This Privacy Policy explains how ORA collects, uses, stores, discloses, and otherwise processes your personal information when you access or use the ORA website at or-a.ae, the ORA mobile application, merchant onboarding services, customer support, marketing communications, digital voucher purchases, bookings, payment processing, and all related services (collectively, the “Platform”).

ORA reserves the right to transfer operation of the Platform to a newly incorporated legal entity. Upon such transfer, this Privacy Policy shall continue to apply with updated operator details published on the Platform.

This Privacy Policy applies to all individuals who interact with ORA, including visitors, registered users, customers, merchants, merchant employees, business partners, applicants, and service providers — regardless of whether access is through desktop browsers, mobile browsers, the ORA mobile application, social media integrations, APIs, or customer support channels.

ORA is committed to complying with applicable privacy and data protection legislation including UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), applicable UAE implementing regulations, consumer protection legislation, and electronic transactions legislation. Where ORA operates in additional jurisdictions, supplementary privacy notices may apply.

• Account — your registered ORA account.
• Merchant — an independent business offering products or services through ORA.
• Personal Data — any information relating to an identified or identifiable natural person.
• Processing — any operation performed on Personal Data including collection, storage, use, disclosure, transfer, or deletion.
• Platform — the ORA website, applications, software, APIs, databases, and related services.
• User — any person accessing or using the Platform.

• Full name, date of birth, nationality, Emirates ID or passport (where required), profile photograph, government-issued identification.

• Email address, telephone number, billing address, correspondence address, country of residence.

• Username, encrypted password, login history, account preferences, saved favourites, profile settings.

• Purchases, voucher history, redemption history, booking history, invoices, payment status, refunds, and cancellations.

Where you register as a Merchant, ORA may collect: company name, trade licence, VAT registration number, registered office, authorised representative details, banking information, pricing, offers, photographs, business descriptions, and operating hours.

When you use the Platform, certain technical information is collected automatically including:

• IP address, browser type, operating system, device identifier, and mobile device model.
• Pages viewed, searches performed, categories browsed, clicks, time spent, and session duration.
• Approximate or precise location data (with your permission) to recommend nearby businesses and personalise offers. Location services may be disabled through your device settings.
• Crash reports and performance diagnostics.

We may receive information from trusted third parties including payment providers, merchants, fraud prevention services, analytics providers, social media platforms (where you choose to sign in using those services), marketing partners, and publicly available business directories. All third-party information is processed in accordance with this Privacy Policy.

We process your Personal Data only where necessary for legitimate business purposes, contractual obligations, legal compliance, or with your consent. Your information may be used to:

• Create and manage your account.
• Process purchases, issue digital vouchers, and facilitate bookings.
• Verify your identity and prevent fraud.
• Process payments and issue refunds.
• Provide customer support.
• Personalise your experience and recommend relevant businesses and offers.
• Communicate important service updates and comply with legal obligations.
• Maintain Platform security and investigate suspicious activity.
• Enforce our Terms & Conditions and conduct internal analytics.

ORA processes Personal Data based on one or more of the following legal grounds:

• Performance of a contract with you.
• Compliance with legal obligations.
• Your consent, where required.
• Our legitimate business interests, provided those interests do not override your fundamental rights.
• Protection against fraud, abuse, and unlawful activity.

Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing.

When you purchase or redeem a voucher, ORA shares only the information reasonably necessary for the Merchant to provide the service — typically your name, contact details, booking information, and voucher details. Merchants are independent businesses responsible for processing your information in accordance with their own privacy policies.

Payments are processed by trusted third-party providers who may collect cardholder name, payment amount, billing address, and fraud prevention information. ORA does not store complete payment card numbers, CVV codes, card PINs, or payment authentication credentials.

ORA may engage carefully selected third-party providers for cloud hosting, customer support, analytics, email and SMS delivery, fraud detection, cybersecurity, software development, and CRM. Each provider receives only the information necessary to perform its services and is contractually required to protect Personal Data.

We may disclose Personal Data to lawyers, accountants, auditors, insurers, and financial advisers where reasonably necessary for legal, financial, or regulatory purposes.

We may disclose Personal Data where required to comply with applicable law, respond to lawful requests, comply with court orders, cooperate with regulatory authorities, investigate fraud, or protect public safety.

If ORA undergoes incorporation into a new legal entity, merger, acquisition, sale of assets, or business restructuring, Personal Data may be transferred to the acquiring or successor entity, subject to applicable data protection laws. Users will be notified where required by law.

ORA primarily operates from the United Arab Emirates. Certain service providers may process Personal Data in other jurisdictions — including locations where cloud hosting services, payment providers, customer support systems, or analytics providers operate. Where Personal Data is transferred internationally, ORA will implement appropriate safeguards in accordance with applicable law.

ORA retains Personal Data only for as long as reasonably necessary to provide the Platform, comply with legal obligations, resolve disputes, enforce agreements, prevent fraud, maintain accounting records, and comply with tax regulations. When Personal Data is no longer required, it will be securely deleted, anonymised, or destroyed.

