24/7 Support
Last Updated: 20 January 2026
1.1 This Data Protection Policy (“Policy”) describes the practices Tamanna BNPL LLC (“Tamanna”, “we”, “us”) has adopted with respect to the processing of Personal Data (as defined below) of the customer (“you”, ”your” or “User”), including the collection, use, storage, or disclosure of Personal Data when you visit our Platform, download our app, apply for and use your Tamanna Account or our Platform, or otherwise interact and engage with us in relation to our Platform, customer products, features, and Services.
1.2 Partners, retailers, online marketplaces, and suppliers with whom Tamanna engages operate independently and are solely responsible for their own privacy policies, practices, content on their websites or applications, and the products or services they provide. For further details, you should consult their respective privacy policies or contact these third parties directly.
1.3 Please review the following information carefully to understand our views and practices concerning your Personal Data and the manner in which we will handle it.
1.4 By using our Services, you acknowledge you have read and understood this Policy.
Account: Your Tamanna Account set up in accordance with the Tamanna Terms and Conditions (https://tamanna.app/privacy/).
Affiliates: Tamanna or any other entity that, directly or indirectly, through one or more intermediaries, controls, is controlled by, or is under common control with Tamanna.
BNPL Regulations: The Buy Now Pay Later Regulations issued by the Qatar Central Bank.
Company / Companies: Any corporation(s), limited liability company or companies, partnership(s) or other similar entities.
Law: QFC Data Protection Regulations, December 2021 and Qatar Financial Centre Data Protection Rules, 2021, as amended from time to time, or any other law applicable in the territory of Qatar.
Non-Personal Identification Information: Any non-personal information collected from Users pursuant to their interaction on the Platform, including but not limited to browser name, type of computer, technical information about Users’ means of connection to the Platform such as operating system, Internet service providers used, and other similar information.
Personal Identification Information: Any information that identifies or can be used to identify, contact, or locate a person. This includes information collected when Users visit the Platform, register, conclude a transaction, respond to a survey, fill out a form, or engage with other activities, services, features, or resources on the Platform. Users may provide Personal Information such as name, email address, phone number, and residential address. Personal Identification Information is collected only if voluntarily submitted. Refusal to provide it may limit access to certain services. For this Policy, Personal Identification Information and Non-Personal Identification Information together are referred to as "Personal Information".
Personal Data: Has the meaning attributed under the Law, as amended from time to time.
Platform: The Tamanna website (https://tamanna.app/) and the Tamanna app.
QFC: Qatar Financial Centre.
Services: Services provided by Tamanna and/or its Affiliates.
Third Party: Any person or entity other than you or us.
Terms and Conditions: The terms and conditions for Tamanna, available at https://tamanna.app/termsandconditions.
Territory: The State of Qatar.
Users / You: Users, visitors, customers, or prospective customers who avail or may avail the services provided by Tamanna.
3.1 Collection Methods
We collect and process Personal Data about you in the following ways:
• When you provide it directly to us;
• When we gather Personal Data while you use our Services, including through cookies and similar technologies;
• When we collect Personal Data from third-party sources.
3.2 Categories of Personal Data
By using our Platform, you agree to provide the following categories of information:
• Contact: Basic contact information such as name, email, phone number, home address, billing, and shipping details;
• Identity: Additional info like photo, gender, date of birth, and content you provide;
• Communications: Records of correspondence including letters, emails, texts, in-app messages, and calls;
• Technical Information: IP address, login info, browser type/version, plug-ins, device settings, device/OS/Platform, hardware version, mobile operator or ISP;
• Location Data: Geographic locations via GPS, Bluetooth, or Wi-Fi, used for location services, fraud detection, and personalized content;
• In-App Activity: Activity within our in-app browser, including visited URLs, to improve user experience.
