PRIVACY POLICY

Zeytoun Dynamics Ventures L.L.C-FZ (trading as 030.Group and 030labs)

Binding language. This Policy is published in English. Any translation is provided for convenience only. In the event of any conflict or inconsistency, the English version prevails.

AT A GLANCE — NOTICE AT COLLECTION

This summary is provided for convenience only. It does not replace, limit or vary the full Policy below, which governs.

1. INTRODUCTION AND SCOPE

1.1 This Privacy Policy (the "Policy") explains how Zeytoun Dynamics Ventures L.L.C-FZ ("030.Group", "we", "us", "our") collects, uses, discloses, transfers, retains and protects personal data.

1.2 Properties covered. This Policy applies to the website at 030.group and to every subdomain, sub-path, application, portal, application programming interface and other digital property that we operate, including without limitation those listed in Schedule D (each a "Site", together the "Sites"). It applies whether a Site is accessed from a desktop, mobile or other device.

1.3 Offline and other interactions. This Policy also applies to personal data we collect outside the Sites, including at events, conferences and meetings, through email, telephone and messaging channels, through our customer relationship management and business development systems, and through third-party data sources described in Section 5.

1.4 New properties. Where we launch a new digital property, this Policy applies to it automatically from launch unless that property publishes its own product-specific privacy notice. Where a product-specific notice exists, that notice governs the processing it describes and this Policy governs everything else.

1.5 What this Policy does not cover. This Policy does not apply to:

  (a) websites, platforms or services operated by third parties, including any partner, client, portfolio company or investee of 030.Group, even where linked from, referenced on, or accessed through a Site;

  (b) personal data that we process on behalf of a client in our capacity as a processor or service provider under a services agreement. In those cases the client is the controller, the client's own privacy notice applies, and our processing is governed by the data processing terms agreed with that client; and

  (c) public blockchain networks, wallets, or third-party protocols, which are outside our control — see Section 18.

1.6 Relationship to other documents. This Policy should be read together with our Terms of Use, our Cookie Notice (Schedule A), and any agreement between you and us. Nothing in this Policy varies, limits or supersedes any exclusion or limitation of liability, or any other term, set out in our Terms of Use or in any contract between you and us, save that nothing in any of those documents limits any right you have under applicable data protection law that cannot lawfully be limited.

1.7 Group companies. References to "030.Group" include Zeytoun Dynamics Ventures L.L.C-FZ and any entity that it controls, that controls it, or that is under common control with it, in each case only to the extent that entity participates in the processing described in this Policy. Zeytoun Dynamics Ventures L.L.C-FZ is the controller of record for the Sites.

2. WHO WE ARE AND HOW TO CONTACT US

2.1 Controller.

2.2 Privacy contact. All privacy enquiries, data subject requests and complaints must be addressed to legal@030.group, marked "Data Protection Request". We may require requests concerning legal rights to be confirmed in writing.

2.3 Accountable person. Sebastian Melz, Managing Partner, is accountable for data protection within 030.Group and is our internal privacy contact. He is reachable through legal@030.group, which is monitored by 030.Group Legal. We are not currently required to appoint a statutory data protection officer; if that position changes, we will appoint one and publish the details here.

2.4 Representative in the European Union and United Kingdom.

  (a) We are established in the United Arab Emirates. Where Article 3(2) of the EU GDPR or UK GDPR applies to a given processing activity, we designate a representative under Article 27 of the relevant regulation.

  (b) Our representative for the purposes of Article 27 of the EU GDPR is [●], contactable at [●]. Our representative for the purposes of Article 27 of the UK GDPR is [●], contactable at [●].

  (c) A representative may be contacted on any matter relating to our processing of personal data. Contacting a representative does not limit your right to contact us directly at legal@030.group, or to complain to a supervisory authority under Section 20.

