سياسة الخصوصية

1 Purpose of this Policy

Numou Ltd ("Numou", "we", "us" and "our") is a company established under the laws of the Abu Dhabi Global Market ("ADGM"), with its registered office address at 15th Floor Al Khatem Tower. Numou is a subsidiary of the ADGM who operate a digital marketplace that connects small and medium enterprises ("SMEs") with financing opportunities and procurement contracts. Numou is committed to protecting the privacy and security of your personal data and this privacy policy (the "Policy") describes how we collect and use personal data about you when you use our digital marketplace platform (“Numou Platform”) www.numou.ae, in accordance with applicable data protection and data privacy laws, such as the ADGM Data Protection Regulations 2021.

This Policy applies to all individuals of SMEs, lending institutions such as banks, service providers, government agencies, and corporates, that use the Numou Platform ("Users", "your" and "you"). "personal data" means any information that Numou processes that relates to an identifiable or identified individual.

Please read and retain a copy of this Policy along with a copy of any other privacy notice or privacy policy that we may provide on specific occasions when we are collecting or processing personal data about you, so that you are aware of the purpose and use of why we are collecting your personal data.

We will usually process your personal data in our capacity as a controller. This means that we are responsible for ensuring that we comply with relevant data protection laws when processing your personal data. In some cases, we may also act as a processor. This means that we act on behalf of the relevant controller, and only under their authority and instructions, in regard to that processing of personal data.

By proceeding with and submitting your application through the Numou Platform, you expressly acknowledge and agree that Numou may collect, use, process, store, verify, analyse, and disclose your personal data, company information, financial information, credit-related information, and supporting documents to participating lenders, financing partners, service providers, regulators, credit bureaus, verification providers, and other relevant third parties for the purposes of identity verification, eligibility assessment, credit evaluation, fraud prevention, compliance checks, financing facilitation, platform operations, analytics, and other purposes set out in this Policy and Numou’s terms and conditions of use.

You further agree to:

• the sharing and transfer of such information within and outside the United Arab Emirates, subject to applicable data protection laws and appropriate safeguards;

• Numou obtaining and verifying information from third-party sources, including credit bureaus, banks, open banking providers, government authorities, and verification agencies where applicable; and

• electronic communications, notices, disclosures, and records in relation to your application and use of the Numou Platform.

• If you do not agree to such collection, processing, and disclosure of personal data, please do not proceed with the application or use of the Numou Platform.

2 Data Protection Principles

We will comply with the following principles, which means that your personal data will be:

a) processed lawfully, fairly and in a transparent way;

b) collected only for specified, explicit and legitimate purposes that we have clearly explained to you, and not used in any way that is incompatible with those purposes;

c) adequate and relevant to the purposes we have told you about, and limited to what is necessary in relation to those purposes;

d) accurate and kept up to date;

e) kept only as long as necessary for the purposes we have told you about; and

f) kept securely to protect against unauthorised or unlawful processing, or accidental loss, destruction or damage.

3 Personal data that we may hold about you, use of such personal data and the legal basis for processing of such personal data

In connection with your use of the Numou Platform, we will collect, store and use the following categories of personal data about you for the below purposes and legal basis:

4 How is your personal data collected?

We collect personal data about you from the following sources:

a) your inputs and uploads (as a user); and

b) other third party data sources such as the ADGM, or certain web browsers and SEO/PPC related networks that Numou is a member of.

5 If you fail to provide personal data

If you fail to provide certain information when requested, we may not be able to provide you with information about our services and products, and it may affect your use, and the available functionality, of the Numou Platform.

6 Automated Decision-Making

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.

7 Data Sharing

We will share your personal data with third parties where required by law, where it is necessary to administer the service relationship with you, or where we have another legitimate interest in doing so.

"Third Parties" includes third-party service providers managing the Numou Platform (including contractors and designated agents) and other entities within the Numou Group. "Numou Group" means Numou, its subsidiaries, its holding company, and its affiliates, including the ADGM.

