Privacy Policy | Joint Points

1 Who we are

Joint Points is operated by USG Middle East, a company organised and duly registered under the laws of the Kingdom of Saudi Arabia under commercial registration number 2050014850, whose registered office is at Dammam 2nd Industrial City, Kingdom of Saudi Arabia (USG ME, we, us or our). USG ME is the controller of personal data processed for the purposes described in this policy.

This policy explains how we collect, use, disclose, protect and retain personal data in the Joint Points mobile application, its related services and the administration of the rewards program (the App or Program). It also explains your choices and how to exercise your rights.

The Program is available in GCC countries. We comply with the data protection laws that apply to the relevant processing, including the applicable laws of Saudi Arabia, the UAE, Qatar, Bahrain, Oman and Kuwait. Naming a law does not mean that every provision applies in every case. Mandatory local rights and requirements take precedence over conflicting provisions of this policy.

A distributor, retailer or group company does not become a joint controller merely because it participates in the Program. Where another organisation determines its own processing purposes, or jointly determines purposes with us, we will explain its identity, role and relevant privacy information before that arrangement applies to your data.

2 Who this policy covers

This policy covers App users, including contractors, applicators, painters and participating retailer or distributor staff. It also covers identifiable business contacts whose details we hold to administer the distribution network. Where we collect contact details indirectly, we provide the required information within the applicable legal timeframe unless a lawful exception applies.

The App is intended for people aged 18 or over. We ask users to confirm eligibility. If we discover an underage account, we restrict its use and assess deletion, safeguarding and any necessary lawful retention. We do not knowingly target children with marketing.

3 Personal data we collect

Account and profile information

We collect your name, mobile number and country code, country, city or area, language, account and member identifiers, password authentication information and acceptance records. Company name is optional. If supported and provided, profile information may include an email address or profile image. We verify mobile numbers using a one-time password. We do not request national identification numbers or identity documents for ordinary registration. Any exceptional verification request will be explained and limited to what is necessary.

Scans and location

For product scans, we process the QR identifier, associated product and batch information, scan time, outcome, points calculation and relevant security information. We collect precise device coordinates at the time of a scan to validate it and help detect misuse. The App requires location access for scan rewards; you may continue to exercise your privacy rights if you decline that access.

Camera access is used to read a QR code. Camera permission alone does not mean that we upload or retain a photograph. If a feature requests a product, receipt or project photograph, a notice at that feature will explain what is uploaded, its purpose, access and retention before collection. Avoid including faces, identity documents, confidential project material or other unnecessary personal information.

We do not use this policy as permission for continuous or background location tracking. Any additional location feature must have a specific purpose, an appropriate legal basis and a clear notice and permission request before activation.

Device security and usage information

We process relevant device or installation identifiers, IP address, session and authentication records, App and device information, language and technical logs. The scan service may record whether the device reports a mocked location. Additional fraud signals, crash reporting or usage analytics are collected only where actually enabled, necessary and supported by the applicable notice and legal basis.

Points transfers rewards and support

We process points earned, held, adjusted, transferred, redeemed or expired; wallet and transaction references; gift-card choices, value and delivery records; and transfer or payment-request participants and outcomes. We retain support requests, complaints, appeals and our responses. Do not send gift-card secrets or OTPs to unauthorised people.

Business contacts and other sources

We may receive necessary sale, delivery, fraud-investigation or redemption information from distributors, retailers and service providers. We may also receive business contact details from the business, authorised staff, user suggestions or lawful public sources. Public availability does not remove applicable privacy obligations. Google Place IDs used for outlet discovery are distinct from customer account data; a saved or promoted ID does not by itself establish a verified merchant relationship.

We do not intentionally request sensitive personal data for ordinary Program participation. If an exceptional feature requires such data, we will assess applicable restrictions, permissions and notices before collecting it.

4 Purposes and lawful grounds

We determine the lawful ground for each purpose under the law applicable to your data. We do not assume that consent, contract or legitimate interests have the same scope in every GCC country. Where consent is required and no applicable exception permits processing, we obtain it before processing.

