Privacy Policy
Last updated: 3 October 2026
This Privacy Policy explains how Cosmopoints Loyalty Tech Ltd ("Cosmo"), a company registered in the Dubai International Financial Centre, Dubai, United Arab Emirates, collects and uses personal data through the Cosmo website at cosmopoints.com (the "Website").
Cosmo is the controller of this personal data and processes it in accordance with the DIFC Data Protection Law No. 5 of 2020.
1. Scope
This Policy covers visitors to the public Website only. It does not cover the Cosmo customer portal (portal.cosmopoints.com), the Cosmo API or Cosmo services provided to customers. Personal data processed in those contexts is governed by separate privacy terms and by the agreements Cosmo has with its customers.
2. Personal data Cosmo collects
Contact form. When you submit the contact form, Cosmo collects your full name, work email address, company name, the role you select and the content of your message.
Email. If you email Cosmo directly, Cosmo collects your email address and anything you include in your message.
Spam protection. The contact form is protected by Google reCAPTCHA. To distinguish people from automated programs, reCAPTCHA collects technical information such as your IP address, browser and device details, and how you interact with the page, and may set cookies. This information is collected and processed by Google under the Google Privacy Policy (policies.google.com/privacy) and Google Terms of Service (policies.google.com/terms).
Technical information. Like most websites, the servers hosting the Website may record basic technical information about requests, such as IP address, browser type and the pages accessed, for security and to keep the Website running.
Cosmo does not use analytics, advertising or tracking cookies on the Website.
3. How Cosmo uses personal data, and why
| Purpose | Legal basis |
|---|---|
| Responding to your enquiry and discussing Cosmo products with you | Cosmo's legitimate interest in responding to business enquiries, or steps taken at your request before entering into a contract |
| Contacting you about Cosmo products related to your enquiry | Cosmo's legitimate interest in developing business relationships |
| Protecting the Website and contact form from spam, abuse and security threats | Cosmo's legitimate interest in keeping the Website secure |
| Complying with legal obligations and establishing or defending legal claims | Compliance with legal obligations, and Cosmo's legitimate interests |
Cosmo does not send newsletters to Website visitors, does not sell personal data, and does not use it for automated decision-making.
4. Sharing personal data
Cosmo shares personal data only with:
- service providers that host the Website and provide email and spam protection, acting on Cosmo's instructions, including Amazon Web Services and Google;
- professional advisers, such as lawyers and auditors, where necessary;
- authorities, where required by law or to protect Cosmo's legal rights; and
- a buyer or successor, in connection with a merger, acquisition or sale of all or part of Cosmo's business.
5. Where personal data is stored
The Website is hosted by Amazon Web Services in Frankfurt, Germany. Personal data may also be processed in other countries by Cosmo's service providers, including Google in the United States for reCAPTCHA.
When personal data is transferred outside the DIFC to a jurisdiction not recognised as providing adequate protection, Cosmo relies on safeguards permitted by the DIFC Data Protection Law, such as standard contractual clauses.
6. How long Cosmo keeps personal data
Enquiries that do not lead to a business relationship are kept for 24 months from the last communication, then deleted. If an enquiry leads to a business relationship, the related personal data is kept for as long as that relationship requires and as required by law.
7. Your rights
Under the DIFC Data Protection Law, you may have the right to:
- access the personal data Cosmo holds about you;
- correct inaccurate or incomplete personal data;
- request deletion of your personal data;
- object to or restrict processing based on Cosmo's legitimate interests;
- receive your personal data in a portable format; and
- withdraw consent, where processing is based on consent.
To exercise any of these rights, email contact@cosmopoints.com. Cosmo may need to verify your identity before responding.
If you are not satisfied with Cosmo's response, you may lodge a complaint with the DIFC Commissioner of Data Protection. If you are located in the European Economic Area or the United Kingdom, you may also contact your local data protection authority.
8. Security
Cosmo uses appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. No method of transmission over the internet is completely secure.
9. Children
The Website is intended for business use and is not directed at anyone under 18. Cosmo does not knowingly collect personal data from children.
10. Changes to this Policy
Cosmo may update this Policy from time to time by publishing a revised version on the Website. The "Last updated" date shows when it was last changed.
11. Contact
Questions about this Policy or about how Cosmo handles personal data can be sent to contact@cosmopoints.com.