Privacy Policy (Bahrain)

DRAFT NOTICE: This Privacy Policy is a draft. It is being prepared for review by qualified legal counsel in the Kingdom of Bahrain and is not yet in force. It does not create any rights or obligations until a final version is published with an effective date. Nothing in this draft is legal advice. Text in [square brackets] is a placeholder or a point still open for counsel.

1. About this policy

This Privacy Policy explains how TokenNo collects, uses, shares, stores and protects personal data when you use TokenNo in the Kingdom of Bahrain ("Bahrain"). It covers:

the TokenNo customer app, used by people who book tokens (hosts) and the people they invite (guests);
the TokenNo Business app, including the web front desk and the TV "Now Serving" board, used by businesses and their staff;
the TokenNo admin console, used by our own staff;
the TokenNo website at tokenno.com;
the TokenNo Integration API and webhooks that businesses can connect to their own systems; and
our messages to you by push notification, SMS and WhatsApp.

The TokenNo platform in Bahrain is operated by [TokenNo Gulf entity legal name], a [type of entity] registered in [country of registration] under [registration number], with its registered office at [registered address] ("TokenNo", "we", "us"). [Name, commercial registration (CR) number and address of any Bahrain entity, branch or representative, if one is appointed.] You can contact us at info@tokenno.com.

This policy is written to meet the requirements of Bahraini law, including:

the Personal Data Protection Law, Law No. 30 of 2018 (the "PDPL"), and the resolutions issued under it by the Personal Data Protection Authority (the "Authority") [counsel to confirm which body currently carries out the Authority's functions, and which resolutions under the PDPL apply to TokenNo];
the Consumer Protection Law, Law No. 35 of 2012, and its implementing regulations;
the Electronic Communications and Transactions Law, Decree-Law No. 54 of 2018; and
the rules of the Telecommunications Regulatory Authority ("TRA") on SMS and other electronic messages [counsel to confirm the TRA rules that apply to transactional and marketing SMS].

In this policy, "personal data" means any information about an individual who is identified, or who can be identified directly or indirectly. The individual the data is about is the "data subject". The organisation that decides why and how personal data is processed is the "data manager" (often called the "controller"), and an organisation that processes it on the data manager's behalf is a "data processor" [counsel to confirm the PDPL terminology].

2. Who is responsible for your data

TokenNo is a platform. Businesses ("vendors") such as clinics, hospitals, doctors, restaurants, salons, offices and event organisers use it to issue tokens and run their queues. Because of this, responsibility is shared:

TokenNo is the data manager for your TokenNo account (your mobile number, name and language), your login, the messages we send, the advance payments we collect, our fraud prevention and security, and our own analytics and improvement of the platform.
TokenNo is also the data manager for the booking and queue records held on the platform (your bookings, tokens, booking history across vendors, guest invitations and queue events), which we use to run the service and for features such as "book again" and "notify me". The vendor you book with is a separate data manager for its own service records of your visit and decides what service it provides to you.
Where a vendor connects its own software (for example clinic software or a point-of-sale system) through the Integration API, the data sent to that system is under the vendor's control and responsibility, and the vendor's own privacy notice applies to it.

[Counsel to confirm this allocation under the PDPL, whether TokenNo acts as a processor for any vendor activity, and the terms of the vendor data-sharing addendum (Terms of Service, section 27). The operating entity is the TokenNo Gulf entity named in section 1, whose details are filled in from the admin.]

If you are not sure who to contact, write to info@tokenno.com and we will help you or pass your request to the right vendor.

3. What personal data we collect

We follow a data minimisation approach. In the current phase of the service we collect only what is needed to give you a token and tell you when it is your turn.

3.1 If you book tokens (customers and hosts)

Mobile number. Your mobile number is your identity on TokenNo. One mobile number is one account across all TokenNo apps. We verify it with a one-time password (OTP).
Name. The name you give us, so the vendor can call you.
Language preference. The app language you choose.
Bookings and tokens. The vendor, location, service point (for example a doctor's room or a counter), session, token number, party size, status (booked, called, served, cancelled, no-show), any changes to your token number, and your booking history, including your "notify me when booking opens" requests and "book again" choices.
Party and guests. If you invite guests, the mobile numbers (and names, if you add them) of the people you invite, and whether they said they are coming.
Payment records. If a vendor asks for advance payment: the amount, currency, date, status, refund details and a reference from the payment gateway. We do not collect or store your full card number, CVV or other card or bank login details. These are entered directly with the payment gateway.
Live location (optional). Only if you turn on location sharing for an active token. See section 5.
Device data. A push notification token for your device, the app version, device type and operating system, and basic technical logs (such as IP address, time of access and error reports) needed to keep the service secure and working.
Support messages. What you tell us when you contact us.

