Privacy Policy
Last updated: 11 October 2026
This Privacy Policy explains how NOCKO Information Technology L.L.C ("NOCKO", "we", "us") collects, uses, stores and shares personal data when you use the Spotipol service at https://spotipol.com, app.spotipol.com and wifi.spotipol.com (the "Service"). We process personal data in line with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and other applicable laws.
1. Who we are
NOCKO Information Technology L.L.C, Office M-02-370, Al Khabeesi Building, Al Khabeesi, Dubai, United Arab Emirates. Contact for privacy matters: [email protected].
2. Two kinds of users
- Business customers ("Venues"): restaurants, cafés and other businesses that use the Service to offer guest WiFi and manage their guest contacts. For guest data collected through a Venue's WiFi, the Venue is the data controller and we act as its data processor.
- Guests: people who connect to a Venue's guest WiFi through a Spotipol login page. If you are a guest, the Venue decides which details are requested and how they are used; we provide the technology.
3. Data we collect
From Venues (account holders)
- Name, work email, password (stored only as a one-way hash), company name and locations.
- WiFi controller connection details, including API keys, stored encrypted.
- Login page settings, logos and images you upload.
- Usage and audit logs of actions in the dashboard.
From Guests (through a Venue's login page)
- The details the Venue asks for on its login page — typically mobile number and first name; optionally last name, email, date of birth and gender.
- Your marketing consent choice (never pre-ticked) and acceptance of the WiFi terms, with the exact text shown and the time.
- Technical data needed to let your device online: device MAC address, the access point and WiFi network name, IP address, browser type, login time and session length.
- Verification codes sent by SMS are stored only as a one-way hash and expire within minutes.
- If a Venue enables Creator login with Instagram and you choose it: your Instagram user ID, username, name, profile picture, account type and follower, following and media counts, as permitted by Meta. We do not receive your Instagram password, email, phone number, direct messages or posts. You can revoke access at any time in Instagram → Settings → Apps and websites.
From website visitors
- Demo requests you submit on https://spotipol.com (name, company, email, phone, message).
- Approximate country derived from your IP address, used only to show prices in the right currency. We do not use advertising cookies or third-party analytics on this website.
4. Why we use the data
| Purpose | Legal basis |
|---|---|
| Connecting a guest device to the internet and keeping the WiFi secure (session limits, abuse prevention) | Performance of the service requested by the guest; legitimate interest of the Venue |
| Sending a one-time verification code by SMS | Performance of the service |
| Remembering a returning device so the guest does not fill in the form every time | Legitimate interest; the Venue sets how often the form is shown |
| Marketing messages from the Venue (offers, birthday treats) | Guest's explicit consent; withdraw at any time |
| Showing a Venue statistics about its guests (new, returning, opt-in rate) | Legitimate interest of the Venue |
| Running and securing Venue accounts, billing, support | Contract with the Venue |
| Legal obligations (e.g. lawful requests from authorities) | Legal obligation |
5. Where data is stored
All Service data is hosted in the United Arab Emirates (Oracle Cloud, UAE Central (Abu Dhabi)). Each Venue sees only the guests collected at its own locations. We do not sell personal data.
6. Who we share data with
- The Venue whose WiFi you used — it receives the details you entered and your consent choices.
- SMS delivery providers, to send verification codes and, where you consented, the Venue's messages (phone number and message text only).
- Hosting and infrastructure providers in the UAE, bound by data-processing terms.
- Meta Platforms, only if you choose Creator login with Instagram, as described in Meta's own privacy policy.
- Authorities where required by law.
We do not share guest data between different Venues.
7. How long we keep data
- Guest profiles: for as long as the Venue uses the Service and the guest has visited within the last 24 months; inactive profiles are anonymised after that.
- WiFi session and technical logs: up to 12 months, as commonly required for network security and lawful requests.
- Consent records: for as long as the related guest profile exists plus 12 months, so that consent can be evidenced.
- Verification codes: minutes. Instagram data: until you revoke access or request deletion.
- Venue account data: for the life of the account and up to 12 months after closure, unless law requires longer (e.g. invoices).
8. Your rights
Subject to the PDPL you may ask to access, correct, delete or receive a copy of your personal data, object to or restrict its processing, and withdraw marketing consent at any time. Guests may send requests to us or directly to the Venue; we will help the Venue respond. See Data Deletion for the quickest way to have your data removed. We answer within 30 days. You may also complain to the UAE Data Office.
9. Security
Data is transmitted over HTTPS only. Passwords and verification codes are stored as hashes; WiFi controller credentials are encrypted at rest. Access to guest data is limited to the Venue's authorised users and to our staff who need it to run the Service, and all dashboard actions are logged.
10. Children
The Service is intended for adults. Venues should not ask guests under 18 for personal data beyond what is needed to provide WiFi access.
11. Changes
We may update this policy. The date at the top shows the current version; material changes are announced to Venues by email and on this page.
12. Contact
NOCKO Information Technology L.L.C, Office M-02-370, Al Khabeesi Building, Al Khabeesi, Dubai, United Arab Emirates — [email protected].