Privacy Policy

Version Effective Date: 28.01.2026

This Platform Privacy Policy (the “Policy” or “Privacy Policy”) explains how Merit, including its direct or indirect subsidiaries, Affiliates, and related entities worldwide (collectively, “Merit”, “we”, “us”, or “our”) , collects, uses, discloses, retains, and otherwise processes Personal Data in connection with your access (regardless of where such access to the Platform is from) to and use of the Merit Super Platform and the products offered therein (collectively the “Platform”). This Policy should be read together with the Data Processing Agreement (“DPA”), which contractually governs Merit’s processing of Personal Data carried out on behalf of you acting as a Data Controller.

The Platform is a unified, modular, software-as-a-service (SaaS) environment that enables you to configure, operate, and manage loyalty, rewards, engagement, and related programs and products through a single integrated interface. The Platform is designed as an interconnected system in which tools, modules, services, and functionalities operate together and may share data as necessary to deliver the Platform’s features and the products offered via the Platform.

This Policy is provided for transparency and informational purposes only.

Data might include, but not limited, to Personal Data processed:

• at the Platform infrastructure level (such as account creation and administration, user authentication, access control, role and permission management, platform security, audit logging, KYB verification, subscription administration, credit card payment details and billing); and

• within any products, tools, services, modules, or functionalities made available through, embedded in, or operated as part of the Platform.

This Policy is intended to provide transparent, high-level information regarding:

• the categories of Personal Data processed;

• the purposes and legal bases for such processing;

• the safeguards implemented to protect Personal Data; and

• the rights available to Data Subjects under applicable law.

This Policy is drafted in accordance with applicable data protection and privacy laws, including the Saudi Personal Data Protection Law (PDPL) and, where applicable, the EU General Data Protection Regulation (GDPR), and reflects Merit’s commitment to processing Personal Data in a lawful, fair, transparent, secure, and accountable manner.

“MERIT / WE / US / OUR” - Mylist Saudi Arabia For Trading Services LLC, including its direct or indirect subsidiaries, Affiliates, and related entities worldwide, responsible for operating the Platform and processing Personal Data as described in this Privacy Policy.

“PLATFORM / MERIT SUPER PLATFORM” - The unified, modular, software-as-a-service (SaaS) environment operated by Merit, enabling you to access, manage, and use loyalty, rewards, engagement, and other programs and Services.

“POLICY / PRIVACY POLICY” - This document (Platform Privacy Policy) that governs the collection, use, disclosure, retention, and processing of Personal Data through the Platform and the Products made available therein.

“PERSONAL DATA” - Any information relating to an identified or identifiable natural person, including end-users, employees, administrators, or your representatives, as processed through the Platform or the Products made available therein.

“DATA CONTROLLER” - The entity that determines the purposes and means of processing Personal Data. In this context, Merit or you may act as the Data Controller depending on the service or Product.

“DATA PROCESSOR” - The entity that processes Personal Data on behalf of a Data Controller, strictly following the Controller’s documented instructions. Merit acts as a Data Processor when processing Personal Data for you.

“JOINT CONTROLLERS” - When Merit and you jointly determine the purposes and means of processing Personal Data, both Merit and you are considered Joint Controllers with responsibilities allocated according to applicable law.

“DATA SUBJECT” - Any identified or identifiable natural person whose Personal Data is processed through the Platform, including end-users, employees, or loyalty program participants.

“PDPL” - Saudi Personal Data Protection Law, governing the collection, use, and processing of Personal Data in the Kingdom of Saudi Arabia.

“GDPR” - General Data Protection Regulation, EU regulation governing the processing of Personal Data of EU/EEA residents.

“KYB / KNOW YOUR BUSINESS” - Regulatory and compliance procedures to verify business identity and conduct, used for Account verification and risk management.

“B2B / B2B2C”

• B2B: Business-to-business transactions.

• B2B2C: Business-to-business-to-consumer transactions, where Personal Data of end-users may also be processed.

“DPA” - Data Processing Agreement, a contractual agreement governing the processing of Personal Data between Merit and you.

“SENSITIVE DATA / SENSITIVE PERSONAL DATA” - Special category Personal Data, including Data Subject to enhanced legal or regulatory safeguards, processed only when strictly necessary and compliant with applicable laws.