3.3 Payment Data
While Tamanna does not access or store full credit card numbers or CVV codes, we process transaction-related information such as transaction identifiers, masked PANs (last 4 digits), payment status, amounts, and timestamps through our Payment Service Providers (PSPs). Full cardholder data is handled by designated payment gateways, which act as independent controllers or processors. Tamanna’s liability is limited to the Personal Data we directly collect and process.
3.4 Data from Other Sources
We may receive information about you from other organisations and payment processors, including:
• Credit Information: Credit score and insolvency information from third-party providers to assess and maintain your Tamanna credit limit;
• Verification Details: Identity verification via third-party services requiring government ID, subject to their own privacy policies;
• Advertisers: Technical information and interaction data shared by advertisers.
4.1 Automatically Collected Information
When you browse our Platform, we may automatically collect information to:
• Understand how Users use our Platform and how we can improve it;
• Ensure content is presented in the most effective manner for you and your device;
• Provide you with information, products, and services you request or may be interested in.
4.2 Account Information
If you create and use an Account with us, we use your Contact, Identity, Log-in, Financial Data, Credit Information, Verification Details, and Automatically Collected Information to:
• Create and administer your Account;
• Verify your identity, including appropriate screening processes;
• Conduct credit checks and receive results from third-party providers;
• Verify and process financial transactions related to payments;
• Provide aggregated reporting to shareholders, investors, and finance providers;
• Identify you during sign-in and provide appropriate Platform access;
• Enforce terms or agreements with you;
• Notify you about service changes.
4.3 Customer Support
When you contact or engage with us, we use your Contact, Identity, Log-in, Financial Data, Credit Information, Verification Details, and Communications Information to provide customer support, address inquiries, troubleshoot issues, and resolve concerns related to our Platform.
4.4 Marketing and Advertising
If we communicate marketing or advertising to you, we may use your Contact and Automatically Collected Information to:
• Send promotional updates via email, SMS, in-app alerts, and phone;
• Request your opinions through surveys and market research;
• Understand how you use and interact with our services;
• Provide personalized recommendations, promotions, and marketing;
• Measure and improve advertising effectiveness.
4.5 Platform Maintenance and Improvement
To maintain and improve our Platform, we may use your Account, Communications, and Automatically Collected Information (including Location Data) to:
• Administer Platform operations, audits, troubleshooting, data analysis, testing, research, surveys, and statistics;
• Evaluate and improve products, services, and features;
• Keep the Platform safe and secure;
• Detect and prevent errors, fraud, or other criminal activity;
• Ensure content is presented effectively and alert you to hardware/software incompatibility;
• Allow participation in interactive features if you choose.
4.6 Legal Bases for Processing
Without prejudice to applicable law, we process your Personal Data on the following legal bases:
• With your consent;
• When necessary to perform a contract to which you are a party, or to take steps at your request before entering a contract;
• When necessary to comply with a legal obligation imposed on Tamanna;
• When necessary to protect your vital interests or those of another individual;
• When necessary to perform a task carried out in the public interest or by authorized entities such as the QFC Authority, QFC Regulatory Authority, Civil and Commercial Court, Regulatory Tribunal, or a QFC Institution;
• When necessary for the legitimate interests of Tamanna or another person, unless overridden by your rights and interests (particularly if you are a child).
4.1 Automatically Collected Information
When you browse our Platform, we may automatically collect information to:
• Understand how Users use our Platform and how we can improve it;
• Ensure content is presented in the most effective manner for you and your device;
• Provide you with information, products, and services you request or may be interested in.
4.2 Account Information
If you create and use an Account with us, we use your Contact, Identity, Log-in, Financial Data, Credit Information, Verification Details, and Automatically Collected Information to:
• Create and administer your Account;
• Verify your identity, including appropriate screening processes;
• Conduct credit checks and receive results from third-party providers;
• Verify and process financial transactions related to payments;
• Provide aggregated reporting to shareholders, investors, and finance providers;
• Identify you during sign-in and provide appropriate Platform access;
• Enforce terms or agreements with you;
• Notify you about service changes.
