BEXU Platform Privacy Policy

1. Introduction and Scope

1.1 BEXU Portal L.L.C., a limited liability company licensed by the Dubai Department of Economy and Tourism, United Arab Emirates (“BEXU”, “we”, “us” or “our”), operates the Platform. This Privacy Policy explains how we collect, use, share, transfer, retain and protect Personal Data when you access or use the Platform or otherwise interact with us. BEXU shall make its corporate identity, legal status, registered address, licensing authority and contact details available through the Platform’s legal and business information.

1.2 The Platform connects Customers with independent Vendors of beauty, personal care, wellness and fitness services and, where available, Vendor Products. Vendors may also use the Platform to administer their profiles, personnel, calendars, bookings, product listings, Customer relationships and related business records.

1.3 This Policy applies to the Customer App, Vendor App, website, dashboards, onboarding and support channels; Customer, Vendor and Vendor Personnel accounts; bookings, purchases, payments, commission administration, complaints, refunds, reviews and enabled promotional features; and visitors, prospective users and other persons who communicate with BEXU.

1.4 This Policy should be read with the BEXU Customer Platform Terms and Conditions of Use, the BEXU Vendor Platform Agreement, the applicable BEXU Vendor Platform Order Form and any specific privacy notice presented when Personal Data is collected. Optional features are addressed only where they are enabled. A feature described conditionally in this Policy is not a promise that it is available.

1.5 We Process Personal Data in accordance with Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data (the “Data Protection Law”) and other Applicable Law, including any applicable rules for children or sector-specific information. Where particular data fall outside the Data Protection Law and are governed by another applicable legal regime, that regime applies to the relevant Processing. This Policy does not replace any mandatory legal requirement.

1.6 Publication of this Policy or acceptance of Platform terms does not by itself provide consent for optional marketing, sensitive-data Processing or a new purpose requiring separate consent.

2. Key Definitions

2.1 “Applicable Law” means the federal and local laws, regulations, regulatory requirements and binding directions applicable in the United Arab Emirates to BEXU, the relevant person, the Platform or the Processing concerned.

2.2 “Automated Processing” means Processing carried out wholly or partly through an electronic system operating automatically with no or limited human involvement.

2.3 “Booking” means a confirmed reservation for a Vendor Service made through the Platform.

2.4 “Controller” means a person or entity that determines the purposes, method and criteria of Processing Personal Data, alone or jointly with another person.

2.5 “Customer” means a person accessing the Customer App or using the Platform to book a Vendor Service or purchase a Vendor Product.

2.6 “Personal Data” means data relating to an identified or directly or indirectly identifiable natural person, including Sensitive Personal Data and Biometric Data as defined under Applicable Law.

2.7 “Platform” means the BEXU Customer App, Vendor App, website, dashboards and related digital services.

2.8 “Processing” means an operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, use, sharing, disclosure, restriction, deletion or destruction.

2.9 “Processor” means a person or entity Processing Personal Data on behalf of and in accordance with a Controller’s instructions.

2.10 “PSP” means a third-party payment service provider appropriately licensed or authorised to provide the relevant payment services in the United Arab Emirates.

2.11 “Sensitive Personal Data” means information treated as sensitive under Applicable Law, including relevant health, biometric, genetic, criminal-record, belief, and family information.

2.12 “Transaction” means a Booking or purchase of a Vendor Product through the Platform.

2.13 “Vendor” means an independent business or professional offering Vendor Services or Vendor Products through the Platform. “Vendor Personnel” means its owners, authorised representatives, employees, contractors, practitioners and other persons whose data are submitted to or used through the Platform.

2.14 “Vendor Product” means a product listed, offered or sold by a Vendor through the Platform. “Vendor Service” means a service listed or provided by a Vendor through the Platform.

3. Who Controls Your Personal Data

3.1 BEXU is the Controller of Personal Data for which it determines the purposes and means of Processing to operate, administer, secure and improve the Platform. This includes account administration, Vendor onboarding, Platform communications, Transaction and complaint records, Customer-source attribution, Customer–Vendor relationship records, commission administration, fraud prevention and lawful Platform marketing.

3.2 A Vendor is generally a separate Controller when it determines how Personal Data are used to provide a service, fulfil an order, maintain its own business or professional records, provide aftercare, meet legal obligations or conduct its own lawful marketing. The Vendor’s privacy notice applies to those independent activities.