“STANDARD CONTRACTUAL CLAUSES / SCCs” - Legal mechanisms approved by the European Commission for lawful international transfers of Personal Data under GDPR.

“DPO” - Data Protection Officer, the contact point for privacy inquiries or rights requests related to the Platform or Policy (email: dpo@meritincentives.com ).

1. Data Controller- Platform And Service Access

   For the purposes of applicable data protection laws, including the Saudi Personal Data Protection Law (PDPL) and, where applicable, the EU General Data Protection Regulation (GDPR), Mylist Saudi Arabia For Trading Services LLC acts as the Data Controller in respect of Personal Data processed in connection with:

   • registration for, access to, and use of the Platform;

   • creation, administration, and management of business accounts;

   • user authentication, authorization, and access control;

   • role, permission, and entitlement management;

   • Know Your Business (KYB) verification and compliance screening;

   • platform security, monitoring, logging, and audit functions; and

   • subscription management, payments, billing, and commercial administration.

   Controller details:

   Mylist Saudi Arabia For Trading Services LLC A company duly incorporated under the laws of the Kingdom of Saudi Arabia Registered Address: Saud Ibn Abdullah Ibn Jalawi Road, Al Qairawan, Building 2359, First Floor, Office Number 7, Riyadh, Kingdom of Saudi Arabia

   Contact:

   dpo@meritincentives.com

Merit processes only those categories of Personal Data that are necessary, relevant, and proportionate to operate, secure, deliver, and administer the Platform and the services, products, tools, and functionalities made available through it, in accordance with this Privacy Policy, the DPA and applicable data protection laws.

The Platform is a business-to-business (B2B) platform that may support business-to-business-to-consumer (B2B2C) use cases. Accordingly, Merit processes Personal Data relating to:

• Your authorised users and representatives; and

• where applicable, end users or loyalty program participants, whose Personal Data is provided to or generated within the Platform by you in connection with your use of the Platform.

The categories of Personal Data that may be processed include, but are not strictly limited to, the following:

1. Account, Identity, and Business Contact Data

   Personal Data processed in connection with the registration for, access to, and administration of Platform accounts and user access, including:

   • legal business name, commercial registration details, and other registered entity information;

   • corporate documentation and information submitted for Know Your Business (KYB), sanctions screening, or compliance verification;

   • names, job titles, and business contact details of administrators and other authorised users or representatives;

   • business email addresses, telephone numbers, and associated professional contact identifiers;

   • assigned user roles, permissions, access scopes, and entitlements; and

   • login credentials, authentication factors, and authentication-related metadata (such as login timestamps, access status, and session identifiers).

   Information relating solely to legal entities does not constitute Personal Data. However, where such information relates to an identified or identifiable natural person (such as a director, signatory, authorised user, end user or company representative), it constitutes Personal Data and is processed in accordance with this Privacy Policy and the DPA.

2. Your Data and End-User Data (B2B2C Use Cases)

   Depending on the services, products, or modules subscribed to by you, the Platform may process Personal Data uploaded to, generated through, or otherwise made available via the Platform by you, which may include Personal Data relating to:

Merit processes Personal Data both at the Platform level and within individual products offered through the Platform. This processing is carried out in accordance with applicable laws, including the Saudi Personal Data Protection Law (PDPL) and, where applicable, the EU General Data Protection Regulation (GDPR).

• Platform-level processing: Merit acts as the Data Controller for Personal Data collected and processed to operate, secure, and administer the Platform itself, including account administration, authentication, role management, KYB verification, subscription management, and Platform security.

• Product-level processing: Depending on the product or service, Merit may act as a Data Controller, joint controller, or Data Processor in respect of Personal Data processed within the product. Where Merit acts as a processor, it processes Personal Data solely on the documented instructions received from you, and you remain the controller of that data.

The table below summarises the main purposes of processing and the corresponding legal bases under PDPL and, where applicable, GDPR:

Where processing requires explicit consent (e.g., optional notifications, marketing communications, or other non-essential processing), Merit obtains freely given, specific, informed, and unambiguous consent from the relevant Data Subject.

