1. INTRODUCTION & SCOPE

• Goom ("Goom", "we", "our", or "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, store, retain and otherwise process your personal data when you access or use the Goom mobile application, website and related services (collectively, the "Platform").

• For purposes of applicable UAE data-protection law, GOOMER SOFTWARE SOLUTIONS FZCO is the entity responsible for determining the purposes and means of processing personal data through the Platform, except where another entity is expressly identified as the controller for a particular processing activity.

• Goom provides a platform through which parents and legal guardians can discover and book activities for children. The Platform may process information relating to a child, including the child's age and interests, to facilitate activity discovery, determine activity suitability and provide personalised recommendations.

• This Privacy Policy applies to personal data collected through the Platform and through your interactions with Goom in connection with the services provided through the Platform. This Privacy Policy is intended to be read in accordance with applicable laws of the United Arab Emirates, including Federal Decree-Law No. 45 of 2021 concerning the Protection of Personal Data, as applicable to Goom and its processing activities.

• Where the processing of personal data is subject to mandatory requirements under applicable law, those requirements shall apply notwithstanding anything inconsistent in this Privacy Policy.

• This Privacy Policy provides information about how Goom processes personal data and does not, by itself, constitute consent to any processing for which consent is required under applicable law. Where Goom relies on consent as the legal basis for processing, such consent will be obtained through an appropriate mechanism that is clear, specific, informed and capable of being withdrawn in accordance with applicable law.

2. CHANGES TO THIS PRIVACY POLICY

• our Platform or services;

• the manner in which we collect, use or process personal data;

• applicable legal or regulatory requirements; or

• our privacy and security practices.

3. DATA WE COLLECT

Information You Provide Directly

• full name;

• email address;

• telephone/mobile number;

• account credentials;

• payment-related information;

• booking and transaction information;

• communications, enquiries, feedback or complaints submitted to us; and

• other information voluntarily provided by you through the Platform.

Child Information Provided by a Parent or Guardian

• first name;

• age;

• interests;

• preferences; and

• information relating to activity suitability.

• Only a parent, legal guardian or other person legally responsible for the Child ("Child Caregiver") may create an account and submit personal data relating to a Child through the Platform. The Child Caregiver represents and confirms that they are authorised to provide such information and, where required by applicable law, to provide consent to its collection and processing.

• Goom will only request additional information concerning a Child where reasonably necessary for the provision or safe facilitation of a Service and where permitted by applicable law.

• Goom does not knowingly seek to collect unnecessary information relating to children.

• Children Under 13. Where Goom collects, processes, publishes or shares personal data relating to a Child under the age of 13 through the Platform, Goom will do so only where the requirements of applicable law are satisfied, including obtaining explicit, documented and verifiable parental or Child Caregiver consent where required. Goom will provide a clear explanation of the purpose of collecting and using the Child's personal data and will provide an accessible mechanism for withdrawal of consent. Goom will limit access to such data to authorised persons and only to the extent necessary to provide the relevant services. Goom will not use the personal data of Children under 13 for targeted electronic advertising, commercial purposes or tracking beyond the purpose for which the data was authorised, except where expressly permitted by applicable law.

Information We Collect Automatically

• device information;

• IP address;

• application and device activity logs;

• information regarding your interaction with the Platform;

• activities viewed;

• bookings made;

• preferences and interactions with the Platform; and

• other technical information generated through your use of the Platform.

Information We Receive from Third Parties

• payment processors in connection with payment transactions;

• activity providers in connection with bookings; and

• service partners providing analytics, hosting or other Platform functionality.

Sensitive or Special Personal Data

• Goom does not intend to collect sensitive personal data unless it is reasonably necessary for the provision or safe facilitation of a service and permitted under applicable law.

• Where a parent, Child Caregiver or Provider provides information concerning a Child's allergies, medical needs, health conditions, behavioural needs or similar information for activity suitability or safety purposes, Goom will limit the collection, use and disclosure of such information to what is reasonably necessary for the relevant purpose and will apply the safeguards required under applicable law.

