Privacy Policy
Draft — not yet in force1. Who Is Responsible for Your Data
Two organisations process personal data when you use the App, in different roles:
| Organisation | Role | What it is responsible for |
|---|---|---|
| Your issuing bank | Controller of your card and identity data | Your identity and its verification, account and card records, balances, limits, payment history, authorization decisions, device registrations, receipts and statements, and fraud monitoring. This data is held in your bank's ZAM Issuer instance, a dedicated environment holding only your bank's data, hosted and operated for your bank by Techween as its processor |
| Techween | Publisher of the App; processor for your bank | Publishing the App, and hosting and operating your bank's issuer instance and the ZAM Service on your bank's instructions under a written data processing agreement and Kuwaiti banking secrecy. Techween does not use your data for any purpose of its own |
This Policy explains what Techween does. Your bank's privacy notice explains what your bank does.
2. What Data the App Handles
2.1 Stored on your device only
The App stores the following in your device's secure storage (iOS Keychain, or Android secure storage). It is protected by the device and is not readable by other apps:
- a randomly generated device identifier created on first launch (not a hardware serial number);
- one card credential per linked card, used to authenticate the App to your bank;
- the private signing key for each card, generated inside your phone's secure chip (the Secure Enclave on iPhone; StrongBox or the trusted execution environment on Android) when you link the card. It cannot be copied out of the chip and it only signs a payment after your biometric or device passcode. Techween never receives it; your bank holds only the matching public key and, on Android, the chip's attestation that the key was made there;
- your list of linked cards, your default card choice, and cached card details for display;
- your App settings, such as whether the App locks itself when you leave it.
Your biometric data never leaves your device and is never seen by the App. The App only learns from the operating system that your authentication succeeded.
2.2 Sent to your issuing bank
When you link a card, the App sends your bank:
- the link code you entered, the device identifier, and device metadata (operating system and version, device model, manufacturer and brand, whether it is a physical device, and on iOS the vendor-scoped device identifier) used for security and audit;
- the public key for the card, registered once at linking.
When you pay, the App sends your bank the payment identifier, amount, merchant identifier, name and logo reference, description, point-of-sale identifier, and the signature computed over those fields with your device's key. Your card credential authenticates the request.
If you allow notifications, the App also sends your bank a push notification token for this phone, and with each request a report of the phone's integrity (whether it is rooted, jailbroken, an emulator or running a modified copy of the App). The App does not send your location or your contacts.
2.3 Processed by the ZAM Service
To route a payment between a merchant and your bank, the acquiring half of the ZAM Service processes only:
- the payment identifier, amount, merchant and point-of-sale identifiers, timestamps, and status;
- the authorization code your bank returns and a card identifier reference (not an account number; ZAM cards have no primary account number);
- the display name your bank supplies for the merchant's receipt, so the merchant can identify who paid.
The ZAM Service does not receive your identity documents, your account number, your balance, your device metadata, or your signing key.
2.4 Data Techween collects from the App
None beyond the above. The App does not include crash reporting, analytics, or advertising software, and does not send diagnostic data to Techween. The device permissions the App requests are the camera (to scan QR codes; images are not stored), the microphone only if you choose to pay by sound (audio is processed on the phone and not stored or sent), NFC only if you choose to tap to pay (the phone reads the payment code from the terminal's tag; nothing is written to it or sent), notifications, and biometric authentication.
We do not collect your location, contacts, photos, advertising identifiers, or browsing history, and we do not use App data for advertising or profiling.
3. Why We Process Data and on What Basis
| Purpose | Data | Legal basis |
|---|---|---|
| Provide the App and let you pay | Device identifier, card credentials, signing keys, payment fields | Performance of the contract (these Terms) and your bank's card agreement |
| Security, fraud prevention, and audit | Device metadata, signatures, API logs | Legitimate interests in protecting you and the network; legal obligations under Central Bank of Kuwait rules |
| Route and settle payments between merchants and banks | Payment identifier, amount, merchant, authorization code, card reference, display name | Performance of the contract; legal obligations of the participating banks |
| Comply with law | Any of the above | Legal obligation |
4. Who We Share Data With
- Your issuing bank — as described above; it is the primary holder of your data.
- The merchant you pay — the amount, time, payment reference, and the display name supplied by your bank for the receipt. Merchants never receive your card credentials.
- The merchant's bank — transaction records needed to settle the merchant and handle disputes. Where the merchant banks with your bank, this is your bank.
- Sub-processors approved by your bank — cloud hosting for your bank's issuer instance and the ZAM Service, bound by contract to process data only on your bank's instructions.
- Regulators and law enforcement — where required by the laws of Kuwait or a competent authority.
We do not sell personal data.
5. Where Data Is Kept
Your registration and card-to-account links stay inside your bank in Kuwait. Your bank's issuer instance and the ZAM Service transaction data are hosted by Techween for your bank in [PLACEHOLDER — Google Cloud, Doha, Qatar, with the Central Bank of Kuwait's no-objection / Kuwait], encrypted, in an environment dedicated to your bank, with access limited to named Techween staff in Kuwait under your bank's audit. No data is transferred to third-party analytics or notification providers by the App.
6. How Long Data Is Kept
| Data | Retention |
|---|---|
| Device-stored credentials, keys, and settings | Until you unlink the card or uninstall the App |
| Device registration and public key at your bank | Until you or your bank unlink or deactivate the device, then per your bank's policy |
| Transaction and payment records | At least ten (10) years, as Central Bank of Kuwait record-keeping rules require |
| API and security logs | At least ten (10) years |
Archived transactions retain their identifiers and codes for reconciliation and dispute purposes.
7. How Data Is Protected
- All communication uses TLS 1.2 or higher.
- Card credentials are stored on your device in platform secure storage and, on your bank's side, only as SHA-256 hashes.
- Your bank's limits for each card are enforced before any payment, and a phone that has not been reconfirmed for twelve months stops paying until you confirm it in your bank's ZAM Cards Manager app.
- Every payment approval is signed on your device with a private key that never leaves it; your bank rejects a request whose signature does not verify.
- Each payment identifier can be approved only once, so a captured request cannot be replayed to charge you twice.
- Your bank checks that your card and device are active before it considers a payment, and can deactivate either immediately when you report a problem.
- The App asks for your biometric or passcode before approving every payment and can lock itself when you leave it.
- Access to production systems by Techween staff is limited, individually attributed, and logged.
8. Your Rights
Subject to the laws of Kuwait, you may ask to access, correct, or delete personal data, object to or restrict certain processing, and withdraw consent where processing is based on consent.
- For card, identity, account, and transaction data, contact your issuing bank, which holds that data. Transaction records required by law will be retained even after a deletion request.
- For App-level data held by Techween, contact us at the address in Section 11.
- You can delete the data stored on your device by unlinking your cards and uninstalling the App.
- You may complain to the Central Bank of Kuwait or the Communication and Information Technology Regulatory Authority (CITRA) if you believe your data has been mishandled.
9. Children
The App is not directed at children below the age in Part A Section 2, and we do not knowingly collect their data. Cards for minors, where a bank offers them, are issued under the bank's terms.
10. Changes to This Policy
We will publish changes in the App and on techween.net, and notify you of material changes in the App or through your bank before they take effect; the App asks you to accept the new version before you can continue to use it. The version and effective date are shown at the top of this Policy in the App.
11. Contact
Data protection contact at Techween: [PLACEHOLDER — email] Postal address: [PLACEHOLDER] For your bank's privacy notice and rights requests, use the contact details shown for your card in the App.