Data Subjects may withdraw consent contacting Merit at dpo@meritincentives.com at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Merit is committed to limiting disclosures of Personal Data to the minimum necessary to fulfil the purposes described in this Policy, in accordance with the principles of data minimization and purpose limitation.

All disclosures of Personal Data, whether at the Platform level or within products, are conducted under strict safeguards:

• International Transfers: Any transfer of Personal Data outside the Kingdom of Saudi Arabia is conducted in compliance with the PDPL transfer requirements, including obtaining any necessary approvals. Where GDPR applies, transfers are safeguarded using Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms.

• Third-Party Processors and Affiliates: Personal Data processed by third-party processors, sub-processors, or Merit group companies is subject to the same security, retention, and access controls as data processed directly by Merit.

• No Sale of Data: Merit does not sell Personal Data to third parties under any circumstances.

Merit may disclose Personal Data under the following circumstances, strictly limited to the purposes outlined in this Policy or the DPA:

1. Merit Group Companies / Affiliates

   • Personal Data may be shared with Merit affiliates or group companies when operationally necessary to provide, maintain, or support the Platform and its products/services.
   • Access is restricted to authorized personnel on a need-to-know basis, and all recipients are bound by confidentiality and security obligations.
   • All Merit affiliates and group companies that access Personal Data are contractually bound to comply with the terms of the DPA, including confidentiality, security, and lawful processing obligations

2. Authorized Service Providers / Processors

   • Merit may engage third-party service providers to perform Platform- or product-related functions, including hosting, cloud infrastructure, identity verification, security monitoring, billing, customer support, or other operational services.

   • All processors and sub-processors are bound by written data processing agreements (DPAs) that require them to:

     1. Process Personal Data only on documented instructions from Merit;

     2. Maintain confidentiality and implement appropriate technical and organizational security measures;

     3. Comply with all applicable data protection laws, including PDPL and GDPR where relevant;

     4. Ensure any sub-processors are similarly contractually bound.

3. Regulatory Authorities, Courts, and Law Enforcement

Merit may transfer Personal Data outside the Kingdom of Saudi Arabia (KSA) only when necessary to operate, provide, maintain, or support the Platform and the products/services offered through it, including for hosting, cloud services, technical support, identity verification, or other operational purposes. All such transfers are conducted in strict compliance with Saudi PDPL, its Implementing Regulations, and, where applicable, the GDPR.

1. Transfers under Saudi PDPL

   Transfers of Personal Data outside the KSA are conducted only where:

   • Permitted under the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations;

   • Appropriate safeguards, approvals, and protections are in place to ensure that Data is processed lawfully, securely, and only for the intended purpose;

   • Merit may require contractual assurances, data transfer agreements, or approvals from relevant Saudi authorities to satisfy legal requirements.

   These rules apply to both Platform-level administrative data and Product-level end-user data processed on behalf of you or for B2B2C services.

2. Transfers under GDPR (where applicable)

   For Personal Data of EU/EEA Data Subjects processed by the Platform or within products:

   • Transfers to countries outside the EU/EEA are safeguarded through one or more of the following lawful mechanisms:

     1. Adequacy decisions issued by the European Commission;

     2. Standard Contractual Clauses (SCCs) approved by the European Commission;

     3. Other lawful transfer mechanisms recognized under GDPR, such as binding corporate rules or explicit consent where strictly necessary.

Merit retains Personal Data processed through the Platform and the products made available via the Platform only for as long as necessary to:

• Fulfil the purposes described in this Privacy Policy;

• Provide and support the services and products subscribed to;

• Comply with applicable legal, regulatory, or contractual obligations;

• Enforce or defend legal or contractual rights.

Retention practices are designed to comply with Saudi PDPL, its Implementing Regulations, and, where applicable, the GDPR, while minimizing storage of Personal Data and safeguarding its security and confidentiality.