4. HOW WE USE PERSONAL DATA

To Provide the Platform and Facilitate Bookings

• create and maintain user accounts;

• enable activity discovery;

• facilitate activity bookings;

• process and confirm payments;

• provide booking confirmations;

• communicate information relating to bookings; and

• provide customer support.

To Provide Personalised Recommendations

• identify activities that may be suitable for the child;

• personalise recommendations; and

• improve the relevance of activities displayed to the parent or guardian.

To Communicate With You

• respond to enquiries and requests;

• provide customer support;

• communicate booking confirmations and updates;

• communicate information concerning the Platform; and

• provide other service-related communications.

• understand how users interact with the Platform;

• analyse Platform usage;

• improve functionality and user experience;

• identify technical issues;

• develop and improve features; and

• understand general usage trends.

• protect the security of user accounts and the Platform;

• detect and prevent unauthorised access;

• detect, investigate and prevent fraud or misuse;

• protect the rights and safety of users and other persons; and

• maintain the integrity and security of our systems.

• comply with applicable laws and regulations;

• respond to lawful requests from governmental, regulatory or law-enforcement authorities;

• establish, exercise or defend legal claims; and

• comply with legal, regulatory or contractual obligations.

5. LEGAL BASIS FOR PROCESSING PERSONAL DATA

• with the consent of the Data Subject, where consent is required;

• where processing is necessary to perform a contract with the Data Subject or to take steps at the Data Subject's request before entering into a contract;

• where processing is necessary to comply with a legal obligation;

• where processing is necessary to protect the vital or legitimate interests of the Data Subject where permitted by applicable law;

• where processing is necessary for the establishment, exercise or defence of legal claims;

• where processing is necessary for a purpose expressly permitted by applicable UAE law, including applicable public-interest or public-health grounds; or

• on any other basis expressly permitted by applicable law.

6. COOKIES & TRACKING TECHNOLOGIES

• enable Platform functionality;

• remember preferences;

• understand how users interact with the Platform;

• analyse Platform performance;

• improve user experience; and

• support analytics and other permitted functionality.

• Essential technologies: necessary for the operation and security of the Platform;

• Analytics technologies: used to understand Platform usage and performance; and

• Functional technologies: used to remember preferences or support Platform functionality.

Your Choices

• Where consent is required under applicable law, Goom will obtain consent before placing or accessing non-essential cookies or similar tracking technologies.

• You may also manage certain cookie or tracking preferences through your browser or device settings. Disabling certain technologies may affect the functionality of the Platform.

7. HOW WE SHARE PERSONAL DATA

• Goom does not sell personal data to third parties.

• We may share personal data with third parties where necessary to provide the Platform, fulfil bookings, process transactions, provide technical services, comply with legal obligations, or otherwise for the purposes described in this Privacy Policy.

Activity Providers

• When you make a booking through the Platform, Goom may share relevant information with the applicable activity provider in order to complete and fulfil the booking.

• Goom will share only the personal data reasonably necessary for the relevant booking or service. Where the information relates to a Child, Goom will limit the information shared to what is necessary for booking fulfilment, activity suitability, safety or safeguarding, and will apply any additional restrictions required by applicable law.

• The information shared with a Provider may include information reasonably necessary to identify the Child, fulfil the Booking, provide the relevant Service, address safety requirements or otherwise facilitate the Service. Providers may independently process personal data in accordance with their own privacy policies and applicable law.

Payment Processors

• We may share relevant information with third-party payment processors to facilitate and process payments and confirm transaction status.

• Payment processors may independently process personal data in accordance with their own privacy policies and applicable law.

Service Providers

• analytics;

• hosting;

• application functionality;

• technical support;

• security;

• payment processing; and

• other services necessary to operate the Platform.

• comply with a lawful request or legal obligation;

• respond to court orders or governmental requests;

• protect the rights, property or safety of Goom, users or others;

• investigate fraud or security incidents; or

• establish, exercise or defend legal claims.

