UAE Data Protection Notice

Company Identification:
This Annex forms part of the Data Processing Agreement between Tanqory Inc. and the Customer and applies when personal data is processed subject to the data protection laws of the United Arab Emirates (UAE), including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, its Executive Regulations, and, where relevant, free-zone frameworks such as ADGM DPR 2021 and DIFC DPL 2020.

This notice explains in clear, practical terms how Tanqory collects, uses, discloses, transfers, and protects personal data under UAE data protection laws. It is aligned with our DPA and global privacy program so merchants, partners, and users understand purposes, lawful bases, cross-border safeguards, rights, security, breach handling, and our approach to sensitive data and children. Where we operate in free zones (ADGM, DIFC), we also apply the specific requirements of those regimes alongside UAE federal law.

Scope and roles

This notice applies to merchants, developers, end customers of merchants, users of our apps/services, and visitors whose data is processed subject to UAE law. Tanqory acts as processor when handling merchant customer data and as controller when providing services directly (e.g., merchant accounts, billing, payments, support, platform analytics). It covers data you provide, data merchants provide about you, and data generated by Tanqory systems (logs, telemetry, analytics), including data routed to third-party systems. We state purposes clearly, limit collection to what is necessary, and provide notices in English (and Arabic where required by user base or law) to support transparency and fairness. When operating in ADGM/DIFC, we follow those regimes’ controller/processor definitions, registration, DPIA, and transfer rules as applicable.

What we collect and why

• Account and contact data (name, email, phone, business address, role): To create/manage accounts, authenticate, provide support, and issue invoices. Basis: contract or consent (where required).
• Transaction and payment data (orders, refunds, disputes, payment tokens via providers): To fulfill services, manage fraud/chargebacks, and meet financial/tax/AML obligations. Basis: contract and legal obligation.
• Technical and event data (IP, device/browser, event logs, cookies/pixels, language/time zone): To secure services, prevent abuse, and improve performance and features. Basis: legitimate interests and consent for non-essential cookies/trackers, supported by balancing tests.
• Merchant customer data: Orders, fulfillment, communications, and related metadata processed on behalf of the merchant. The merchant is the controller; Tanqory is processor under the DPA and written instructions.
• Sensitive data (where applicable): Identity documents, biometric verification signals, health or belief data only if strictly needed and lawful (e.g., explicit consent, legal obligation, protection of vital interests, substantial public interest where permitted). Such processing is minimized, access-controlled, encrypted, and logged.
• Children’s data: Collected only with a lawful basis and parental/guardian consent where required by UAE law or free-zone guidance. Default settings maximize privacy; behavioural tracking/targeted advertising for minors is disabled.

We avoid over-collection, use anonymization or pseudonymization where feasible (especially in testing or analytics), and validate accuracy for decisions affecting service eligibility, security, or risk.

Sources of data

• Directly from you: account sign-up, support interactions, device/app telemetry you permit.
• From merchants: order and customer service information needed to process transactions.
• From service providers: payment authorizations, fraud signals, logistics events.
• From public or third-party sources (where lawful): sanctions/PEP lists, industry watchlists for AML/CTF and fraud prevention.

Examples of purposes by category

• Service delivery: account setup, checkout, order fulfillment, shipping updates, invoicing, customer support.
• Risk and compliance: fraud/abuse detection, AML/CTF screening, sanctions checks, chargeback management, security monitoring.
• Product improvement: performance analytics, feature testing, error diagnostics, user-experience tuning (non-essential analytics only with consent where required).
• Legal and disputes: responding to lawful requests, audits, defending claims, enforcing terms, debt collection where permitted.
• Marketing (optional): product updates and offers with opt-in/opt-out controls and consent where required.

Lawful bases, consent, and transparency

We rely on appropriate lawful bases under UAE law (and ADGM/DIFC where applicable): contract performance; legal obligation (financial, tax, AML/CTF, sanctions screening); legitimate interests (security, fraud prevention, service improvement) with documented balancing; explicit consent for sensitive data, non-essential cookies/trackers, and optional marketing; and protection of vital interests where applicable. Consent is specific, informed, freely given, and unbundled from non-essential services; withdrawal is as easy as giving and is honoured promptly. Consent records are maintained. If purposes change materially, we will update notices and seek consent again where required.

We provide layered notices at or before collection describing categories, purposes, recipients, retention, transfer mechanisms, rights, and how to exercise them. For higher-risk processing (e.g., profiling/ADM), Statements of Reasons and DPIAs are produced where required, and summaries can be shared under NDA to support customer compliance.

Lawful basis mapping (illustrative)

• Contract: account management, checkout, payment processing, shipping, support.
• Legal obligation: tax/finance recordkeeping, AML/CTF, sanctions screening, responding to lawful authority requests.
• Legitimate interests: security monitoring, fraud prevention, service reliability, limited product analytics (with minimization and opt-outs where required).
• Consent: marketing communications (where required), non-essential cookies/trackers, sensitive data verification where no other lawful basis applies.
• Vital/public interest: safeguarding life/health, public health or safety where permitted by law.

