Uzin Utz Middle East Trading LLC | Dubai, United Arab Emirates | v 1.0 July 2026

Uzin Utz Middle East Trading LLC
Dubai, United Arab Emirates
Version: May 2026

1. Identity of the Data Controller
The data controller responsible for the processing of your personal data is Uzin Utz Middle East Trading LLC, a limited liability company incorporated under the laws of the United Arab Emirates, with its registered office in Dubai, UAE.
For any questions or requests regarding this Privacy Policy or the processing of your personal data, please contact us at:
• Uzin Utz Middle East Trading LLC
• Registered Office: Dubai, United Arab Emirates
• E-mail: info.middle-east@uzin-utz.com
• Telephone: +971 (0)4 – 510 1323

2. Scope of this Privacy Policy
This Privacy Policy applies to the processing of personal data of our business customers, their representatives, employees and contact persons (collectively "you") in connection with our commercial activities, including the sale and delivery of products, the provision of services, the management of business relationships, and the operation of our web shop and online ordering platforms.
This Privacy Policy does not apply to the processing of personal data of our own employees, which is governed by separate internal policies.

3. Categories of Personal Data Processed
We process the following categories of personal data, depending on the nature of our business relationship with you:

3.1 Business contact data
• Name, job title and business function
• Business address, telephone number and e-mail address
• Employer / company name and registration details

3.2 Contractual and transactional data
• Order and delivery information
• Invoice and payment data (bank account details, payment history)
• Complaints and correspondence relating to deliveries or services

3.3 Credit and financial data
• Credit information and payment behaviour, where relevant to assess creditworthiness
• Information from publicly available registers or credit agencies

3.4 Identification and verification data
• copies of identification documents, including Emirates ID and passport copies
• Information collected or generated for customer registration, onboarding and identity verification
We do not intentionally process special categories of personal data (such as health data, biometric data or data relating to criminal convictions) in the context of our commercial activities. The processing of identification and verification date, including Emirates ID and passport copies, is limited to customer registration and identity verification and is not intended to involve processing of special categories of personal data beyond what may appear on the relevant identification documents. If such data is provided to us inadvertently, it will be deleted without undue delay.

4. Purposes and Legal Bases of Processing
We process personal data for the following purposes and on the following legal bases under UAE Federal Decree-Law No. 45/2021 on the Protection of Personal Data ("PDPL") and its implementing regulations:

4.1 Performance of contract (Art. 4 PDPL)
We process personal data relating to our customers’ contact persons, including identification and verification data where required, to the extent necessary to conclude, perform and administer contracts for the delivery of goods and provision of services, including order processing, invoicing, delivery coordination and after-sales support.

4.2 Compliance with legal obligations (Art. 4 PDPL)
We process personal data to comply with applicable legal obligations, including UAE commercial law, tax and accounting regulations (in particular UAE VAT Law, Federal Decree-Law No. 8/2017), anti-money laundering requirements, and applicable sanctions regimes.

4.3 Legitimate interests (Art. 4 PDPL)
Where permitted by applicable law, we process personal data on the basis of our legitimate business interests, including:
• Creditworthiness assessment and risk management
• Fraud prevention and security of our IT systems
• Enforcement and defence of legal claims
• Business development and customer relationship management
• Sending business-relevant communications (product updates, regulatory changes) to existing customers

4.4 Consent (Art. 4 PDPL)
Where we rely on your consent as the legal basis for processing (e.g., for marketing communications beyond the existing business relationship), we will inform you separately and obtain your explicit consent. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

5. Recipients and Disclosure of Personal Data
We may share your personal data with the following categories of recipients, strictly to the extent necessary for the purposes set out in Section 4:
• Affiliated companies within the Uzin Utz Group, for internal administrative and reporting purposes
• Logistics and freight service providers, for the purpose of delivery coordination
• Financial institutions and payment service providers, for payment processing
• Insurance companies, for the purpose of cargo and liability insurance
• Legal and tax advisors, auditors and compliance service providers
• Credit rating agencies, where creditworthiness assessment is required
• IT service providers and cloud hosting providers supporting our systems
• Public authorities, courts and regulatory bodies, where required by law or court order
We do not sell personal data to third parties. We do not disclose personal data to third parties for their own marketing purposes.

6. International Transfers of Personal Data
As part of the Uzin Utz Group, personal data may be transferred to group companies or service providers located outside the UAE, including within the European Union or other jurisdictions.
Where personal data is transferred to a country that has not been recognised by the UAE as providing an adequate level of data protection, we ensure that appropriate safeguards are in place, which may include:
• Standard contractual clauses or data transfer agreements approved under applicable law
• Binding corporate rules within the Uzin Utz Group
• Other transfer mechanisms recognised under the PDPL or applicable data protection law
Upon request, we will provide you with further information about the safeguards applicable to international data transfers.

7. Retention Periods
We retain personal data for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:
• Contractual and transactional data: ten (10) years from the end of the contractual relationship, in accordance with UAE commercial law retention requirements
• Tax and accounting records: five (5) years from the end of the relevant financial year, as required by UAE VAT Law
• Business correspondence: five (5) years from the date of the last communication
• Credit data: deleted when no longer required for creditworthiness assessment or enforcement of claims
• Identification and verification data (including Emirates ID and passport copies): deleted when no longer required for customer registration, identity verification, compliance checks or enforcement of claims
After expiry of the applicable retention period, personal data is securely deleted or anonymised, unless further retention is required by mandatory law.

8. Your Rights as a Data Subject
Under the PDPL and, where applicable, the EU General Data Protection Regulation (GDPR), you have the following rights with respect to your personal data:
• Right of access: to obtain confirmation whether we process your personal data and to receive a copy thereof
• Right to rectification: to request correction of inaccurate or incomplete personal data
• Right to erasure: to request deletion of your personal data, subject to applicable legal retention obligations
• Right to restriction of processing: to request that we restrict processing in certain circumstances
• Right to data portability: to receive your personal data in a structured, commonly used format, where processing is based on consent or contract
• Right to object: to object to processing based on legitimate interests, including for direct marketing purposes
• Right to withdraw consent: to withdraw consent at any time, without affecting prior lawful processing
To exercise any of these rights, please contact us using the contact details set out in Section 1. We will respond to your request within the timeframe prescribed by applicable law. We may need to verify your identity before processing your request.
If you believe that the processing of your personal data violates applicable law, you have the right to lodge a complaint with the competent data protection authority in the UAE (UAE Data Office) or, where applicable, the supervisory authority in your country of residence.

9. Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or alteration, in accordance with Art. 16 PDPL. These measures include access controls, encryption of data in transit, regular security assessments and staff training on data protection.
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the competent authority and, where required, affected data subjects in accordance with the timeframes prescribed by the PDPL

10. Amendments to this Privacy Policy
We reserve the right to update this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance or our data processing practices. The current version will be made available on our website and / or communicated to you directly where required by law. The date of the most recent version is indicated at the top of this document.