8. INTERNATIONAL DATA TRANSFERS

• Goom may use third-party service providers whose systems, infrastructure or personnel are located outside the United Arab Emirates. Accordingly, personal data may be transferred to or processed in jurisdictions outside the UAE.

• Where Goom transfers or permits access to personal data outside the UAE, Goom will do so only in accordance with applicable UAE data-protection requirements and the applicable conditions and safeguards governing cross-border transfers. Depending on the circumstances, this may include relying on an approved protection mechanism, appropriate contractual safeguards, consent or another transfer ground permitted by applicable law.

• Where required by applicable law, Goom will provide information concerning relevant cross-border transfers and applicable safeguards through this Privacy Policy or another appropriate notice.

9. DATA RETENTION

• Goom retains personal data only for as long as reasonably necessary to fulfil the purposes for which the data was collected, including providing the Platform, fulfilling bookings, maintaining accounts, resolving disputes, preventing misuse and complying with legal obligations.

• Account and Service Data: Personal data associated with an account may be retained for as long as reasonably necessary to maintain the account and provide the requested services.

• Booking and Transaction Data: Booking and transaction-related information may be retained for as long as reasonably necessary for fulfilment of bookings, customer support, dispute resolution, accounting, legal or regulatory purposes.

• Child Information: Child information will be retained only for as long as reasonably necessary for the purposes for which it was collected or as otherwise required or permitted by applicable law.

Deletion

• Users may request deletion of their account and associated personal data through the account-deletion functionality available in the App, where available, or by contacting Goom at support@goom.fit.

• Deletion requests may be subject to applicable legal, regulatory, contractual or other lawful retention requirements. Once personal data is no longer required, Goom will take reasonable steps to securely delete or anonymise it in accordance with applicable law.

10. DATA SECURITY

• Goom takes the security of personal data seriously and implements appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, misuse or destruction.

• Goom may use encryption, access controls, secure servers and other technical and organisational measures appropriate to the nature and risks of the processing.

• Although Goom takes reasonable measures to protect personal data, no method of electronic transmission or storage is completely secure. Accordingly, Goom cannot guarantee the absolute security of personal data transmitted to or stored through the Platform.

11. PERSONAL DATA BREACHES

• If Goom becomes aware of a personal data breach, Goom will assess, investigate and manage the incident in accordance with applicable UAE data-protection law.

• Where notification to the competent authority or affected Data Subjects is required by applicable law, Goom will make the required notification within the applicable statutory timeframe and in accordance with the applicable legal requirements.

• Goom may take reasonable measures to contain, investigate and remediate a personal data breach and to prevent recurrence.

12. YOUR RIGHTS

• the right to obtain information concerning the processing of personal data;

• the right to access personal data;

• the right to request correction or completion of inaccurate or incomplete personal data;

• the right to request erasure where the conditions for erasure under applicable law are satisfied;

• the right to request restriction or cessation of processing where applicable;

• the right to object to certain processing where applicable;

• the right to data portability where applicable; and

• the right to withdraw consent where processing is based on consent.

Right to Obtain Information

• the categories of personal data being processed;

• the purposes of processing;

• automated processing, including profiling;

• the categories of entities or sectors with which your personal data is shared;

• applicable storage and retention arrangements; and

• available procedures for correction, erasure, restriction and objection.

Right to Erasure

• You may request deletion of your personal data where the conditions for erasure under applicable law are satisfied.

• To exercise your rights, please contact Goom using the contact information provided in Section 16. Goom may take reasonable steps to verify the identity of the person making a request before responding.

• Where a request relates to a child's personal data, Goom may also require reasonable evidence of the requester's identity and authority to act on behalf of the child.

13. CHILDREN'S PRIVACY

Parent/Guardian Accounts

• Only a parent, legal guardian or other authorised Child Caregiver may create an account and submit information relating to a Child.

• By submitting Child information, the parent, legal guardian or other authorised Child Caregiver confirms that they are authorised to provide such information and, where required by applicable law, have obtained the necessary consent.