3.3 Where BEXU stores or manages exclusive Vendor customer-management records solely on that Vendor’s documented instructions, and does not use them for an independent Platform purpose, the Vendor is the Controller and BEXU acts as its Processor for that activity. The data processing provisions of the applicable Vendor agreement govern that Processing. Such records do not become a general BEXU marketing database merely because they are stored through the Vendor App.

3.4 If an invited customer registers with BEXU or initiates a Platform Transaction, BEXU acts as Controller for the Personal Data reasonably necessary to administer that Platform account, Transaction, source attribution and relationship. This does not permit unrelated use of the Vendor’s imported records.

3.5 A PSP, bank, card scheme, delivery provider or identity provider may act as a separate Controller for Processing whose purposes and means it determines, including its own regulatory obligations. Its applicable privacy notice applies to that activity.

3.6 These distinctions do not reduce BEXU’s responsibility for Processing under its control. If you are unsure which party is responsible, contact us through the channels described in Section 17.

4. Personal Data We Collect

4.1 The data collected depend on your role and the functions you use. We receive data from you, from an authorized Vendor or user, from enabled identity, payment, delivery, communications or other service providers, from lawful registries for relevant verification, and through your use of the Platform. We limit collection to the information reasonably required for the relevant purpose.

4.2 Identity and contact data, name, contact details, account identifier, age confirmation where needed, preferred language, profile photograph and preferences. Sources may include you, an authorized administrator or an enabled identity provider.

4.3 Account and authentication data, login credentials or password hash, verification records, third party sign-in identifiers, login history, permissions, account status and security events, collected from you or generated through account administration.

4.4 Customer preferences, saved Vendors, services, locations, notification choices and optional service preferences you provide. Promotional or loyalty preferences are collected only where the relevant feature is enabled.

4.5 Vendor business and Personnel data, legal and trade name, licence and registration details, tax information, premises and branches, authority, relevant ownership information where required, bank or settlement details, insurance and professional approvals, and Personnel names, roles, business contact details, photographs, qualifications, schedules and availability, provided by the Vendor or authorised Personnel or verified from lawful sources.

4.6 Listings and availability, service and product descriptions, prices, appointment slots, service areas, stock and fulfilment information, Vendor profiles and approved promotional content.

4.7 Booking and Transaction records, the Vendor, service or product selected, appointment or delivery details, price, taxes, charges, status, completion, cancellation, no-show, delivery, refund and payment dispute information, provided by you, the Vendor, an applicable PSP or delivery provider, or generated through Platform administration.

4.8 Customer source and relationship records, the relevant Customer and Vendor identifiers, invitation or referral link or code where used, evidence of the Customer’s source, the date a relationship was recorded, qualifying completed Transactions, commission eligibility and the date of the last commission charged Transaction. These records support relationship based commission administration and resolution of source or eligibility disputes. Where a 365-day renewal rule applies, the relevant reference date is the last commission charged Transaction, rather than every repeat booking.

4.9 Existing customer migration and Vendor records, the minimum contact and relationship information lawfully provided by a Vendor for an invitation or authorized customer management function, together with the authority or consent records needed for that activity. The rules below apply to any import or upload.

4.10 Payment and reconciliation data, payment method type, payment reference or token, masked payment information where made available, amount, currency, status, refunds, disputes and relevant settlement information. For direct Vendor payments, the Vendor may provide payment confirmation or evidence needed for Transaction administration. BEXU does not store complete payment-card numbers or card-security codes on its own systems.

4.11 Location and address data, a service or delivery address, Vendor branch or service area, a manually entered search location and, with permission, device location for an enabled location feature. Device-location permission is optional and may be withdrawn through device settings, manual search remains available. We do not use continuous background location tracking unless a specific feature is separately explained and valid permission is obtained.

4.12 Communications, complaints and public content, support requests, Platform messages, complaint evidence and attachments, feedback, reviews, ratings, moderation reports and approved photographs or videos. Any recording of a communication requires an appropriate notice and a lawful basis before recording begins.

4.13 Technical, usage and security data, IP address, device or browser type, operating system, app version, push token, relevant cookie or SDK identifiers, session and search activity, diagnostics, crash reports, authentication events and proportionate records of suspected misuse, duplicate accounts or fraud.

4.14 Marketing and engagement data, consent and opt-out records, campaign engagement, referral information and optional survey or promotion data, and programme participation or benefit records where a separately offered programme applies.