3. DEFINITIONS

3.1 In this Policy:

  "Applicable Data Protection Law" means every data protection, privacy and electronic communications law that applies to a given processing activity, including as applicable: UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and any implementing regulations issued under it ("UAE PDPL"); Regulation (EU) 2016/679 ("EU GDPR") and the national laws implementing it; the EU GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland ("UK GDPR") together with the UK Data Protection Act 2018; the DIFC Data Protection Law, DIFC Law No. 5 of 2020, and the ADGM Data Protection Regulations 2021, in each case where and to the extent they apply; and applicable United States state privacy statutes.

  "personal data" means any information relating to an identified or identifiable natural person.

  "processing" means any operation performed on personal data, whether or not by automated means.

  "you" means any individual whose personal data we process, including visitors to the Sites, enquirers, clients and client personnel, partners and partner personnel, suppliers, investors, portfolio company personnel, event attendees, subscribers and job applicants.

3.2 Terms defined in Applicable Data Protection Law and used in this Policy carry the meaning given in the law that applies to the processing in question. Where two definitions conflict for the same processing activity, the definition affording you greater protection applies.

4. CATEGORIES OF PERSONAL DATA WE PROCESS

4.1 We process the following categories of personal data. Not all categories apply to every individual.

4.2 Special categories. We do not seek, and ask you not to send us, special categories of personal data (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation), or data relating to criminal convictions and offences.

4.3 Two limited exceptions apply. First, where you volunteer accessibility, dietary or medical information in connection with an event, we process it only to accommodate you and delete it promptly afterwards. Second, screening under Category K may return information relating to alleged or actual criminal offences or regulatory findings; where it does, we process it only to the extent necessary to comply with our legal and regulatory obligations, to conduct due diligence, and to establish, exercise or defend legal claims, and we retain it under the shortest applicable retention period in Schedule B.

4.4 Where you provide data about others. If you provide us with personal data relating to another person — for example a colleague, a referee, or a contact you introduce to us — you confirm that you are entitled to do so and that you have provided that person with the information required by Applicable Data Protection Law, including a link to this Policy. We may contact that person directly and provide them with this Policy.

4.5 Failure to provide data. Where we need personal data to perform a contract with you or to comply with a legal obligation, and you do not provide it, we may be unable to provide the relevant service or to enter into or continue the relevant engagement. We will tell you if this is the case.

5. HOW WE COLLECT PERSONAL DATA

5.1 Directly from you — when you complete a form on a Site, subscribe to updates, request a proposal, correspond with us, meet with us, attend an event, apply for a role, or otherwise interact with us.

5.2 Automatically — when you use a Site, through cookies, pixels, tags, software development kits, server logs and similar technologies. See Section 8 and Schedule A.

5.3 From third parties and public sources, namely:

  (a) business contact data providers and enrichment services (for example B2B contact databases), which supply professional contact and role information for business development purposes;

  (b) publicly available sources, including company websites, professional networking platforms, public registers, regulatory filings, press and industry publications;

  (c) our clients, partners, referral partners and portfolio companies, where they introduce you to us, name you as a contact, or share prospect or client information under a data-sharing arrangement;

  (d) service providers listed in Schedule C, in the course of providing hosting, analytics, marketing, communications, customer relationship management and security services to us;

  (e) screening and verification providers, for the compliance purposes described at Category K; and

  (f) public blockchains and public block explorers, which are open, permissionless and outside our control.

5.4 Article 14 notice. Where we obtain your personal data from a source other than you, we take reasonable steps to inform you of that fact within a reasonable period and in any event no later than our first communication with you. Our first communication with you will identify that we hold your business contact details, the source category, and how to object or unsubscribe. You may at any time ask us at legal@030.group to tell you the specific source from which we obtained your data.

6. PURPOSES AND LEGAL BASES

6.1 We process personal data only where we have a lawful basis to do so. The table below sets out our purposes and the basis on which we rely. Where more than one basis is stated, we rely on the basis appropriate to the jurisdiction and circumstances.

6.2 Legitimate interests. Where we rely on legitimate interests, we have assessed that our interests are not overridden by your interests, rights and freedoms. You may request a summary of the relevant assessment at legal@030.group.