Children Under 13

• Goom does not knowingly permit Children under the age of 13 to create or operate independent accounts on the Platform where such use is prohibited by applicable law. Child information may be submitted by a parent, Child Caregiver or other authorised person for the purpose of discovering, booking or safely participating in activities.

• Where Goom collects, processes, publishes or shares personal data relating to a Child under 13, Goom will comply with the requirements applicable to children's personal data, including obtaining explicit, documented and verifiable parental or Child Caregiver consent where required by law.

• Goom will provide a clear explanation of the purpose for which the Child's personal data is collected and used and will provide a readily accessible mechanism for withdrawal of parental consent.

• Goom will restrict access to personal data relating to Children under 13 to authorised persons and to the minimum extent necessary to provide the relevant services.

• Goom will not use personal data relating to Children under 13 for targeted electronic advertising, commercial purposes or tracking beyond the purpose for which the data was authorised, except where expressly permitted by applicable law.

• access to their child's personal data;

• correction of inaccurate information;

• deletion of their child's personal data;

• restriction or cessation of processing; and

• withdrawal of consent where processing is based on consent.

14. THIRD-PARTY LINKS

• The Platform may contain links to third-party websites, applications or services.

• Such third parties operate independently from Goom and may have their own privacy policies and practices.

• Goom is not responsible for the privacy practices of third-party websites, applications or services that are not controlled by Goom. Users should review the privacy policy of any third-party service before providing personal data.

15. COMPLAINTS

• Goom is committed to addressing privacy concerns and complaints relating to the processing of personal data. If you have a question, concern or complaint regarding the manner in which Goom processes personal data, please contact Goom using the contact details provided below.

• Goom will review and address complaints in accordance with its applicable procedures and legal obligations.

• If you are not satisfied with Goom's response to your privacy complaint, you may lodge a complaint with the UAE Data Office, subject to the procedures and requirements applicable under UAE law.

16. CONTACT INFORMATION

1. PURPOSE AND SCOPE

• This Children's Personal Data and Parental Consent Policy ("Policy") explains how Goom ("Goom", "we", "us" or "our") collects, uses, protects and handles Personal Data relating to Children and how parental or Guardian consent is obtained and managed where required by applicable UAE law.

• This Policy applies to the processing of Children's Personal Data through the Goom Platform and in connection with Services made available through the Platform.

• This Policy should be read together with Goom's Privacy Policy and Terms of Service. In the event of any inconsistency, the provisions of applicable law shall prevail.

2. GOOM'S APPROACH TO CHILDREN'S DATA

• Goom is committed to protecting the privacy, safety and Personal Data of Children and will process Children's Personal Data only for lawful, specified and reasonably necessary purposes in accordance with applicable UAE law.

• Goom will apply appropriate technical and organisational measures to protect Children's Personal Data against unauthorised access, disclosure, alteration, loss, misuse or other unlawful processing.

• Goom will limit access to Children's Personal Data to authorised persons and only to the extent reasonably necessary for the relevant purpose or Service, subject to applicable law.

3. WHO IS A CHILD?

• For the purposes of this Policy, "Child" means a natural person who falls within the applicable definition of a child under UAE law.

• Goom will apply the safeguards required by applicable UAE law based on the Child's age and the nature and purpose of the processing.

• In particular, where a Child is under thirteen (13) years of age, Goom will comply with the specific requirements and safeguards applicable to Children under the UAE Child Digital Safety Law, including requirements concerning parental or Guardian consent and age verification where applicable.

4. PARENTAL / GUARDIAN CONSENT

• Goom will obtain parental or Guardian consent where such consent is required under applicable UAE law before collecting or processing a Child's Personal Data for the relevant purpose.

• Where the Child is under thirteen (13) years of age and the requirements of the UAE Child Digital Safety Law apply, Goom will obtain and maintain the required parental or Guardian consent before collecting, processing, publishing or sharing the Child's Personal Data, except where otherwise permitted or required by applicable law.