4.3 Customer Support
When you contact or engage with us, we use your Contact, Identity, Log-in, Financial Data, Credit Information, Verification Details, and Communications Information to provide customer support, address inquiries, troubleshoot issues, and resolve concerns related to our Platform.
4.4 Marketing and Advertising
If we communicate marketing or advertising to you, we may use your Contact and Automatically Collected Information to:
• Send promotional updates via email, SMS, in-app alerts, and phone;
• Request your opinions through surveys and market research;
• Understand how you use and interact with our services;
• Provide personalized recommendations, promotions, and marketing;
• Measure and improve advertising effectiveness.
4.5 Platform Maintenance and Improvement
To maintain and improve our Platform, we may use your Account, Communications, and Automatically Collected Information (including Location Data) to:
• Administer Platform operations, audits, troubleshooting, data analysis, testing, research, surveys, and statistics;
• Evaluate and improve products, services, and features;
• Keep the Platform safe and secure;
• Detect and prevent errors, fraud, or other criminal activity;
• Ensure content is presented effectively and alert you to hardware/software incompatibility;
• Allow participation in interactive features if you choose.
4.6 Legal Bases for Processing
Without prejudice to applicable law, we process your Personal Data on the following legal bases:
• With your consent;
• When necessary to perform a contract to which you are a party, or to take steps at your request before entering a contract;
• When necessary to comply with a legal obligation imposed on Tamanna;
• When necessary to protect your vital interests or those of another individual;
• When necessary to perform a task carried out in the public interest or by authorized entities such as the QFC Authority, QFC Regulatory Authority, Civil and Commercial Court, Regulatory Tribunal, or a QFC Institution;
• When necessary for the legitimate interests of Tamanna or another person, unless overridden by your rights and interests (particularly if you are a child).
We may collect, use, share, and otherwise process your Personal Data in the following circumstances:
5.1 Group Companies
We may share your Personal Data with any member of our group, including our affiliates, subsidiaries, and ultimate holding company and its subsidiaries, where such entities assist us in processing your Personal Data, are supported by us in processing your Personal Data, or otherwise receive such data in accordance with this Privacy Policy.
5.2 Legitimate Business Purposes
We may process and disclose your Personal Data for legitimate business purposes, including but not limited to:
• Operating, managing, developing, and improving our Platform and Services;
• Sending administrative communications, service notifications, and updates to our agreements;
• Providing information regarding services, features, promotions, rewards programs, newsletters, and related content (you may opt out at any time);
• Ensuring technical functionality, security, fraud prevention, and abuse detection;
• Conducting research, analytics, and statistical analysis;
• Marketing, business development, and service enhancement;
• Verifying user identity and authorizations;
• Internal administration, auditing, and compliance purposes; and
• Developing new products, services, and features.
5.3 Third-Party Disclosures
We may share your Personal Data with selected third parties, including:
• Service providers, agents, subcontractors, or affiliates that process Personal Data under our instructions and in compliance with applicable data protection laws, including hosting, data storage, communications, IT support, marketing services, and feedback facilitation;
• Advertisers and advertising networks, who may receive aggregated or anonymized data to deliver relevant advertisements. We do not disclose identifiable Personal Data to advertisers;
• Business partners and merchants with whom we have contractual agreements governing the handling of Personal Data (a list may be provided upon request);
• Qatar Credit Bureau, for creditworthiness assessment, identity verification, account management, fraud prevention, debt recovery, and ongoing credit reporting in accordance with applicable law. Your data may be associated with related parties such as spouses or joint applicants where permitted by law;
• Payment processing providers for secure transaction processing;
• Debt collection agencies, where your account falls into arrears;
• Law enforcement agencies, regulators, courts, or other government authorities where required to enforce our rights, protect users, comply with legal obligations, or respond to lawful requests;
• Any person or entity where disclosure is necessary to enforce this Policy or other agreements, or to protect our rights or the rights of third parties;
• Prospective sellers or purchasers in connection with any merger, acquisition, sale, or transfer of business assets.