3.2 If you are a guest

If a host invites you, we receive your mobile number (and possibly your name) from the host, not from you. We use it only to send you the invitation and updates about that token by push, SMS or WhatsApp, and to show you the token in the app or in a simple web page. If the host picks you from their phone's contacts, the app uses the device's contact picker: it reads only the number the host selects and never uploads the host's address book. Section 3.5 explains our legal basis and how you can stop invitations.

3.3 If you work for a vendor (vendor staff)

your name, mobile number, role (for example owner, manager, receptionist, doctor) and the locations you can access;
the actions you take in TokenNo Business (for example calling, serving, pushing back or cancelling tokens), which we record in audit logs; and
for the business: its name, addresses, service points, schedules, holidays, refund rules, prices, bank account details for payouts, tax details (such as a VAT account number), and KYC documents you upload so that we can verify the business (for example a commercial registration (CR) certificate, and the CPR (identity) card or passport of owners or authorised signatories).

3.4 Health information and other sensitive personal data

We do not ask for medical records, symptoms or other health details. Even for clinics and hospitals, TokenNo holds only your name, mobile number and booking. Please do not type health details into names, notes or other free-text fields. Vendors are not permitted to add health details to TokenNo in the current phase.

The PDPL treats some personal data as sensitive personal data, including data that reveals a person's health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, criminal record, or sex life. Sensitive personal data may in general be processed only with the data subject's consent or in other limited cases allowed by the PDPL, and some processing needs prior authorisation from the Authority. The fact that you booked with a particular clinic or doctor may itself say something about you. We protect booking data carefully and share it only as described in this policy. [Counsel to confirm: whether clinic booking data could be treated as health data or sensitive personal data under the PDPL, whether express consent or prior authorisation from the Authority is needed, and whether any National Health Regulatory Authority (NHRA) or Ministry of Health rules restrict storing such data outside Bahrain.] [Launch-blocking compliance item for BH: obtain the Authority's prior authorisation, or counsel's written view that booking-only data is outside scope, before healthcare vendors go live in Bahrain.]

3.5 If someone else gives us your number (guests, phone, walk-in, kiosk and API bookings)

Sometimes we receive your name and mobile number from someone other than you: a host who invites you as a guest; vendor staff who book a token for you when you phone the vendor, walk in, or use its QR code or kiosk; or a vendor's own system that creates a token for you through the Integration API. You may not have seen this policy before. In these cases:

Where the data came from: the host or vendor named in our first message to you.
What we use it for: only to issue that token and send you messages about it (invitation, confirmation, call alerts, changes, cancellations and any refund).
Legal basis: the legitimate interests, ours and the vendor's, in managing the queue you joined, which the PDPL allows where they do not conflict with your fundamental rights and freedoms [counsel to confirm].
Our first SMS or WhatsApp message to a number entered by someone else names TokenNo and the host or vendor who added you, says it is a message about one visit, links to this policy and gives you a one-tap "stop inviting me" option.
How long we keep it: see section 11. If you choose "stop inviting me", we stop messaging you and keep only an irreversible hash of your number so that we can honour your request.
Vendors must tell callers and walk-ins that TokenNo will process their number to manage their token (see our Terms of Service, sections 21 and 27).

4. How and why we use your data

We use personal data for these purposes:

To create and secure your account, verify your mobile number by OTP and keep you logged in.
To issue and manage tokens: booking, showing your place in the queue and estimated waiting time, calling your token, handling cancellations, holidays and changes (including "push back" renumbering), and showing your past bookings.
To tell you about your token by push, SMS and WhatsApp: booking confirmations, "your turn is near" and "your number is called" alerts, changes to your token number, cancellations, refunds and "booking is now open" alerts that you asked for.
To handle your party: inviting guests, updating party size and keeping the host and guests informed.
To process advance payments and refunds where a vendor requires them, and to keep accounting and tax (including VAT) records.
To show distance and estimated arrival time, only if you turn on location sharing (section 5).
To translate vendor content (such as business and room names) into your chosen language.
To verify vendors (KYC) and to pay them out.
To keep the platform safe: preventing fraud, misuse and security incidents, and investigating complaints.
To improve the service, for example by estimating average service times at a counter. Where possible we use aggregated or anonymised data for this.
To meet legal obligations, respond to lawful requests from Bahraini authorities and enforce our Terms of Service.