Individual rights

Under UAE PDPL (and ADGM/DIFC equivalents), you may request:

• Access and copies of your personal data.
• Correction/rectification of inaccurate data.
• Deletion/erasure where data is no longer needed, consent is withdrawn (where consent was the basis), or required by law.
• Restriction or objection to processing in certain cases, including objection to direct marketing.
• Portability where technically feasible and permitted.
• Withdrawal of consent for processing that relies on consent.

We aim to respond within a reasonable period (target: within 30 days) and will inform you if more time is needed for complex requests. Identity verification is required to protect data. If we decline a request, we provide reasons and cite relevant legal grounds (e.g., public security, ongoing investigations, legal obligations). You may escalate complaints to the UAE Data Office or, for free zones, the ADGM Commissioner of Data Protection or DIFC Commissioner, as applicable. We log requests and outcomes for accountability.

How to submit a request

• Email privacy@tanqory.com with “UAE data rights request” in the subject, your contact details, the right you wish to exercise, and information to help us locate your data.
• We may request additional verification (e.g., ID confirmation) to protect your data.
• If your data was provided by a merchant, we may coordinate with that merchant to fulfill your request in line with controller/processor roles.
• Responses are provided securely; portability responses use a structured, machine-readable format where applicable.

Sensitive data and children

Sensitive data (e.g., health, biometric identifiers, religious beliefs, criminal background, identity documents) is processed only when lawful and necessary, with explicit consent or another permitted legal basis, strict access controls, encryption, and audit trails. Criminal offence data is handled only where legally allowed and with heightened safeguards.

For children, parental/guardian consent is obtained where required. Age gates and proportionate age assurance are used; behavioural tracking and targeted ads for minors are disabled. Age-restricted content/features are separated, and guardians can pause or request deletion easily, with an auditable trail. We will adapt to any specific guidance issued by the UAE Data Office or ADGM/DIFC for minors.

Automated decision-making and profiling

Where automated decision-making (ADM) or profiling is used for fraud checks, risk scoring, or personalization, we apply human oversight for decisions that may have significant effects. We provide meaningful information about the logic and consequences where required and offer opt-out from direct marketing profiling. Thresholds and models are reviewed to reduce bias and unintended impacts; DPIAs are conducted for high-risk ADM.

Examples of controls for ADM

• Human review for negative decisions (e.g., blocking transactions or accounts) before final action, unless immediate risk requires temporary holds.
• Regular testing for false positives/negatives and bias across relevant segments.
• Documented escalation paths and appeal channels for impacted users.
• Model/versioning logs and rollback plans to address unintended behaviour.

Cross-border transfers

When transferring personal data outside the UAE, we identify the destination, recipient, purpose, data types, retention, and your rights/choices. We use permitted mechanisms such as:

• Contractual safeguards (e.g., data transfer clauses/model clauses, binding corporate rules where available)
• Transfers to jurisdictions or entities on an approved/adequacy list issued by the UAE Data Office, ADGM, or DIFC
• Explicit consent, necessity for contract, vital/public interest, or other legal derogations where appropriate

Technical/organizational measures include encryption, access controls, logging, and minimization of transferred data. Transfer risk assessments and justifications are recorded, and measures are updated if regulatory guidance changes. Regional hosting options may be offered to reduce cross-border movement where feasible.

Transfers under ADGM/DIFC

Where ADGM DPR 2021 or DIFC DPL 2020 applies, we follow those regimes’ transfer rules, including adequacy/equivalence lists, mandatory contractual clauses, and transfer impact assessments. We will disclose the applicable regime in the contract and ensure appropriate safeguards for onward transfers.

Security and retention

We protect personal data with encryption in transit/at rest (e.g., TLS 1.3/AES-256), RBAC/MFA, segregation of duties, 24x7 monitoring (SIEM/SOC), vulnerability management, and secure development lifecycle practices. Subprocessors are vetted against standards such as SOC 2, ISO 27001, and PCI DSS (for payments). Data is retained only as necessary for stated purposes and legal requirements (e.g., tax/finance) per our retention schedule (https://legal.tanqory.com/legal/data-protection/data-retention-policy); summaries for UAE data are available on request. Data is deleted or anonymized when no longer needed, including from backups on scheduled cycles, with logs kept for compliance.

Retention illustrations

• Account and billing records: Duration of contract plus statutory finance/tax periods.
• Payment and transaction records: Retained per financial/AML obligations and chargeback windows.
• Security logs: Retained for periods necessary to investigate incidents and comply with regulatory expectations.
• Marketing consents/suppression: Retained to demonstrate compliance and honour opt-outs.
• Backups: Deleted on rolling cycles with documented purge timelines.