1. Retention Periods by Data Category

   Data Category	Retention Period	Justification
   Account and Identity Data (e.g., business contact info, administrator names, login credentials)	Duration of your contractual relationship with Merit + 2 years	To allow for administrative closure, dispute resolution, and regulatory recordkeeping.
   your-Provided / End-User Data (e.g., loyalty program participants, reward recipients, employee data, or other participants within products)	Duration necessary to provide the contracted Product/service, unless otherwise required by law	Ensures the delivery of services, proper functioning of products, and compliance with contractual obligations. Merit processes this data on behalf of you in accordance with your documented instructions.
   Operational, Security, and Audit Data (e.g., login logs, system events, configuration changes)

The Platform may include artificial intelligence (AI)–enabled or automated features designed to assist you in identifying, configuring, or selecting products, services, or functionalities based on Platform usage, interactions, and other relevant data. These features analyse inputs, behavioural patterns, and historical data to generate recommendations, insights, or alerts intended solely to support your decision-making.

1. Principles of AI Processing

   Human Oversight: AI-enabled processing is designed to supplement, not replace, human decision-making. Automated outputs are informational only and do not produce legal, regulatory, or similarly significant effects without explicit human review.

   Inputs used for AI processing are limited to Personal Data strictly necessary to generate relevant insights and comply with applicable laws. AI processing is conducted under appropriate technical and organisational measures, including:

   • Ensuring accuracy, reliability, and auditability of outputs;
   • Preventing unauthorized access, modification, or misuse of data;
   • Implementing appropriate security controls for processing Personal Data in accordance with PDPL and GDPR.

   Where AI processing involves Personal Data, Merit ensures that such processing is lawful, fair, and transparent, in accordance with PDPL, GDPR (where applicable), and this Privacy Policy.

The Platform may display advertising, promotional content, product recommendations or sponsored content, including in relation to Merit’s own products and services or those of third parties (collectively, “Promotional Content”).

Promotional Content may be displayed based on contextual factors such as Platform functionality, product categories, usage patterns, or general Platform interactions. Promotional Content is displayed for purposes of operating, improving and commercialising the Platform, including informing business users about relevant products, services or offerings available through the Platform.

Where applicable, the display or prioritisation of Promotional Content may involve the processing of Personal Data, as further described in this Privacy Policy.

Merit does not sell Personal Data to third parties. Any processing of Personal Data in connection with Promotional Content is carried out in accordance with applicable data protection laws, including the Saudi Personal Data Protection Law (PDPL) and, where applicable, the GDPR, and is limited to what is necessary for the purposes described in this Privacy Policy.

Where required by applicable law, Merit will provide appropriate transparency, controls, or choices in relation to the display of Promotional Content, including mechanisms to object to or limit certain forms of processing.

Promotional Content is presented for informational or commercial purposes only and does not constitute an endorsement, guarantee, or representation by Merit of any third-party products or services. Promotional Content and any related recommendations do not produce legal effects or similarly significant impacts and are not used to make binding or automated decisions.

Merit implements comprehensive technical, organizational, and administrative measures designed to protect all Personal Data processed through the Platform and the products made available via the Platform, including data relating to both client organisations or Platform customers and end users. These measures ensure the confidentiality, integrity, availability, and resilience of Personal Data and are designed to protect against unauthorized access, disclosure, alteration, loss, or destruction.

1. Security Measures

   Merit’s security program includes, but is not limited to, the following:

   1. Access Control:

      • Role-based access and least-privilege principles for Platform administrators and product users; where applicable;
      • Strong authentication mechanisms, including multi-factor authentication for privileged accounts where supported.

   2. Data Protection:

      • Encryption of Personal Data at rest and in transit, where appropriate;
      • Secure storage and processing practices for sensitive or regulatory-required data;
      • Anonymisation or aggregation of end-user data where supported by the relevant product and use case, particularly in B2B2C operations.

   3. Monitoring and Logging:

      • Monitoring of systems and networks to detect anomalous or unauthorized activity;
      • Generation and review of audit logs, system events, and security alerts;
      • Logging of administrative and configuration changes to support accountability and compliance purposes.

Merit respects the rights of Data Subjects under applicable data protection laws, including the Saudi Personal Data Protection Law (PDPL) and, where relevant, the EU General Data Protection Regulation (GDPR). These rights allow Data Subjects to exercise control over their Personal Data processed at the Platform and the products and services offered via the Platform.

1. Rights under Saudi PDPL. Subject to applicable limitations under the PDPL, Data Subjects may have the right to:

   • Be informed about the collection and processing of their Personal Data;
   • Access their Personal Data;
   • Request correction, amendment, or updating of inaccurate or incomplete Personal Data;
   • Request destruction of Personal Data, where legally permissible;
   • Object to processing where the processing is not legally required.