4.15 Under the standard product checkout route, payments are processed by an appropriately licensed PSP. Where that route is used, payment credentials are entered through the PSP interface and BEXU receives only the limited payment references and status information needed to administer the Transaction. BEXU does not store complete card numbers or security codes. Service payments made directly to a Vendor are recorded through confirmation and Transaction information. If another lawful payment route is expressly enabled, the Platform shall identify the payment recipient and material data-processing arrangements before use. Nothing in this Policy authorises unlicensed payment services or undisclosed handling of Customer funds.

4.16 We do not request detailed medical histories, diagnoses, treatment records or other sensitive information in a general Platform profile or public review. If such information is necessary for a Vendor Service, it should ordinarily be given directly and securely to the relevant Vendor. A booking category or service instruction may itself reveal a sensitive preference or health related inference, so its access and use are limited to the purposes reasonably necessary for that Transaction.

4.17 If a particular Platform feature requires BEXU to Process Sensitive Personal Data, we will explain the specific purpose and recipients, establish a lawful basis, obtain explicit consent where required and apply additional safeguards before Processing. Where health sector rules apply, restrictions on access, hosting and transfer shall be observed. Ordinary consent or this Policy will not override a mandatory restriction. BEXU does not collect biometric templates for ordinary registration, device or identity provider authentication may occur independently without BEXU receiving the underlying biometric data.

4.18 You must have lawful authority to provide another person’s data, supply only information necessary for the relevant purpose and make this Policy available where appropriate. An administrator’s acceptance of Platform terms is not a substitute for another person’s consent where consent is required.

4.19 A Vendor may invite its existing customers or provide records only through an enabled method and only where it has a valid basis and authority for the invitation, disclosure and intended use. The Vendor must provide appropriate privacy information, retain evidence of authority and respect objections or opt-outs. A bulk upload is not authorised merely because a Vendor uses the Platform. Imported records are restricted to the approved purpose and are not used to create a public Customer profile, market unrelated Vendors or enrol a person in a promotion without the lawful basis and any separate consent required.

5. How We Use Personal Data and Our Legal Bases

5.1 We Process Personal Data only with valid consent or where an applicable exception under the Data Protection Law.

5.2 To create, authenticate and administer accounts, verify contact details, authority, licences and qualifications where relevant, manage permissions and provide requested functions, on contractual necessity or the relevant legal obligation, or consent where required.

5.3 To confirm and administer Transactions, share necessary instructions with the relevant Vendor, provide appointment and delivery communications and record completion, cancellation and remedies, where necessary for the requested contract.

5.4 To record whether a Customer relationship was introduced by a Vendor or acquired through the Platform, determine applicable Vendor commission, recognise repeat relationships, prevent duplication and investigate eligibility disputes. Processing is limited to what is necessary for the agreed Platform relationship and contractual administration, or another applicable legal basis, optional tracking or marketing requires its own lawful basis.

5.5 To display direct payment or PSP payment status, administer Vendor commission invoices, reconcile records and support refunds and payment disputes, on contractual necessity, applicable legal record duties or legal claims grounds.

5.6 To answer enquiries, investigate complaints, assess Platform remedies, secure accounts, prevent fraud and enforce applicable terms, using the applicable contractual, legal obligation or legal claims basis. Exclusive Vendor customer management records are Processed on the Vendor’s documented instructions rather than for BEXU’s independent marketing.

5.7 To respond to a requested search or use an address intentionally supplied for a Transaction. Optional device location is used with permission and the consent required by Applicable Law. Optional personalisation beyond what is necessary for a requested feature requires the appropriate separate basis.

5.8 To administer a program only where it is offered under separately accepted programme terms, and to use optional personalised promotional information only with consent.

5.9 To diagnose faults, measure reliability and improve features, using anonymous or appropriately aggregated information where possible. Identifiable information is used only with consent or an applicable statutory exception. Optional analytics technologies are subject to the required controls.

5.10 To send and measure permitted promotional communications only with valid consent where required and in accordance with direct marketing rules. Vendor provided data are not automatically authorized for BEXU marketing or cross Vendor promotion.

5.11 To maintain legally required records, respond to lawful authority requests and establish or defend legal rights, under the applicable legal obligation or statutory exception.

5.12 Where consent is the basis, we request it clearly and specifically and provide a means to withdraw it. Withdrawal does not affect lawful Processing completed before withdrawal. If data are necessary for a feature or Transaction, declining to provide them may prevent that feature or Transaction, but optional marketing consent is not a condition of core Platform access.

