Privacy Notice

2. Who is responsible for your personal data?

For personal data processed through this website and the UAE practice, the controller is:

EXPEDE CYBER RISK MANAGEMENT SERVICES – FZCO

IFZA Business Park, DDP
PO Box 338482
Dubai, United Arab Emirates

Privacy email: privacy@expede.ae

3. Personal data we may collect

Depending on how you interact with us, we may process:

• your name and professional contact details;
• your organisation, role or business affiliation;
• information you provide when making an enquiry or discussing a potential engagement;
• correspondence and records of our communications with you;
• information associated with an existing or prospective client, supplier or professional relationship;
• your preferences where you ask to receive Expede insights or professional updates; and
• limited technical information generated when you access the website, such as IP address, device/browser information and security or server logs, where collected by our website or hosting providers.

Please do not send sensitive or unnecessary personal information by email unless it is genuinely required for the matter being discussed.

4. Why we use personal data

We may use personal data to:

• respond to enquiries and provide information you have requested;
• discuss, establish and manage prospective or existing business relationships;
• prepare proposals and provide advisory or professional services;
• manage contracts, suppliers and business administration;
• provide Expede insights or professional updates where you have asked to receive them;
• operate, secure and maintain our website and information systems;
• protect our legal rights and respond to legal, regulatory or governmental requirements; and
• comply with obligations imposed by applicable law.

We will not use personal data for purposes that are incompatible with the purpose for which it was collected unless permitted or required by applicable law.

5. Basis for processing

We process personal data only where permitted under applicable law.

Depending on the circumstances, processing may be based on your consent, steps taken at your request in connection with a prospective business relationship, performance of an agreement, compliance with a legal obligation, or another basis or exception permitted under applicable data-protection law.

Where we rely on consent, you may withdraw that consent by contacting privacy@expede.ae.

6. Professional updates and direct marketing

We will send Expede insights or similar professional communications where you have requested them or where otherwise permitted by applicable law.

You can ask us to stop sending these communications at any time by emailing hello@expede.ae.

We do not sell personal data to third parties.

7. Sharing personal data

We may share personal data where reasonably necessary with organisations that support our business, such as:

• website hosting and technology providers;
• cloud, email and communications providers;
• professional advisers;
• suppliers supporting delivery of our services; and
• regulators, government bodies or law-enforcement authorities where required by law.

These parties receive only the information reasonably necessary for the relevant purpose and are expected to protect it appropriately.

We do not disclose personal information to third parties for them to market their own products or services to you.

8. International transfers

Expede operates in an international business environment and some service providers or professional activities may involve personal data being processed outside the United Arab Emirates.

Where personal data is transferred internationally, we will take appropriate steps required by applicable law to protect that information and to ensure that the transfer is made using an appropriate legal mechanism or safeguard.

9. Data retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and for any applicable legal, regulatory, contractual, accounting or dispute-resolution requirements.

Routine enquiries that do not develop into a continuing business relationship will normally be reviewed for deletion within 24 months of the last meaningful interaction.

Where an enquiry develops into a client, supplier or other contractual relationship, relevant records may be retained for longer where necessary for business or legal purposes.

When personal data is no longer required, we will delete, securely dispose of or anonymise it as appropriate.

10. Security

We use appropriate organisational and technical measures intended to protect personal data against unauthorised access, disclosure, alteration, loss or misuse.

While no method of electronic transmission can be guaranteed to be completely secure, we take proportionate measures to protect personal data throughout its lifecycle.

11. Your rights

Depending on the applicable law and circumstances, you may have rights concerning your personal data, including rights to:

• obtain information about how your personal data is processed;
• request access to or a copy of personal data we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of personal data in circumstances provided by law;
• request restriction or cessation of certain processing;
• object to direct-marketing processing;
• request transfer of personal data where applicable;
• withdraw consent where processing relies on consent; and
• object to certain decisions based solely on automated processing, where applicable.

These rights may be subject to conditions or exceptions under applicable law.

To exercise a data-protection right or ask a privacy question, contact privacy@expede.ae.

We may need to verify your identity before acting on a request.

12. Automated decision-making

We do not currently use this website to make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.

13. Cookies and website technology

The website may use essential cookies or similar technologies required for security and basic site functionality.

We do not intend to use non-essential advertising or behavioural-tracking cookies without providing any notice or consent mechanism required by applicable law.

If analytics, advertising or other non-essential tracking technologies are introduced, this Privacy Notice and the site’s cookie controls will be updated accordingly.

14. Children

This is a business-to-business professional-services website and is not directed at children. We do not knowingly seek to collect personal information from children through this website.

15. Complaints

If you have a concern about how Expede handles your personal data, please contact us first at privacy@expede.ae so that we can investigate and respond.

You may also have the right to raise a complaint with the UAE Data Office or another competent data-protection authority where applicable.

16. Changes to this Privacy Notice

We may update this Privacy Notice where our services, website, technology or legal obligations change.

The date at the top of this page shows when the notice was last updated.

17. Contact

Privacy questions, data-protection rights requests and privacy complaints should be sent to:

EXPEDE CYBER RISK MANAGEMENT SERVICES – FZCO
IFZA Business Park, DDP
PO Box 338482
Dubai, United Arab Emirates

privacy@expede.ae