Privacy Policy

This Privacy Policy (the "Policy") is a binding statement of how Base7 processes Personal Data through the website located at this domain (the "Website"). It applies to all Data Subjects whose Personal Data we process in that context, including visitors, enquirers and correspondents. By accessing or using the Website, or by submitting Personal Data to us, you acknowledge that you have read and understood this Policy.

This Policy does not form part of any contract of employment, engagement or services and may be updated from time to time in accordance with Section 20. Where a separate notice or consent is provided to you in respect of a specific processing activity, that notice or consent shall apply in addition to, and where inconsistent shall prevail over, this Policy in respect of that activity.

For the purposes of the Regulations, the Controller of your Personal Data is Base7, a company established and registered in the Abu Dhabi Global Market, with its registered office at Al Maryah Island, Abu Dhabi, United Arab Emirates ("Base7", "we", "us" or "our").

All requests, enquiries and notices concerning this Policy or the processing of your Personal Data, including the exercise of the rights described in Section 15, must be addressed to our data protection contact at privacy@base7.ai, marked for the attention of the Data Protection contact.

In this Policy, unless the context requires otherwise:

• "Regulations" means the Data Protection Regulations 2021 of the Abu Dhabi Global Market, together with any regulations, rules, guidance and codes of practice issued under them, each as amended, supplemented or replaced from time to time.
• "Personal Data", "Controller", "Processor", "Processing", "Data Subject" and "Special Categories of Personal Data" have the meanings given to them in the Regulations.
• "Office of Data Protection" or "Commissioner" means the Office of Data Protection of the Abu Dhabi Global Market, being the competent supervisory authority.
• "you" and "your" refer to the Data Subject to whom the relevant Personal Data relates.

Headings are for convenience only and do not affect interpretation. References to the singular include the plural and vice versa, and the words "including", "include" and "in particular" are illustrative and not limiting.

This Policy applies to the Processing of Personal Data carried out by or on behalf of Base7 through the Website. It does not apply to Personal Data processed by third parties, including operators of websites we link to, advertisers, or social media platforms, each of which processes Personal Data under its own privacy policy for which we accept no responsibility.

Depending on how you interact with the Website, we may process the following categories of Personal Data:

• Identity and contact data: your name, email address, telephone number, employer or organisation, job title, and any other information you choose to provide.
• Communications data: the content of, and metadata relating to, messages, enquiries and correspondence you send to us, including through the contact form.
• Technical and device data: internet protocol (IP) address, login and access times, browser type and version, operating system and platform, device identifiers, and time-zone and location inferred from your IP address.
• Usage data: information about how you access and use the Website, including pages viewed, referring and exit pages, click paths, session duration and interaction events.
• Consent and preference data: records of the consents you have given or withdrawn, and the cookie and communication preferences you have set.

Where you provide Personal Data relating to any other individual, you represent and warrant that you are authorised to do so and that you have informed that individual of the matters set out in this Policy.

We obtain Personal Data:

• directly from you, when you complete forms, contact us, or otherwise interact with the Website;
• automatically, through cookies, server logs and similar technologies, as described in our Cookie Policy; and
• from third parties acting on our behalf, such as hosting, analytics and infrastructure providers, and from publicly available sources where relevant to a legitimate business purpose.

We Process Personal Data only where the Regulations permit. The purposes for which we Process Personal Data, and the corresponding lawful bases, are:

• To respond to and manage your enquiries and to provide information you request. Lawful basis: the Processing is necessary to take steps at your request prior to entering into any dealing, and our legitimate interests in responding to and managing communications.
• To operate, administer, secure and maintain the Website, including to detect, prevent and respond to fraud, abuse, security incidents and technical faults. Lawful basis: our legitimate interests in operating a secure and reliable service, and compliance with our legal obligations.
• To analyse and improve the Website and our content and services. Lawful basis: your consent in respect of non-essential cookies, and otherwise our legitimate interests in understanding and improving performance.
• To send communications and, where applicable, marketing. Lawful basis: your consent, or our legitimate interests where permitted by the Regulations, subject to your right to object at any time.
• To comply with applicable law and regulatory obligations, and to establish, exercise or defend legal claims. Lawful basis: compliance with a legal obligation to which we are subject, and our legitimate interests in protecting our rights.

Where we rely on legitimate interests, we have carried out a balancing assessment to ensure that those interests are not overridden by your interests, rights and freedoms. You may request further information about that assessment using the contact details in Section 2.

We do not seek to collect Special Categories of Personal Data through the Website. You should not submit such data to us unless expressly requested. Where you nonetheless provide it, you consent to our Processing it for the purpose of managing your communication, and we will Process it only to the extent necessary and permitted under the Regulations.

We use cookies and similar technologies to operate the Website and, subject to your consent, to measure performance and personalise content. Non-essential technologies are deployed only where you have given consent, which you may withdraw or vary at any time. Full details are set out in our Cookie Policy.