6. Rankings, Personalisation and Automated Processing

6.1 The Platform may use pre-set rules or automated systems for search, matching, availability, recommendations, security, Customer source attribution and commission administration. Search order may reflect relevance, location, availability, ratings, responsiveness, completion rates and cancellations. The current free access model does not use Vendor subscription tiers as a ranking factor.

6.2 If paid placements are separately offered, they will be identified as advertising or promotion. Optional personalised recommendations or marketing are used only with consent.

6.3 Automated records may flag duplicate accounts, unusual activity, suspected fraud, an attribution inconsistency or events requiring investigation. Where possible, identity matching uses relevant account or verified contact. Optional cross device tracking will not be introduced without explaining it and obtaining consent where required.

6.4 A Customer or Vendor may contest an inaccurate source classification, commission related relationship record or relevant account restriction through the support channels. BEXU will consider available evidence and provide assessment where required.

6.5 Where a decision is made solely by Automated Processing and has an effect or otherwise materially and adversely affects you, you may object, provide information and request manual review, subject to the conditions and exceptions under Applicable Law. Sensitive Personal Data will not be used for such decisions unless the Processing is expressly permitted and appropriate safeguards are applied.

7. When and With Whom We Share Personal Data

7.1 We do not sell or trade Personal Data. We share data only where reasonably necessary for a purpose described in this Policy, with the consent required, or where required or permitted by Applicable Law.

7.2 Customer contact information, the particular Booking or order, service or delivery instructions, payment status and relevant complaint information are shared as necessary to perform and administer that Transaction and meet the Vendor’s lawful obligations. A Vendor receives only the information relevant to its own relationship.

7.3 Approved Vendor profiles, Personnel names, photographs, roles, qualifications and availability, and the public review information a user submits, may be displayed to support discovery and verified reviews. Private account, relationship and commission records are not public listings.

7.4 Relevant identity and contact information, payment reference, amount, status and dispute information are shared where necessary for an enabled payment, refund, settlement or fraud check.

7.5 Relevant identifiers and authority or verification information are shared for enabled sign-in, authentication and lawful onboarding checks.

7.6 Relevant address, location, contact and order details are shared for an enabled mapping, address-validation or delivery function.

7.7 Data necessary for hosting, secure operation, messaging, support, diagnostics and permitted measurement are Processed under appropriate access restrictions and contractual safeguards. Optional marketing providers receive only the data authorised for the applicable campaign.

7.8 Only the contact, authorized brand, Personnel and campaign information necessary for an expressly agreed content or fulfilment service is shared.. A promotional partnership does not give the partner general access to the Customer database.

7.9 Data reasonably necessary for the relevant professional engagement or legal claim may be disclosed subject to professional duties and confidentiality.

7.10 Limited data may be disclosed for a proposed or completed investment, reorganisation or transfer of the business under appropriate confidentiality and data-protection safeguards, with any required change of Controller notice.

7.11 We disclose information lawfully required or permitted for the relevant request or proceeding and seek to limit it to the appropriate scope.

7.12 Vendors and PSPs may Process information independently for their own performance, professional, tax, accounting or regulatory duties. Their privacy notices apply to that independent Processing. This does not limit BEXU’s obligations for its own disclosures or Processing.

8. How We Manage Disclosures

8.1 A provider acting as our Processor is required to Process data only for the agreed purposes and our documented instructions and to apply appropriate confidentiality, security, assistance, return and deletion obligations. Access is limited to persons who need the data for their duties.

8.2 Where BEXU acts as a Vendor’s Processor for exclusive customer management records, BEXU follows the Vendor instructions and the data-processing terms of the Vendor agreement, applies confidentiality and security safeguards, controls subprocessing and cross-border transfers and assists with rights requests, breach handling and deletion as applicable.

8.3 A disclosure between separate Controllers requires a lawful basis and is limited to its disclosed purpose. BEXU does not assume that a Vendor’s customer relationship authorises disclosure to every other Vendor or marketing partner.

8.4 Where legally permitted, we assess the validity and scope of an authority request, and any material change in Controller will be notified where required.

9. International Data Transfers

9.1 A hosting or service provider may Process data or allow access from outside the United Arab Emirates. Any such transfer will occur only under a mechanism permitted by the Data Protection Law and any other Applicable Law governing the particular data.

9.2 Transfer safeguards may include data minimisation, encryption, role-based access, confidentiality, Processor restrictions and contractual controls on onward use, return and deletion. Information concerning applicable cross-border safeguards may be requested through Section 17.

