Privacy and Cookie Policy

1Introduction

ZABNEXUS Technologies LLC (“ZABNEXUS”, “we”, “us” or “our”) is a technology company licensed in the United Arab Emirates.

This Privacy and Cookie Policy (“Policy”) explains how we collect, use, disclose, store, transfer and protect Personal Data when an individual:

• Visits the ZABNEXUS website;
• Contacts us by email, telephone, WhatsApp, the contact form on our website or another communication channel;
• Requests information, a quotation or a proposal;
• Purchases or uses our services;
• Makes a payment to us;
• Works with us as a client, supplier, contractor or business contact; or
• Otherwise interacts with a service that refers to this Policy.

For the purposes of this Policy, “Personal Data” means information relating to an identified or identifiable natural person. It includes Sensitive Personal Data and Biometric Data where applicable.

We process Personal Data in accordance with applicable laws and regulations, including Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data.

For Personal Data processed for our own business purposes, ZABNEXUS generally determines the purposes and means of processing and acts as a Controller. Where we process Personal Data solely on behalf of a client and under that client’s documented instructions, ZABNEXUS generally acts as a Processor.

2Company and Privacy Contact Details

ZABNEXUS Technologies LLC is registered in the United Arab Emirates.

Questions, requests or complaints concerning privacy may be directed to:

• Email: hello@zabnexus.com
• Telephone or WhatsApp: +971 58 139 3965

3UAE Privacy-Law Notice

This Policy describes the general privacy practices of ZABNEXUS and the measures adopted to support compliance with applicable data-protection requirements in the United Arab Emirates.

This Policy is provided for transparency and general information. It does not constitute legal advice or limit any right, obligation, remedy or protection established under applicable law.

The laws applicable to a particular processing activity may depend upon the nature of the Personal Data, the parties’ locations, the relevant regulatory jurisdiction, the purposes of processing and the sector in which the activity is conducted. Separate or additional requirements may apply within UAE financial free zones, regulated sectors or other jurisdictions.

Where this Policy conflicts with a mandatory provision of applicable law, the mandatory legal provision shall prevail. Nothing in this Policy is intended to exclude, restrict or waive any right that cannot lawfully be excluded, restricted or waived.

4Scope

This Policy applies to Personal Data processed through our website and in connection with our business operations and services.

It does not apply to websites, applications or services operated independently by third parties, even where they are accessible through a link on our website. Those third parties are responsible for their own privacy, security and data-processing practices.

Client projects may be subject to additional privacy, security and processing terms contained in the applicable proposal, service agreement, data-processing agreement or project documentation. Where there is a conflict concerning the processing of client-project data, the applicable written agreement will govern to the extent permitted by law.

5Personal Data We Collect

The Personal Data we collect depends upon the nature of your relationship and interaction with us.

5.1 Information provided directly to us

We may collect:

• Name;
• Email address;
• Telephone number;
• Company name;
• Job title or professional role;
• Business contact details;
• Information contained in emails, telephone calls or WhatsApp messages;
• Information submitted through the contact form on our website: your name, email address, optional phone number and company, the service you are interested in, an optional budget range and your message;
• Project descriptions, requirements and instructions;
• Documents, files and other materials supplied for a project;
• Information included in a brief prepared using Nex on our homepage and sent to us;
• Information required to prepare a quotation, proposal or contract;
• Client, supplier, invoicing and billing information;
• Communications concerning our services;
• Technical or customer-support requests;
• Feedback and correspondence;
• Records of consent, where applicable; and
• Marketing and communication preferences.

You should not provide Personal Data that is unnecessary for the relevant enquiry, transaction or project.

5.2 Payment information

Card and digital-wallet payments are processed by Stripe or another authorized payment-service provider identified at the time of payment.

We may receive limited transaction information, including:

• Payment amount;
• Payment status;
• Transaction reference;
• Payment date;
• Card brand; and
• The last four digits of the payment card.

We do not receive or store full card numbers, card security codes or complete payment credentials.

5.3 Website and technical information

When you access our website, our hosting, security and infrastructure providers may automatically process limited technical information required to deliver, maintain and protect the website.