We process personal data fairly and lawfully, only for specified and legitimate purposes that we tell you about, and we do not keep more data, or keep it for longer, than needed for those purposes.

4.1 Legal basis

Under the PDPL, we may process your personal data with your consent, or without consent where the processing is necessary: to perform a contract with you (or to take steps you ask for before entering into one); to comply with a legal obligation; to protect your vital interests; or for the legitimate interests of TokenNo or of a third party to whom the data is disclosed, unless those interests conflict with your fundamental rights and freedoms. [Counsel to confirm the exact lawful grounds available under the PDPL and whether consent should be collected for any of the purposes below.]

For purposes 1 to 5 and 8, the processing is necessary to perform our agreement with you (and with the vendor) and to provide the service you asked for.
We rely on your consent for live location sharing (purpose 6), for "notify me when booking opens" alerts, for WhatsApp messages where WhatsApp's rules or the law require opt-in, and for any marketing messages.
We rely on legal obligations for purpose 11 and for keeping payment, VAT and other tax records.
For purposes 7, 9 and 10, we rely on our legitimate interests in running, protecting and improving the service.

When we ask for consent, we will do so clearly, in plain language, and separately from other matters. You can withdraw your consent at any time (see section 9). Withdrawing consent does not affect processing that already took place, but it may mean we can no longer provide some features.

Guests and people booked by a vendor are not parties to our agreement with the host or the vendor. For their data we rely on the basis described in section 3.5, not on performance of an agreement.

5. Live location

Location sharing is off by default and optional.

You can turn it on for one active token at a time. It only runs from a set time before your expected turn until you arrive, your token closes, or you turn it off.
It stops automatically.
We use it to calculate how far away you are and your estimated arrival time, to send a "leave now" reminder, and to mark you as "arrived" when you reach the location.
The vendor and your host see your distance or estimated arrival time (for example "8 min away"), not a continuous map of where you are. [Product to confirm that no vendor or host setting shows exact coordinates or a map; if one is added, this policy will be updated first and your opt-in asked for.]
We send your location to a maps/routing provider only to calculate the route and time.
We delete raw location data soon after the visit, within [24 hours] of your token closing [counsel to confirm retention period], and keep only the fact that you arrived.

You can control location permission at any time in your device settings and in the app.

6. Messages we send (push, SMS and WhatsApp)

Service messages about your token (confirmation, call alerts, changes, cancellations, refunds) are part of the service. You can switch some of them off in the app, but you may then miss your turn.
"Notify me when booking opens" messages are sent only if you ask for them, and you can cancel each request.
Direct marketing. Under the PDPL, you have the right to object at any time to the processing of your personal data for direct marketing. We do not send marketing messages without your consent. Every marketing message will say who it is from and give you a simple, free way to opt out.
SMS in Bahrain is sent through licensed telecom operators in line with the rules of the Telecommunications Regulatory Authority (TRA), including any sender ID registration and rules on unsolicited messages [counsel to confirm the current TRA requirements for transactional and promotional SMS, including sender ID registration, permitted sending hours and opt-out wording].
WhatsApp messages are sent through the WhatsApp Business Platform operated by Meta, and only where you have agreed to receive messages on WhatsApp or as allowed by WhatsApp's policies. You can reply "STOP" or block the business number at any time. [Product to confirm that an inbound STOP keyword handler is implemented for WhatsApp and SMS with our messaging providers in Bahrain; otherwise this sentence will be removed.]
The vendor pays for SMS and WhatsApp messages sent for its bookings. This does not change how your data is protected.

7. Who we share your data with

We do not sell your personal data. We share it only as follows:

With the vendor you book with: your name, mobile number, token, party size, status and, if you turned on location sharing, your distance or estimated arrival time. Vendor staff see this in TokenNo Business, and your token number may be shown and announced on the vendor's TV "Now Serving" board in its waiting area. [Product to confirm whether any part of the customer's name can appear on the board.]
With your host or guests: the members of a party see each other's status (for example "coming" or "arrived") and, if location sharing is on, estimated arrival time.
With the vendor's own systems, if the vendor connects them through the Integration API and webhooks. These receive your name, mobile number, booking, token and queue details, and payment events (payment status, amount and reference). They never receive health details. Once the data reaches the vendor's system, the vendor is responsible for it.
With our service providers (data processors), who process data on our instructions under written contracts, only for the services they provide to us, and who must keep it secure:
- Amazon Web Services (AWS): cloud hosting and storage;
- payment gateways: in Bahrain, the gateway configured for Bahrain (currently [Tap Payments — to be confirmed]); our other gateways (Razorpay, Stripe and Moyasar) serve other countries;
- SMS and WhatsApp providers: such as Unifonic and Twilio for SMS, and Meta for the WhatsApp Business Platform (MSG91 serves other countries);
- Firebase Cloud Messaging (Google) and Apple's push notification service: to deliver push notifications;
- translation providers: to translate vendor content (not your personal messages); and
- maps and routing providers: to calculate distance and arrival times.
An up-to-date list is available on request from info@tokenno.com [or at [link to sub-processor list]].
With authorities, where required by Bahraini law, a court order or a lawful request from a competent Bahraini authority.
In a business transfer, such as a merger or acquisition, subject to this policy and applicable law.

8. Where your data is stored and cross-border transfers

Our main servers are in India (the AWS Asia Pacific (Mumbai) region). This means that if you use TokenNo in Bahrain, your personal data is transferred outside Bahrain to India. Some of our service providers (for example push notification, messaging, translation or maps providers) may also process limited data in other countries.

The PDPL allows personal data to be transferred outside Bahrain to a country or territory that provides an adequate level of protection, for example one included in a list published by the Authority. Transfers to other countries are allowed only with the Authority's authorisation, or in specific cases set out in the PDPL, such as where the data subject has consented to the transfer or where the transfer is necessary to perform a contract with the data subject. Contracts with our providers are a safeguard, not a legal ground for the transfer. Our ground for the transfer to India is [the Authority's authorisation / your consent, collected separately at sign-up, together with the transfer being necessary to perform our contract with you] [counsel to confirm whether India is on any list of adequate jurisdictions published by the Authority, and which ground to rely on]. We also limit the data transferred to what is needed to provide the service, use written contracts with our providers that require them to protect your data to a standard consistent with the PDPL, and apply the security measures in section 12. [Counsel to confirm whether any data localisation rule applies to booking data with healthcare vendors (see section 3.4).]

[Business to consider whether to host Bahrain data in Bahrain (for example in the AWS Middle East (Bahrain) region) or in another GCC cloud region.]

9. Your rights and how to use them

Under the PDPL, you have the right to:

Be informed about how your personal data is processed, including who processes it and why, when the data is collected (this policy is part of that).
Access your personal data: to be told whether we process your data and to receive a copy of it, together with information about its source, the purposes of processing and the recipients it was disclosed to.
Correct, erase or block your personal data if it is inaccurate or incomplete, or if it is being processed in breach of the PDPL, unless we must keep it to meet a legal obligation (for example payment and VAT records).
Withdraw your consent at any time where we rely on consent.
Object to direct marketing at any time.
Object to processing that causes, or is likely to cause, material or moral damage to you or to another person.
Object to decisions based solely on automated processing that significantly affect you. TokenNo does not make decisions about customers based solely on automated processing that have legal or similarly significant effects on them.
Complain to us and to the Authority (see section 10).

[Counsel to confirm the list and limits of data subject rights under the PDPL and the resolutions issued under it.]

You can use these rights:

In the app: go to Profile to edit your name and language, see and manage your bookings, manage notifications and location permission, and delete your account.
By email: write to info@tokenno.com with the subject "Privacy request", from or mentioning the mobile number on your account. To protect you, we may ask you to confirm a one-time password sent to that number.

We will respond without undue delay and within the period required by the PDPL, which we currently understand to be [15 working days] [counsel to confirm the response period]. We do not charge a fee for these requests unless the law allows one [counsel to confirm]. If a request relates to a vendor's own records, we will tell you and pass it to the vendor where appropriate.

10. Data Protection Guardian and how to complain

If you have a question or complaint about your personal data, please contact our Data Protection Guardian / Privacy Officer:

Name: [Data protection officer name]
Address: [TokenNo Gulf entity legal name], [registered address]
Email: info@tokenno.com (subject: "Privacy")
Phone: [contact phone]
Hours: [working days and hours, Bahrain time]

[Mandatory pre-launch item for Bahrain in the compliance register: either notify the Authority before processing begins, or appoint and register a data protection guardian with the Authority. Once decided, this section will name the guardian or confirm the notification. Counsel also to confirm whether any processing needs the Authority's prior authorisation, and whether a representative in Bahrain is required.]

