Surplus - Privacy Policy

Last Updated: July 14, 2026

This Privacy Policy describes how Surplus FZ-LLC ("Surplus", "we", "us", or "our"), a company registered in Dubai, United Arab Emirates with its registered office at In5 Tech, Dubai Internet City, Dubai, UAE, collects, uses, shares, and protects your personal data when you use our mobile application and website (together, the "Platform").

We process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and other applicable UAE laws. Surplus FZ-LLC is the data controller for personal data processed through the Platform.

1. Information We Collect

• Account information: Name, email address, and phone number when you sign up.
• Order information: Surprise bag reservations, order history, pickup confirmations, and order-related communications.
• Location data: With your consent, approximate location to show nearby partner outlets and offers. You can disable this in your device settings at any time.
• Payment information: Payments are processed by licensed third-party payment providers. We do not store full payment card details; we receive only transaction confirmations and the last digits of your card for order support.
• Device and technical data: Device type, operating system, app version, IP address, device identifiers, and crash logs/diagnostics.
• Communications: Support messages, feedback, and inquiries you send to us.

2. How We Use Your Information

We process your personal data on the basis of your consent, the performance of our contract with you, and our legal obligations, in order to:

• Process orders and reservations and confirm pickups.
• Show available surprise bags near you.
• Provide customer support and resolve disputes and refunds.
• Detect and prevent fraud, abuse, or misuse of the Platform.
• Send service and transactional messages about your orders.
• Send promotional offers, with your consent and with an opt-out in every message.
• Improve the Platform using aggregated, anonymized analytics.
• Comply with legal and regulatory obligations in the UAE.

We do not use your data to make automated decisions that produce legal or similarly significant effects without human review.

3. Sharing Your Information

We do not sell your personal data. We share it only with:

• Partner outlets — order details needed to prepare and hand over your order.
• Payment processors — to complete transactions securely.
• Cloud hosting and infrastructure providers — to run the Platform.
• Analytics and crash-reporting providers — to improve performance and stability.
• Legal or regulatory authorities — where required by UAE law or to protect our legal rights.

All service providers are contractually required to protect your data and to use it only for the services they provide to us.

4. International Data Transfers

Some of our service providers (such as cloud hosting) store or process data outside the UAE. Where personal data is transferred outside the UAE, we do so in accordance with Articles 22 and 23 of the PDPL, including transferring only to jurisdictions with adequate protection or under contractual safeguards that require an equivalent level of protection.

5. Data Retention

• We retain your personal data while your account is active and as needed to provide our services.
• After account deletion, most personal data is deleted within 30 days.
• Transaction and accounting records may be retained for up to 7 years where required by UAE tax and commercial laws.
• Anonymized analytics data may be retained longer.

6. Your Rights

Under the PDPL, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data.
• Restrict or object to certain processing.
• Receive your data in a portable, machine-readable format (data portability).
• Withdraw consent at any time, including opting out of marketing communications.

To exercise any of these rights, contact us at contact@getsurplus.ae. We respond to requests within 30 days. You can also request account deletion directly — see our Account Deletion page.

7. Cookies and Tracking

• Our website uses only essential cookies necessary for it to function. We do not use advertising or cross-site tracking cookies on the website.
• The mobile app uses analytics and crash-reporting tools as described in Sections 1 and 3.
• You can control cookies through your browser settings.

8. Data Security

• Encryption in transit (TLS) for all Platform traffic.
• Encryption at rest where applicable.
• Access controls limiting who can view personal data.
• Monitoring and regular security reviews.

No method of transmission or storage is 100% secure. If you suspect unauthorized access to your account, contact us immediately at support@getsurplus.ae.

9. Children's Privacy

Surplus is not intended for users under the age of 18. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us data, contact us and we will promptly delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or by email at least 14 days before the changes take effect. The "Last Updated" date above always shows the current version.

11. Complaints

If you have a concern about how we handle your personal data, contact us first at contact@getsurplus.ae and we will investigate. You also have the right to lodge a complaint with the UAE Data Office.

12. Contact Us

Surplus FZ-LLC
In5 Tech, Dubai Internet City, Dubai, United Arab Emirates
Email: contact@getsurplus.ae
Phone: +971 55 221 8322