This information may include:

• IP address;
• Browser type;
• Device type;
• Operating system;
• Date and time of access;
• Pages or resources requested;
• Referring page or website;
• General diagnostic information;
• Security events; and
• Server or error logs.

To limit spam, our contact form keeps a one-way hash of the IP address that sent a message, together with the times of recent messages. It is used only to block repeated submissions, is ignored after one hour, and is removed by routine server clean-up.

5.4 Nex homepage briefs

Information entered into Nex on our homepage stays in the open page in your browser. It is not sent to us, and it is not saved in cookies or browser storage. It is cleared when you close or reload the page.

If you choose to send that information to us by email, WhatsApp or our contact form, it will be processed as an enquiry under this Policy. The communication provider you choose may also process it under its own terms and privacy policy.

5.5 Information obtained from public sources

Where reasonably necessary for legitimate business administration or due diligence, we may obtain limited professional or business-contact information from:

• Public corporate websites;
• Official company registers;
• Professional directories;
• Public business profiles; and
• Other lawful, publicly accessible business sources.

We will process such information only for a specific and lawful purpose.

5.6 Sensitive and Biometric Personal Data

ZABNEXUS does not request Sensitive Personal Data or Biometric Data through general website enquiries.

You should not provide health information, biometric identifiers, criminal-record information, religious or political information, genetic information, or other Sensitive Personal Data unless:

• It is necessary for an agreed project;
• ZABNEXUS has expressly authorized its transmission;
• An appropriate and lawful method of transmission has been agreed; and
• The required legal, contractual and security safeguards are in place.

Where ZABNEXUS processes Sensitive Personal Data or Biometric Data, we will apply the additional conditions and safeguards required by applicable law.

6How We Collect Personal Data

We may collect Personal Data:

• Directly from you;
• From your employer, representative or organization;
• Through correspondence and contractual dealings;
• Through payment and transaction providers;
• From suppliers and service providers;
• From lawful, publicly available professional or business sources;
• Through authorized client systems or project materials; and
• Automatically through our website infrastructure, security systems and server logs.

Where another person provides Personal Data to us on your behalf, that person is responsible for ensuring that they are authorized to do so and that any required notice or consent has been provided.

7Purposes of Processing

We may process Personal Data for the following purposes:

• Responding to enquiries and communications;
• Understanding your requirements;
• Preparing quotations, proposals and project plans;
• Entering into, administering, amending or terminating contracts;
• Providing, operating, maintaining and supporting our services;
• Communicating about current or completed projects;
• Providing technical or customer support;
• Processing payments and maintaining transaction records;
• Issuing invoices and managing accounts;
• Managing client, supplier and contractor relationships;
• Verifying instructions, transactions or identities where necessary;
• Detecting, investigating and preventing fraud, misuse and security incidents;
• Protecting our website, systems, clients and business;
• Maintaining business, tax, accounting and audit records;
• Establishing, exercising or defending legal rights;
• Complying with legal, regulatory and contractual obligations;
• Managing business continuity, backups and disaster recovery;
• Sending marketing communications where valid consent has been provided or where otherwise permitted by law;
• Improving our internal operations and service delivery; and
• Evaluating or completing a proposed business restructuring, financing, investment, merger or transfer.

We do not sell Personal Data.

We do not send marketing communications unless the recipient has requested them or the communication is otherwise permitted by applicable law. You may withdraw from marketing communications at any time.

8Legal Grounds for Processing

Subject to applicable law, we may process Personal Data where:

• You have provided specific, clear and valid consent;
• Processing is necessary to take steps at your request before entering into a contract;
• Processing is necessary to enter into, perform, amend or terminate a contract to which you are a party;
• Processing is necessary to comply with an obligation imposed upon ZABNEXUS by applicable law;
• Processing is necessary to establish, exercise or defend legal rights or claims;
• Processing is necessary to protect your interests;
• The Personal Data was made publicly available by you and its processing is permitted by law;
• Processing is necessary for an authorized employment, social-protection, archival, statistical or other purpose recognized by applicable law; or
• Processing is otherwise expressly permitted or required under applicable law.