5.4 Legal and Emergency Disclosures
We may disclose Personal Data where required by law or where we believe in good faith that such disclosure is necessary to comply with legal processes, protect our rights or property, investigate suspected fraud or illegal activity, respond to emergencies involving potential threats to safety, or protect the public interest. This may include exchanging information with other companies or organizations for fraud prevention purposes.
5.5 Business Transfers
As our business evolves, we may engage in mergers, acquisitions, partnerships, or asset sales. In such cases, Personal Data may be transferred as part of the transaction, subject to applicable legal restrictions and safeguards.
As we are based in the Territory, all information we collect is stored within the Territory. However, in compliance with the Law and BNPL Regulations, we may transfer your information outside the Territory. Tamanna shall ensure that any transfer of Personal Data within or outside the QFC shall be carried out in accordance with the provisions of Articles 23 and 24 of the Law.
All information provided by you is securely maintained in our paper and digital records. We exercise a high degree of care and diligence in preserving the confidentiality of your Personal Data. To protect your Personal Data against loss, theft, misuse, and unauthorized access, disclosure, alteration, or destruction, we implement appropriate administrative, technical, and physical safeguards. While we strive to protect your data, the internet is not a completely secure environment, and we cannot guarantee absolute security during transmission or storage.
As a PCI-DSS compliant company, we require our third-party service providers to adhere to stringent privacy and security standards when processing data on our behalf. Access to Personal Data is limited to our employees, contractors, and service providers who require such access to fulfill the purposes outlined in this Privacy Policy.
We use various technical and organizational measures, including data protection tools, secure servers, encryption, SSL-secured communication channels, and anti-virus and anti-hacking technologies, to help protect the confidentiality, integrity, and availability of data stored on our systems.
Our payment gateway partners comply with the Payment Card Industry Data Security Standard (PCI-DSS) and implement encryption, passwords, and physical security measures to protect Users’ Personal Data. However, no method of data transmission or storage is completely secure, and we cannot guarantee absolute security. We are not responsible for any breach of security or actions of third parties that receive your Personal Data. To the extent permitted by law, Tamanna shall not be liable for any loss, damage, or misuse of Personal Data arising from events beyond our reasonable control.
We also employ physical, technical, and organizational precautions to safeguard Personal Data against unauthorized or unlawful processing, accidental loss, destruction, or damage. All payment transactions are encrypted using SSL technology. While we take reasonable steps to secure data transmitted to our Platform, any transmission is undertaken at your own risk.
Our Platform may contain links to external websites, each governed by its own privacy policy. We encourage you to review such policies before providing any Personal Data. In addition, our Platform is intended for individuals aged 18 and above, and use by minors is not permitted.
We retain your Personal Data for as long as necessary to fulfill the purposes for which it is collected and used (for example, to provide customer service, respond to queries, or resolve technical issues), unless a longer retention period is required to comply with legal obligations or to establish, protect, or defend legal claims under applicable law. In this context, the provisions of Article (19) of the Law are taken into account when objecting to Tamanna’s retention of data. We will also retain Personal Data as necessary to fulfill our contractual obligations and comply with applicable law. If you opt out of receiving promotional communications or object to other processing of your Personal Data, we may retain a record of your preferences to ensure compliance with your choices. Additionally, we may retain aggregated and anonymized information beyond this period for research, analytics, and service improvement purposes, where such data cannot be used to identify individuals.
If you would like to update your preferences regarding the types of communications you receive from us, or opt out of marketing communications, you may do so at any time.Please note that we may continue to send non-promotional communications such as important notices, payment confirmations, transaction-related emails, and other information about your use of the Services. If you would like to opt out of marketing communications, you may also do so by emailing your request to support@tamanna.app.
