Privacy Policy

• ·identification information (such as name and Emirates ID details, where applicable);
• ·contact information (such as email address and phone number);
• ·account and login information;
• ·payment-related information (excluding full card details, which are processed by the Payment Gateway); and
• ·transaction history and usage data.

• ·identification and employment-related information (such as name, company affiliation, and role);
• ·contact information;
• ·account and access credentials; and
• ·payment-related and transaction data linked to education payments.

• ·name and identification details (such as student ID or reference number);
• ·school or educational institution details;
• ·payment-related information linked to the Student; and
• ·other limited data necessary to facilitate payments.

• ·institution details, licensing information, and authorised representatives;
• ·contact and account information; and
• ·transaction and payment-related data.

• ·device information, IP address, and browser type;
• ·log data and usage activity; and
• ·interaction with the Platform.

Drby limits the collection of Personal Data to what is necessary for the provision of the Services and compliance with Applicable Law.

Personal Data is collected directly from Parents, Company representatives, and School users when they create an account, use the Platform, initiate or manage payments, or communicate with Drby.

Companies may provide Personal Data relating to Employees and associated Students for the purpose of facilitating payments through the Platform.

Schools and other Recipients may provide Personal Data relating to Students or payment details required to facilitate transactions.

Drby may receive limited transaction-related information from the Payment Gateway, excluding sensitive payment card details.

Certain technical and usage data is collected automatically through the use of the Platform, including device and log information.

Any party providing Personal Data to Drby represents that such data has been obtained lawfully and that all necessary consents or authorisations have been obtained in accordance with Applicable Law.

• ·create, authenticate, and manage user accounts;
• ·enable payment initiation and coordination through the Platform;
• ·generate and manage Payment Links;
• ·provide transaction tracking, reporting, and reconciliation; and
• ·display fee and billing information.

Personal Data is processed to facilitate payments between Parents, Companies, and Recipients through the Payment Gateway.

Personal Data is used to communicate with users, including sending notifications, updates, confirmations, and support responses.

Personal Data is processed to comply with Applicable Law, including regulatory, reporting, and compliance requirements.

Personal Data is used to detect, prevent, and investigate fraud, misuse, or unlawful activity, and to ensure the security of the Platform.

Personal Data may be used to analyse usage, improve functionality, and enhance the user experience.

Personal Data shall not be used for purposes incompatible with those set out in this Section. For the avoidance of doubt, Drby does not:

• ·Process or authorize any payments
• ·Capture, store, or transmit card data
• ·Hold, pool, control, or move funds
• ·Execute settlement or reconciliation
• ·Provide financial or lending services

Personal Data is processed where necessary for the performance of a contract, including providing access to the Platform, facilitating payments, and delivering the Services.

Personal Data is processed where required to comply with Applicable Law, including regulatory, reporting, and compliance obligations.

Personal Data may be processed where necessary for Drby's legitimate interests, including ensuring the security and integrity of the Platform, preventing fraud and misuse, and improving the Services.

Where required, Personal Data is processed based on the consent of the individual, including processing of certain categories of Personal Data and processing of Personal Data relating to Students.

Where processing is based on consent, such consent may be withdrawn at any time, subject to legal or contractual limitations.

Personal Data necessary for payment processing is shared with the Payment Gateway, which processes such data in accordance with its own terms and privacy policies.

Personal Data may be shared with Schools and other Recipients to facilitate payments, verify transactions, and support the provision of education-related goods or services.

Personal Data may be shared with Companies where payments are made on behalf of Employees, for purposes including payment management, reporting, and reconciliation.

Drby may share Personal Data with third-party service providers supporting the Platform, including cloud hosting providers, analytics providers, IT security and maintenance, and communication service providers.

Drby may disclose Personal Data to regulatory authorities, law enforcement agencies, or other third parties where required to comply with Applicable Law.

Personal Data may be transferred as part of a corporate transaction, including a merger, acquisition, or sale of assets, subject to appropriate safeguards.

Drby never sells or trades personal data.

Drby acts as a data controller where it determines the purposes and means of processing Personal Data, including operating the Platform, managing accounts, and ensuring security and compliance.