6.3 Consent. Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal. Withdrawal is as easy as giving consent.

6.4 Change of purpose. We use personal data only for the purposes for which we collected it, unless we reasonably consider that we need to use it for a compatible purpose. Where we intend to use it for an unrelated purpose, we will notify you and explain the legal basis.

7. WHEN YOU ARE NOT OUR CUSTOMER

7.1 Much of our processing concerns individuals acting in a business capacity — client and partner personnel, prospects, suppliers and investors. We process that data on the basis of legitimate interests in operating a business-to-business enterprise. This does not reduce your rights, and you may object at any time under Section 14.

7.2 Independent controllers. Where we exchange client or prospect contact details with a partner, referral partner or portfolio company, each party acts as an independent controller and not as a joint controller or as a processor of the other. Each party is responsible for its own lawful basis, its own transparency notice and its own responses to data subject requests. Where a partner has passed your details to us, please direct requests concerning that partner's own processing to the partner.

7.3 Transactional properties. Where a Site facilitates a purchase, subscription, listing or other transaction — including 030.sale — we additionally process order, billing and payment-status data for the purposes of concluding and performing that transaction, on the basis of performance of a contract, and for the purposes of accounting, tax and financial crime compliance, on the basis of legal obligation.

  (a) Our transactional Sites are offered to businesses, not to consumers. They are not directed at, and are not intended for, individuals acting outside their trade, business or profession.

  (b) We do not operate card checkout and we do not collect, process or store payment card numbers. Settlement is by bank transfer. Our banking providers are identified in Schedule C and act as independent controllers in respect of the payment data they hold; their own privacy notices apply to that data.

  (c) If we introduce card payment or open a transactional Site to consumers, we will update this Policy and publish the additional disclosures required before doing so.

8. COOKIES AND SIMILAR TECHNOLOGIES

8.1 We use cookies and similar technologies (pixels, tags, local storage, software development kits) on the Sites. The categories we use, their purposes and their durations are set out in Schedule A.

8.2 Strictly necessary technologies are used without consent because the Sites cannot function without them.

8.3 All other categories — analytics, functionality and any marketing technologies — are deployed only where you have given prior consent through our consent management interface, in every jurisdiction where prior consent is required, and we apply that standard as our global default.

8.4 Managing your choices. You may accept all, reject all, or select categories. Rejecting is as straightforward as accepting. You may change or withdraw your choices at any time via the "Cookie Settings" control on each Site. Browser-level controls may also be used, though disabling strictly necessary cookies will impair the Sites.

8.5 Consent records. We record the fact, date, scope and version of your consent for accountability purposes and retain that record for the period in Schedule B.

8.6 Do Not Track and Global Privacy Control. There is no uniform industry standard for "Do Not Track" browser signals, and we do not currently respond to them. Where Applicable Data Protection Law requires us to honour an opt-out preference signal such as Global Privacy Control, we honour it for the Site on which it is received.

8.7 Visitor identification. We use a third-party visitor identification service on the Sites. That service processes your IP address in order to identify the organisation from which you appear to be visiting, and records the pages you view. We use the result to understand which organisations are interested in our services and to prioritise our business development activity. We may combine that organisation-level information with business contact records held in our customer relationship management and contact database systems.

  (a) This is not a strictly necessary technology. It is deployed only where you have given prior consent through our consent management interface, and you may withdraw that consent at any time through "Cookie Settings".

  (b) The service is designed to identify organisations rather than individuals. It may nonetheless involve the processing of personal data, because an IP address can constitute personal data, and because the result may lead us to contact a named individual at the organisation concerned.

  (c) The provider is identified in Schedule C. You may object to this processing, or ask us to exclude your organisation entirely, by emailing legal@030.group. We will action an exclusion request without requiring a reason.

9. MARKETING COMMUNICATIONS

9.1 We may send you information about our services, insights, events and product releases where you have consented, or where you are an existing business contact and applicable law permits us to do so on a soft opt-in or legitimate interests basis.

9.2 Opting out. Every marketing email contains a working unsubscribe link. You may also email legal@030.group at any time. We action opt-outs within ten (10) working days and in any event within any shorter period required by law.