Where processing is based upon consent:

• Consent will be requested in a clear and accessible manner;
• We will maintain appropriate evidence of consent;
• Consent will relate to the stated processing purposes; and
• You may withdraw consent through a reasonably accessible method.

Withdrawal of consent will not affect processing completed before consent was withdrawn or processing lawfully conducted on another basis.

9Requirement to Provide Personal Data

You are not required to provide Personal Data merely to browse our website.

However, certain information may be required for us to:

• Respond to an enquiry;
• Prepare a quotation or proposal;
• Enter into or perform a contract;
• Verify or process a payment;
• Deliver or support a service;
• Confirm an authorized instruction; or
• Meet a legal or regulatory obligation.

If the required information is not provided, we may be unable to complete the relevant request, transaction or service.

10Cookies and Similar Technologies

10.1 What cookies are

Cookies are small text files that a website may place on a user’s device. Cookies may be used to provide website functions, remember preferences, maintain security, understand website usage or support advertising.

Similar technologies may include local storage, session storage, pixels, tags, software-development kits and comparable browser- or device-based mechanisms.

10.2 Our current use of cookies

The ZABNEXUS website does not currently set any cookies or store any information in your browser’s storage.

In particular, it does not use:

• Advertising cookies;
• Analytics cookies;
• Behavioral-profiling cookies;
• Cross-site tracking cookies; or
• Cookies used to create advertising profiles.

We do not use cookies to monitor your activities across unrelated websites.

If we later need strictly necessary cookies or similar technologies, we will use them only where reasonably required to:

• Deliver requested website functionality;
• Maintain a secure session;
• Prevent fraud, abuse or malicious activity;
• Remember an action during a browser session; or
• Maintain the stability and security of the website.

10.3 How Nex handles what you type

Nex does not use cookies or browser storage. What you type is held only in the open page so that the feature can work, and it is cleared when you close or reload the page.

This information is not transmitted to ZABNEXUS unless you choose to send it by email, WhatsApp or our contact form.

10.4 Third-party resources

The website currently obtains font files through Google Fonts. When your browser requests these files, it connects to Google’s systems. Google may receive technical information associated with that request, including your IP address and browser information.

Google is independently responsible for information it processes under its own terms and privacy policy.

Payment services, WhatsApp and other third-party services that you choose to use may place or access their own cookies or similar technologies. ZABNEXUS does not control technologies placed directly by independently operated third-party websites or applications.

10.5 Managing cookies and browser storage

Most browsers enable users to:

• Review stored cookies;
• Delete cookies and local browser data;
• Block cookies;
• Restrict third-party cookies;
• Clear site data when the browser closes; and
• Receive a notification before certain cookies are stored.

Available controls vary between browsers and devices. Restricting cookies or storage may prevent some third-party services, such as payment pages, from working correctly.

10.6 Changes to our use of cookies

If we introduce analytics, advertising or other non-essential cookies in the future, we will update this Policy and implement any consent or preference controls required by applicable law before using those technologies.

11Disclosure of Personal Data

We disclose Personal Data only where reasonably necessary for the purposes described in this Policy.

Recipients may include:

• Stripe and other authorized payment-service providers;
• Website hosting and cloud-infrastructure providers;
• Email, communications and business-productivity providers;
• Security, backup and technical-support providers;
• AI, database, software and development providers used for authorized projects;
• WhatsApp and Meta when you choose to communicate with us through WhatsApp;
• Contractors, developers and specialists involved in an authorized project;
• Accountants, auditors, insurers, lawyers and other professional advisers;
• Government authorities, regulators, courts and law-enforcement bodies where disclosure is required or permitted by law; and
• Prospective purchasers, investors, lenders and professional advisers involved in a proposed restructuring, financing, investment or transfer of all or part of our business.

We seek to limit disclosures to the Personal Data reasonably required for the recipient’s authorized role.

Where a provider processes Personal Data on our behalf, we require appropriate confidentiality, security and data-processing commitments. We select Processors that provide sufficient assurances concerning their technical and organizational measures.

