Privacy Policy

This Privacy Policy explains how UG UAE LLC ("UG UAE," "we," "us," or "our") collects, uses, discloses, retains, and protects personal data obtained through our public website, marketing communications, recruiting channels, and limited business interactions originating from those surfaces.

This policy does not govern the processing of personal data inside operational engagements with our clients, which is addressed by separate data-processing agreements negotiated per engagement.

1. Data controller

The data controller for personal data described in this policy is:

• Entity: UG UAE LLC. Specific registration details are provided to counterparties on request.
• Registered address: Our registered office is in Dubai, United Arab Emirates. We maintain offices in Dubai and Abu Dhabi.
• Postal address for privacy correspondence: Privacy correspondence should be directed to privacy@ug-uae.co, and a postal address will be supplied on request.
• Email: privacy@ug-uae.co
• Data Protection Officer or representative: Privacy matters are handled by our designated privacy function, which can be reached at privacy@ug-uae.co.

Where UG UAE operates through subsidiaries or affiliates in additional jurisdictions, the local entity may act as joint or independent controller for processing performed in that jurisdiction.

2. Personal data we collect

We collect the following categories of personal data:

a. Information you provide directly

• Identification and contact details submitted via web forms (name, business email, organization, role, country, telephone where provided).
• Recruiting submissions (CV, employment history, references, work authorization indicators, and any information you elect to include).
• Procurement and supplier intake information submitted via supplier registration forms.
• Free-text content of inquiries or messages.

b. Information collected automatically

• Server access logs containing IP address, user-agent string, requested URL, response status, and timestamp.
• Security telemetry generated by our edge network and bot-mitigation providers.
• Aggregate, cookieless analytics signals as described in our Cookies Policy.

c. Information from third parties

• References and background-check results from authorized providers in connection with recruiting, where lawful and disclosed to candidates in advance.
• Sanctions and adverse-media screening results in connection with prospect, supplier, or counterparty due diligence, processed to meet our legal and regulatory obligations and to protect the integrity of our business relationships.

We do not knowingly collect personal data from children. Our website is not directed to individuals under the age of 18.

3. Purposes and legal bases for processing

We process personal data for the following purposes, on the following legal bases under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL"), with practices aligned to the EU General Data Protection Regulation (Regulation 2016/679, "GDPR") for any EU-connected processing, and equivalent laws of jurisdictions in which we operate:

Purpose	Legal basis
Responding to inquiries and managing pre-contractual communications	Steps taken prior to entering a contract; our legitimate interest in operating our business (GDPR Article 6(1)(b) and 6(1)(f) for EU-connected processing)
Recruiting and candidate evaluation	Steps prior to a contract and our legitimate interest in evaluating candidates; explicit consent for any special-category data voluntarily disclosed (GDPR Articles 6(1)(b), 6(1)(f), and 9(2)(a) for EU-connected processing)
Supplier and counterparty due diligence, including sanctions and integrity screening	Compliance with legal obligations under export-control, sanctions, and anti-bribery regimes; our legitimate interest in lawful and ethical dealings (GDPR Articles 6(1)(c) and 6(1)(f) for EU-connected processing)
Site security, fraud prevention, and abuse mitigation	Our legitimate interest in protecting our infrastructure and users (GDPR Article 6(1)(f) for EU-connected processing)
Marketing communications to business contacts	Our legitimate interest in business outreach or consent, depending on jurisdiction (GDPR Article 6(1)(f) or 6(1)(a) for EU-connected processing)
Compliance with legal, regulatory, and judicial obligations	Compliance with a legal obligation (GDPR Article 6(1)(c) for EU-connected processing)

Where we rely on legitimate interests, we have conducted a balancing assessment. You may request a summary of that assessment via the contact details below.