10.1 Subject to applicable law and as explained in this section, you may have certain rights with respect to the information we collect and process about you.
10.2 Under the applicable data protection laws, you may have the following rights:
a) Right of access and erasure (as defined in Articles 16 and 18 of the Law);
b) Right to request from Tamanna the rectification of inaccurate Personal Data concerning you, taking into account the purposes of the processing (Article 17 of the Law);
c) Right to require Tamanna to restrict processing of Personal Data, if any of the conditions stipulated under Article 20 (1) of the Law is applicable;
d) Right to object to the data processing at any time on reasonable grounds relating to your particular situation (Article 19 of the Law);
e) Subject to applicable laws, the right to be informed within a reasonable period, but no longer than 30 (thirty) days after obtaining the Personal Data from a third party, if Tamanna envisages that the Personal Data will be disclosed to a third party, no later than when the Personal Data is first disclosed (Article 15 (2) of the Law);
f) Right to data portability (Article 21 of the Law);
g) Right not to be subjected to a decision based solely on automated processing, including profiling, if the decision would have a legal effect on you or otherwise significantly affect you (Article 22 of the Law);
h) Right to lodge a complaint with the Data Protection Office (Article 34 of the Law);
i) Right to receive compensation if you suffer material or non-material damage due to an infringement of the Law by Tamanna (Article 35 of the Law);
j) Each Party shall cooperate to respond to Customer requests regarding personal data rights (access, correction, deletion) within timeframes required by Applicable Law;
k) In the event of a data breach affecting shared Customer Personal Data, the Party discovering the breach shall notify the other Party within 48 hours. Both Parties shall cooperate to investigate, remediate, and notify affected individuals and/or relevant authorities as required by Applicable Law. Where the breach poses a serious risk to data subjects, the Parties shall notify the Ministry of Communications and Information Technology as required by Qatar Law No. 13 of 2016.
10.3 Where Tamanna processes Personal Data based on your granted consent, you may revoke your consent at any time. If you object to the processing of your Personal Data for any reason, Tamanna will cease such processing unless otherwise required by Law. Revocation will take effect only for future processing and will not affect processing carried out prior to the revocation. Tamanna may still process your Personal Data if another legitimate legal basis applies.
We reserve the right to amend this Privacy Policy at any time to reflect changes in the law, our data collection and use practices, the features of our Services, or advances in technology. If we make a material change to the Privacy Policy, you will be provided with appropriate notice in accordance with legal requirements.By continuing to use the Services, you are confirming that you have read and understood the latest version of this Privacy Policy.
Breach Detection & Response: Tamanna maintains internal procedures to detect, investigate, and remediate suspected personal data breaches. Notification Timeframe: In the event of a data breach affecting your Personal Data, Tamanna shall notify the relevant supervisory authority without undue delay and, where feasible, within 48 hours of becoming aware of the breach, or as otherwise required by Applicable Law. Customer Notification: Where a data breach is likely to result in a high risk to your rights and freedoms, or where a serious risk is posed to data subjects, we will notify you and the Ministry of Communications and Information Technology as required by Qatar Law No. 13 of 2016. Cooperation: We will cooperate with our partners and regulatory bodies to investigate and remediate any such incident.
You may exercise your rights or make a request regarding your information held by us, request further information about your legal rights under applicable law, or submit a complaint about our privacy practices by contacting us at any time using the contact details set forth below. We will consider all requests and provide our response within the time period stated by applicable law. Please note, however, that certain information may be exempt from such requests in some circumstances, if we need to keep processing your information to provide services to you or to comply with a legal obligation. Moreover, you will not be permitted to examine the information of any other person or entity. We may also request that you provide information necessary to confirm your identity before responding to your request. If you have any questions about this Privacy Policy, would like to exercise your rights regarding your information, or wish to raise a complaint related to your information, you may contact us at support@tamanna.app.