9.3 Opting out of marketing does not stop service, transactional, contractual, security or legal notices, which are not marketing communications.

9.4 Suppression. Where you opt out, we retain the minimum data necessary — typically your email address and the date of the opt-out — on a suppression list, so that we do not contact you again. That is a legal obligation-driven and legitimate interests-driven retention and cannot be satisfied by deletion.

10. HOW WE DISCLOSE PERSONAL DATA

10.1 We do not sell personal data. We do not sell, rent or trade personal data, and we do not share personal data for cross-context behavioural advertising or targeted advertising as those terms are defined under United States state privacy statutes.

10.2 Recipients. We disclose personal data to the following categories of recipient, always limited to what is necessary:

  (a) group companies, as described at Section 1.7;

  (b) service providers and processors — hosting, cloud infrastructure, database, email, customer relationship management, marketing automation, analytics, contact enrichment, e-signature, project management, communications, IT support and security providers. Categories and named providers are listed in Schedule C;

  (c) professional advisers — lawyers, auditors, accountants, tax advisers, insurers and insurance brokers, in each case bound by professional or contractual confidentiality obligations;

  (d) partners, referral partners, resellers and portfolio companies, where relevant to a service, an introduction or a partnership, and subject to Section 7.2;

  (e) payment providers and financial institutions, to process payments and comply with financial crime obligations;

  (f) regulators, courts, law enforcement and government authorities, where we are legally required or permitted to disclose, or where disclosure is necessary to establish, exercise or defend legal claims; and

  (g) actual or prospective investors, acquirers, purchasers, lenders and their advisers, as described at Section 10.4.

10.3 Contractual controls. Where a recipient acts as a processor, we put in place a written agreement requiring it to process personal data only on our documented instructions, to keep it confidential, to apply appropriate technical and organisational security measures, to engage sub-processors only under equivalent terms, to assist us with data subject requests and breach notification, and to delete or return the data at the end of the engagement.

10.4 Corporate transactions. If we raise capital, restructure, or negotiate or complete a merger, acquisition, sale of assets, joint venture, or any similar transaction, we may disclose personal data to the counterparty, its advisers and its funders as part of due diligence, and personal data may transfer as part of the transferred business. Disclosure before completion is made under confidentiality obligations and limited to what is reasonably necessary. Any transferee will be bound to handle the data consistently with this Policy or will notify you of any material change.

10.5 Compelled disclosure. Where we are required to disclose personal data by law, court order or regulator, we disclose only the minimum required and, where we are legally permitted to do so, we will notify you.

10.6 Aggregated and de-identified data. We may create aggregated, anonymised or otherwise de-identified data from personal data. Once data no longer identifies you and cannot reasonably be re-identified, it is no longer personal data. We may use, retain, disclose, license and commercialise such data for any lawful purpose, including benchmarking, research, product development, model training and marketing, without further notice to you. We do not attempt to re-identify de-identified data, and we contractually prohibit recipients from doing so.

10.7 Related-party providers. Some of our service providers are commercial partners, portfolio companies or otherwise connected to 030.Group or its principals. Where that is the case, the provider is engaged on arm's-length terms and is subject to the same written data processing obligations as any unconnected provider, and the connection is disclosed in Schedule C.

11. THIRD-PARTY SITES, LINKS AND UNSOLICITED SUBMISSIONS

11.1 Third-party sites. The Sites contain links to third-party websites, plug-ins, applications and platforms, including those of clients, partners and portfolio companies. Clicking a link or enabling a connection may allow that third party to collect data about you. We do not control those third parties and are not responsible for their privacy practices. Read their privacy notices.

11.2 Portfolio company properties. Companies featured at portfolio.030.group or elsewhere on the Sites are separate legal entities with their own privacy practices. Their inclusion is not an endorsement of, and creates no responsibility on our part for, their data handling.

11.3 Unsolicited submissions. If you send us an unsolicited business plan, pitch deck, proposal, idea, concept, code, or other material — whether through a Site, by email or otherwise — we do not accept it in confidence, and no confidential relationship, fiduciary duty, obligation of any kind, or expectation of compensation arises from your submission unless we have signed a written agreement with you saying otherwise. We may already be pursuing, or may independently develop, similar ideas. Do not send us material you consider confidential without a signed non-disclosure agreement in place.

