Privacy Policy

01

Introduction

This Privacy Policy (the "Policy") describes how Miray PIF Technologies L.L.C dba Verati ("Verati", "we", "us", or "our") collects, uses, discloses, retains, and protects personal information in connection with Verati's concierge aggregator system and related services (the "System").

The System allows users to discover, request, book or purchase curated products, services, experiences, inventory and offers from approved third-party suppliers (the "Supplier Services").

This Policy explains:

What personal information we collect;
How and why we use it;
When we may disclose it;
How we safeguard it;
How long we retain it; and
Your rights and choices under UAE privacy law.

By accessing the System, using our services, or submitting personal information to us, you acknowledge and agree to the practices described in this Policy.

02

Scope

This Policy applies to personal information processed by Verati in connection with:

accessing, browsing or using the System or customer-facing interface;
creating or using an account, profile or customer journey made available through the System;
viewing, enquiring about, requesting, booking, purchasing, cancelling or receiving Supplier Services;
payments, refunds, returns, chargebacks, disputes, customer support and service communications;
fraud prevention, platform security, risk management, compliance, sanctions screening and misuse prevention;
communications with Verati, suppliers, customer support or related service providers; and
websites, apps, digital interfaces, cookies, analytics and technical infrastructure used to deliver the System.

This Policy does not apply to anonymised or aggregated information that cannot reasonably identify an individual. Payment processors, suppliers and other third parties may provide their own privacy notices where they process personal information for their own purposes.

03

Information we collect

Account, profile and contact information

name, email address, phone number, address and preferred contact details;
account identifiers, profile preferences, saved preferences and communication settings;
authentication details, security settings and account activity information.

Concierge, booking and service information

service enquiries, booking requests, order details, itinerary or reservation information;
preferences for travel, hospitality, mobility, dining, events, retail, concierge or lifestyle services;
special requests, delivery details, guest details or information needed to fulfil a booking or service request;
customer support communications, complaints, cancellations, refunds, returns and dispute records.

Payment and transaction information

payment status, transaction references, booking values, refund, reversal and chargeback records;
limited payment-related information shared by payment service providers where necessary to confirm, process, reconcile or support transactions;
fraud, payment risk, transaction monitoring or dispute information relevant to the use of the System.

Verati does not need to store full payment card numbers where payment collection is handled by authorised payment service providers. Payment information may be processed by those providers under their own applicable terms and privacy notices.

Identity, compliance and risk information

information required to verify identity, eligibility or account security where needed;
sanctions, fraud-prevention, suspicious activity, adverse media or risk indicators where required for compliance, security or payment integrity;
documents or information required to complete a regulated, high-value, restricted or sensitive transaction.

Technical, device and usage information

IP address, approximate location, device identifiers, browser type, operating system and app or platform version;
login records, session logs, clickstream data, pages viewed, features used and interaction history;
cookies, similar technologies, analytics events, fraud signals and security logs.

04

How we collect information

We may collect personal information directly from users when they access the System, make a request, complete a booking, contact support, update preferences or communicate with us. We may also receive information from suppliers, payment service providers, fraud prevention providers, identity verification providers, customer support providers, analytics providers, public sources and other authorised third parties.

Where a user provides information about another person, such as a guest, passenger, recipient or companion, the user must ensure that they have authority to provide that information and, where required, have informed that person that their information may be processed in accordance with this Policy.

05

Why we use personal information

We use personal information for the following purposes:

To provide the System: including account access, browsing, curated listings, service requests, bookings, confirmations, customer support and communications.
To fulfil services: including sharing necessary booking and fulfilment information with suppliers and operational service providers.
To process payments and refunds: including coordinating with payment service providers for payment collection, confirmations, refund, reversal, chargeback and dispute support.
To personalise and improve the experience: including preferences, saved information, recommendations, quality assurance, analytics and service improvement.
To communicate with users: including service updates, booking information, customer support, security notices, legal notices and, where permitted, marketing communications.
To keep the system secure: including fraud prevention, suspicious activity monitoring, access controls, cybersecurity, abuse prevention and platform integrity.
To comply with legal and regulatory requirements: including privacy, consumer protection, payment, tax, accounting, sanctions, AML/CFT, law enforcement, court, regulator, audit and legal claims requirements.
To enforce rights and manage risk: including handling complaints, disputes, refunds, chargebacks, misuse, breach of terms, investigation and protection of Verati, suppliers and users.

