1. Introduction

At Redington Gulf, we are committed to safeguarding the privacy and security of your personal data. We understand the importance of maintaining your trust and are dedicated to handling your personal information with transparency, care, and in accordance with applicable data protection laws.

This Privacy Notice outlines how we collect, use, disclose, and protect your personal data when you interact with us—whether through our websites, applications, services, or other communication channels. It also describes your rights as a data subject and how you can exercise them. Please read this Privacy Notice carefully.

2. Definitions

In this Privacy Notice, the following definitions are used:

• Personal Data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• Sensitive Personal Data means information that reveals an individual’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a person, health data, and data concerning a person’s sex life or sexual orientation.
• Data Subject means an individual whose personal data is being collected, held, or processed.
• Data Controller means the natural or legal person, public authority, agency, or other body which determines the purposes and means of the processing of personal data.
• Data Processor means the natural or legal person, public authority, agency, or other body who processes personal data on behalf of the Data Controller.
• Third Party means any person or entity other than the data subject, controller, processor, or persons authorized to process personal data under the direct authority of the controller or processor.
• Consent means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which the individual, through a statement or a clear affirmative action, signifies agreement to the processing of personal data.
• Processing means any operation or sets of operations performed on personal data, whether by automated means, such as collection, recording, organization, structuring, storage, alteration, retrieval, consultation, use, disclosure, erasure, or destruction.
• Cookies are small text files that are placed on your device when you visit our websites or use our digital services.
• Data Protection Officer (DPO) means an individual appointed to monitor internal compliance, inform and advise on data protection obligations, and act as a contact point for data subjects and the supervisory authority.

3. What Personal Data We Collect?

Personal data comprises all the details that Redington Gulf collects and processes directly or indirectly about you as an individual, for instance information about your identity and contact details like:

• Name
• Email-ID
• Contact Number
• Address

We collect personal data from the following individuals in the course of our operations:

• Employees and job applicants
• Customers and users
• Business partners, vendors, and third parties
• Website and digital platform users

Usage Data is collected automatically while using the Service. Usage Data may include information such as:

• Your device’s IP address
• Browser type, browser version
• The pages of our Service that you visit
• Time and date of your visit
• Time spent on those pages
• Unique device identifiers (e.g., cookies, session IDs)
• Other diagnostic data (e.g., error messages, page load times)

When You access the Services by or through a mobile device, certain information is collected automatically, including, but not limited to:

• The type of mobile device you use
• Your mobile device’s unique ID
• IP address of your mobile device
• Your mobile’s operating system
• The type of mobile Internet browser
• Unique device identifiers (e.g., cookies, mobile advertising IDs)
• Other diagnostic data (e.g., app crashes, usage patterns)

We may collect personal data directly from you, from third parties (such as service providers or business partners), and through your use of Redington Gulf’s websites and digital services.

Our services are not intended for children below 16 years or 21 years of age with respect to GDPR and UAE PDPL. Redington Gulf does not knowingly collect or process personal data of children. If you qualify as a child, you must not use our services or submit any personal information. We encourage parents and guardians to monitor their children’s online activity and advise that users make a self-declaration regarding their age when accessing our services.

Our website offers products or services for use by children. If you qualify as a child, you must use our services or submit any personal information in consultation with your legal guardian/parent. Where applicable, the user must self-declare that they are a minor along with necessary details so that verifiable consent can be obtained from parent/ guardian for collection of data in accordance with the General Data Protection Regulation (GDPR). Additionally, Redington Gulf does not intend to use children’s data for tracking, behavioural monitoring and targeted advertising towards minors.

Redington Gulf also does not intentionally collect or process any sensitive personal data, such as financial information, health records, biometric data, or information revealing racial or ethnic origin, political opinions, religious beliefs, or sexual orientation. Users are advised not to submit such information through our services.

4. Whose Personal Data We Collect?

We collect personal data from the following individuals in the course of our operations:

• Employees and job applicants
• Customers and users
• Business partners, vendors, and third parties
• Website and digital platform users

5. What are Cookies?

Cookies help us recognize your device and improve your browsing experience by remembering your preferences and enabling certain functionalities.

Information Collected Automatically

This includes information collected automatically via cookies and similar tracking technologies. Usage Data may include details such as your device’s IP address (considered an online identifier under applicable data protection laws), browser type and version, pages visited, date and time of access, time spent on pages, and diagnostic data. When accessing our services via a mobile device, we may also collect information such as your device type, unique device ID (also an online identifier), operating system, mobile browser type, and additional technical data required to ensure service functionality and security.

How We Use Cookies

• Ensure the proper functioning of our websites and digital services;
• Remember your preferences and settings;
• Analyse usage patterns to improve our services and website performance;
• Deliver personalized content and marketing communications where permitted by law;
• Facilitate security features and prevent fraudulent activities.