11.4 No investment offer. Nothing on the Sites, including at portfolio.030.group, is an offer, solicitation or invitation to buy or subscribe for any security or investment, or advice of any kind.

12. INTERNATIONAL TRANSFERS

12.1 We are established in the United Arab Emirates and use service providers located in a number of jurisdictions, including the European Economic Area, the United Kingdom, the United States and elsewhere. Personal data may therefore be transferred to, stored in, and accessed from countries outside your own, including countries that do not provide the same level of legal protection.

12.2 Safeguards. We transfer personal data internationally only where at least one of the following applies:

  (a) the destination is subject to an adequacy decision or equivalent recognition by the relevant authority;

  (b) an appropriate safeguard is in place, including the European Commission Standard Contractual Clauses, the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses, or equivalent contractual clauses recognised under UAE PDPL;

  (c) the transfer is necessary for the performance of a contract with you or in your interest; or

  (d) you have given explicit consent after being informed of the risks, or another derogation under Applicable Data Protection Law applies.

12.3 Transfer impact. Where required, we conduct and document an assessment of the destination jurisdiction and apply supplementary technical, organisational and contractual measures — including encryption in transit and at rest, access controls and challenge of unlawful government access requests.

12.4 Copies. You may request details of the safeguards applying to a transfer of your personal data at legal@030.group. We may redact commercially sensitive terms.

13. SECURITY

13.1 We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access. These include encryption in transit, access control on a need-to-know basis, multi-factor authentication on administrative accounts, logging and monitoring, supplier due diligence, and staff confidentiality obligations.

13.2 Limits. No method of transmission over the internet, and no method of electronic storage, is completely secure. While we take appropriate measures, we cannot and do not guarantee absolute security, and any transmission of personal data to us is at your own risk. This Section does not exclude any liability that cannot lawfully be excluded.

13.3 Your responsibilities. Where you hold credentials for any of our systems, you are responsible for keeping them confidential and for all activity under them. Do not send sensitive information to us by unencrypted email or unsecured messaging.

13.4 Breach. We maintain a documented incident response procedure. Where a personal data breach occurs, we will assess it without undue delay and notify the competent supervisory authority and, where required, affected individuals, within the timescales required by Applicable Data Protection Law.

14. YOUR RIGHTS

14.1 Subject to Applicable Data Protection Law and the conditions and exceptions it contains, you may have the following rights:

Jurisdiction-specific rights are set out in Annex 1 (EEA/UK), Annex 2 (UAE) and Annex 3 (United States).

14.2 How to exercise. Email legal@030.group with the subject line "Data Protection Request", stating the right you wish to exercise and the personal data concerned.

14.3 Verification. We will verify your identity before responding, because disclosing personal data to the wrong person is itself a breach. We may request proportionate evidence of identity and, where you act through an agent, evidence of authority. The response period does not begin until we have received the information reasonably necessary to verify your identity and to identify the data concerned.

14.4 Timescales. We respond within one (1) month of a verified request, or within any shorter period required by Applicable Data Protection Law. Where a request is complex or where you have made a number of requests, we may extend by up to two (2) further months and will tell you within the first month, with reasons.

14.5 Fees and refusal. Requests are free of charge. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable fee reflecting our administrative costs, or refuse to act. If we refuse, we will explain why and tell you how to complain.

14.6 Limits on rights. Rights are not absolute. We may decline in whole or in part where an exemption applies, including where compliance would: adversely affect the rights and freedoms of others; disclose the personal data of another individual who has not consented; reveal information subject to legal professional privilege or litigation privilege; prejudice the prevention, detection, investigation or prosecution of crime, or the assessment or collection of tax; prejudice negotiations with you; disclose our confidential information, trade secrets or commercially sensitive information; or conflict with a legal obligation to retain the data. Where we decline, we will tell you which category applies.