06

Legal basis for processing

Depending on where a user is located and which laws apply, Verati may rely on one or more legal bases for processing personal information, including:

Contractual necessity: to provide the System, process requests, administer bookings and deliver services requested by users.
Consent: where required for optional marketing, certain cookies, optional features or other processing activities that require consent.
Legal obligations: to comply with applicable privacy, payment, tax, accounting, sanctions, AML/CFT, consumer, regulator, court and law enforcement requirements.
Legitimate interests: to operate and improve the system, prevent fraud, maintain security, support customer service, analyse usage, manage risk, enforce terms and protect rights.
Vital or public interest grounds: where necessary and legally permitted for safety, emergency, fraud prevention, security or legal purposes.

07

Sharing personal information

Verati does not sell personal information. We may share personal information where necessary for the purposes described in this Policy, including with:

Suppliers: to enable suppliers to quote, confirm, fulfil, deliver, modify, cancel or support Supplier Services requested by users.
Payment providers and financial partners: including payment processors, acquiring banks, card networks, settlement providers and transaction monitoring providers.
Identity verification, compliance and fraud-prevention providers: where required for account security, identity checks, sanctions screening, risk management or suspicious activity prevention.
Technology and infrastructure providers: including hosting, cloud, security, analytics, communications, customer support, API, integration and operational providers.
Professional advisers and insurers: including legal advisers, auditors, accountants, consultants and insurers.
Authorities and regulators: where required or permitted by law, legal process, court order, regulator request, law enforcement request, fraud investigation or legal claim.
Group companies and business successors: where necessary for administration, business continuity, restructuring, merger, acquisition, transfer, financing, asset sale or similar corporate transaction.

We aim to share only the information reasonably necessary for the relevant purpose and to apply appropriate safeguards, contractual controls and access restrictions where required by applicable law.

08

Payments

Payments for Supplier Services may be processed by authorised third-party payment service providers. Those providers may collect and process personal information for payment gateway, payment collection, transaction monitoring, refund, chargeback, fraud prevention, compliance, customer support and regulatory purposes.

A payment service provider may process payment and compliance information under its own privacy policy and legal obligations. Users should review the applicable payment service provider privacy policy and terms where payment services are provided by a third party.

Verati may receive transaction status, payment confirmation, refund, chargeback, dispute, risk and settlement information from payment service providers where necessary to operate the System, provide customer support, manage suppliers, prevent fraud or comply with legal and regulatory obligations.

09

Suppliers and fulfilment partners

Verati works with approved third-party suppliers who provide the underlying products, services, experiences, bookings, inventory or offers made available through the System. To fulfil a user request, Verati may share relevant personal information with the supplier, such as name, contact details, booking details, preferences, delivery or attendance information, guest details and any information reasonably needed to complete or support the service.

Suppliers are expected to use personal information only for authorised fulfilment, customer support, complaint, refund, cancellation, dispute and legal purposes. Suppliers may also have their own privacy notices where they act independently under applicable law.

10

International transfers and processing

Verati is based in the United Arab Emirates and works with suppliers, payment service providers and other service providers in multiple jurisdictions. Personal information may therefore be accessed, processed, disclosed or transferred outside the country where the user is located, including to the UAE, Canada, the United Kingdom, the United States, the European Economic Area and other jurisdictions where Verati, suppliers or service providers operate.

Where required by law, Verati uses appropriate safeguards for cross-border transfers and international processing, which may include contractual data protection terms, transfer assessments, vendor due diligence, data minimisation, encryption, access controls, security monitoring and other technical and organisational measures.

11

Security measures

Verati maintains administrative, technical and organisational safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, misuse and other unlawful processing. These safeguards may include:

role-based access controls and least-privilege permissions;
encryption in transit and, where appropriate, at rest;
secure system architecture, logging, monitoring and vulnerability management;
multi-factor authentication for administrative access;
vendor due diligence and contractual confidentiality and data protection obligations;
incident response, breach management and escalation procedures;
employee confidentiality obligations and access policies.

No platform can guarantee absolute security. Users should keep login credentials secure, use strong passwords, enable available security controls and notify Verati promptly of suspected unauthorised access or misuse.

12

Data retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by law, regulation, contractual requirement, payment network rule, AML/CFT requirement, tax or accounting requirement, audit, dispute, investigation or legal claim.