Purpose	Processing and applicable ground
Account and Program administration	Register and authenticate users; maintain accounts; validate scans; calculate and deliver rewards. We rely on an applicable agreement or contractual ground only where local law permits and the processing is necessary; otherwise we obtain required consent or use another applicable statutory ground.
Fraud prevention and security	Detect duplicate or manipulated scans, secure accounts, investigate incidents and protect legitimate claims. Legitimate interests are used only where available under local law and following the required necessity and balancing assessment. Legal duties apply where specifically relevant.
Points transfers and requests	Process transfers and requests initiated by users, including eligible cross-country transactions, and disclose only necessary participant and transaction information. The applicable contractual or other permitted ground is assessed for the countries involved.
Service communications	Send OTPs and essential account, transaction, reward, security and policy notices under the applicable service-related or statutory ground. We distinguish these from optional marketing.
Marketing and personalised offers	Send offers and campaigns, including location-relevant offers or remarketing, only with the consent required by applicable law. We do not treat accepting Program terms or granting device permissions as marketing consent.
Product and market insight	Analyse product use, distribution coverage, demand and Program performance. We use genuinely anonymous or aggregated information where possible. Any identifiable analysis requires a separately assessed lawful ground and safeguards.
Compliance and legal claims	Meet identified legal obligations, respond to lawful requests and establish, exercise or defend legal claims. We limit the information and retention to what the obligation or claim reasonably requires.

We will not repurpose personal data in a way that is incompatible with the original purpose without a lawful basis, appropriate notice and any consent required by law. Developing a future feature is not, by itself, authority to collect additional data now.

5 Consent permissions and marketing choices

We distinguish acknowledgement of this privacy notice, acceptance of Program terms, any legally required processing consent, optional marketing consent and device permissions. These are not interchangeable. Optional marketing is not a condition of joining the Program or earning rewards.

Where we rely on consent, we keep evidence of the notice and purpose presented, the choice made, the time and method of consent and any later withdrawal. We provide an accessible withdrawal route, including contacting jointpoints@usgme.com. Channel-specific unsubscribe options are provided where required. We stop the consent-based processing when consent is withdrawn, subject to lawful exceptions and reasonable implementation steps permitted by law.

You can manage camera and location permissions in your device settings. Declining or withdrawing the permissions required for a scan prevents scan-based rewards, but does not remove your privacy rights or automatically authorise cancellation of previously valid rewards. Withdrawal does not retrospectively invalidate lawful processing carried out before it.

Marketing may use App notifications, SMS, email or WhatsApp where enabled and lawfully authorised. Essential service messages are separate. We may keep a minimal suppression record to respect an opt-out; we do not use that record to continue marketing. We do not assume that marketing consent lasts indefinitely after an account becomes inactive or closes.

6 Location analytics and market insight

Scan locations may help us understand product usage, distribution gaps and demand, assess product launches and plan sales coverage. Access to identifiable scan locations is restricted to authorised personnel with a legitimate need. We do not give distributors or retailers unrestricted access to an individual user’s precise location history.

Replacing a name with an identifier is pseudonymisation, not necessarily anonymisation. A location map, a small group or repeated scan pattern may still identify a person. Before sharing or publishing a map or analysis, we assess re-identification risk and apply suitable aggregation, suppression or other safeguards. Data remains subject to privacy requirements unless it is genuinely anonymised.

Project-location mapping or retailer-suggestion features may involve additional people or confidential site information. Any such feature requires its own assessment and appropriate collection notice before use. Users should not submit unnecessary personal details about workers, residents or other third parties.

7 Fraud prevention and account decisions

We use proportionate automated checks and authorised manual review to protect the Program. Relevant indicators may include duplicate or invalid codes, unusual scan volume or timing, inconsistent locations, reported mock locations, suspicious account or device patterns, false information or collusion. A technical indicator, VPN use or an unusual location is not by itself conclusive proof of fraud.

We use only information relevant to the investigation. Automated checks may reject an invalid scan or trigger a temporary restriction or review where permitted by the Program terms and law. A proposed final decision to cancel disputed rewards or permanently close an account for suspected fraud is subject to meaningful review by an authorised person. Users may request human review of a materially adverse automated decision where applicable law provides that right.

Subject to the Program terms and applicable law, proportionate action may include holding disputed transactions, reversing improperly obtained points, suspending access or closing an account. Cancellation or recovery of a gift card is subject to the issuer’s capabilities, contractual rights and applicable law. This privacy policy does not independently create a right to confiscate valid rewards or recover money.

