Privacy Policy - Shamia & Shuwaikh Cooperative Society

1. Introduction

Welcome to the Shamia & Shuwaikh Cooperative Society mobile application ("App"), operated by Shamia & Shuwaikh Cooperative Society ("we," "us," or "our"), based in Kuwait. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App.

By using the App, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the App.

2. Information We Collect

2.1 Personal Information Provided by You

When you register for an account or use our services, we may collect:

Identity Information: Full name (in English and Arabic), gender, date of birth
Kuwait Civil ID: 12-digit Civil ID number, used for member and shareholder verification through the Public Authority for Civil Information (PACI)
Contact Information: Email address, phone number (with country code), emergency contact details
Account Credentials: Password (stored in encrypted/hashed form)
Delivery Addresses: Governorate, area, block, street, building, floor, apartment number, and additional directions
Profile Photo: Optional profile image uploaded by you

2.2 Shareholder & Member Information

If you are a cooperative shareholder or member, we additionally collect:

Shareholder/Membership Number: Your cooperative registration number
Share Holdings: Number of shares, share value, and total investment
Profit & Dividend Information: Dividend amounts, payment history, distribution preferences
Bank Account Details: Bank name, account number, and IBAN (for profit distribution via bank transfer)
Heir Information: Names, Civil IDs, relationships, and share percentages of designated heirs
Digital Card Data: Card number, barcode, QR code data for your cooperative membership card
Family Member Data: Names, Civil IDs, dates of birth, relationships, phone numbers, and email addresses of registered family card holders

2.3 Financial & Transaction Information

Wallet Data: Wallet balance, transaction history, loyalty points
Payment Information: Payment method (KNET, Visa, Mastercard, wallet, cash on delivery), transaction amounts, and payment references. Card details are processed by our payment gateway and only masked card information (card brand and last 4 digits) is stored in the App.
Order History: Products purchased, order amounts, delivery details, and order status
Booking History: Facility bookings, dates, guest information, and payment details

2.4 Information Collected Automatically

When you use the App, we automatically collect:

Device Information: Device model, operating system version, unique device identifiers, and app version
Push Notification Token: Firebase Cloud Messaging (FCM) token for delivering push notifications
App Usage Data: Last login date, account creation date, and language preference

2.5 Camera Data

The App requests camera access for the following purposes:

Barcode/QR Code Scanning: To scan product barcodes for price checking and to scan QR codes for wallet payments, membership cards, and bookings
Photo Capture: To upload profile photos or documents when required

Camera data is processed locally on your device for scanning purposes and is not stored or transmitted unless you explicitly upload a photo.

2.6 Biometric Data

If you enable biometric login (fingerprint or Face ID), your biometric data is processed entirely on your device by your operating system. We do not collect, store, or transmit any biometric data. We only store an encrypted flag indicating whether biometric authentication is enabled.

3. How We Use Your Information

We use the information we collect for the following purposes:

Account Management: To create and manage your account, verify your identity, and authenticate your login
Service Delivery: To process orders, manage deliveries, handle bookings, and operate the cooperative wallet
Shareholder Services: To manage share holdings, calculate and distribute dividends and profits, manage family cards, and provide digital membership cards
Payment Processing: To process payments through KNET and other payment gateways
Communication: To send push notifications about order updates, promotions, news, booking reminders, and dividend announcements
Customer Support: To respond to your inquiries and resolve issues
Civil ID Verification: To verify your identity through Kuwait's PACI system for shareholder and member registration
Price Checking: To look up product prices and availability when you scan barcodes
App Improvement: To understand how our App is used and to improve our services

4. How We Share Your Information

We do not sell your personal information to third parties. We may share your information with:

4.1 Service Providers

Firebase (Google LLC): For push notification delivery. We share your device's FCM token with Firebase to send notifications.
Payment Gateways (KNET, Visa, Mastercard processors): To process your payment transactions. Payment card details are handled directly by the payment gateway and are not stored on our servers in full.
Public Authority for Civil Information (PACI): Your Civil ID and date of birth are shared with PACI for identity verification during shareholder/member registration.

4.2 Cooperative's Internal Systems

Your data is processed by our internal systems:

Backend API Server: Processes all app operations securely over HTTPS
Content Management System (CMS): Manages app content and user accounts for administrative purposes
Enterprise Resource Planning (ERP/Oracle): Synchronizes shareholder data, product inventory, and pricing information with the cooperative's existing systems
File Storage: Securely stores uploaded documents and images

4.3 Legal Requirements

We may disclose your information if required to do so by law, regulation, or legal process, or if we believe disclosure is necessary to protect the rights, property, or safety of our users or the public.

5. Data Storage & Security

5.1 Data Storage

Your data is stored on secure servers operated by us or our authorized service providers
All data transmission between the App and our servers is encrypted using HTTPS/TLS
Sensitive data (authentication tokens, credentials, Civil ID, wallet PIN) is stored on your device using encrypted secure storage
Passwords are stored in hashed form and are never stored in plain text

5.2 Security Measures

We implement the following security measures:

HTTPS encryption for all network communications
JWT (JSON Web Token) based authentication
Encrypted local storage for sensitive data
Optional biometric authentication (fingerprint/Face ID)
Optional wallet PIN protection
Screenshot protection for sensitive screens (digital card, wallet)
Account lockout after 5 failed login attempts (30-minute lockout period)
Automatic session expiry after 7 days of inactivity

6. Data Retention

Account Data: We retain your personal information for as long as your account is active. If you request account deletion, we will delete your data within 30 days, subject to any legal retention requirements.
Transaction Records: Financial transaction records may be retained for up to 7 years as required by Kuwait commercial and tax regulations.
Cached Data: Locally cached data (product listings, news, etc.) expires automatically based on content type.
Authentication Tokens: Session tokens expire after 7 days and are automatically refreshed or cleared.

7. Your Rights & Choices

7.1 Access & Update

You can access and update your personal information through the App's profile settings at any time.

7.2 Account Deletion

You can request deletion of your account and associated data through:

The "Delete Account" option in the App's Settings screen
Contacting us at the email address provided below
Visiting our account deletion page at: https://shamiyacoop.com/delete-account

Upon receiving a deletion request, your account will enter a pending deletion period during which you can cancel the request. After this period, your account and personal data will be permanently deleted, except for records we are legally required to retain.

7.3 Notification Preferences

You can manage your notification preferences in the App's Settings screen, including:

Enabling/disabling push notifications
Choosing which notification types to receive (order updates, promotions, booking reminders, dividend alerts)

7.4 Data Portability

You can request a copy of your personal data by contacting us at the email address provided below.

8. Children's Privacy

Our App is not intended for use by children under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

9. Third-Party Links

The App may contain links to third-party websites or services (such as WhatsApp for customer support and social media platforms). We are not responsible for the privacy practices of these third-party services. We encourage you to review their privacy policies before providing them with your information.

10. International Data Transfers

Your information is primarily stored and processed in Kuwait. If your data is transferred to servers outside of Kuwait for processing or storage purposes, we ensure that appropriate safeguards are in place to protect your data in accordance with applicable data protection laws.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

Posting the updated Privacy Policy in the App
Updating the "Last Updated" date at the top of this policy
Sending a push notification for significant changes

Your continued use of the App after any changes constitutes your acceptance of the updated Privacy Policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: support@shamiyacoop.com
Phone: +965 1877788
WhatsApp: +965 1877788
Address: Shamia & Shuwaikh Cooperative Society, Shamia, Kuwait