Privacy Policy

Effective Date : 13 July 2026

This Privacy Policy explains how Kimy Technology FZE ("GulfGrid", "we", "our", "us") collects, uses, shares and protects your personal data when you use the GulfGrid Platform available at www.gulf-grid.com.

This Privacy Policy is designed to comply with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE PDPL"), as well as with the European Union General Data Protection Regulation ("EU GDPR") and the United Kingdom General Data Protection Regulation ("UK GDPR") where applicable to visitors from the European Union or the United Kingdom.

1. WHO WE ARE

The data controller responsible for your personal data is :

KIMY TECHNOLOGY FZE
Office SF3283, 1st Floor, C1 Building, Ajman Free Zone
Ajman, United Arab Emirates
Email : contact@gulf-grid.ae

We do not currently have a designated Data Protection Officer, but our contact email above may be used for any privacy-related enquiry, exercise of rights, or complaint.

2. WHAT PERSONAL DATA WE COLLECT

We collect and process the following categories of personal data :

2.1. Data you provide directly

• Account data : first name, last name, username, email address, password (stored in hashed form).
• Profile data : profile picture, biography, phone number (if you choose to share it in a Listing), preferred language, communication preferences.
• Listing data : content of the Listings you post (text, images, price, category, location).
• Communication data : messages you exchange with other users through the Platform's messaging system, communications you send to us via email or contact form.
• Payment data : billing name, billing address (Payment card details are collected and processed directly by our payment processor Stripe; we do not store your card number).
• Boutique Pro data : business name, banner, logo, bio (if you subscribe to Boutique Pro).

2.2. Data we collect automatically

• Usage data : pages viewed, search queries, click patterns, session duration, referring URL.
• Device data : IP address, browser type and version, operating system, device identifier, language settings.
• Cookies and similar technologies : see Section 8 below.

2.3. Data we receive from third parties

• Payment processor (Stripe) : payment confirmation, refund status, dispute information.
• Email service provider (Brevo/Sendinblue) : email delivery status, open/click rates for transactional emails.
• Analytics providers (Google Analytics) : aggregated anonymised usage statistics.
• Advertising platforms (Meta, TikTok, Snapchat) : conversion tracking data, in aggregated and hashed form.

3. WHY WE PROCESS YOUR DATA

We process your personal data for the following purposes :

For visitors from the UAE, the equivalent legal basis under the UAE PDPL is consent or the performance of a contract, as applicable.

4. WHO WE SHARE YOUR DATA WITH

We share your personal data only with the categories of recipients listed below, and only to the extent necessary for the purposes described :

• Other users of the Platform — When you post a Listing, the information contained in that Listing (including any contact information you have chosen to disclose) is visible to other users of the Platform. When another user contacts you via the messaging system, they can see your username and profile picture.
• Payment processor (Stripe, Inc.) — For processing payments related to Paid Services. Stripe's own privacy policy is available at stripe.com/privacy.
• Email service provider (Brevo) — For sending transactional and marketing emails. Brevo's privacy policy is available at brevo.com/legal/privacypolicy.
• Hosting provider (o2switch) — For hosting the Platform and its underlying database.
• Analytics providers — Google Analytics, subject to IP anonymisation.
• Advertising platforms — Meta (Facebook/Instagram), TikTok, Snapchat, for conversion tracking. Data shared is limited and hashed.
• Backup provider (Google Drive via UpdraftPlus) — Encrypted backups of the database and files.
• Legal or law enforcement authorities — Where required by law, court order, or to protect our rights.
• Professional advisers — Lawyers, accountants, auditors, bound by strict confidentiality obligations.

We do not sell your personal data to any third party for their own marketing purposes.

5. INTERNATIONAL DATA TRANSFERS

GulfGrid is based in the United Arab Emirates. Some of our service providers (notably Stripe, Google, Meta) are based in the United States or the European Union. When we transfer your personal data outside the UAE :

• For visitors from the European Union or the United Kingdom, we rely on adequate transfer mechanisms permitted under the EU/UK GDPR (such as Standard Contractual Clauses).
• For visitors from the UAE, transfers are made in compliance with the UAE PDPL.

6. HOW LONG WE KEEP YOUR DATA

We retain your personal data for as long as your Account is active and for a reasonable period thereafter to allow you to reactivate your Account, comply with our legal obligations, resolve disputes, and enforce our agreements.

Indicative retention periods :

• Account data : until deletion of your Account + 90 days grace period, then anonymised.
• Listings : until you remove the Listing, or until 12 months after the Listing has expired or become inactive.
• Payment records : for the duration required by applicable tax and accounting law (typically 5 to 10 years).
• Communications with support : 2 years after the last exchange.
• Marketing consent records : until you withdraw consent + 3 years thereafter for evidentiary purposes.
• Cookies : as described in the Cookie Policy in Section 8 below.

7. YOUR RIGHTS

Depending on your location, you have the following rights in relation to your personal data :

• Right of access : to obtain a copy of the personal data we hold about you.
• Right of rectification : to correct any inaccurate or incomplete data.
• Right of erasure : to request the deletion of your data, subject to our legal obligations.
• Right to restrict processing : to limit our use of your data in certain circumstances.
• Right to data portability : to receive your data in a structured, machine-readable format.
• Right to object : to processing based on our legitimate interest, and to direct marketing.
• Right to withdraw consent : where processing is based on your consent, at any time.
• Right to lodge a complaint : with the competent supervisory authority (in the UAE, the UAE Data Office; in the EU, your national data protection authority; in the UK, the Information Commissioner's Office).

To exercise any of these rights, please contact us at contact@gulf-grid.ae. We will respond within one (1) month, or notify you of any necessary extension of that period.

8. COOKIES AND SIMILAR TECHNOLOGIES

The Platform uses cookies and similar technologies (pixel tags, local storage) for the following purposes :

• Strictly necessary cookies — Session management, authentication, security. These cannot be disabled.
• Functional cookies — Language preference, currency preference, remembering search filters.
• Analytics cookies — Google Analytics, with IP anonymisation. Set only after your consent via our cookie banner.
• Advertising cookies — Meta Pixel, TikTok Pixel, Snapchat Pixel. Set only after your consent via our cookie banner.

You can manage your cookie preferences at any time via the cookie banner or your browser settings.

9. DATA SECURITY

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. These measures include :

• HTTPS/TLS encryption for all data transmitted between your device and our servers;
• Password hashing (bcrypt);
• Access controls and role-based permissions for administrative access;
• Regular backups, stored in encrypted form;
• Regular software updates and security patches;
• Firewall and web application firewall protection.

Despite our efforts, no method of data transmission or storage is 100% secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the competent supervisory authority as required by applicable law.

10. CHILDREN

The Platform is not intended for use by anyone under the age of eighteen (18). We do not knowingly collect personal data from minors. If you become aware that a minor has provided us with personal data, please contact us at contact@gulf-grid.ae and we will take appropriate steps to delete the data.

11. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. The updated version will be published on this page with the new "Effective Date". Where the changes are material, we will notify existing registered users by email.

12. CONTACT

For any question, request or complaint regarding this Privacy Policy or your personal data, please contact us at :

Kimy Technology FZE
Email : contact@gulf-grid.ae
Postal address : Office SF3283, 1st Floor, C1 Building, Ajman Free Zone, Ajman, UAE

Last updated : 13 July 2026 — Kimy Technology FZE, Ajman Free Zone, United Arab Emirates.