1. Definitions

1. “Controller” means the natural or legal person, public authority, agency, or other body which alone or jointly with others, determines the purposes and means of the processing of Personal Data
2. “Customer” means any person or entity with whom the Merchant interacts using the Services.
3. “Merchant” means the natural or legal person that has subscribed to the Services by entering into an agreement with Us.
4. “Personal Data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person, including SPDI.
5. “To Process/Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
6. "DPDP Act" means the Digital Personal Data Protection Act, 2023 and the rules made under it."Data Fiduciary" means the person who, alone or with others, determines the purpose and means of processing personal data."Data Processor" means a person who processes personal data on behalf of a Data Fiduciary."Data Principal" means the individual to whom the personal data relates; where that individual is a child, it includes the parent or lawful guardian."Child" means an individual who has not completed 18 years of age.
7. “CCPA” California Consumer Privacy Act, 2018
8. “CPRA” California Privacy Rights Act, 2020
9. “Terms” means the Terms of Service made available at https://urbanpiper.com/legal/merchant-agreement
10. “User” means those who are designated users within the Services, including an Account administrator, agents and other designated users.
11. “You” and “Your” means an identified or identifiable natural person who (i) visits the Website(s); (ii) is a User of the Services from whom We collect Personal Data as a Controller, as specified in Section 2 of this Policy
12. "Anonymised Data" means data that has been processed so that it can no longer be attributed to an identified or identifiable natural person, whether by Us or by any other person. Anonymised Data is not Personal Data.
13. "Pseudonymised Data" means Personal Data that can no longer be attributed to a specific individual without the use of additional information that is kept separately and subject to technical and organisational measures. Pseudonymised Data remains Personal Data and is protected under this Policy.

2. Product data flows and our role

3. Personal Data Collected by us

• • You directly provide Us with most of the data We collect. We collect Personal Data from You directly as follows:
  • • When You subscribe for any of Our Services, We collect sign-up, account information including Your name, e-mail address, shipping address, billing address, IP address, geographic location, phone number of the account administrator or information required for authentication of a Account into Our Services;
    • When a User is added, We collect the name, email address and phone number of the User.
    • When You submit forms on Our Website(s) or as You use interactive features of the Website(s), including providing feedback or suggestions, testimonials, making requests, participation in surveys, contests promotions, or sweepstakes, We collect Your feedback, name and e-mail address;
    • When You attend an event conducted by Us, including webinars or seminars, We may collect Your contact information such as name, e-mail address, phone number, designation and company name;
    • When You request customer support or otherwise communicate with us, We collect Your name, usage information or any other Personal Data You may provide Us in the course of such interaction;
    • When you interact with Us on public forums, Our social media channels, Our community forums, or Our blogs, We collect the information You provide Us while interacting with Us and Personal Data such as Your name, location and any information You provide in your bio while registering with such forums;
    • When You apply for a job with Us, whether through Our Website or otherwise, We collect Your Personal Data, including your Resume, in connection with Your job application;
    • When You are a representative of Our business partners, suppliers or vendors, We collect Your name, e-mail and contact information;
    • When You choose to invite others to join our Services through our referral feature, We collect the email address or any other information You provide us for such referrals;
    • When you register for Our loyalty programme(s), We may collect Your Personal Data such as name, email address, billing address while registering for such programme(s).
• • We may also receive Your Personal Data indirectly as follows:
  • • from third party sources like marketing lists, databases and social media but only where We have checked that these third parties either have Your consent or are otherwise legally permitted or required to disclose Your Personal Data to Us;
    • When You use the Services, We automatically collect information on the type of device You use, and the operating system version, to perform Our agreement with You;
    • When You use or view Our Website(s), information is collected via Your browser’s cookies as described in clause 10 herein;
    • We may also collect or receive Your Personal Data from other sources such as Our business or channel partners through whom You create or access Your account, publicly available sources, email add-ons and/ or through the combining of information We obtain from third parties along with the Personal Data You provide to Us.
• The Website(s) includes social media features and widgets that are either hosted by a third-party or hosted directly on the Website(s) and Your interaction with these social media features and widgets is governed by the privacy statement of the companies that provide them. You should check Your privacy settings on these third-party services to understand and change the information sent to Us through these services.