We do not authorize service providers to use Personal Data for their independent purposes except where that independent processing has been disclosed, is necessary to provide a service you have selected, or is otherwise permitted by law.

12International Transfers

Certain service providers may process or store Personal Data outside the United Arab Emirates.

Where Personal Data is transferred internationally, we apply the conditions and safeguards required by applicable law. Depending upon the circumstances, these may include:

• Contractual safeguards;
• Transfer-risk assessments;
• Technical and organizational protections;
• Access restrictions;
• Encryption or pseudonymization where appropriate;
• Vendor due diligence; and
• Other legally recognized transfer arrangements.

We maintain appropriate records of relevant cross-border processing activities.

You may contact us to request information about the safeguards applicable to your Personal Data. We may limit the information provided where necessary to preserve security, confidentiality, legal privilege or the rights of another person.

13Client Projects and AI Systems

Where a client provides Personal Data for the purpose of building, configuring, maintaining or operating a system, ZABNEXUS will generally process that project data under the client’s documented instructions and for the purposes agreed with that client.

Such projects may involve:

• AI agents;
• Retrieval systems;
• Automation systems;
• Knowledge bases;
• Custom software;
• Project-specific models developed using client-provided information;
• Embedding and indexing systems;
• Databases;
• Cloud infrastructure; and
• Integrations with third-party platforms.

In relation to client-project data, ZABNEXUS will:

• Treat the information as confidential;
• Process it only for documented and agreed purposes;
• Apply access and security controls appropriate to the project;
• Restrict access to authorized personnel and providers;
• Not sell the information;
• Not use the information to train or improve generalized models for ZABNEXUS or unrelated clients; and
• Return, delete or retain the information in accordance with the client’s instructions, the applicable agreement and legal requirements.

Any project-specific fine-tuning, embedding, indexing, evaluation or other model-related processing will be performed only where authorized by the client and documented in the applicable project agreement.

Where an approved third-party AI, cloud, database or software provider is required, relevant project data may be processed by that provider. The applicable agreement or project documentation may specify the relevant:

• Provider;
• Processing purpose;
• Data categories;
• Hosting or processing region;
• Retention configuration;
• Security measures; and
• International-transfer arrangements.

ZABNEXUS may separately process business-contact and administrative information for contract management, invoicing, security, legal compliance and record-keeping purposes.

14Processors and Subprocessors

Where ZABNEXUS acts as a Processor for a client, processing will be subject to a written agreement or equivalent binding terms defining, as applicable:

• The subject and duration of processing;
• The nature and purpose of processing;
• The categories of Personal Data;
• The categories of Data Subjects;
• The documented instructions of the client;
• Confidentiality requirements;
• Security requirements;
• Subprocessor arrangements;
• International transfers;
• Breach reporting;
• Assistance with Data Subject requests;
• Return or deletion of Personal Data; and
• The parties’ respective responsibilities.

ZABNEXUS will engage subprocessors in accordance with applicable law and the relevant client agreement. Where required, the client will be informed of, or asked to authorize, relevant subprocessors and material changes concerning them.

Subprocessors will be required to provide appropriate confidentiality, security and data-protection commitments.

15Automated Processing and Profiling

ZABNEXUS does not use Personal Data collected through its general website or business-enquiry channels to make decisions based solely upon automated processing that produce legal or similarly significant effects on individuals.

Where a client project involves automated processing, profiling or automated decision-making, the respective responsibilities of ZABNEXUS and the client will be established in the applicable agreement.

Where required by law, appropriate measures may include:

• Providing meaningful information about the relevant processing;
• Assessing the potential effects upon individuals;
• Enabling eligible individuals to express their point of view;
• Providing access to human review;
• Permitting an eligible decision to be challenged; and
• Implementing measures to protect the privacy, confidentiality and security of Personal Data.

16Data-Protection Impact Assessments

Before undertaking processing that may create a high risk to the privacy or confidentiality of individuals, ZABNEXUS will assess whether a data-protection impact assessment or equivalent documented risk assessment is required.