Breach notification and incident response

If personal data is accessed, disclosed, or altered without authorization, we assess quickly, contain and mitigate, and notify customers within 24 hours. We will notify the UAE Data Office or relevant free-zone authority and affected individuals without undue delay where required (targeting within 72 hours of awareness or sooner if mandated). Notifications include incident details, affected data/systems, likely impacts, remediation steps, and guidance to reduce risk. Post-incident reviews are conducted, and notification decisions/timing are documented.

Anonymization and pseudonymization

Where data is anonymized for analytics or product development, it is rendered non-identifiable and re-identification is prohibited. Pseudonymous data is used internally with mapping kept separately, access-restricted, and not shared externally. If purposes change in ways that affect individuals, notices will be updated.

Cookies and similar technologies

We use strictly necessary cookies for core functionality and security; performance/analytics and marketing cookies/trackers are used only with consent where required. Users can manage preferences via the cookie banner/control centre or browser settings. Our Cookie Policy (https://legal.tanqory.com/legal/platform/cookie-policy) describes categories, purposes, retention, and how to withdraw consent.

Data localization and storage choices

Where customers require or prefer local hosting, we can offer regional storage options where feasible (e.g., UAE or nearby data centres operated by vetted providers). Certain platform telemetry may traverse other regions for resilience and security monitoring; these flows are covered by the transfer safeguards described above. Architecture and data-flow summaries can be shared under NDA to support residency and transfer assessments.

Subprocessors and payments

We engage third-party providers (hosting, cloud, security, analytics, payments) under contracts requiring UAE-compliant data protection and PCI DSS for payment data. Access is limited to need-to-know, and providers are periodically reviewed. For providers outside the UAE, approved transfer mechanisms are applied, and consent/notice is provided where required. The current subprocessor list is available at https://legal.tanqory.com/legal/data-protection/subprocessor-list.

Record-keeping, DPIA, and governance

We maintain Records of Processing Activities for UAE processing, including purposes, categories, recipients, transfers, and retention. DPIAs are performed for high-risk processing (e.g., large-scale profiling, sensitive data, ADM with significant effects), and outcomes inform controls and user disclosures. Data protection governance assigns owners for key processes, and training covers UAE PDPL/ADGM/DIFC requirements, security, and incident response. Change management logs material updates to data flows or purposes.

Data accuracy, fairness, and minimization

We take reasonable steps to keep personal data accurate and up to date for its intended use, prompt users or merchants to correct inaccuracies, and restrict use of stale data in decisioning. Data minimization principles are applied in design, collection, storage, and access. Fairness is assessed when introducing new analytics or ADM to avoid discriminatory outcomes contrary to UAE legal and ethical expectations.

Vendor oversight and audits

Vendors and subprocessors undergo due diligence covering security, privacy, compliance, and financial stability. Contracts include confidentiality, data protection, breach notification, audit/inspection rights where appropriate, and flow-down of relevant obligations. High-risk vendors may be subject to periodic reassessment, certification reviews, and evidence of control effectiveness.

Training and accountability

Tanqory personnel receive role-based training on UAE PDPL/ADGM/DIFC requirements, security, incident response, and privacy-by-design. Managers are accountable for embedding controls in their teams’ processes. Key policies (information security, access control, data handling, incident response, retention) are reviewed regularly, and compliance is monitored.

Complaints, escalation, and dispute resolution

If you have concerns about our handling of personal data, contact legal@tanqory.com with details of the issue. We investigate and respond within a reasonable period. If dissatisfied, you may escalate to the UAE Data Office or, for free-zone matters, the ADGM/DIFC authorities. Contractual disputes follow the governing law and SIAC arbitration terms above, without limiting any mandatory rights under applicable data protection law.

Interaction with other Tanqory terms

This notice supplements the Tanqory Privacy Policy, DPA, Cookie Policy, and service terms. If there is a conflict, the stricter document or mandatory law prevails. Product- or region-specific notices may add requirements that complement this notice.

Marketing and communications

Direct marketing is sent only where lawful, with clear opt-outs in every channel. Consent is used where required; soft opt-in is applied only where legally permitted and contextually appropriate. Marketing preferences are honoured promptly, and suppression lists are maintained to enforce opt-outs.

Updates to this notice

We update this notice when UAE law, free-zone guidance, or our services change. Material changes will be communicated in advance (e.g., dashboard/email) with version/date and a summary. If you disagree, you may adjust settings or stop using the services. Change history is retained for reference and audit.

Contact

• Privacy/legal: legal@tanqory.com
• Policy site: https://legal.tanqory.com/
• Subprocessors list: https://legal.tanqory.com/legal/data-protection/subprocessor-list
• Retention schedule: https://legal.tanqory.com/legal/data-protection/data-retention-policy