14.7 Erasure — practical limits. We cannot erase personal data that we are required to retain by law, that we need to establish, exercise or defend legal claims, or that exists in immutable form on a public blockchain (see Section 18). Data may also persist in encrypted, access-controlled backups for a limited period until those backups expire on their normal cycle; we exclude it from active use in the meantime.

15. RETENTION

15.1 We retain personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, tax, regulatory or reporting requirements, and to establish, exercise or defend legal claims.

15.2 Our retention periods are set out in Schedule B. In determining the appropriate period we consider the nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes of processing, whether those purposes can be achieved by other means, and applicable legal requirements.

15.3 At the end of the retention period we securely delete or irreversibly de-identify the data. Where deletion is not immediately feasible — for example in backups — we isolate the data and delete it on the next available cycle.

16. CHILDREN

16.1 The Sites are business-to-business properties directed at professionals. They are not directed at children and we do not knowingly collect personal data from anyone under the age of eighteen (18).

16.2 If you believe we hold personal data relating to a child, contact legal@030.group and we will delete it promptly.

17. AUTOMATED PROCESSING, PROFILING AND ARTIFICIAL INTELLIGENCE

17.1 Profiling. We carry out limited profiling for business development purposes — for example scoring the likely relevance of our services to an organisation based on sector, size and publicly stated activity, and prioritising follow-up. This informs human decisions about who to contact; it does not produce legal or similarly significant effects for you.

17.2 No solely automated significant decisions. We do not make decisions about you that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing, including profiling. Where automated tools support a decision affecting you — for example initial candidate screening — a human being reviews the output and takes the decision. If this position changes, we will update this Policy before implementing the change and, where required, obtain consent or provide the safeguards the law requires.

17.3 AI systems. We build and use artificial intelligence and machine learning systems. In relation to personal data:

  (a) We do not train our own or third-party models on personal data contained in client materials, client systems, or confidential information disclosed to us, unless the relevant client has expressly agreed in writing.

  (b) We may use aggregated or de-identified data to develop, test, benchmark and improve products, as described at Section 10.6.

  (c) Where we use third-party AI services to assist internal work — for example drafting, summarising, translation or research — we select providers that contractually commit not to use our inputs to train their general models, and we apply internal rules restricting what may be submitted.

  (d) Where you interact with an AI-enabled feature on a Site, we will tell you that you are interacting with an automated system.

17.4 Accuracy. AI-generated output may be inaccurate. It does not constitute advice, and we do not rely on it alone for decisions about individuals.

18. BLOCKCHAIN, WALLETS AND ON-CHAIN DATA

18.1 Some of our work and some of our partners' products involve public blockchain networks. Where you supply a public wallet address, or where a service records a transaction on a public blockchain:

  (a) a wallet address may amount to personal data where it can be linked to you;

  (b) public blockchains are decentralised, permissionless and immutable. Data written to a public blockchain is replicated across nodes worldwide, cannot be altered or deleted by us or by anyone else, and is publicly visible. We are not the controller of a public blockchain and have no ability to rectify, erase, restrict or port on-chain data;

  (c) your rights of rectification and erasure therefore cannot be exercised against on-chain data. They can be exercised against the off-chain records we hold, and we will do so on request; and

  (d) writing data to a public blockchain constitutes an international transfer that cannot be constrained by geography. Where a service requires it, we will tell you before it happens.

18.2 We do not provide custody, exchange, brokerage or other regulated financial services through the Sites, and we do not collect know-your-customer documentation through the Sites. Where a partner or client provides such services, that party is the controller of the relevant data and its own notice applies.

19. CHANGES TO THIS POLICY

19.1 We may amend this Policy from time to time to reflect changes in our processing, our products, or the law. The current version is always published on the Sites, with the version number and effective date shown at the top.

19.2 Where a change is material, we will take reasonable steps to bring it to your attention before it takes effect, for example by a notice on the Sites or, where we hold your contact details and it is proportionate, by email.

19.3 Continued use of the Sites after the effective date of an amended Policy constitutes acknowledgement of the amended Policy. Where a change requires your consent under Applicable Data Protection Law, we will obtain that consent before applying the change to your personal data.