An assessment may be undertaken where a project involves:

• New or emerging technologies;
• Systematic or extensive automated assessment;
• Profiling that may produce legal or similarly significant effects;
• Large-scale processing of Sensitive Personal Data;
• Large-scale monitoring;
• Combining datasets in a way that creates additional privacy risks; or
• Another processing activity presenting a potentially high risk to individuals.

Where an assessment is required, ZABNEXUS will evaluate the proposed processing, its necessity and proportionality, the foreseeable risks, and the measures intended to address those risks before the relevant processing begins.

17Data Protection Officer

ZABNEXUS will assess whether appointment of a Data Protection Officer is required based upon its processing activities and applicable law.

A Data Protection Officer will be appointed where required, including where applicable processing presents a high risk because of new technologies or data volume, involves systematic and comprehensive assessment of Sensitive Personal Data, or involves large-scale processing of Sensitive Personal Data.

Where appointed, the Data Protection Officer will be provided with appropriate independence, access, resources and support. The Data Protection Officer’s contact details will be published on this page or otherwise made available as required by law.

Until a separate Data Protection Officer contact is published, privacy enquiries may be directed to hello@zabnexus.com.

18Data Retention

We retain Personal Data only for as long as reasonably necessary for the purpose for which it was collected and to comply with applicable legal, accounting, security and dispute-resolution obligations.

Our general retention approach is as follows:

• Enquiries that do not result in a project: up to two years after the last meaningful communication;
• Client and contract records: for the duration of the relationship and any additional period required to manage legal or contractual obligations;
• Invoices, transaction records and accounting information: for the period required by applicable UAE law;
• Client-project data: for the project period and any agreed support, transition or closure period;
• Website, security and technical records: for the documented period reasonably necessary to operate, diagnose and protect our systems;
• Support communications: for the period reasonably necessary to resolve the matter and maintain an appropriate service record;
• Consent records: for as long as necessary to demonstrate the relevant consent and address legal or regulatory requirements;
• Legal and dispute records: until the matter and any applicable claim or limitation period have concluded; and
• Backup copies: until overwritten or securely deleted under the applicable backup schedule.

Retention periods may vary where an applicable contract, legal obligation, dispute, investigation or security requirement justifies a longer or shorter period.

When Personal Data is no longer required, we will delete it, anonymize it or securely isolate it until deletion is reasonably possible.

19Information Security

We implement technical and organizational measures designed to protect Personal Data against unauthorized access, disclosure, alteration, destruction, loss or misuse.

Depending upon the relevant system, project, risks and information, these measures may include:

• Access restrictions;
• Role-based permissions;
• Authentication controls;
• Encryption in transit;
• Encryption at rest where appropriate;
• Secure hosting and cloud services;
• Protected backups;
• Confidentiality obligations;
• Provider and access reviews;
• Logging and monitoring;
• System maintenance and security updates;
• Development and testing controls;
• Data-minimization measures; and
• Business-continuity and recovery measures.

We periodically review relevant safeguards and adjust them where reasonably necessary to address changes in risks, technologies and processing activities.

No website, transmission method or storage system can be guaranteed to be entirely secure.

20Personal-Data Breaches

If a Personal Data breach occurs, we will:

• Investigate and document the incident;
• Take reasonable steps to contain it;
• Evaluate the potential consequences;
• Implement appropriate corrective measures;
• Maintain relevant incident records; and
• Notify the competent authority and affected individuals where and within the period required by applicable law.

Where notification is legally required, we will provide the information required by applicable law, which may include the nature and cause of the incident, its potential effects, the approximate scope of affected records or individuals, and the corrective measures taken or proposed.

Where ZABNEXUS processes Personal Data on behalf of a client, we will notify the client of a relevant breach as soon as reasonably practicable after becoming aware of it and in accordance with applicable law and the governing agreement.

21Your Rights

Subject to applicable law and any permitted exceptions, you may have the right to:

• Obtain information concerning the processing of your Personal Data;
• Request access to Personal Data held about you;
• Request correction of inaccurate or incomplete Personal Data;
• Request deletion of Personal Data;
• Request restriction or cessation of certain processing;
• Object to certain processing where the relevant right applies;
• Request an eligible copy of your Personal Data in a portable format;
• Request the transfer of eligible Personal Data where applicable;
• Withdraw consent where processing is based upon consent;
• Request information concerning applicable international-transfer safeguards;
• Request human review of an eligible decision based solely upon automated processing;
• Express your point of view and challenge an eligible automated decision; and
• Raise a complaint regarding the processing of your Personal Data.

