PERSONAL DATA PROCESSING AND PROTECTION POLICY

1.1. This Personal Data Processing and Protection Policy ("Policy") has been drawn up in accordance with the requirements of the Dubai International Financial Centre Data Protection Law (DIFC Law No. 5 of 2020) and, where applicable, the General Data Protection Regulation (EU) 2016/679 ("GDPR").

1.2. The Policy sets out the legal basis and principles governing the Processing of Personal Data, the categories of Personal Data processed by the Operator, the categories of Data Subjects whose Personal Data is processed, the rights and obligations of the Operator and Data Subjects, as well as the procedure and conditions for Processing information about Data Subjects that may be obtained by the Operator from such Data Subjects or from third parties in the course of the following relationships with the Data Subject:

• 1.2.1. when Clients or Data Subjects use the functions of the Website, including all domains, subdomains and pages, their content, as well as the Service and other software;
• 1.2.2. when the Operator provides services to the Client or Data Subject;
• 1.2.3. when the Operator exercises its rights and obligations under agreements or contracts;
• 1.2.4. when it is necessary to contact the Client and/or Data Subject;
• 1.2.5. when processing enquiries, requests, and messages sent by the Operator and Data Subjects to each other;
• 1.2.6. when the Service interacts with Data Subjects in the performance of a service agreement entered into between the Operator and the Client;
• 1.2.7. when collecting feedback from recipients of the Operator's services for the purpose of improving the quality of the Operator's operations, attracting new users/Clients, and enhancing the quality of services provided to users of the Website and/or Service.

1.3. Use of the Website and/or Service by the Client and/or Data Subject implies the Client's and/or Data Subject's consent to the Processing of Personal Data and acceptance of the terms of this Policy, including the transfer of Personal Data to third parties in accordance with Section 11 of this Policy.

1.4. The Client may instruct the Operator to process Personal Data with the consent of the Data Subject, unless otherwise provided by applicable law, on the basis of a contract entered into with the Operator. The Operator processing Personal Data on behalf of the Client is not required to obtain separate consent from the Data Subject for such processing, but must comply with the principles and rules of Personal Data processing under the DIFC Data Protection Law, maintain confidentiality of Personal Data, and take all necessary measures to fulfil its obligations under applicable law.

2.1. Unless the context requires otherwise, all capitalized terms used in this Policy shall have the following meanings:

"Client" means a natural person or legal entity that has entered into an agreement (contract) with the Operator for the provision of services in order to use the Website and Service;

"Operator" means Numisnipe Tech Ltd (License No. CL6629), located at Unit 2, Level 7, Gate Village Building 10, DIFC, Dubai, UAE, which independently or jointly with other persons (including on behalf of the Client under a contract between the Client and the Operator) carries out the Processing of Personal Data;

"Processing" (of Personal Data) means any action (operation) or set of actions (operations) performed with or without automated means on Personal Data, including collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction of Personal Data, and the term "Process" shall be construed accordingly;

"Policy" means this Personal Data Processing and Protection Policy (as amended from time to time in accordance with Section 12.4 hereof);

"Personal Data" means any information relating to an identified or identifiable natural person (Data Subject), obtained from the Data Subject and/or Client, directly or indirectly relating to the Data Subject, including information that the Data Subject provides in the course of interacting with the Website and/or Service or by other means;

"Website" means the collection of texts, graphics, design elements, images, software code, photographs, video materials, and other content available on the Internet and administered by the Operator, including at the following address: www.qoo.qa;

"Service" means the software (comprising programs, algorithms, databases, interfaces, and logical structures) known as "Qooqa", access to which is provided by the Operator to the Client through the Website;

"Data Subject" means any natural person (including a representative or employee of the Client) who has accessed the Website and accepted the terms of this Policy, regardless of whether they have completed registration or authorization procedures, as well as any other person who provides Personal Data to the Operator, and persons who have posted their resumes on various online resources and websites whose Personal Data is processed by the Operator on behalf of the Client for the purpose of providing recruitment services using the Service;

"Cross-Border Data Transfer" means the transfer of Personal Data to the territory of a foreign state, to a foreign government authority, foreign natural person, or foreign legal entity.