4. Legal Basis for Processing

1. If You are a data subject from the European Economic Area and USA, Our legal basis for collecting and using the Personal Data described above will depend on the Personal Data concerned and the specific context in which We collect it.We will normally collect Personal Data from You only where it needs it to perform a contract with You, where the Processing is in Our legitimate interests and not overridden by Your data protection interests or fundamental rights and freedoms, or where We have Your consent. In some cases, We may also have a legal obligation to collect Personal Data from You. If We Process Personal Data with reliance on Your consent, You may withdraw Your consent at any time.
2. If You are in the Middle East, We process Your Personal Data in accordance with the data protection law of Your country, which may include: the Saudi Personal Data Protection Law (Kingdom of Saudi Arabia); Federal Decree-Law No. 45 of 2021 and, where applicable, DIFC and ADGM data protection laws (United Arab Emirates); [Law No. 30 of 2018 (Bahrain); Law No. 13 of 2016 (Qatar); the data privacy regulations issued by CITRA (Kuwait); and Law No. 151 of 2020 (Egypt)]. Our primary legal basis in these countries is Your consent; where permitted by local law We may also process Personal Data to perform a contract, to comply with a legal obligation, or for Our legitimate interests.
3. If You are in India, We process Your Personal Data under the Digital Personal Data Protection Act, 2023. Depending on the Product, UrbanPiper acts either as a Data Fiduciary (for example, for Our website visitors, account administrators, marketing contacts and job applicants) or as a Data Processor on a Merchant's behalf (for example, for Customer data processed through Hub, Meraki and Orderline), as described in the "Our Products and Our Role" section. Where We act as a Data Fiduciary and rely on consent, We will, at or before the time We collect Your Personal Data, give You an itemised notice of the personal data We seek to collect and the specific purpose of processing, the manner in which You may exercise Your rights, and the manner in which You may complain to the Data Protection Board of India. You may withdraw Your consent at any time, and withdrawing consent will be as easy as giving it; withdrawal does not affect processing carried out before withdrawal.
4. If You have questions or need further information concerning the legal basis on which We collect and use Your Personal Data, please contact Us using the contact details provided under clause 13.
5. United Kingdom. If You are in the United Kingdom, We Process Your Personal Data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018, on the bases of performance of a contract, Our legitimate interests, compliance with a legal obligation, or Your consent.
   ‍United Arab Emirates. If You are in the United Arab Emirates, We Process Your Personal Data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (and, where applicable, the data protection laws of the DIFC or ADGM), primarily on the basis of Your consent and, where permitted, for the performance of a contract, compliance with a legal obligation, or Our legitimate interests.
   ‍Kingdom of Saudi Arabia. If You are in the Kingdom of Saudi Arabia, We Process Your Personal Data in accordance with the Personal Data Protection Law and its Implementing Regulations, as administered by the Saudi Data & Artificial Intelligence Authority (SDAIA), on the bases permitted under that law, including Your consent.

5. Purposes for which personal data will be processed

• facilitate Your access to the Website(s) and Services;
• process and complete payment transactions;
• provide customer service and support;
• to authenticate Your identity and help You log into Our Services;
• send You communication on Your use of the Services, updates on Our Terms or other policies;
• send You communication on new features in the Services or new service offerings;
• perform Our obligations or receive products/services in accordance with any contract that We may have with You or Your organization;
• Organise events or for other marketing/ promotional activities;
• investigate and prevent fraudulent transactions, unauthorized access to the Website(s) and Services, and other illegal activities;
• personalize the Website(s) and Services;
• evaluate You for the job position that You have applied for or any position that We consider You suitable for, to ensure that We can make the best recruitment decisions;
• for providing loyalty or customer engagement programme(s) You may register for;
• inviting, adding invitees to Your social network and sending reminders to invitees to through Our referral feature; and
• for other purposes for which We obtain Your consent.