We may disclose Personal Data to the following categories of recipient, in each case subject to appropriate safeguards:

• our operating companies, Bridge, Base7 and Obsidian, where relevant to your enquiry or dealing;
• Processors and service providers who process Personal Data on our behalf and on our documented instructions, including hosting, infrastructure, analytics, communications and security providers;
• professional advisers, including legal, audit, insurance and tax advisers, where necessary for the establishment, exercise or defence of legal claims or for compliance purposes;
• regulators, courts, law enforcement and governmental authorities, where required or permitted by applicable law or to protect our rights, property or safety or those of others; and
• a purchaser or successor in the event of a reorganisation, merger, acquisition or transfer of all or part of our business or assets, subject to the confidentiality of your Personal Data.

We do not sell your Personal Data, and we do not disclose it for the independent marketing purposes of third parties without your consent.

Where we engage a Processor, we do so under a written contract that requires the Processor to Process Personal Data only on our documented instructions, to implement appropriate technical and organisational measures, to impose equivalent obligations on any sub-processor, and to assist us in complying with our obligations under the Regulations, in each case consistent with the requirements of the Regulations.

Personal Data we Process may be transferred to, and stored or otherwise Processed in, jurisdictions outside the Abu Dhabi Global Market and the United Arab Emirates, including where our service providers or their infrastructure are located. Where we make such a transfer, we do so only where the Regulations permit, including where:

• the recipient jurisdiction is recognised as providing an adequate level of protection;
• the transfer is subject to appropriate safeguards that provide enforceable rights and effective remedies, such as approved contractual clauses or binding instruments; or
• a specific derogation under the Regulations applies, including where the transfer is necessary for the performance of steps taken at your request or for the establishment, exercise or defence of legal claims.

You may request further information about the safeguards applied to a particular transfer using the contact details in Section 2.

We retain Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy any legal, regulatory, tax, accounting or reporting requirements, and to establish, exercise or defend legal claims. To determine the appropriate retention period we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure, the purposes of Processing, and applicable legal requirements. When Personal Data is no longer required, it is securely deleted or irreversibly anonymised.

We maintain appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing. These measures may include access controls, encryption in transit, network security, logging and monitoring, and staff confidentiality obligations. No method of transmission over the internet or method of electronic storage is completely secure, and while we strive to protect your Personal Data we cannot guarantee absolute security, and any transmission is at your own risk. In the event of a Personal Data breach that meets the threshold under the Regulations, we will notify the Office of Data Protection and affected Data Subjects as and to the extent required.

Subject to, and in accordance with, the Regulations, you have the following rights in respect of your Personal Data:

• Right of access: to obtain confirmation as to whether we Process your Personal Data and, where we do, to access that data and receive prescribed information about the Processing.
• Right to rectification: to have inaccurate Personal Data corrected and incomplete Personal Data completed.
• Right to erasure: to have your Personal Data erased in the circumstances specified in the Regulations.
• Right to restriction: to obtain a restriction of Processing in the circumstances specified in the Regulations.
• Right to object: to object to Processing based on our legitimate interests, and to object at any time to Processing for direct marketing.
• Right to data portability: to receive certain Personal Data in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
• Right to withdraw consent: to withdraw any consent you have given at any time, without affecting the lawfulness of Processing carried out before withdrawal.

To exercise any of these rights, contact us using the details in Section 2. We may need to verify your identity before responding. We will respond within the period required by the Regulations, and may extend that period where permitted, in which case we will inform you. We do not charge a fee to exercise your rights, except where a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act, as permitted by the Regulations.

We do not make decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated Processing, including profiling, except where permitted by the Regulations and subject to suitable safeguards. Where any such Processing is carried out, you have the right to obtain human intervention, to express your point of view and to contest the decision.

Where we send you marketing communications, we do so only in accordance with the Regulations and applicable law. You may opt out of marketing at any time by using the unsubscribe mechanism in the relevant communication or by contacting us using the details in Section 2. Opting out of marketing does not affect service or transactional communications necessary for our dealings with you.

The Website is directed at a business audience and is not intended for children. We do not knowingly collect Personal Data from any individual under the age of 18. If you believe we have inadvertently collected such data, please contact us and we will take appropriate steps to delete it.

If you have any concern about our Processing of your Personal Data, we ask that you contact us first, using the details in Section 2, so that we may seek to resolve it. You also have the right to lodge a complaint with the Office of Data Protection of the Abu Dhabi Global Market, without prejudice to any other administrative or judicial remedy available to you.

We may amend this Policy from time to time to reflect changes in our practices, technology, legal requirements or other factors. The date at the top of this Policy indicates when it was last revised. Where changes are material, we will take reasonable steps to bring them to your attention. Your continued use of the Website after any change takes effect constitutes acknowledgement of the amended Policy.

This Policy, and any matter arising out of or in connection with it, is governed by the Regulations and the laws of the Abu Dhabi Global Market. Any dispute is subject to the exclusive jurisdiction of the courts of the Abu Dhabi Global Market, without prejudice to your statutory right to lodge a complaint with the Office of Data Protection.

Base7, Office 1801, Floor 18, Sky Tower, Shams Abu Dhabi, Al Reem Island, Abu Dhabi, United Arab Emirates. Data protection contact: privacy@base7.ai.