Privacy policy

Last updated: 29 October 2026

This policy explains how Euro Mall uses your personal data in Euro Mall Rewards, our loyalty programme: in the Euro Mall app, on euromalljo.com and at participating store tills. Jordan's Personal Data Protection Law No. 24 of 2023 gives you the rights described below.

In short

We use your mobile number and your purchases to run your points and vouchers.
We never sell your data, and the app has no advertising or tracking tools.
Notifications about offers are off until you turn them on.
Deleting your account cancels your points and vouchers, so use them first.

Who we are

Euro Mall runs Euro Mall Rewards and is responsible for your personal data.
Our technology partner JoSequal, a Jordanian software company, built and operates the app for us, using your data only on our behalf.
Privacy questions: support@euromalljo.com.

What we collect

We start when you first sign in to the app, first give your mobile number at a participating till to collect points (even if you have not installed the app), or ask Euro Mall customer service to register you. Participating tills show a notice that points to this policy.

Mobile number (required), given at sign-in or at the till. It identifies your account.
Profile (optional): your name and gender if you add them in My profile, and your email or date of birth if you asked Euro Mall customer service to add them.
Purchases from the till when you give your number: invoice reference, amount paid, branch, till, date and time, and returns. If a till sends item details (such as product, quantity and price), we keep them with the purchase only to answer questions about points and returns, and never use them for marketing or to profile you.
Programme records: points history, tier, vouchers, and staff corrections with their reason.
Phone details: notification token, your phone's operating system, app language, last connection time and notification settings.
Notification delivery data, collected in the app by Google Firebase: an installation ID and basic technical details (phone model, operating system and app version, language and time zone), without your name or mobile number.
Contact us messages: name, email, phone number and message, all required.
Requests to customer service by email, phone or at a branch: your contact details and what you ask us, used only to handle your request.
IP address: used briefly to block abuse, and kept in server logs.

The app does not access your location, contacts, photos, camera or microphone. It has no advertising or tracking tools, and no analytics tools of its own: Google uses the Firebase data above to deliver notifications and measure that service. We don't collect payment card details.

Why we use it, and on what basis

Running your membership (sign-in codes, points, tier, vouchers, history, service notifications): your consent, which you give when you join (on the sign-in screen, or by choosing to give your mobile number at a participating till) and which lasts until you delete your account. We also need this processing to carry out the programme agreement (our terms).
Fraud prevention and security: necessary to carry out that agreement safely, and required by our legal duty to keep your data secure (Personal Data Protection Law, Art. 8).
Accounting and tax records: required by Jordanian law.
Answering your messages, keeping the optional profile details you add (so you and customer service can see them), offers notifications and website analytics: your consent, which lasts until you withdraw it.

You can withdraw consent at any time, and we stop that use as soon as we receive your choice: turn off Offers & updates in Account › Manage notifications, change your choice in Cookie settings on our website, or ask us to delete your optional profile details or your Contact us messages (details below). To withdraw your consent to membership, delete your account (see Deleting your account).

Your tier is set automatically from the points you earned in the last 12 months, and carries no extra benefits today. We build no marketing profiles, and we don't use your gender or date of birth for offers. If you think your tier is wrong, or object to how it is set, contact us and we will review it.

Who receives your data

We never sell your data. Only the following receive it:

JoSequal (Jordan): builds and operates the app.
Hetzner (European Union): our servers in Finland and our backups.
Cloudflare (worldwide): security and fast delivery for the app and website.
Google Firebase Cloud Messaging and Apple Push Notification service (worldwide): notification delivery, using the installation ID and technical details described above.
Our SMS provider in Jordan: sign-in codes.
Participating stores (listed in the app): after a purchase, their tills receive your member ID, points earned, balance and tier, and may print them on the receipt. When checking a voucher, they see its details and only the last 4 digits of your mobile number.
Google Analytics: our website only, if you accept.
Competent authorities: only when the law or a court requires it.

JoSequal, Hetzner, Cloudflare, Google, Apple and our SMS provider process your data for us as service providers. They and the participating stores may use your data only for these purposes, and must protect it to the same standard as this policy. Separately, the app store you download the app from handles that download under its own privacy policy.

Where your data is stored

Your data is stored outside Jordan. Our servers, and the nightly backups kept on them, are in Finland (European Union), and encrypted backup copies are kept in a separate Hetzner storage service in the European Union. Cloudflare, Google and Apple handle data in many countries, including the United States. Before using any provider outside Jordan, we check that it protects data at least as well as Jordan's Personal Data Protection Law requires (Art. 15), keep a record of that check, and use only providers bound by written data protection terms. Data is encrypted in transit. You can ask us for details of these safeguards.