6. Sharing of Personal Data

• You acknowledge that We will share Your Personal Data with Our group companies and third-party service providers so that they may offer You Our Services and/or to send information or updates on the Services if You are a Merchant.
• When We Process Your order where You are a Merchant, We may send Your Personal Data to and also use the resulting information from credit reference agencies to prevent fraudulent purchases.
• We share Personal Data with sub-processors who help Us provide and improve Our Website(s) and Services, including hosting, backup, storage, payment processing, analytics and other related services. These third-party service providers may access or Process Your Personal Data only to provide these services to Us and under obligations of confidentiality and data protection. A current list of Our sub-processors is available on request, and where We act as a Processor We will give affected Merchants reasonable prior notice of any new sub-processor.
• We will not share your mobile information with third parties, platforms, or affiliates for any unsolicited marketing or promotional purposes. This doesn't include the information you have opted in to receive through text messages.
• We may be required to disclose Your Personal Data in response to: a) lawful requests by public authorities, including to meet national security or law enforcement requirements; b) subpoenas, court orders, or legal process, and/or c) to establish or exercise Our legal rights or defend against legal claims.
• We may share Your Personal Data to assist investigation and prevention of illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of Our Terms, or as otherwise required by law.
• We may also share Your Personal Data with an entity to which we divest all or a portion of our business, or otherwise in connection with a merger, consolidation, change in control, reorganization or liquidation of all or a portion of our business.
• Where required by applicable law, including the California Consumer Privacy Act (CCPA/CPRA), you have the right to opt out of the sale or sharing of your Personal Data.

7. International Transfer

• We mainly Process Personal Data in Singapore. However, We may transfer Personal Data outside Singapore for the purposes referred to in Section 4. We will ensure that the recipient of Your Personal Data offers an adequate level of protection that is at least comparable to that which is provided under applicable data protection laws.
• If You are a resident of the European Economic Area (EEA) and when Your Personal Data is Processed outside EEA, We will ensure that the recipient of Your Personal Data offers an adequate level of protection, for instance by entering into standard contractual clauses for the transfer of Personal Data as approved by the European Commission (Article 46 General Data Privacy Regulation, 2016), or We will ask You for Your prior consent to such international data transfers.
• When we transfer personal data to recipients located outside the United States, we do so in accordance with applicable federal and state privacy laws. We take appropriate measures to ensure that your personal data remains protected, including entering into contractual agreements with recipients that require them to safeguard your information in a manner consistent with relevant US data protection standards. Where required by law, we will obtain your consent before transferring your data internationally and will provide you with clear information about the nature and purpose of such transfers.
• For residents of the Middle East and North Africa (MENA) region, international transfers of personal data are conducted in compliance with applicable local data protection laws. Where necessary, we will transfer your personal data only to recipients that meet the required standards of data protection. This may involve putting appropriate contractual safeguards in place or obtaining your explicit consent before any transfer occurs. We are dedicated to ensuring that your personal data is protected and processed securely, fully complying with the legal requirements of your country of residence during any international transfer.
• Transfer mechanisms by region. When We transfer Personal Data across borders, including to Our group companies and sub-processors, We use the safeguard appropriate to the transfer, which may include: the European Commission's Standard Contractual Clauses for transfers from the European Economic Area; the UK International Data Transfer Agreement or Addendum for transfers from the United Kingdom; the transfer conditions permitted under the Digital Personal Data Protection Act, 2023 for transfers from India; and the cross-border transfer conditions under the Saudi Personal Data Protection Law and the UAE Federal Decree-Law No. 45 of 2021 for transfers from Saudi Arabia and the United Arab Emirates respectively. Where no such mechanism applies, We will rely on another lawful basis for the transfer, including Your explicit consent.

8. Retention of Personal Data

• We retain Personal Data only for as long as necessary for the purposes set out in this Policy. The retention period depends on the type of data and the reason We hold it — for example, account data is retained for the duration of the relationship and any period required by applicable law, and marketing data is retained until You opt out. Where We Process Personal Data on a Merchant's behalf as a Processor, We retain and delete such data in accordance with Our agreement with the Merchant and the Merchant's instructions.
• In the absence of a need to retain Personal Data under Section 7.1. above, We will either delete it or aggregate it, or, if this is not possible then We will securely store Your Personal Data and isolate it from any further Processing until deletion is possible.
• • The periods for which We retain Personal Data depend on the category of data and the purpose for which We hold it. Unless a longer period is required or permitted by Applicable Law, We apply the following retention guidelines:
  • • Account and User data (Atlas): for the duration of the Merchant's relationship with Us and for up to 24 months thereafter, save where a longer period is required by law.
    • Order and integration data routed through Hub: retained only transiently for the purpose of delivering the integration and, where logs are kept, for up to 90 days, unless the Merchant's instructions require otherwise.
    • Meraki Customer data: retained for the period specified in Our agreement with the relevant Merchant and in accordance with the Merchant's instructions.
    • Billing, tax and accounting records: for the period required by applicable tax and company law, typically 10 years.
    • Marketing data: until You opt out or withdraw consent, and thereafter only as needed to honour Your opt-out.
    • Recruitment data: for up to 12 months after a decision, unless You consent to a longer period.
    • Cookies and similar technologies: for the periods set out in Our Cookie Policy.