19.4 Archived versions are available on request from legal@030.group.

20. COMPLAINTS

20.1 Contact us first. If you are concerned about how we handle your personal data, please contact legal@030.group. We take complaints seriously, will acknowledge within five (5) working days, and aim to resolve them promptly.

20.2 Supervisory authorities. You have the right to complain to a competent supervisory authority at any time, whether or not you contact us first:

  (a) United Arab Emirates — the UAE Data Office established under Federal Decree-Law No. 44 of 2021;

  (b) European Economic Area — the supervisory authority of the Member State of your habitual residence, place of work, or the place of the alleged infringement;

  (c) United Kingdom — the Information Commissioner's Office;

  (d) DIFC — the Commissioner of Data Protection, where the DIFC Data Protection Law applies; and

  (e) ADGM — the Office of Data Protection, where the ADGM Data Protection Regulations apply.

21. GENERAL

21.1 Governing law. This Policy and any dispute arising out of or in connection with it are governed by the laws of the Dubai International Financial Centre (DIFC).

21.2 Dispute resolution. Any dispute arising out of or in connection with this Policy shall be referred to and finally resolved by arbitration administered by the Dubai International Arbitration Centre (DIAC) under its rules in force at the time of commencement, before a single arbitrator, with the seat of arbitration in the DIFC, in the English language, and with the DIFC Courts acting as supervisory court.

21.3 Mandatory rights preserved. Sections 21.1 and 21.2 do not deprive you of the protection of any mandatory provision of the law of the country in which you are habitually resident, and do not remove your right to bring proceedings before, or complain to, a supervisory authority or court with jurisdiction under Applicable Data Protection Law. Where Applicable Data Protection Law confers a right or forum that cannot be varied by agreement, that right or forum prevails over Sections 21.1 and 21.2 to the minimum extent necessary.

21.4 Severability. If any provision of this Policy is held invalid or unenforceable, that provision is severed and the remainder continues in full force.

21.5 No third-party rights. Save for the rights conferred on individuals by Applicable Data Protection Law, this Policy confers no rights on any third party.

21.6 Interpretation. Headings are for convenience only. "Including" means "including without limitation". References to legislation include that legislation as amended, extended, consolidated or re-enacted.

21.7 Language. English is the binding version of this Policy, as set out at the top of this document.

SCHEDULE A — COOKIE NOTICE

A.1 Categories

A.2 Cookie inventory

Apollo.io stores its identifiers in local storage rather than cookies. Controls that operate only on cookies will not restrict it.

A.3 Consent management. Consent is captured on first visit through our consent management platform. Accept-all and reject-all controls are presented with equal prominence. Granular category selection is available. Consent is re-sought at least every twelve (12) months and on any material change to the cookies in use.

A.4 Records. We log consent identifier, timestamp, categories selected, consent-string version and the Site on which consent was given.

SCHEDULE B — RETENTION SCHEDULE

House standard set by 030.Group Legal. A single seven-year period is applied to contract, financial and tax records so that no per-record classification is required: it meets or exceeds the corporate tax, VAT and commercial record-keeping minima applicable to us in the United Arab Emirates. Anti-money-laundering and screening records are held for five years, being the applicable minimum, and no longer, because that data is more sensitive than the rest.

Where a legal claim is live or reasonably anticipated, a litigation hold suspends deletion of the relevant records until the matter is finally resolved and any appeal or limitation period has expired.

SCHEDULE C — CATEGORIES OF RECIPIENT AND KEY PROCESSORS

An up-to-date list is available on request from legal@030.group.

SCHEDULE D — DIGITAL PROPERTIES COVERED

This Policy applies to each of the following, and to any successor, sub-path, staging or regional variant:

Where we operate a property that is not listed, this Policy applies to it from launch under Section 1.4.

ANNEX 1 — ADDITIONAL INFORMATION FOR INDIVIDUALS IN THE EEA, UK AND SWITZERLAND

1.1 Application. This Annex applies where the EU GDPR, UK GDPR or the Swiss Federal Act on Data Protection applies to our processing, including where we offer services to, or monitor the behaviour of, individuals in those territories.