Unless law or a legitimate investigation prevents disclosure, we give notice of a restriction or final decision and an understandable general reason. We do not disclose details that would compromise security or another person’s privacy. Contact jointpoints@usgme.com to challenge a decision and provide supporting information.

Please submit an internal Program appeal within 14 days of notice where practicable. This administrative target does not extinguish statutory rights, prevent a regulatory complaint or override legal limitation periods. We aim to respond to appeals within 30 days and will explain any permitted delay. Privacy-rights requests follow the applicable statutory deadline, which may be different.

We retain only necessary investigation and restriction records for a justified period. Restrictions on re-registration are proportionate, periodically reviewed and subject to correction or appeal. An unresolved investigation is not a reason to retain all data indefinitely.

8 Information shared during transfers

When you initiate a point transfer or request, the other participant may see limited account-identification information and the transaction details needed to recognise and complete it. We limit any confirmation display to information necessary for that purpose.

Eligible transfers may involve participants in different countries. We assess disclosures and international-transfer requirements for the data involved. A points transaction does not authorise disclosure of your wider profile, scan history, precise locations or unrelated wallet activity to the other participant.

9 Who receives personal data

We do not sell personal data. We disclose it only for explained purposes, under an applicable lawful ground and with appropriate safeguards.

Recipient	Purpose and limits
Authorised group companies	Relevant USG Middle East group companies, including Juman Industrial Group entities where actually involved, may receive necessary information for administration, support, security or compliance. Group membership does not automatically permit access or unrestricted reuse.
Hosting and technology providers	DigitalOcean and other contracted providers may process information needed for hosting, storage, support, authentication, messaging, security or analytics. We assess their actual roles, services, countries and subprocessors and apply the required contracts.
Messaging and delivery providers	OTP, notification and WhatsApp providers may receive contact details and message or delivery information needed for the service. We distinguish essential delivery from optional marketing. Relevant provider processing is covered in the applicable notices and arrangements.
Gift card partners and issuers	They receive only the account, contact, order and delivery information actually required to issue, fulfil, support or investigate a redemption. Their independent processing, where applicable, is explained through their own privacy notices; it is not described as processing solely on our instructions.
Distributors and retailers	Necessary information may be shared to confirm a transaction or investigate a specific stock-related issue. Identifiable user profiles and detailed location histories are not supplied as a general sales or marketing database.
Authorities and legal advisers	Relevant information may be disclosed where required or permitted by law, to respond to lawful requests or to establish, exercise or defend claims. We assess necessity, authority and scope.
Business successors	Necessary information may be disclosed in a genuine reorganisation or transfer under appropriate confidentiality and privacy safeguards. Any material change in controller or purpose is addressed through applicable notices and legal requirements.

We distinguish processors acting on our documented instructions from independent or joint controllers. We assess each relationship rather than assuming all providers have the same role. You may contact us for relevant information about recipients, subject to lawful confidentiality or security limits.

Where genuinely anonymous statistics are shared, we take reasonable steps to prevent re-identification. Information that can still identify a person remains protected personal data.

10 Hosting and international transfers

We use DigitalOcean for hosting.

Hosting detail	Status
Production application region and country	Singapore
Primary database region and country	Singapore
Backups snapshots and disaster recovery locations	Singapore
Other storage logs CDN support access and relevant subprocessors	Singapore

Depending on the confirmed configuration and provider arrangements, personal data may be processed outside your country of residence or collection, including through overseas support or subprocessor access. Naming a hosting provider does not establish the physical location of all data.

Before a restricted international transfer takes place, we assess the applicable country requirements, the recipient and purpose, the information needed, the destination and onward access. We implement the required lawful transfer mechanism, assessments, contractual safeguards and any necessary approvals or consent. An EU or other foreign contractual mechanism is not automatically a substitute for Saudi or other GCC requirements.

For transfers subject to Saudi law, we assess compliance with the Saudi Personal Data Protection Law and the applicable rules for transfers outside the Kingdom. Other GCC requirements are assessed separately where relevant. You may request information about the safeguards applicable to your data by contacting us, subject to lawful restrictions on disclosure.

11 Security and incident response

We apply technical and organisational safeguards proportionate to the data and risks. Our controls are designed to include secure transmission, suitable protection of stored data and backups, restricted role-based access, authentication controls, relevant audit logging, vulnerability management and procedures for authorised support and incident response. The control set and its implementation are reviewed against the actual production configuration.

