Privacy Policy

9. International Data Transfers

Ring n Bring operates internationally. Your personal data may be transferred to, stored in, and processed in countries outside your country of residence, including the United Arab Emirates, the United Kingdom, the European Economic Area (EEA), and the United States.

Where we transfer personal data out of the United Arab Emirates, we do so in accordance with the UAE PDPL — only where the destination jurisdiction ensures an adequate level of protection, where appropriate safeguards (such as standard contractual clauses) are in place, or where you have given your explicit consent to the transfer after being informed of any associated risks.

Where we transfer personal data from the EEA, the UK, or Switzerland to a country that has not received an adequacy decision from the European Commission or the UK Information Commissioner, we put one or more of the following safeguards in place under Chapter V of the GDPR:

• Standard Contractual Clauses (SCCs) adopted by the European Commission, including, where applicable, the UK International Data Transfer Addendum and the Swiss adaptation;
• EU–US Data Privacy Framework certification of the relevant US recipient, where available;
• Binding Corporate Rules, where the recipient has them in place;
• Supplementary technical, contractual, and organisational measures (such as encryption in transit and at rest, and pseudonymisation) following a transfer impact assessment.

You may request a copy of the safeguards we rely on for a specific transfer by contacting privacy@ringnbring.com.

10. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.

For guest data that we process on behalf of a Venue as a Processor, retention is also governed by the Venue's own instructions and policies as the Controller.

Where we cannot delete data immediately (for example because it is held in encrypted backups), we will isolate it from active processing until deletion is possible.

11. Data Security

Ring n Bring is ISO/IEC 27001 certified, and our Information Security Management System (ISMS) is independently audited against this international standard. We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, damage, alteration, or disclosure, including:

• Encryption of personal data in transit using TLS 1.2 or higher;
• Encryption of personal data at rest using industry-standard algorithms;
• Role-based access control, least-privilege principles, and multi-factor authentication for staff access;
• Tokenisation of payment data via PCI-DSS compliant payment processors — we do not store full card numbers;
• Regular vulnerability scanning, penetration testing, and security patching;
• Logging, monitoring, and alerting on access to systems containing personal data;
• Background checks and confidentiality obligations for staff with access to personal data;
• Documented incident response and business continuity procedures, tested at least annually.

No method of transmission over the internet or method of electronic storage is completely secure. While we strive to use commercially acceptable means to protect personal data, we cannot guarantee absolute security.

12. Your Rights Under the GDPR and UK GDPR

If you are located in the EEA, the UK, or Switzerland, you have the following rights in relation to your personal data. Equivalent rights are available under the UAE PDPL — see Section 12.1.

• Right of access (Art. 15): Obtain confirmation of whether we process your personal data and, if we do, a copy of that data and information about how we use it.
• Right to rectification (Art. 16): Have inaccurate personal data corrected and incomplete data completed.
• Right to erasure / right to be forgotten (Art. 17): Have your personal data deleted, subject to legal exceptions such as our need to retain records for tax purposes.
• Right to restriction of processing (Art. 18): Ask us to limit how we process your personal data in certain circumstances.
• Right to data portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible.
• Right to object (Art. 21): Object to processing based on our legitimate interests, and at any time and without restriction object to direct marketing.
• Rights related to automated decision-making (Art. 22): Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects — see Section 14.
• Right to withdraw consent: Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.
• Right to lodge a complaint: With a data protection supervisory authority — see Section 13.

12.1 Your Rights Under the UAE PDPL

As a UAE-based company, we comply with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “UAE PDPL”) and apply its principles to our processing of UAE residents' personal data. Where the PDPL applies to you, you have rights that closely mirror those described above, including:

• Right to access and to obtain a copy of your personal data;
• Right to rectification of inaccurate or incomplete data;
• Right to erasure of your personal data, subject to legal exceptions;
• Right to restrict or object to processing in certain circumstances, including to stop processing that causes you serious harm;
• Right to data portability in a structured, machine-readable format;
• Right to withdraw consent at any time, without affecting processing carried out before withdrawal.

The UAE Data Office (and its successor federal authority responsible for data protection) supervises compliance with the PDPL. To exercise any PDPL right, email privacy@ringnbring.com. You also retain the right to lodge a complaint with the competent UAE authority.

13. How to Exercise Your Rights and Lodge a Complaint

To exercise any of your rights, email privacy@ringnbring.com. We may need to verify your identity before responding. We will respond within one month of receipt of your request. We may extend this period by up to two further months where necessary, taking into account the complexity and number of requests; in that case we will inform you within the first month.

There is no fee for exercising your rights. However, we may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive.

Guest data held by a Venue: If your request relates to personal data we process on behalf of a Venue as a Processor, please contact the Venue directly. We will assist the Venue in responding to your request.

13.1 Supervisory Authorities

You have the right to lodge a complaint with a data protection supervisory authority if you believe our processing of your personal data infringes the GDPR or other applicable data protection law. You may complain in the EU member state of your habitual residence, place of work, or place of the alleged infringement. Useful starting points include:

• EU — the European Data Protection Board lists national supervisory authorities at edpb.europa.eu.
• United Kingdom — the Information Commissioner’s Office (ICO) at ico.org.uk.
• United Arab Emirates — the UAE Data Office at dataoffice.gov.ae.

We would, however, appreciate the opportunity to address your concerns before you approach a supervisory authority.

14. Automated Decision-Making and Profiling

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you within the meaning of Article 22 of the GDPR.

We do use automated logic for operational purposes such as routing requests to the nearest available staff member, prioritising service queues, and surfacing analytics insights for Venues. These activities do not produce legal or similarly significant effects on you. If this changes, we will update this Policy and provide the information required by Articles 13 and 14 of the GDPR.

15. Children’s Data

Our services are not directed to children under the age of 16, and we do not knowingly collect personal data from children. Where a Venue’s offering is directed at families, the relevant adult guest is responsible for any orders or requests made on behalf of a minor in their care. If we become aware that we have collected personal data from a child under 16 without verified parental or guardian consent, we will delete that data promptly. Please contact privacy@ringnbring.com if you believe we may hold such data.

16. Data Breach Notification

If a personal data breach occurs, we will notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay.

Where we act as a Processor, we will notify the relevant Venue (Controller) without undue delay after becoming aware of a personal data breach affecting data we process on their behalf.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, our tracking technologies, or legal or regulatory requirements. The “Last Updated” date at the top of the Policy will always indicate when it was most recently revised. Where the changes are material, we will provide a more prominent notice (for example, by email to B2B account holders or by a banner on the website) before the changes take effect.

We encourage you to review this Policy periodically. Your continued use of our services after a revised Policy takes effect constitutes your acceptance of the revised Policy to the extent permitted by law.

18. Contact Us

If you have any questions about this Privacy Policy or our processing of your personal data, please contact us:

End of Privacy Policy.