1.2 Controller and representative. The controller is identified at Section 2.1. Our Article 27 representatives, where appointed, are identified at Section 2.4.

1.3 Legal bases. Set out at Section 6.1, mapped to Article 6(1) of the EU GDPR and UK GDPR as follows: "performance of a contract" — Article 6(1)(b); "legal obligation" — Article 6(1)(c); "legitimate interests" — Article 6(1)(f); "consent" — Article 6(1)(a). Where Category K data engages Article 9 or Article 10, we rely on the substantial public interest condition in applicable national law and on the establishment, exercise or defence of legal claims.

1.4 Right to object. You have the right to object at any time, on grounds relating to your particular situation, to processing based on legitimate interests. You have an unqualified right to object to processing for direct marketing purposes, and we will stop on receipt.

1.5 Transfers. See Section 12. Where we rely on the Standard Contractual Clauses, we use the modules appropriate to the transfer and, for UK transfers, the UK Addendum or the International Data Transfer Agreement.

1.6 Supervisory authorities. See Section 20.2. You may complain in the Member State of your habitual residence, place of work or place of the alleged infringement.

1.7 Automated decision-making. See Section 17.2.

ANNEX 2 — ADDITIONAL INFORMATION FOR INDIVIDUALS IN THE UNITED ARAB EMIRATES

2.1 Application. As a company registered in the Meydan Free Zone, Dubai, we are subject to UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and its implementing regulations. The DIFC Data Protection Law and the ADGM Data Protection Regulations apply to us only in respect of processing carried out within, or in connection with, those financial free zones.

2.2 Rights. Under the UAE PDPL you have rights to information, access, rectification, erasure, restriction of processing, objection, data portability, and to object to automated processing, in each case subject to the conditions and exceptions in that law.

2.3 Consent. Where the UAE PDPL requires consent, we obtain it in a clear, specific and unambiguous form, keep a record of it, and allow withdrawal at any time.

2.4 Cross-border transfers. We transfer personal data outside the UAE only where the destination provides an adequate level of protection, or where an appropriate contractual or other safeguard recognised under the UAE PDPL is in place, or where a statutory exception applies. See Section 12.

2.5 Breach notification. We notify the UAE Data Office and, where required, affected individuals, of a personal data breach in accordance with the UAE PDPL and its implementing regulations.

2.6 Complaints. Complaints may be submitted to the UAE Data Office established under Federal Decree-Law No. 44 of 2021.

ANNEX 3 — ADDITIONAL INFORMATION FOR RESIDENTS OF UNITED STATES STATES WITH COMPREHENSIVE PRIVACY LAWS

3.1 Application. This Annex applies to residents of United States states with comprehensive consumer privacy statutes, including California, to the extent those statutes apply to us. We provide the disclosures and honour the requests below as a matter of policy, whether or not statutory thresholds are met.

3.2 Categories collected, sources, purposes and disclosures. See Sections 4, 5, 6 and 10.

3.3 No sale; no sharing. We do not sell personal information and we do not share personal information for cross-context behavioural advertising or targeted advertising. We have not done so in the preceding twelve (12) months, including in respect of individuals under sixteen (16) years of age.

3.4 Sensitive personal information. We do not use or disclose sensitive personal information for purposes other than those permitted without a right to limit under applicable statute.

3.5 Rights. Subject to statutory conditions and exceptions, you may request to know, access, correct, delete, obtain a portable copy, opt out of sale, sharing, targeted advertising and certain profiling, and appeal a refusal. We do not discriminate against you for exercising these rights.

3.6 Authorised agents. An authorised agent may submit a request with written authorisation, and we may require you to verify your identity directly and to confirm the agent's authority.

3.7 Appeals. If we decline a request, you may appeal by emailing legal@030.group with the subject line "Privacy Request Appeal". We will respond in writing within the period required by applicable statute and, if we maintain our decision, tell you how to contact the relevant Attorney General.

3.8 Opt-out preference signals. See Section 8.6.