Providers are assessed and placed under the contractual duties required for their role. Personnel with access must follow confidentiality and security requirements. We limit access to identifiable data and review access permissions. No system can guarantee absolute security.

We investigate suspected personal data incidents and make regulatory and individual notifications when required, within the applicable country-specific time limits. A generic notification promise does not replace our internal incident-response process. Keep passwords, OTPs and gift-card credentials confidential and contact us promptly if you suspect misuse.

12 Retention closure and erasure

We retain personal data only for as long as necessary for an identified purpose or applicable legal requirement. We do not apply an automatic ten-year period to all data. Retention depends on the record type, applicable country requirements and justified investigation or legal needs.

Record category	Retention rule
Active account and profile	Kept while needed to provide the account and associated services. Inactive and closed accounts are reviewed against the approved retention schedule; closure is not authority for indefinite profile retention.
Scan attempt logs	The inspected application configuration provides an 18-month retention window for scan-attempt logs, with scheduled pruning.
Points transactions and redemption records	Retained for the applicable documented accounting, tax, audit, dispute or other legal period. The precise period and trigger must be approved for each relevant record and jurisdiction. A financial retention duty does not automatically extend to all GPS or device data.
Precise location device and technical information	Kept for the shortest justified operational or security period under the approved schedule. Delete or irreversibly anonymise unnecessary detail when its purpose ends; do not retain it solely because it once accompanied a financial transaction.
Fraud investigations and legal holds	Retain the minimum evidence needed for a specific investigation, restriction or claim. Record the reason, scope and review date. Release the hold and apply ordinary deletion rules when the justification ends.
Marketing consent and suppression records	Stop consent-based marketing after withdrawal. Keep only necessary evidence of consent or withdrawal and a minimal suppression record for compliance and dispute purposes; do not reuse suppressed contacts for marketing.
Support records exports and backups	Use defined operational retention and expiry periods. Expire temporary exports and backups, restrict access and prevent restored backups from reactivating deleted data or withdrawn marketing choices without lawful justification.

Closing an account disables its use and revokes access. It is distinct from erasure: the current account-closure workflow retains account and transaction records. You may separately request erasure at jointpoints@usgme.com. We assess the request, remove or anonymise information no longer lawfully needed, and explain any permitted retention and its reason. An account labelled “deleted” is not necessarily physically erased.

13 Your privacy rights

Depending on the law applicable to your data, you may have rights to be informed; obtain access and a copy; correct inaccurate or incomplete information; request erasure; withdraw consent; object to or restrict processing; receive data in an applicable portable format; and challenge certain automated decisions or request human intervention. We do not limit a mandatory right merely because it is not expressly listed here.

Send requests to jointpoints@usgme.com. We verify identity proportionately and ask only for information reasonably needed. We respond within the applicable statutory deadline; our general service target is 30 days, but a shorter legal period takes priority. Any extension, refusal, fee or restriction must be permitted by law and explained as required.

Where correction affects your country or storefront, operational restrictions do not override a legal right to correct inaccurate personal information. We assess correction requests securely and explain any separate consequences for the Program account or transactions.

You may complain to the competent authority without first completing our internal appeal procedure. Relevant bodies include SDAIA in Saudi Arabia, the competent UAE authority, Qatar’s National Cyber Security Agency, Bahrain’s Personal Data Protection Authority, Oman’s Ministry of Transport, Communications and Information Technology and CITRA in Kuwait where its jurisdiction applies. The applicable authority and complaint route depend on the law and processing involved; contact us for assistance.

14 Changes and access to this policy

We identify each issued policy by version and effective date. We provide notice of material changes through an appropriate channel before they take effect, and obtain new consent where required before applying the relevant processing. Continuing to use the App is not treated as consent where an explicit choice is required.

The approved policy will be accessible before registration and through the App and https://jp.usgme.club/privacy-policy. We provide clear language appropriate to our users. The Arabic and English versions must be consistent; translation or interpretation provisions do not reduce mandatory local rights.

15 Contact details

Controller: USG Middle East
Saudi commercial registration number: 2050014850
Registered office: Dammam 2nd Industrial City, Kingdom of Saudi Arabia
Privacy requests, complaints and Program appeals: jointpoints@usgme.com

PO BOX 34326-4201 Kingdom of Saudi Arabia.