3.1. The legal grounds for Processing Personal Data are:

• 3.1.1. the DIFC Data Protection Law (DIFC Law No. 5 of 2020) and applicable regulations thereunder;
• 3.1.2. the General Data Protection Regulation (EU) 2016/679, to the extent applicable;
• 3.1.3. agreements (contracts) entered into between the Operator and the Data Subject and/or Client;
• 3.1.4. the consent of the Data Subject to the Processing of their Personal Data;
• 3.1.5. legitimate interests of the Operator, provided such interests are not overridden by the rights and freedoms of the Data Subject;
• 3.1.6. compliance with legal obligations to which the Operator is subject.

4.1. Personal Data is processed in respect of the following categories of Data Subjects:

• 4.1.1. Clients and/or representatives of Clients;
• 4.1.2. users of the Website;
• 4.1.3. natural persons seeking employment whose resumes have been published on various online resources and websites (applicants/candidates).

4.2. The Operator processes the following categories of Personal Data using the Website (Service) or otherwise:

• 4.2.1. full name of the Data Subject;
• 4.2.2. date of birth;
• 4.2.3. postal address, email address, telephone number;
• 4.2.4. messenger and social media accounts, message content (where such content contains Personal Data);
• 4.2.5. information about education (name of educational institution, form of study, period of study, faculty, specialization, qualification), professional experience (including total work experience, area of activity, period of employment, position), place of work, key skills, citizenship, and other information provided by the Data Subject during phone calls, video interviews, or text messages;
• 4.2.6. information about additional skills (level of proficiency in computer applications, foreign language proficiency, professional achievements);
• 4.2.7. photographs and video images (not for identification purposes);
• 4.2.8. other information provided by the Data Subject in their resume posted on various online resources and websites;
• 4.2.9. results of preliminary screening;
• 4.2.10. information on salary level (current and expected);
• 4.2.11. information about work experience, completed projects (portfolio).

4.3. The Website may use cookies that facilitate the use of the Website by Data Subjects. Cookies consist of technical data automatically transmitted by the device used to access the Website, including:

• 4.3.1. device technical characteristics;
• 4.3.2. IP address;
• 4.3.3. type of operating system;
• 4.3.4. internet service provider domain name;
• 4.3.5. browser information;
• 4.3.6. date and time of access to the Website;
• 4.3.7. duration of visit;
• 4.3.8. information about behavior and activity on the Website;
• 4.3.9. other technical information.

4.4. Cookies are processed for the purpose of improving the Website's performance, enhancing the Operator's products and/or services, and determining Data Subjects' preferences, including through the use of analytical tools.

5.1. The Operator processes Personal Data for the following purposes:

• 5.1.1. compliance with applicable laws and regulations;
• 5.1.2. fulfilment of the Operator's functions, powers, and obligations under applicable data protection legislation;
• 5.1.3. conclusion and performance of obligations under contracts entered into by the Operator with Data Subjects and/or Clients;
• 5.1.4. provision of personalized products and/or services to the Data Subject and/or Client through the Website and Service;
• 5.1.5. enabling the Client and/or Data Subject to order products and/or services available on the Website;
• 5.1.6. improvement of the quality of the Website, Service, and products (services);
• 5.1.7. collection of feedback from Clients and/or Data Subjects;
• 5.1.8. informing Clients and Data Subjects about product offers and/or services provided;
• 5.1.9. conducting statistical and other research based on anonymized data.

5.2. Data Subjects and Clients using the Operator's services agree that the Operator may contact the Data Subject and/or Client at any time regarding updates and/or any other information that the Operator deems relevant to the continued use of the Website and provision of services.

6.1. Processing of Personal Data is carried out by the Operator with the consent of the Data Subjects, unless otherwise provided by applicable law.

6.2. The Data Subject makes the decision to provide their Personal Data and gives consent to Processing freely, of their own volition, and in their own interest. Inaction by the Data Subject shall not be construed as consent.