• Where parental or Guardian consent is required, Goom will take reasonable measures to ensure that the consent is informed, specific to the relevant processing, demonstrable and capable of being withdrawn in accordance with applicable law.

• Goom may take reasonable measures to verify the identity and authority of a person providing parental or Guardian consent, particularly where required by applicable law or reasonably necessary to protect the Child's Personal Data.

• Where applicable law requires a particular form, record, verification method or other safeguard for parental or Guardian consent, Goom will implement the applicable requirement.

5. WHAT CHILDREN'S PERSONAL DATA MAY BE COLLECTED

• the Child's name, age or date of birth;

• information about the Child's activities, interests or preferences where reasonably necessary to facilitate or personalise a Service;

• information concerning the Child's gender, where voluntarily provided and reasonably necessary;

• information relating to the Child's participation in or booking of a Service;

• photographs or other content involving the Child where provided or collected for a lawful and specified purpose;

• health, medical, allergy, medication, accessibility or behavioural information where reasonably necessary for the Child's safe participation in a Service; and

• emergency contact or other safety-related information where reasonably necessary.

• Goom will seek to limit the collection of Children's Personal Data to information that is reasonably necessary for the relevant purpose and will not require additional information merely for convenience.

• Where Children's Personal Data constitutes Sensitive Personal Data under applicable UAE law, Goom will process such information only where there is a lawful basis to do so and subject to the additional safeguards required by applicable law.

6. HOW GOOM USES CHILDREN'S PERSONAL DATA

• facilitating or administering a Booking or Service requested by a Parent or Guardian;

• communicating with a Parent or Guardian regarding a Child's Booking or participation;

• providing relevant safety, accessibility, medical or emergency support where reasonably necessary;

• communicating relevant Service information to Providers where necessary to deliver the booked Service;

• maintaining the security and integrity of the Platform;

• complying with applicable legal or regulatory requirements; and

• other purposes expressly disclosed to the Parent or Guardian and permitted by applicable law.

• Goom will not use Children's Personal Data for a purpose that is incompatible with the purpose for which it was collected, except where such use is permitted or required by applicable law.

• Goom will not knowingly use Children's Personal Data for targeted electronic advertising or other prohibited commercial purposes where such use is prohibited by applicable UAE law.

7. SHARING CHILDREN'S PERSONAL DATA

• Goom may share a Child's Personal Data with a Provider where reasonably necessary to facilitate or deliver a Service booked through the Platform.

• Goom will limit information shared with a Provider to the information reasonably necessary for the relevant Service, safety requirements or other lawful purpose.

• Providers receiving Children's Personal Data through Goom must handle such information in accordance with their contractual obligations with Goom and applicable UAE law and must not use the information for an incompatible purpose.

• Goom may also disclose Children's Personal Data where reasonably necessary to comply with applicable law, respond to a lawful request from a competent authority, protect the safety of a Child or another person, or prevent or address fraud, misuse or security incidents.

8. AGE VERIFICATION AND SAFETY MEASURES

• Goom may implement reasonable age-verification or age-assurance measures where required by applicable UAE law or reasonably necessary to implement its child-safety obligations.

• Where Goom collects information for age verification or parental or Guardian verification, Goom will use such information only for the relevant verification, compliance, security or other lawful purpose and will apply appropriate safeguards.

• Goom will seek to avoid collecting or retaining more information for age or parental verification than is reasonably necessary for the relevant purpose, subject to applicable legal or regulatory requirements.

9. WITHDRAWAL OF PARENTAL / GUARDIAN CONSENT

• Where processing of a Child's Personal Data is based on parental or Guardian consent, the Parent or Guardian may withdraw that consent in accordance with applicable law.

• Goom will provide an appropriate mechanism for submitting a withdrawal request where required by applicable law.

• Following withdrawal of consent, Goom will cease the relevant consent-based processing where required by applicable law, subject to any Personal Data that Goom is otherwise permitted or required to retain or process under another lawful basis.

• Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal, where permitted by applicable law.

• Where withdrawal affects an existing Booking or Service, Goom may retain or process information reasonably necessary to administer that Booking, comply with legal obligations, resolve disputes, protect rights or interests, or otherwise comply with applicable law.