9.3 Where health sector, child protection or another mandatory rule restricts overseas storage, disclosure or access, that restriction applies. A general consent or contractual clause will not override it.

10. Data Retention

10.1 We retain Personal Data only for as long as reasonably necessary for the disclosed purpose, Transaction administration, lawful records, complaint resolution, fraud prevention and legal rights. When no longer needed, data are securely deleted or irreversibly anonymised, subject to proportionate restricted backup cycles and legal preservation requirements.

10.2 Account and profile information is retained while the account is active and thereafter only as needed to complete outstanding matters, meet legal duties or address misuse and claims.

10.3 Vendor onboarding, licence, agreement and Personnel records are retained for the relevant business relationship and applicable statutory, audit and claims periods.

10.4 Customer source and relationship records are retained while necessary to determine the relationship’s exemption or commission eligibility, administer any applicable 365-day renewal cycle and resolve associated disputes, and thereafter only for the proportionate legal, audit and evidentiary period. The expiry of 365 days does not itself require deletion or justify indefinite retention of unrelated Customer history. Access and the retained detail are limited to what is necessary.

10.5 Exclusive Vendor customer management records are retained on the Vendor’s lawful documented instructions and under the Vendor agreement, subject to BEXU’s applicable statutory obligations. They are returned, deleted or restricted when the authorised Processing ends, as applicable.

10.6 Booking, order, invoice, payment status and financial records are retained for the statutory tax, accounting, consumer protection and claims periods applicable to the record. Complaints, refunds and payment disputes are retained until resolved and for the proportionate subsequent evidentiary or legal period.

10.7 Where card payments are processed through a PSP, complete payment credentials are retained under that provider’s applicable policies. BEXU retains only the limited payment references, tokens and status information needed for Transaction administration, reconciliation, disputes and lawful recordkeeping. Any other enabled lawful route shall have its material data and retention arrangements disclosed before use.

10.8 Device location is used for the requested session or feature and is not retained beyond its disclosed purpose, unless it forms part of a necessary Transaction or address record. Public reviews are retained while published and for proportionate moderation or legal purposes thereafter.

10.9 Marketing preferences and consent evidence are retained while relevant, with a limited suppression record where necessary to honour an opt-out and demonstrate compliance. Technical, security and fraud logs are retained for a proportionate period reflecting the risk and legal requirements.

10.10 Anonymous information may be retained longer only if it no longer identifies a person and is not used for re-identification. A legal hold may extend retention of relevant records during an audit, complaint, investigation or proceeding; it does not authorise unrelated continued use.

11. Data Security and Personal Data Breaches

11.1 We apply appropriate technical and organisational safeguards having regard to the nature, context, purpose and risk of Processing. Relevant controls include restricted access and authentication, confidentiality obligations, secure transmission and storage measures appropriate to the data, logging and recovery controls, secure development and review, and incident response arrangements.

11.2 No method of transmission or storage guarantees complete security. You should keep credentials confidential, use secure devices and promptly report suspected unauthorised access through the Platform’s support channel.

11.3 If a Personal Data Breach occurs, we assess, contain, investigate and remediate it and make the notifications to the competent authority and affected persons required by Applicable Law. Notices include the information and protective measures required by the applicable regime. If BEXU acts as Processor, it also informs the relevant Controller and assists under the applicable agreement and law.

12. Your Rights and Choices

12.1 Subject to Applicable Law and its conditions and exceptions, you may request information about our Processing, relevant recipients, retention criteria, cross-border safeguards and Automated Processing, access and correction, completion of incomplete information, erasure or restriction, portability of eligible data and transfer where technically feasible, withdrawal of consent, cessation of direct marketing and related profiling, and review of qualifying automated decisions.

12.2 Withdrawal of consent does not affect Processing already lawfully completed. A request may be limited where records or Processing are required by law, to protect another person, preserve security, serve a permitted public interest or establish or defend legal rights. We explain any applicable limitation in accordance with the law.

12.3 You may update available account details and preferences in account settings. For another request, use Section 17 and identify it as a privacy request. We may seek only the information reasonably needed to verify identity or authority and locate the records. We respond within the procedure and period required by Applicable Law.

12.4 If BEXU is Processing exclusive Vendor records on that Vendor’s instructions, we may direct the request to that Vendor and assist it in fulfilling the request as required. If BEXU is Controller of the relevant Platform records, BEXU handles the request itself.