Types of Cookies We Use

• Essential Cookies: Necessary for core website operations and cannot be disabled as they support fundamental functions such as user login, page navigation, and security.
• Performance and Analytics Cookies: Collect anonymous information about how visitors use our sites to help us understand visitor interactions and improve user experience.
• Functionality Cookies: Remember choices you make, such as language preferences, to provide enhanced and personalized features.
• Targeting or Advertising Cookies: Used to deliver relevant advertisements and measure the effectiveness of marketing campaigns, often set by third-party partners.

Managing Cookies

You have the option to control or disable cookies through your browser settings. However, please note that disabling cookies may affect the functionality and your overall experience of our websites and services.

By continuing to use our websites and services, you consent to the use of cookies as described in this Privacy Notice. Where required by applicable laws, we will obtain your consent for the placement of non-essential cookies.

For further information on specific active cookies on the website, please refer to the cookie policy. <Link to cookie policy>

1.1 How do we use Data Collected?

We may use your personal data for a variety of legitimate business purposes in accordance with applicable data protection laws. These purposes include, but are not limited to:

• To Provide and Maintain Our Services: facilitating access to our platforms, delivering products or services, and monitoring usage to ensure functionality, performance, and security.
• To Manage Your Account: administer registration and user account, enabling access to features and functionalities available to registered users.
• To Fulfil Contractual Obligations: execution and management of contracts you enter into with us, including purchases and related transactions.
• To Communicate With You: contact via email, phone, SMS, or other electronic means for updates, service-related communications, or important information—based on your consent, where applicable.
• To Send You Marketing and Promotional Material: subject to your preferences and applicable laws, information about similar products, services, special offers, and upcoming events. You can opt out at any time.
• To Manage and Respond to Your Requests: handling queries, support tickets, complaints, and other interactions initiated by you.
• For Analytical and Improvement Purposes: internal business purposes such as data analysis, identifying usage patterns, evaluating marketing effectiveness, enhancing user experience, and improving services and platforms.

6. Disclosure of Personal Data

We may share your personal data with third parties only as necessary and in accordance with applicable data protection laws. These disclosures are governed by appropriate contractual safeguards to ensure your data remains secure and is processed only for legitimate purposes. Your information may be shared with:

• Service Providers: third-party service providers to perform functions on our behalf, such as monitoring and analysing service usage, facilitating payments, and communicating with you. These providers are obligated to process your data securely and solely for the purposes instructed by us.
• Affiliates: affiliated entities, including subsidiaries, joint ventures, and other group companies under common ownership or control. These affiliates must adhere to the principles outlined in this Privacy Notice and maintain equivalent data protection standards.
• Business Partners: to offer certain products, services, promotions, or events that may be of interest to you, where appropriate legal bases exist, and with your consent where required.
• Other Users: if you choose to share personal information in public areas of our services (forums, comments, social features), that information may be visible to other users and publicly distributed beyond our platform.
• Legal and Regulatory Authorities: if required to do so by law or in response to valid data requests by public authorities, such as a court order or government agency.
• In Business Transfers: in connection with any merger, sale of company assets, financing, or acquisition of all or a portion of our business, personal data may be shared or transferred as part of the transaction.

7. Data Retention

We will retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, as outlined in this Privacy Notice. This includes the retention of personal data to:

• Fulfil contractual and legal obligations
• Resolve disputes
• Enforce our agreements and policies
• Support internal operational requirements such as auditing, data analysis, and service improvement

Retention periods may vary depending on the type of data and the legal or regulatory requirements applicable in different jurisdictions.

We retain Usage Data (such as logs, diagnostics, and analytics data) for a shorter duration, unless such data is required to enhance security, improve performance, or where a longer retention period is legally mandated.

Once your personal data is no longer required for the purposes for which it was collected, or if you withdraw your consent (where applicable), we will securely delete, anonymize, or pseudonymize it in accordance with our data retention and disposal policies.

8. Cross Border Transfer of Your Personal Data

Your personal data may be transferred to—and processed in—countries other than the one in which you reside. Redington Gulf stores and processes personal data in Middle East and the European regions, in accordance with applicable data protection laws. This may include processing at Redington Gulf operating locations, affiliate offices, data centres, or by trusted third-party service providers located outside your jurisdiction, including countries that may not provide the same level of data protection as your home country.

By submitting your personal data to us and using our services, you acknowledge and consent to the transfer of your information across borders, in accordance with this Privacy Notice.

Where such international transfers occur, Redington Gulf ensures that appropriate safeguards are in place to protect your data. These may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission or other legally recognized data transfer mechanisms;
• Data Processing Agreements (DPAs) with third-party processors that mandate adequate technical and organizational security measures;
• Transfer Impact Assessments, where required, to evaluate risks associated with cross-border transfers;
• Contractual obligations on the receiving parties to maintain a level of protection consistent with applicable legal and regulatory standards.

1.2 Consent

We may process your personal data based on your consent where required under applicable data protection laws. By providing your personal data to Redington Gulf and using our services, you acknowledge and agree to the terms outlined in this Privacy Notice, and you consent to the collection, use, and sharing of your data as described.