10. RETENTION AND DELETION

• Goom will retain Children's Personal Data only for as long as reasonably necessary to fulfil the purpose for which it was collected, or as otherwise required or permitted by applicable UAE law.

• Where the relevant purpose has been fulfilled and Goom is not otherwise required or permitted to retain the information, Goom will take reasonable steps to delete, anonymise or securely dispose of the relevant Children's Personal Data in accordance with applicable law.

• Where a Parent or Guardian withdraws consent or requests deletion of a Child's Personal Data, Goom will assess and action the request in accordance with applicable law, taking into account any legal, contractual, security or dispute-related requirements that may permit or require continued retention or processing.

11. PARENTAL / GUARDIAN RIGHTS

• Subject to applicable UAE law, a Parent or Guardian may have the right to request access to, correction of, deletion of, or other appropriate action concerning a Child's Personal Data held by Goom.

• A Parent or Guardian may submit a request relating to a Child's Personal Data using the contact details provided in this Policy or through any applicable mechanism made available by Goom.

• Goom may take reasonable steps to verify the identity and authority of the person making a request before providing access to or taking action in relation to a Child's Personal Data.

• Goom will respond to requests in accordance with applicable UAE law and may refuse, restrict or defer a request where permitted or required by law.

12. SECURITY OF CHILDREN'S PERSONAL DATA

• Goom will implement appropriate technical and organisational measures designed to protect Children's Personal Data against unauthorised access, disclosure, alteration, loss, misuse or other unlawful processing.

• Access to Children's Personal Data will be limited to authorised persons who require access for a legitimate and lawful purpose and only to the extent reasonably necessary for that purpose.

• Where a security incident affects Children's Personal Data, Goom will take reasonable steps to investigate, contain and remediate the incident and will make any notifications required by applicable UAE law.

• Goom will maintain appropriate safeguards proportionate to the nature and risks of processing Children's Personal Data, including where such information constitutes Sensitive Personal Data under applicable UAE law.

13. PROVIDER RESPONSIBILITIES

• Providers that receive or access Children's Personal Data through Goom must handle such information in accordance with their contractual obligations with Goom and applicable UAE law.

• Providers must use Children's Personal Data only for the authorised purpose for which it was disclosed and must not sell, commercially exploit, disclose or otherwise use such information for an incompatible purpose, except where permitted or required by applicable law.

• Providers must take appropriate measures to protect Children's Personal Data against unauthorised access, disclosure, loss, misuse or other unlawful processing.

• Where reasonably necessary, Goom may require Providers to provide information or reasonable assistance concerning their handling of Children's Personal Data.

14. COMPLAINTS AND CONCERNS

• A Parent or Guardian who has a question, concern or complaint regarding Goom's processing of a Child's Personal Data or the handling of parental or Guardian consent may contact Goom using the contact details provided in this Policy.

• Goom will review and respond to complaints or concerns within a reasonable period and in accordance with applicable UAE law.

• Nothing in this Policy limits any rights or remedies available to a Parent, Guardian or Child under applicable UAE law.

15. CHANGES TO THIS POLICY

• Goom may update this Policy from time to time to reflect changes to its services, data-processing practices, applicable law or regulatory requirements.

• Where required by applicable law, Goom will provide appropriate notice of material changes and obtain any additional consent required before implementing changes that affect consent-based processing of Children's Personal Data.

• The latest version of this Policy will be made available through the Goom Platform and will identify its effective date and, where appropriate, the date on which it was last updated.

16. GOVERNING LAW

• This Policy shall be governed by and interpreted in accordance with the applicable laws of the United Arab Emirates.

• Goom will comply with applicable UAE data protection, child protection and child digital safety requirements governing the collection, processing, use, disclosure and retention of Children's Personal Data.

• Nothing in this Policy limits or excludes any mandatory rights or protections available to a Child, Parent or Guardian under applicable UAE law.

17. CONTACT INFORMATION