2. Rights under GDPR (where applicable). Where GDPR applies, Data Subjects may also have the right to:

   • Access, rectification, and erasure of their Personal Data;
   • Restriction or objection to the processing of Personal Data;
   • Data portability for Personal Data provided to Merit;
   • Withdraw consent at any time where processing is based on consent;
   • Lodge a complaint with a competent supervisory authority.

3. Exercising Rights

   • Requests to exercise any of the above rights may be submitted to dpo@meritincentives.com .
   • Merit will verify the identity of the requester to protect Personal Data and prevent unauthorized disclosures.

The Platform and the products made available through it may use cookies, web beacons, server logs, and other similar tracking technologies (collectively, “Cookies”) to operate, secure, and improve the Platform and its products. These technologies may automatically collect technical, usage, and analytics data about your device, location, browsing behavior, interactions, and patterns. Merit may also combine this information with other Personal Data you provide or that is collected in the course of using the Platform or products.

1. Types of Cookies

   Merit uses the following categories of cookies:

   Strictly Necessary Cookies:

   • Essential for authentication, access control, and the security of the Platform and its products.
   • Enable core functionalities such as login sessions, user role management, subscription management, and product-specific operations.
   • These Cookies are necessary for the performance of the contract with you and do not require consent.

   Performance / Analytics Cookies:

   • Collect anonymized or pseudonymized information about how the Platform or products are used, including page views, navigation patterns, and technical performance.
   • Help Merit identify opportunities for improving system performance, usability, and reliability.
   • May require consent where mandated by applicable law; such consent is obtained through appropriate mechanisms where required.

   Functionality Cookies:

   • Retain user or administrator preferences, such as account identifiers, selected settings, or configuration choices, to enhance usability and efficiency across the Platform and products.

   Targeting / Advertising Cookies:

The Platform may integrate with or provide access to third-party services, applications, or tools (“Third-Party Services”) to enhance Platform functionality, support business operations, or enable features within the products offered through the Platform.

1. Responsibility and Compliance

   • Third-Party Services process Personal Data independently in accordance with their own privacy policies, terms of service, and applicable legal obligations.
   • Merit is not responsible for the privacy practices, security measures, or data processing activities of Third-Party Services.
   • Data Subjects are encouraged to review the privacy notices and terms of any Third-Party Service accessed through the Platform or its products.

2. Platform-Level Safeguards

   • Where Merit shares Platform-level Personal Data with Third-Party Services (e.g., cloud hosting, security monitoring, identity verification, billing, payments, analytics, or technical support), such processing is subject to contractual safeguards, DPAs, and security obligations in accordance with PDPL, GDPR (where applicable), and industry best practices.

   • Agreements with Third-Party Service providers require them to:

     1. Process Personal Data only on documented instructions from Merit;

     2. Maintain confidentiality and implement appropriate technical and organizational security measures

     3. Comply with all applicable data protection laws;

     4. Restrict access to authorized personnel on a need-to-know basis.

Merit may update this Platform Privacy Policy from time to time to reflect:

• Changes in applicable laws, regulations, or regulatory guidance;
• Updates or enhancements to the Platform, products, services, or business operations;
• Expansion into new jurisdictions or territories; or
• Other legitimate operational or compliance reasons.

1. Material Changes

   • Material changes to this Policy, including changes that may significantly affect the rights of Data Subjects or the processing of their Personal Data, will be clearly communicated to you and when applicable end users through the Platform or via other appropriate communication channels.

   • Merit may provide a notice period for material changes where required by law or good practice.

2. Review and Version Control

   • The Policy will include a Version Effective Date to ensure transparency and clarity.

   • Data Subjects are encouraged to periodically review the Policy and the DPA to remain informed of how their Personal Data is processed.

3. Non-Material Updates

   • Non-material updates, such as minor clarifications, formatting changes, or editorial corrections, may be implemented without prior notice but will be reflected in the updated Version Effective Date of the Policy on the Platform.

For privacy inquiries or rights requests related to this Policy:

Email:

dpo@meritincentives.com