Where consent is the lawful basis for processing, you have the right to:

• Be informed of the purpose for which your personal data is being collected;
• Provide consent freely, specifically, and unambiguously;
• Withdraw your consent at any time, without affecting the lawfulness of any processing carried out prior to the withdrawal;
• Refuse to provide consent, in which case certain services may be limited or unavailable.

You can manage your consent preferences or withdraw consent by contacting us at DPO.MEA@redingtongroup.com or by following the opt-out instructions provided in our communications or service interfaces.

Newsletter and Marketing Communications

If you subscribe to our newsletter, your email address will be used for our marketing and promotional communications until you choose to unsubscribe. You may have explicitly granted consent during the subscription or as part of a service or product ordering process (e.g., by confirming: “I am accepting to receive newsletters from this website”).

You have the right to revoke your consent at any time with effect for the future. If you no longer wish to receive our newsletters, you can unsubscribe by clicking the “unsubscribe” link available in the footer of every newsletter email.

9. Your Rights

As a data subject, you have certain rights concerning the personal data we collect and process about you. These rights are granted under applicable data protection laws, including the General Data Protection Regulation (GDPR) and the UAE Personal Data Protection Law (PDPL). Redington Gulf is committed to ensuring that your rights are respected, protected, and facilitated.

Your Rights Include:

• Right to Obtain Information: request and receive clear, free information about how your personal data is processed.
• Right of Access & Subject Access Request: request confirmation and a copy of the personal data being processed by Redington Gulf.
• Right to Rectification: request correction of inaccurate or incomplete personal data.
• Right to Erasure (‘Right to be Forgotten’): request deletion of personal data under specific lawful conditions.
• Right to Restriction: request limited processing while accuracy or legal grounds are being verified.
• Right to Data Portability: request your data in a structured, machine-readable format for reuse or transfer to another controller.
• Right to Object/Stop Processing: object to data processing for direct marketing or based on legitimate interests.
• Right to Withdraw Consent: withdraw previously given consent.
• Right Not to be Subject to Automated Decision-Making: object to decisions made solely by automated processing that significantly affect you.
• Right to Request Personal Data Transfer: request that Redington Gulf transfer your personal data to another controller, where technically feasible.
• Right to Lodge a Complaint: file complaints with the relevant data protection authority if you believe your data rights have been violated.

If you would like to exercise any of the above rights, please contact us at DPO.MEA@redingtongroup.com. We may need to verify your identity before responding to your request and will respond in accordance with applicable legal timelines.

Where we are legally permitted to do so, we may refuse your request. If we refuse your request, we will tell you the reasons for the same.

1.3 Data Security

Redington Gulf is committed to protecting your personal data and has implemented appropriate technical, organizational, and physical security measures to prevent unauthorized access, loss, misuse, alteration, or destruction of your information.

Key security practices include:

• Encryption and Secure Transmission: We use industry-standard encryption technologies, including Secure Sockets Layer (SSL), to secure personal data transmitted through our systems.
• Access Controls and Confidentiality: Access to your personal data is strictly limited to authorized employees, contractors, and third-party service providers who have a legitimate business need.
• System and Network Protections: Robust firewalls, intrusion detection systems, antivirus tools, and logging mechanisms to monitor and protect our systems.
• Physical and Environmental Safeguards: Locked facilities, restricted access controls, and surveillance systems to protect IT infrastructure and data storage.
• User Responsibilities: You are responsible for maintaining the confidentiality of your account credentials and using strong, unique passwords. Notify us immediately of any suspected unauthorized use of your account.

We continually assess and enhance our data security practices to adapt to evolving threats and technologies.

1.4 Data Breach Management

At Redington Gulf, we take the security of your personal data seriously. Despite our best efforts to implement robust safeguards, data breaches may occasionally occur due to unforeseen circumstances. In such events, we follow a structured and timely Data Breach Management Process to minimize harm and comply with applicable data protection laws.

Where legally required, Redington Gulf will notify the appropriate supervisory authority within the stipulated time frame (e.g., within 72 hours under GDPR). If the breach is likely to result in a high risk to the rights and freedoms of individuals, affected data subjects will also be informed without undue delay, with clear guidance on protective measures they can take.

1.5 Changes and Communication of Updates

We may update this Privacy Notice from time to time to reflect changes in laws, our practices, or services. When we do, we will revise the “Last Updated” date and, where required, notify you through appropriate channels such as our website or direct communication. We encourage you to review this Notice periodically to stay informed about how we handle your personal data.

1.6 Contact Us / Grievance Officer

If you have any questions, concerns, or complaints regarding the processing of your personal data or this Privacy Notice, or if you wish to exercise your rights under applicable data protection laws, you may contact our designated Grievance Officer/ DPO. We are committed to addressing your queries in a timely and effective manner.

Grievance Officer / DPO

• Email: DPO.MEA@redingtongroup.com
• Mobile Number: +971 56 216 7232
• Legal Department, Redington, Plot S30902, PO Box 17266, Jebel Ali Free Zone, Dubai, UAE

We aim to acknowledge and resolve your concerns as quickly as possible, and in accordance with applicable legal requirements.