All Third Parties and other entities in the Numou Group are required to take appropriate security measures to protect your personal data in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. Where they are acting as a processor, we only permit them to process your personal data for specified and limited purposes, and only in accordance with our instructions.

We will share your personal data with other entities in our Numou Group where another entity provides us with relevant services, as part of our regular reporting activities on company performance, in the context of a business reorganisation or group restructuring exercise, and for system maintenance support and hosting of data.

We may share your personal data with other third parties, for example in the context of the possible sale or restructuring of our business. In this situation we will, so far as possible, share only anonymised or pseudonymised data with the other parties before the transaction completes. Once the transaction is completed, we will share your personal data with the other parties if and to the extent required under the terms of transaction.

8 Numou may disclose or share Personal Data with relevant regulatory authorities, government agencies, law enforcement bodies, courts of competent jurisdiction, or other authorities where such disclosure is required by applicable laws, regulations, legal process, or pursuant to a lawful request or order.

9 Countries to which we transfer your personal data

The information you submit will be processed and stored on servers based in the United Arab Emirates.

Where personal data is transferred outside the United Arab Emirates, Numou shall ensure that such cross-border transfers are conducted in compliance with applicable data protection laws, including implementing adequate contractual, technical, organisational, and security safeguards to protect the personal data against unauthorised access, disclosure, misuse, or loss.

10 Data Security

Data security is very important to us, and to protect your personal data we have taken suitable measures to safeguard and secure the data collected about you.

We have put in place appropriate security measures to prevent your personal data from being lost, used or accessed in an unauthorised way, or otherwise altered or improperly disclosed. In addition, we limit access to your personal data to those of our employees, agents, contractors and other third parties on a need to know basis. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We train people who work for us on how to handle personal data appropriately and we restrict access to what is necessary for specific job functions. In addition, our employees and third-party service providers are subject to confidentiality obligations and may not disclose your personal data unlawfully or unnecessarily.

We have put in place procedures to deal with any suspected data breaches and will notify you and any applicable regulator of a suspected breach where we are required to do so under applicable laws.

11 Data Retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data, and whether we can achieve such purposes through other means, as well as the applicable legal requirements.

Once you are no longer a user of the Numou Platform, we will retain and securely destroy your personal data in accordance with applicable laws and regulations.

12 Requests about your personal data

Under certain circumstances, you have the right to:

• Access your data – request a copy of your personal data that we process about you;

• Rectify your data – request that we amend or update your personal data where it is inaccurate or incomplete;

• Erase your data – request that we delete your personal data where it is no longer necessary for the purpose(s) for which your information was originally collected;

• Block your data – request that we temporarily or permanently stop processing all, or some of, your personal data;

• Withdraw your consent – withdraw your consent at any time to the use of your personal data for a particular purpose (where we have asked for your consent to use your personal data for that particular purpose);

• Receive or transmit your data in a machine-readable and structured format (otherwise known as "data portability") – request the receipt or transmission of your personal data to another organisation, in a structured and machine-readable format;

• Object to the use of your data – at any time, object to us processing your personal data where it is based exclusively on our legitimate interests (see above) or for direct marketing purposes; and

• Object to any automated decision-making – request us not to subject you to a decision based solely on automated decision making, including profiling, where the decision would have a legal effect on you, or produce a similarly significant effect.

For any of the above, please email us at support@numou.ae or send postal mail to the following address:

Numou Support Team

15th Floor Al Khatem Tower

Subject to any overriding legal obligations, requirements and/or exemptions, we will endeavour to respond to your request as soon as possible and within any timeframes under applicable data protection law. We may ask for further information from you to be able to respond to your request and ask you to provide proof of your identity.

If you feel that we do not comply with applicable data protection and privacy rules, you may lodge a complaint with the competent data protection authority, the ADGM Commissioner of Data Protection.

13 Notification of changes

Numou reserves the right to amend or update this Policy from time to time. Any updated version will be published on Numou’s website and/or the Numou Platform with the revised effective date. Where required by applicable law or where changes are material, Numou may notify users through appropriate communication channels

14 Contact

For any questions about this Policy, please contact the Numou Support Team at support@numou.ae.