We may request information reasonably necessary to verify your identity, confirm your authority to act for another person and understand the scope of your request.

We will respond to valid requests within the period required by applicable law. We aim to provide an initial response within 30 days, subject to identity verification, the complexity of the request and any lawful extension or exception.

A request or right may be restricted where processing or retention is necessary to:

• Comply with a legal obligation;
• Protect the rights of another person;
• Establish, exercise or defend legal claims;
• Prevent fraud or misuse;
• Preserve legal privilege or confidentiality;
• Maintain system or information security; or
• Satisfy another exception permitted by applicable law.

We will explain a refusal or restriction where required by law.

22Exercising Your Rights

To submit a privacy request, contact us at hello@zabnexus.com.

Please include sufficient information to identify:

• The person making the request;
• The nature of the request;
• The relevant interaction, service or project; and
• Any applicable date range or communication channel.

Do not send copies of identity documents through ordinary email unless we specifically request them and provide an appropriate transmission method.

Where ZABNEXUS processes Personal Data solely on behalf of a client, we may refer the request to that client or assist the client in responding, as appropriate.

23Children’s Personal Data

Our general website and services are intended for businesses and adults. They are not directed to children, and we do not knowingly collect Personal Data from children through the general website.

If you believe that a child has provided Personal Data to us through the website, please contact us so that we may investigate and take appropriate action.

Client projects involving Personal Data relating to children will be accepted only where:

• The processing is permitted by applicable law;
• The client has appropriate authority to provide the information;
• The project has been expressly approved by ZABNEXUS;
• The parties have documented their respective responsibilities; and
• Appropriate legal, contractual and security safeguards are in place.

Clients must not provide Personal Data relating to children without prior written authorization from ZABNEXUS.

24Third-Party Websites and Services

Our website may contain links to websites, applications or services operated independently by third parties.

Those third parties are responsible for their own privacy and security practices. This Policy does not govern their independent processing activities.

When you contact us through WhatsApp, make a payment through Stripe, load fonts from Google Fonts or use another third-party service, the relevant provider may process information under its own terms and privacy policy.

We recommend reviewing the applicable third-party privacy information before providing Personal Data or using the relevant service.

25Complaints

If you have a concern regarding our processing of Personal Data, please contact us at hello@zabnexus.com. We will review the matter and seek to provide an appropriate response.

Depending upon the applicable jurisdiction, you may also have the right to submit a complaint to the UAE Data Office or another competent data-protection regulator.

If you are uncertain which regulator applies to your circumstances, you may contact us for further information. Nothing in this section limits a right to contact a competent authority directly.

26Records and Accountability

ZABNEXUS maintains records and procedures appropriate to its processing activities. Depending upon the circumstances, these may include:

• Records of processing activities;
• Records of client-processing instructions;
• Vendor and subprocessor records;
• International-transfer records;
• Security and access records;
• Consent and withdrawal records;
• Retention and deletion records;
• Data Subject request records;
• Data-protection impact assessments; and
• Incident and breach records.

We may review relevant policies, controls and records periodically and update them where necessary to address changes in our services, technologies, risks and legal obligations.

27Amendments to This Policy

We may amend this Policy periodically to reflect changes in our services, technologies, providers, business practices or legal obligations.

The revised Policy will be published on this page, and the “Last updated” date will be amended accordingly.

Where a change materially affects how we process Personal Data, we will provide additional notice or obtain consent where appropriate or required by law.

28Contact Details

Questions, requests and complaints concerning privacy or this Policy may be directed to:

• Company: ZABNEXUS Technologies LLC
• Location: United Arab Emirates
• Privacy email: hello@zabnexus.com
• Telephone or WhatsApp: +971 58 139 3965
• Website: zabnexus.com