9. Security of Personal Data

• We use appropriate technical and organizational measures to protect the Personal Data that We collect and Process, designed to provide a level of security appropriate to the risk of Processing Your Personal Data. These measures include encryption of Personal Data in transit and at rest, role-based access controls, network and infrastructure protection, regular security testing, and confidentiality obligations on Our personnel.
• We maintain an information security programme aligned to recognised standards and hold ISO/IEC 27001 certification and a SOC 2 attestation, and We operate a data protection programme designed to meet the requirements of the EU and UK General Data Protection Regulation (GDPR). The scope and currency of Our certifications, and copies of relevant reports, are available to Merchants on request through (by contacting Us at the details in the Contact section) subject to appropriate confidentiality undertakings.
• Personal data breach. If We become aware of a personal data breach affecting Your Personal Data, We will act promptly to investigate and contain it. Where We act as the Controller, We will notify the affected individuals and the competent supervisory authority as required by, and within the timelines set by, Applicable Law. Where We act as a Processor, We will notify the affected Merchant without undue delay, and in any event within 48 (forty-eight) hours of becoming aware of the breach, so that the Merchant can meet its own obligations. Our notification will include, to the extent available, a description of the breach, the categories and approximate number of individuals and records affected, the likely consequences, and the measures taken or proposed to address it. Depending on where affected individuals are located, notifications may be made to authorities including the Data Protection Board of India, the UK Information Commissioner's Office, the Saudi Data & Artificial Intelligence Authority (SDAIA), the UAE data protection authority, and relevant United States state authorities.
• Payment information. Where payments are processed in connection with the Services, card and payment details are handled only by payment processors that are certified as compliant with the Payment Card Industry Data Security Standard (PCI-DSS). We do not store full payment card numbers, and We do not store any card or payment identifiers collected through Meraki.

10. Your Rights

• You can request Us for access and correction of Your Personal Data.
• If We have collected and processed Your Personal Data with Your consent, then You can withdraw your consent at any time. Withdrawing Your consent will not affect the lawfulness of any processing We have conducted prior to Your withdrawal, nor will it affect Processing of Your Personal Data conducted in reliance on lawful processing grounds other than consent.
• You have the right to complain to a data protection authority about Our collection and use of Your Personal Data. For more information, please contact Your local data protection authority.
• You have the right to opt-out of marketing communications We send You at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing emails We send You. To opt-out of other forms of marketing (such as postal marketing or telemarketing), please Contact Us at support@urbanpiper.com
• • If You are a resident of the EEA, UK, US, or Switzerland, You are also entitled to the following rights:
  • • You can request Us for deletion and erasure of Your Personal Data
    • You can object to the Processing of Your Personal Data, ask Us to restrict Processing of Your Personal Data or request portability of Your Personal Data.
• To exercise any of these rights, please contact Us using the details in clause 13 or at infosec@urbanpiper.com. We will verify Your request before acting on it and will respond within the timeframe required by applicable data protection laws. Residents of India may also nominate another individual to exercise these rights on their behalf and may raise any grievance with Our Grievance Redressal Officer named in clause 13. Where Your Personal Data was collected by a Merchant and We Process it only on the Merchant's behalf, please contact the Merchant directly as the Controller; We will support the Merchant in responding to You.
  