ORA takes reasonable administrative, organisational, and technical measures to protect Personal Data against unauthorised access, accidental disclosure, misuse, loss, alteration, or destruction. Security measures may include encrypted communications (SSL/TLS), secure cloud infrastructure, access controls, firewalls, intrusion monitoring, security logging, and employee confidentiality obligations.

Users are responsible for maintaining the confidentiality of their account credentials. You should choose a strong password, never share login credentials, log out after using shared devices, and notify ORA immediately if unauthorised access is suspected. ORA is not responsible for losses arising from failure to protect account credentials.

ORA uses cookies and similar technologies to remember login sessions, save preferences, improve security, personalise content, understand user behaviour, analyse website traffic, and optimise performance.

Required for Platform functionality — including login authentication, security, and payment sessions. These cookies cannot generally be disabled.

Used to understand website traffic, page performance, loading times, and user interactions.

Remember language preferences, location, saved settings, and recently viewed businesses.

Where consent has been provided, used to display personalised advertising and measure advertising performance. Users may control cookies through browser settings. Disabling cookies may reduce Platform functionality.

ORA may use analytics services to understand how Users interact with the Platform. Analytics information may include pages visited, search queries, device information, operating system, browser version, clicks, session duration, and referring websites. Analytics data is generally aggregated and used to improve the Platform.

ORA may send booking confirmations, receipts, account notifications, security alerts, and customer support messages. Where permitted by law or where consent has been provided, ORA may also send newsletters, promotions, merchant offers, event invitations, loyalty programme updates, and product announcements.

Users may unsubscribe from marketing communications at any time. Transactional communications relating to purchases and account security cannot be opted out of while an account remains active.

Subject to applicable law, Users may have the right to:

• Access their Personal Data.
• Request correction of inaccurate information.
• Request deletion of Personal Data.
• Request restriction of processing.
• Object to certain processing activities.
• Withdraw consent where processing is based on consent.
• Request a copy or transfer of their Personal Data where applicable.

Requests may be submitted to info@or-a.ae. ORA may require reasonable identity verification before responding. Certain requests may be declined where ORA is legally required or permitted to retain information.

ORA is intended for individuals aged 18 years or older. We do not knowingly collect Personal Data from children. If ORA becomes aware that Personal Data has been collected from a child in violation of applicable law, we will take reasonable steps to delete such information. Parents or guardians who believe a child has provided Personal Data may contact us immediately.

ORA may use artificial intelligence and automated technologies for personalised business and offer recommendations, intelligent search, customer support assistance, fraud detection, content moderation, language translation, automated categorisation, and analytics. AI-generated information is intended solely to improve user experience and should not be considered professional, medical, legal, or financial advice. Users remain solely responsible for evaluating any recommendations presented by the Platform.

ORA may use automated systems for fraud detection, suspicious transactions, account security, payment verification, spam prevention, voucher abuse, and review moderation. Where appropriate, decisions involving significant legal or similar effects may be subject to human review. Users may contact ORA if they believe an automated decision has been made in error.

The Platform may contain links to third-party websites, including Merchant websites and social media platforms. ORA is not responsible for the privacy practices, security, content, or policies of third-party websites. Users should review the privacy policies of those websites before providing Personal Data.

Where Users interact with ORA through social media platforms, those interactions may also be governed by the privacy policies of the relevant platform. ORA is not responsible for data processing carried out by social media providers.

ORA facilitates payments through trusted PCI-DSS compliant third-party payment providers. ORA does not store complete payment card numbers, CVV codes, card PINs, or payment authentication credentials. Users should review the privacy policies of those providers before completing payment transactions.

In the event of an actual or suspected Personal Data breach, ORA will take reasonable steps to investigate the incident, contain the breach, minimise potential harm, restore system integrity, and comply with applicable legal reporting obligations. Where required by applicable law, affected Users and competent authorities will be notified within the applicable legal timeframes.

If ORA undergoes incorporation into a dedicated company, merger, acquisition, sale of assets, or change of ownership, Personal Data may be transferred to the successor operator, provided the successor agrees to process the information in accordance with this Privacy Policy and applicable law. Such transfer will not reduce the level of protection afforded to Users.

ORA may update this Privacy Policy periodically to reflect changes in applicable law, new Platform features, technological developments, changes in business operations, or expansion into new jurisdictions. The latest version will always be published on the Platform. Continued use of the Platform after publication of an updated Privacy Policy constitutes acceptance of the revised Policy.

If you have questions or concerns regarding the way ORA processes your Personal Data, please contact us using the details below. ORA will make reasonable efforts to acknowledge complaints promptly and investigate them in good faith. Where applicable, Users may also have the right to lodge complaints with competent regulatory authorities.

This Privacy Policy shall be governed by and interpreted in accordance with the laws of the United Arab Emirates as applicable in the Emirate of Dubai. Any dispute relating to this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Dubai, United Arab Emirates.

ORA reserves the right to transfer the operation of the Platform, including all associated customer accounts, merchant relationships, contracts, intellectual property, databases, and Personal Data, to a newly incorporated or affiliated legal entity within the UAE. The successor entity will continue processing Personal Data in accordance with this Privacy Policy and applicable law.

© 2026 ORA. All rights reserved. DMCC-1008088. Dubai, UAE.