Drby may act as a data processor where it processes Personal Data on behalf of Schools or Companies, strictly under their instructions as Data Controllers for student and billing related data.

Drby, Schools, and Companies may act as independent or joint data controllers where each party determines the purposes and means of processing Personal Data for their respective activities.

• ·determining the lawful basis for their processing of Personal Data;
• ·obtaining all necessary consents or authorisations from Parents, Employees, or Students; and
• ·ensuring that Personal Data shared with Drby is accurate and lawfully obtained.

Drby may process Personal Data relating to Students solely for the purposes of providing the Services, including facilitating payments and related platform functionality. Schools remain the primary Data Controller for student information.

Personal Data relating to Students must be provided by a Parent, Guardian, or authorised party who has the legal authority to do so.

Drby limits the collection and processing of Student Personal Data to what is strictly necessary for the provision of the Services.

Student Personal Data is used only for purposes directly related to payment facilitation, service coordination, compliance, and platform operation.

Student Personal Data may be shared with Schools, Companies, and the Payment Gateway only to the extent necessary to provide the Services or comply with Applicable Law.

Personal Data may be transferred to, stored in, or processed in jurisdictions outside the United Arab Emirates where Drby or its service providers operate.

Where Personal Data is transferred outside the United Arab Emirates, Drby implements appropriate safeguards in accordance with Applicable Law to ensure that such data is protected.

By using the Platform, users acknowledge that Personal Data may be transferred outside the United Arab Emirates in accordance with this Privacy Policy.

Drby retains Personal Data only for as long as necessary to fulfil the purposes set out in this Privacy Policy, including providing the Services, complying with Applicable Law, and supporting disputes, audit requirements, and operational logs.

Personal Data may be retained for longer periods where required to comply with legal, regulatory, or reporting obligations.

Upon termination or closure of an account, Personal Data may be retained for a reasonable period for compliance, record-keeping, and dispute resolution purposes.

Where Personal Data is no longer required, Drby will take reasonable steps to delete or anonymise such data in accordance with Applicable Law.

Drby implements appropriate technical and organisational measures to protect Personal Data against unauthorised access, loss, misuse, alteration, or disclosure.

Access to Personal Data is restricted to authorised personnel and service providers on a need-to-know basis and subject to appropriate access controls.

Drby applies reasonable security practices, including encryption, access controls, authentication mechanisms, monitoring, and periodic testing, to safeguard Personal Data.

While Drby takes reasonable measures to protect Personal Data, no system can be guaranteed to be completely secure.

Subject to Applicable Law, individuals have the right to:

• ·request access to their Personal Data;
• ·request correction of inaccurate or incomplete Personal Data;
• ·request deletion of Personal Data;
• ·request restriction of processing;
• ·object to certain processing activities; and
• ·request transfer of Personal Data, where applicable.

Requests to exercise data subject rights may be submitted to Drby through the contact details provided in this Privacy Policy.

Drby may require verification of identity before processing any request relating to Personal Data.

Individuals have the right to lodge a complaint with the relevant data protection authority in the United Arab Emirates.

Drby maintains procedures to identify, assess, and respond to incidents involving Personal Data.

Where required under Applicable Law, Drby will notify affected individuals of a Personal Data breach that is likely to result in a risk to their rights or interests.

Drby may notify relevant regulatory authorities of a Personal Data breach where required under Applicable Law.

Drby may update this Privacy Policy from time to time to reflect changes in the Services, legal requirements, or data processing practices.

Where required, Drby will notify users of any material changes through the Platform or other communication channels. It is the user's responsibility to frequently review the Privacy Policy.

Continued use of the Platform after the effective date of any updates constitutes acceptance of the revised Privacy Policy.

For any questions, requests, or concerns regarding this Privacy Policy or the processing of Personal Data, you may contact Drby at hello@drby.com.

Requests relating to access, correction, deletion, or other data subject rights may be submitted through the contact channels made available by Drby.

If you believe that your Personal Data has been processed in violation of Applicable Law, you have the right to lodge a complaint with the relevant data protection authority in the United Arab Emirates.