4. Disclosure of personal data

We disclose personal data to:

• Service providers acting as processors on our behalf (for example, cloud hosting, email delivery, customer-relationship management, recruiting platforms, security and bot-mitigation providers). A current list is available on request.
• Professional advisors (legal, audit, insurance) under duties of confidentiality.
• Group entities of UG UAE for centralized administration, security, and compliance functions.
• Public authorities, courts, regulators, and law-enforcement bodies where required by applicable law or where reasonably necessary to protect our rights, the rights of others, or the integrity of our infrastructure.
• A successor entity in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to confidentiality obligations and applicable law.

We do not sell personal data, and we do not share personal data for cross-context behavioral advertising.

5. International transfers

Personal data may be transferred to, processed in, or accessed from countries outside the United Arab Emirates, the European Economic Area, the United Kingdom, or the country in which the data subject is located. Where such transfers occur, we rely on the following safeguards:

• The transfer conditions set out in the PDPL and its implementing regulations, which permit cross-border transfers where the destination provides an adequate level of protection or where appropriate contractual and organizational safeguards are in place.
• For EU-connected processing, the European Commission's Standard Contractual Clauses (Decision 2021/914) and the UK International Data Transfer Addendum, where applicable.
• Adequacy decisions where the destination country has been recognized as providing an adequate level of protection.
• Supplementary technical and organizational measures, including encryption in transit and at rest and access controls, as informed by transfer impact assessments.

A copy of the relevant transfer mechanism for a specific transfer can be obtained on request via privacy@ug-uae.co.

6. Retention

We retain personal data for the period necessary to fulfill the purposes described in this policy, to satisfy legal, regulatory, accounting, or reporting obligations, and to defend legal claims. Indicative retention periods:

• Web inquiry contact data: 24 months from last interaction.
• Recruiting candidate records (unsuccessful applicants): 12 months unless the candidate consents to extended retention.
• Server access and security logs: 12 months.
• Supplier due-diligence records: term of the relationship plus the applicable statutory limitation period.
• Records subject to legal hold: duration of the hold.

Following expiry, personal data is securely deleted or irreversibly anonymized.

7. Your rights

Subject to the conditions set out in applicable law, including the PDPL and, for EU-connected processing, the GDPR, you have the right to:

• Access. request confirmation of whether we process personal data about you, and a copy of that data.
• Rectification. request correction of inaccurate or incomplete personal data.
• Erasure. request deletion of personal data in defined circumstances.
• Restriction of processing. request that we limit processing in defined circumstances.
• Data portability. receive personal data you provided in a structured, commonly used, machine-readable format, and transmit it to another controller, where processing is based on consent or contract and carried out by automated means.
• Object. object to processing carried out on the legal basis of legitimate interests, including profiling based on those interests.
• Withdraw consent. where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not currently make such decisions in the contexts covered by this policy.

To exercise any of these rights, contact privacy@ug-uae.co. We will respond within the period required by applicable law (one month under the GDPR for EU-connected processing, extendable by two further months for complex requests, and within the timeframes set by the PDPL). We may need to verify your identity before acting on the request.

8. Complaints

If you believe our processing of your personal data infringes applicable law, you have the right to lodge a complaint with the competent supervisory authority.

• United Arab Emirates: the UAE Data Office, established under the PDPL, supervises the protection of personal data in the United Arab Emirates.
• United Kingdom: Information Commissioner's Office (ico.org.uk).
• Other jurisdictions: see the European Data Protection Board (edpb.europa.eu) and local-equivalent regulators.

We encourage you to contact us first so we may attempt to resolve your concern.

9. Cookies and similar technologies

Our use of cookies, pixels, and similar technologies is described in our Cookies Policy.

10. Security

We maintain technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, and destruction. No system is perfectly secure; if you discover a vulnerability affecting our website or platform, please report it under our Vulnerability Disclosure Policy.

11. Changes to this policy

We may update this policy from time to time. The version number, last-updated date, and effective date at the top of this page identify the current version. Material changes will be notified through prominent notice on this website and, where appropriate, by direct communication to known contacts.

---

This is a published legal statement. The current version supersedes all prior versions. Last updated: 2026-06-09. For questions: legal@ug-uae.co.