How long we keep it

Account details: while your account exists.
Sign-in codes: 10 minutes.
Sign-in on your phone: until you log out, delete your account or sign in on another phone, and at most 12 months.
Notification tokens: until you log out, delete your account or Google reports that the token is no longer valid.
Contact us messages: deleted 365 days after we receive them, or sooner if you ask.
Requests to customer service by email, phone or at a branch: deleted 365 days after the request is closed, unless we need them longer for a complaint or legal claim.
Server logs: 14 days.
Backups: a nightly backup kept 14 days on our server, readable only by our system administrators, and encrypted copies in a separate Hetzner storage service in the EU (7 daily and 4 weekly). Deleted data is gone from them within about 5 weeks.
Website analytics, if you accept: Google Analytics keeps detailed data for up to 14 months, and its cookies stay in your browser for up to 2 years after your last visit, unless you decline them in Cookie settings or clear them.
After account deletion: purchase, points and voucher records, no longer linked to your name, mobile number or email, for up to 10 years after the end of the year they relate to (the period Jordan's Commercial Law No. 12 of 1966, Art. 19, sets for keeping business books), and then deleted.
If the programme ends: accounts are closed after the end date, as described in Deleting your account.

How we protect it

HTTPS encryption for the app and website, and your sign-in kept in your phone's secure storage.
Sign-in codes that expire after 10 minutes, with limits on requests and wrong attempts. Phone numbers are masked in our routine logs, and sign-in codes are never logged.
Encrypted off-site backups, staff access limited by role, and a duty of confidentiality for everyone handling your data.

If a breach affects your data, we will tell you. If it is likely to cause you serious harm, we will tell you within 24 hours of discovering it, with steps you can take, and report it to the Personal Data Protection Unit within 72 hours.

Your rights

You can ask to see your data and get a copy, correct or update it, limit or object to how we use it (including the tier calculation), erase or hide it, or have a copy moved to another organisation. You can also withdraw consent, and you will be told of any breach affecting your data.

In the app: edit your name and gender (Account › My profile), choose notifications (Account › Manage notifications) or delete your account (Account › Delete account).
For anything else, such as removing a detail or changing your mobile number, contact us (details below).

Using your rights is free. Most requests, such as correcting your details or deleting an optional detail, do not affect your points. Your account cannot work without your mobile number, so erasing your number, or all your data, means deleting your account, which cancels your remaining points and unused vouchers (see Deleting your account). If you ask us for this outside the app, we will first tell you your balance so you can use it. We may need to check your identity. We carry out your request within 15 working days from the day after we receive it; if we need longer, we may extend this once by up to 15 working days and tell you why.

Notifications

Orders & points: one of your vouchers was used or expires within 3 days, or points came back from an expired voucher. On by default.
Offers & updates: offers and news from Euro Mall. Off until you turn them on.
Change either in Account › Manage notifications, or turn off all notifications in your phone settings. The app works fully without them.
We use SMS only for sign-in codes, and send no marketing SMS or emails.

Deleting your account

In the app: Account tab › Delete account › confirm. Deletion is immediate and cannot be undone.
Without the app: email support@euromalljo.com or call +962 78 524 5668 and give your registered mobile number. We will call that number to check the request is yours, delete the account within 15 working days and confirm when it is done.
Use your points and vouchers first. Remaining points and unused vouchers are cancelled and stop working at the till.
We delete your name, mobile number, email, date of birth, gender, tier, notification settings, sign-in sessions and notification tokens.
We keep purchase, points and voucher records for accounting, no longer linked to your name, mobile number or email. Invoices keep only the last 3 digits of your mobile number.
Contact us messages are not linked to your account, so they are not deleted with it: they are deleted 365 days after we receive them, or sooner if you ask. Deleted data leaves our backups within about 5 weeks.
You can rejoin with the same number, but your new account starts from zero points.

Website cookies

Our website uses Google Analytics only if you accept analytics cookies in the cookie banner: it is off by default, and its advertising features are always off. Your choice is saved in your browser, and you can change it through Cookie settings; declining removes the analytics cookies. Cloudflare may set strictly necessary security cookies. The app uses no cookies.

Children

Euro Mall Rewards is for people aged 18 and over. If we learn that a member is under 18, we will close the account and delete their personal data as described in Deleting your account.

Complaints

Contact us first (details below): we will give you a reference number and reply within 10 days from the day after we receive your complaint. Complaining is free. If you are not satisfied or get no reply, you can complain to the Personal Data Protection Unit at the Ministry of Digital Economy and Entrepreneurship (modee.gov.jo). You can also go to court at any time.

Changes to this policy

Before important changes take effect, we will tell you with a notice on the Home screen of the app and at euromalljo.com/privacy. We will ask for your consent again before using your data for a new purpose or in a different way.

Contact us

Email support@euromalljo.com, call +962 78 524 5668, use Contact us in the app, or visit Euro Mall customer service at one of our branches.

This policy is published in Arabic and English. If they differ, the Arabic version prevails.