We aim to acknowledge your complaint within [2] working days and to resolve it within [15 working days] [counsel to confirm].

If you are not satisfied with our response, you may file a complaint with the Personal Data Protection Authority, the authority that receives complaints under the PDPL [counsel to confirm the complaint process and contact details]. Consumer complaints can also be raised with the Ministry of Industry and Commerce (Consumer Protection Directorate) under the Consumer Protection Law, Law No. 35 of 2012 [counsel to confirm the current name of the ministry and directorate].

11. How long we keep your data

We keep personal data only as long as needed for the purpose it was collected for, or as long as the law requires. Our draft retention periods are [counsel to confirm all retention periods]:

Account data (mobile number, name, language): while your account is active. If you delete your account, we delete or anonymise it within [30] days, except what we must keep by law.
Bookings and token history: for [3 years] after the visit, so that you can see past bookings and use "book again", and so that disputes can be handled.
Guest numbers and numbers entered by vendors: deleted, or kept only as an irreversible hash to honour a "stop inviting me" request, within [30 days] after the visit, unless the person creates their own TokenNo account (section 3.5) [counsel to confirm].
Live location: deleted within [24 hours] after the token closes (section 5).
Payment, refund, payout and tax records: for the period required by Bahraini law, including the record-keeping rules of the Value Added Tax Law (Decree-Law No. 48 of 2018) and commercial record-keeping rules (currently understood to be at least [5] years) [counsel and tax advisor to confirm].
Vendor KYC documents: for as long as the vendor uses TokenNo and for [5 years] afterwards, or longer if required by anti-money-laundering or other law [counsel to confirm].
Audit and security logs: for [1 year].
Device push tokens: until you log out, uninstall the app or the token expires.
Inactive accounts: we may delete accounts with no activity for [period] after giving you notice.

When the retention period ends, we delete the data or make it anonymous.

12. How we protect your data

We use appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure or access, including:

encryption of data in transit (HTTPS/TLS) and at rest;
OTP-based login, role-based access for vendor staff and least-privilege access for our own team;
storing only a secure hash of Integration API keys, signed webhooks and audit logs of API use;
payment card details handled only by the PCI-DSS compliant payment gateway;
monitoring, backups, risk assessments and regular security reviews; and
contracts with our service providers requiring them to protect personal data.

No system is completely secure. If a personal data breach happens that is likely to harm you, we will tell the affected people without undue delay and notify the Authority where the law requires it or where we consider it appropriate [counsel to confirm whether the PDPL or resolutions issued under it impose a mandatory breach notification duty and, if so, the timelines].

13. Children

TokenNo accounts are meant for adults with full legal capacity. We currently require account holders to be at least [21] years old [counsel to confirm the minimum age, given that the age of majority under the Bahraini Civil Code (Legislative Decree No. 19 of 2001) is understood to be 21, and whether users aged 18 to 20 may hold accounts].

If you are under that age, please ask a parent or legal guardian to book for you.
A parent or legal guardian may book a token for a child (for example at a children's clinic) and enter the child's name. By doing so, they confirm they are the child's parent or legal guardian and consent to us processing the child's name for that booking.
We do not knowingly collect personal data directly from children, track children, monitor their behaviour, or show them targeted advertising. The TokenNo apps and website are not directed at children.

[Counsel to confirm: how the PDPL applies to consent given on behalf of a minor by a parent or legal guardian, and any additional safeguards required for children's data.]

If you believe a child has created an account without consent, contact info@tokenno.com and we will delete it.

14. Cookies and similar technologies

Our website and web views (for example the guest token page) use essential cookies or local storage to keep you logged in and remember your language. We use [analytics tool, if any] only with your consent where consent is required. You can control cookies in your browser.

15. Changes to this policy

We may update this policy. If we make important changes, we will tell you in the app or by message before they take effect and, where the law requires, ask for your consent again. The "last updated" date at the top shows when it last changed.

16. Language

This policy is available in English and Urdu. The [Arabic/English] version prevails if there is any difference; the Urdu version is a translation provided for convenience. Until an Arabic version is published, the English version prevails. [Counsel to confirm: an Arabic version is very likely required in Bahrain (the Consumer Protection Law, Law No. 35 of 2012); when it is added it is expected to be the prevailing consumer text.]

17. Contact us

[TokenNo Gulf entity legal name] [registered address] Email: info@tokenno.com