12.5 You may submit a complaint to the competent UAE data protection authority or other competent regulator where you consider that your data have been Processed contrary to Applicable Law. Contacting BEXU first does not remove that right.

13. Marketing, Cookies and Notifications

13.1 Operational communications include account verification, confirmations, reminders, Vendor responses, order and delivery updates, cancellations, refund information, Vendor invoice notices and security alerts. They are sent only as appropriate for the relevant account or Transaction and are distinguished from optional advertising.

13.2 Direct marketing and personalised promotions are sent only where permitted and with the required valid consent. An invitation from a Vendor, an imported contact record or a Transaction with one Vendor is not automatic consent to BEXU marketing or promotions for other Vendors. You may opt-out through the message controls, account settings or Section 17. An opt-out does not prevent necessary operational communications.

13.3 Where used, cookies, SDKs, local storage, and related technologies support authentication, preferences, security, diagnostics, permitted analytics and enabled promotional features. Essential technologies are limited to functions needed to provide or secure the requested Platform service. Optional analytics, advertising, personalisation or cross-device technologies are subject to the notices and consent controls required by Applicable Law.

13.4 The applicable cookie or in-app notice identifies material optional technologies and their purposes when they are used. You may manage browser cookies and app permissions in the relevant settings, disabling an essential technology may affect the requested function. Device permission alone is not treated as consent to unrelated Processing.

13.5 Any third-party provider that acts as a separate Controller has its own privacy notice. BEXU remains responsible for establishing a lawful basis for its own disclosure to that provider.

14. Children and Bookings for Minors

14.1 Customer and Vendor account holders must be aged 18 or above. Children may not independently create or operate an account. We do not knowingly collect children’s data directly for account registration, direct marketing or behavioural advertising.

14.2 An authorised adult may make a Booking for a minor where the relevant Vendor permits it. The adult must have lawful authority and provide only the minimum information necessary for the Booking. Health details should ordinarily be supplied directly and securely to the Vendor. A minor’s information must not be placed in a public review or provided for unrelated marketing or profiling.

14.3 Where limited child data are necessary, we apply the protections, verifiable parental or guardian authority and other specific conditions required by Federal Decree-Law No. 26 of 2025 Regarding Child Digital Safety and other Applicable Law. Data concerning a child under 13 are not collected, Processed, published or shared unless the specific legal conditions permitting that activity are satisfied.

14.4 If you believe a child has opened an account or child data have been submitted improperly, contact us through Section 17. We will assess the report and restrict, delete or safeguard the relevant data, subject to any necessary lawful retention to protect the child, complete an authorised Transaction or preserve legal rights.

15. Third-Party Services and Links

15.1 The Platform may link to or integrate Vendor websites, PSP interfaces, identity providers, maps, delivery services, social-media services or app stores. When you use a third-party service directly, its privacy notice applies to its independent Processing. Please review it before providing data.

15.2 This Policy does not make BEXU responsible for decisions about Processing independently made by a third party, but does not limit BEXU’s responsibility for its own selection, disclosures, instructions or Processing under Applicable Law.

16. Changes to this Policy

16.1 We may update this Policy to reflect changes in the Platform, Processing or Applicable Law. The current version and effective date are published on the Platform. This version takes effect when first published or otherwise made available for the relevant Processing.

16.2 We provide additional notice of material changes through an appropriate channel. A Policy update alone does not authorise a materially new or incompatible purpose. Any lawful basis, specific notice or consent required is established before the new Processing begins.

17. Contact Us

17.1 The Platform Controller is BEXU Portal L.L.C. To ask a privacy question, exercise a data right or raise a complaint, use the in-app support function or the contact form at ().

17.2 BEXU’s corporate and business-contact information is available through the legal and contact information published on the Platform. Privacy requests received through support are referred to the person responsible for data protection and, where applicable, the appointed Data Protection Officer.

17.3 If your enquiry concerns a Vendor’s independent use of data, you may also contact that Vendor using its published contact information. BEXU may assist in identifying the relevant party and will continue to handle any part of the request concerning its own Processing.

18. Governing Law and Language

18.1 This Policy is governed by the applicable federal and local laws of the United Arab Emirates. It shall be made available in Arabic as required and may also be provided in English. In the event of inconsistency between published versions, the Arabic version prevails to the extent required by Applicable Law. Nothing in this Policy limits a non-excludable data-protection right or remedy.