, including account restrictions, suspension of benefits or further investigation.

9. How We Protect Your Personal Data

We implement appropriate technical, administrative and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction. These measures include:

•Secure Sockets Layer (SSL) encryption;

•access control and monitoring; and

•secure storage systems.

While we take reasonable steps to safeguard personal data, no method of transmission or storage is completely secure. You are responsible for keeping your account credentials confidential and for securing any device you use to access the Services.

10. Data Retention and Disposal

We retain personal data only for as long as necessary to provide the Services, perform our obligations under the Terms, and meet legal, regulatory, accounting and reporting requirements. When personal data is no longer required, including after you close your account, it will be securely deleted, anonymised or destroyed in accordance with applicable law in the State of Qatar and our internal data retention and disposal procedures.

11. Sharing and International Transfers

We may share personal data with Authorised Operators, participating outlets and third-party service providers (including hosting, IT, customer relationship management, communications, analytics, payment and fraud-prevention providers) only where reasonably necessary to operate or support the Programme, and subject to applicable legal, confidentiality and security requirements. Service providers that process personal data on our behalf are required to do so only on our instructions and to protect it appropriately. We may also disclose personal data where required by applicable law, regulation or a competent governmental, regulatory or judicial authority.

Where personal data is transferred, accessed, stored or processed outside the State of Qatar, we will assess the laws and practices of the receiving jurisdiction and the recipient's ability to protect the personal data. We will implement appropriate safeguards, which may include contractual data protection obligations, confidentiality undertakings, security requirements and other measures required by applicable law. Cross-border transfers will take place only where permitted under the PDPPL and where an appropriate level of protection for the personal data is ensured.

12. Cookies and Similar Technologies

We use cookies, pixels, software development kits (SDKs), local storage and similar technologies on our website and in the App to operate, secure and improve the Services, enhance your experience, remember your preferences, facilitate account authentication, analyse usage and performance, provide customer support, and deliver relevant content, offers and marketing communications.

The cookies and similar technologies we use may include:

•Strictly necessary cookies: required for the operation, security and functionality of the Services.

•Analytics and performance cookies: used to understand how users interact with the Services, troubleshoot issues, and improve performance and user experience.

•Functionality cookies: used to remember your preferences, settings and choices.

•Advertising and marketing cookies: used to measure the effectiveness of marketing campaigns and provide more relevant advertisements and promotional content.

You may manage or disable certain cookies through your browser or device settings. Disabling certain cookies or technologies may affect the availability, functionality or performance of the Services.

Where required by applicable law, we will obtain your consent before placing non-essential cookies or similar technologies on your device. You may withdraw your consent at any time through the cookie preference settings we make available or through your browser settings.

We may also permit selected third-party service providers, such as analytics, advertising, cloud hosting and customer engagement providers, to place cookies or similar technologies on the Services for the purposes described in this Privacy Policy. These third parties may collect information about your interactions with the Services in accordance with their own privacy notices.

13. Personal Data Breaches and Security Incidents

We maintain policies and procedures designed to identify, investigate, contain and remediate actual or suspected personal data breaches and security incidents. Where we become aware of a personal data breach that is likely to result in a risk to the rights, freedoms or privacy of affected individuals, we will assess the incident and take appropriate remedial measures.

Where required by applicable law, we will notify the competent regulatory authority and affected individuals of a personal data breach within the timeframe and in the manner prescribed by law. Such notifications may include information about the nature of the breach, the categories of personal data affected, the likely consequences of the breach and the measures taken or proposed to address it.

We may also provide notifications or updates about security incidents where we consider it appropriate to protect users and the integrity of the Services.

14. Your Rights and How to Contact Us

Subject to the PDPPL and other applicable law, you have the right to:

•withdraw your consent to the processing of your personal data at any time, including consent to direct marketing;

•object to the processing of your personal data where it is not necessary for the purposes for which it was collected, or where it is excessive, discriminatory, unfair or unlawful;

•request the correction of inaccurate personal data;

•request the deletion of your personal data where it is no longer needed or where its retention is not legally required;

•be informed of the processing of your personal data and its purposes;

•be notified of any disclosure of inaccurate personal data about you; and

•obtain a copy of your personal data.

To exercise your rights, or to make a privacy enquiry or complaint, please email loyalty@auragroup-intl.com. So that we can verify your identity and respond, please include your full name, registered mobile number and membership number.

If you believe that we have processed your personal data in a manner inconsistent with applicable data protection law, we encourage you to contact us first so that we can try to resolve your concerns promptly and fairly. You also have the right to submit a complaint to the authority responsible for administering the PDPPL, currently the National Data Privacy Office of the National Cyber Security Agency, or any successor authority.