• Region-Specific Rights
  ‍
  United States. If You are a resident of a US state with a comprehensive privacy law (including California, Virginia, Colorado, Connecticut, Utah and Texas), You may have the right to access, correct, delete and obtain a portable copy of Your Personal Data, and to opt out of the "sale" or "sharing" of Your Personal Data and of targeted advertising. We do not sell Your Personal Data for money. To opt out of the sale or sharing of Personal Data, or to limit the use of sensitive Personal Data, use the "Do Not Sell or Share My Personal Information" subject line to contact Us at infosec@urbanpiper.com. You may appeal a declined request by contacting Us, and You may also complain to Your state Attorney General.
  ‍
  India. If You are a Data Principal in India, You have the right to: (a) access a summary of the Personal Data We process about You and the processing activities; (b) know the identities of the Data Fiduciaries and Data Processors with whom Your Personal Data has been shared, and a description of the data shared; (c) correction, completion, updating and erasure of Your Personal Data; (d) readily withdraw consent; (e) grievance redressal; and (f) nominate another individual to exercise Your rights in the event of Your death or incapacity. To exercise these rights or raise a grievance, contact Our Grievance Officer at the details in the Contact section. We will respond within the timelines prescribed under the DPDP Act.
  ‍
  ‍United Kingdom and EEA. If You are in the United Kingdom or the European Economic Area, You have the rights described above in this Section, and You may lodge a complaint with Your local supervisory authority, which in the United Kingdom is the Information Commissioner's Office (ICO).
  ‍
  Saudi Arabia and the United Arab Emirates. If You are in Saudi Arabia or the United Arab Emirates, You have the right to: (a) be informed about how Your Personal Data is processed and the legal basis; (b) access and obtain a copy of Your Personal Data in a clear format; (c) request correction, completion or updating of Your Personal Data; (d) request deletion of Your Personal Data where it is no longer required or where processing was based on consent; (e) withdraw Your consent at any time; and (f) lodge a complaint with the competent regulator (in Saudi Arabia, the Saudi Data & Artificial Intelligence Authority (SDAIA); in the United Arab Emirates, the UAE Data Office). Users in the United Arab Emirates also have the right to data portability and to object to processing in the circumstances allowed by law. To exercise these rights, contact Us at infosec@urbanpiper.com.
  

11. Cookie Policy

• Cookies are text files that are placed on Your computer to collect standard internet log information and visitor behaviour information by Us. When You visit the Website(s), We may collect Personal Data automatically from You through cookies or similar technology. We also set cookies to collect information that is used either in aggregate form to help Us understand how Our Website(s) is being used or how effective Our marketing campaigns are, to help customise the Website(s) for You or to make advertising messages more relevant to You.
• Essential Cookies: We set essential cookies that enable core functionality such as security, network management, and accessibility. You may not opt-out of these cookies. However, You may disable these by changing Your browser settings, but this may affect how the Website(s) functions.
• Analytics, Customisation and Advertising Cookies: We set these cookies to help Us improve Our Website(s) by collecting and reporting information on how You use it. The cookies collect information in a way that does not directly identify anyone.
• When You visit the Website(s), a cookie banner will be displayed providing additional information about cookies and options to opt out of non-essential cookies as required by applicable laws.
• You can review and change Your cookie choices at any time through Our cookie preference centre through the banner presented when You visit our website at https://www.urbanpiper.com

12. Privacy of Children

• We do not seek to profile, track or serve targeted advertising to children. Where a Merchant's Customers order through Our Products and may include children, the Merchant is the Data Fiduciary and is responsible for obtaining verifiable consent of the parent or lawful guardian before a child's Personal Data is processed. Where We process a child's Personal Data through Our Products, We do so only as a Data Processor on the Merchant's documented instructions, and We will not use a child's Personal Data for tracking, behavioural monitoring or targeted advertising.

13. Notice to Customer and other exclusions

• Other than the Personal Data collected under clause 2 and for the purposes set forth in clause 4 for which UrbanPiper shall act as the Controller, for any other Processing of Personal Data collected from a Customer, We will only act as a Processor of Personal Data and such Processing will be governed by the terms and conditions of the agreement with the Merchant. The Customer’s data privacy questions and requests should be submitted to the Merchant in its capacity as the Customer’s Controller. We are not responsible for Merchant’s privacy or security practices which may be different from this notice. Merchants to Our Services are solely responsible for establishing policies for and ensuring compliance with all applicable laws and regulations, as well as any and all privacy policies, agreements, or other obligations, relating to the collection of Personal Data in connection with the use of Our Services by Customers.
• Our Website(s) contain links to other websites. Our Policy applies only to our Website(s), so if You click on a link to another website, You should read their privacy policy. We encourage You to review the privacy statements of any such other websites to understand their Personal Data practices

14. Automated decision-making and profiling

15. Contact Information

16. Changes to the Policy