Retention periods vary depending on the type of information. Account, booking, transaction, refund, chargeback, dispute, support, fraud prevention, compliance and payment-related records may be retained for longer where necessary to protect users, Verati, suppliers and payment partners or to comply with applicable legal and regulatory obligations.

When information is no longer required, Verati will delete, anonymise or securely dispose of it in accordance with applicable retention schedules and security procedures, unless continued retention is necessary for legal, regulatory, audit, dispute or legitimate business purposes.

13

Cookies and similar technologies

Verati may use cookies, pixels, local storage, device identifiers, session tokens and similar technologies to operate the System, enable secure login, manage sessions, remember preferences, improve performance, conduct analytics, detect fraud, support security monitoring and maintain platform integrity.

Users may manage cookies through browser or device settings. Disabling essential, security or authentication cookies may prevent the System, customer interface or related functionality from operating correctly.

14

Marketing and communications

Verati may send operational, service, legal, security and support communications where necessary to provide the System or manage a user request, booking, payment, refund, complaint, dispute or account issue.

Where permitted by law, Verati may send marketing communications about services, experiences, offers or updates. Users may opt out of marketing communications at any time using the unsubscribe link or contact details provided. Opting out of marketing will not stop service, security, legal or transactional communications.

15

Your privacy rights

Depending on the user's location and the applicable law, users may have rights to request access to personal information, correction of inaccurate information, deletion or erasure, restriction of processing, objection to processing, portability, withdrawal of consent, information about processing and the right to complain to a regulator.

These rights are not absolute. Verati may refuse, limit or delay a request where permitted or required by law, including where necessary for legal obligations, AML/CFT, sanctions, fraud prevention, security, payment processing, dispute handling, tax, accounting, audit, regulatory reporting, legal privilege, confidential commercial information or the rights and freedoms of others.

To exercise rights, users may contact Verati using the details in the Contact information section. Verati may require identity verification before responding to protect personal information and system integrity.

16

Regional privacy rights

Depending on the user's jurisdiction of residence, location, citizenship, applicable law or the circumstances in which personal information is processed, users may have certain rights in relation to their personal information.

Subject to applicable law, such rights may include the right to:

request access to personal information;
request correction or rectification of inaccurate personal information;
request deletion, erasure or anonymisation of personal information;
restrict or object to certain processing activities;
withdraw consent where processing is based on consent;
request portability of personal information;
request information regarding how personal information is processed;
object to direct marketing communications; and
lodge a complaint with a competent supervisory authority, regulator or data protection authority.

The availability and scope of such rights may vary depending on the jurisdiction in which the user resides and the applicable legal requirements. Verati may refuse, restrict or defer a request where permitted or required by applicable law, including where necessary to comply with legal, regulatory, fraud prevention, security, payment processing, AML/CFT, sanctions, tax, accounting, audit, dispute resolution or record-retention obligations.

To exercise any applicable privacy rights, users may contact Verati using the contact details set out in this Privacy Policy. Verati may require reasonable verification of identity before responding to any request.

17

Children's privacy

The System is intended for adults and is not directed to individuals under the age of 18. Verati does not knowingly collect personal information from minors. If Verati becomes aware that personal information has been collected from a minor without appropriate authority, Verati will take reasonable steps to delete or restrict the information unless retention is required for fraud prevention, safety, legal or regulatory purposes.

18

Third-party links and services

The System may contain links to third-party websites, apps, platforms, services or supplier pages. Verati is not responsible for the privacy practices of third parties that are not acting on Verati's behalf. Users should review the privacy notices of suppliers, payment service providers and other third parties where they interact with those services directly.

19

Changes to this Policy

Verati may update this Policy from time to time to reflect changes in the System, supplier services, payment arrangements, legal or regulatory requirements, operational practices or security needs. When changes are made, Verati will update the Last Updated date and may provide additional notice where required by law or where changes are material.

Continued use of the System after an updated Policy becomes effective may constitute acceptance of the updated Policy, where permitted by applicable law.

20

Contact information

If you have questions, concerns, or requests relating to this Policy or the handling of your personal information, you may contact us using any of the methods below. We will respond in accordance with applicable privacy and financial regulatory requirements.

Verati (Miray PIF Technologies L.L.C)
A601, Opus by Omniyat, Business Bay, Dubai, United Arab Emirates
Email: support@verati.com

You may also contact us to exercise your privacy rights, request additional information about our data-handling practices, or file a complaint regarding how your personal information has been managed. The terms on which suppliers provide services through the System are set out in our Supplier Services and Distribution Agreement.