6.3. By providing their Personal Data to the Operator, the Data Subject confirms that they understand and agree to the terms of this Policy and give informed, conscious, specific, and unambiguous consent to the Processing of Personal Data on the terms set out herein.

6.4. This Policy is based on the following principles:

• 6.4.1. Lawfulness, fairness, and transparency -- Personal Data shall be processed lawfully, fairly, and in a transparent manner in relation to the Data Subject;
• 6.4.2. Purpose limitation -- Personal Data shall be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes;
• 6.4.3. Data minimization -- Personal Data shall be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed;
• 6.4.4. Accuracy -- Personal Data shall be accurate and, where necessary, kept up to date;
• 6.4.5. Storage limitation -- Personal Data shall be kept in a form that permits identification of Data Subjects for no longer than is necessary for the purposes for which the Personal Data is processed;
• 6.4.6. Integrity and confidentiality -- Personal Data shall be processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage;
• 6.4.7. Accountability -- the Operator shall be responsible for, and be able to demonstrate compliance with, the principles set out in this Policy.

6.5. Processing of Personal Data of persons under 18 years of age is only permitted with the prior written consent of a legal representative. If the Operator becomes aware that it has received Personal Data of a minor without the consent of legal representatives, such Personal Data shall be deleted.

7.1. The Operator takes the necessary legal, organizational, and technical measures to protect Personal Data from unauthorized or unlawful access, destruction, modification, blocking, copying, provision, dissemination, and other unlawful actions in respect of Personal Data.

7.2. In particular, the Operator implements the following measures:

• 7.2.1. designation of personnel authorized to access Personal Data and responsible for ensuring compliance with data protection requirements;
• 7.2.2. application of encryption, access controls, and other technical safeguards to protect Personal Data during storage and transmission;
• 7.2.3. regular assessment and review of the effectiveness of technical and organizational security measures;
• 7.2.4. ensuring that employees authorized to process Personal Data are informed of their obligations under applicable data protection laws and this Policy;
• 7.2.5. maintenance of internal policies and procedures for the secure Processing of Personal Data.

7.3. Only employees of the Operator whose job duties include the Processing of Personal Data or access to Personal Data are permitted to work with Personal Data.

8.1. Data Subjects have the right to:

• 8.1.1. Access -- obtain full information about their Personal Data processed by the Operator, including the right to receive a copy of any records containing their Personal Data;
• 8.1.2. Rectification -- request that the Operator correct or update inaccurate or incomplete Personal Data;
• 8.1.3. Erasure -- request that the Operator erase their Personal Data where the Personal Data is no longer necessary for the purposes for which it was collected, where consent has been withdrawn, or where the Personal Data has been unlawfully processed;
• 8.1.4. Restriction of processing -- request that the Operator restrict the Processing of their Personal Data in certain circumstances;
• 8.1.5. Data portability -- receive their Personal Data in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller, where technically feasible;
• 8.1.6. Objection -- object to the Processing of their Personal Data on grounds relating to their particular situation, where Processing is based on legitimate interests;
• 8.1.7. Withdrawal of consent -- withdraw consent to the Processing of their Personal Data at any time by sending a request to the contact details specified in Section 12.3 of this Policy;
• 8.1.8. lodge a complaint with the relevant supervisory authority if the Data Subject considers that the Processing of their Personal Data infringes applicable data protection law.

8.2. Data Subjects are obliged to:

• 8.2.1. provide the Operator with accurate Personal Data;
• 8.2.2. notify the Operator of any changes to their Personal Data.

9.1. The Operator is obliged to:

• 9.1.1. provide Data Subjects, upon request, with information concerning the Processing of their Personal Data;
• 9.1.2. respond to enquiries and requests from Data Subjects and/or their legal representatives in accordance with applicable law;
• 9.1.3. provide the relevant supervisory authority with the necessary information within the time periods prescribed by law;
• 9.1.4. publish or otherwise ensure unrestricted access to this Policy;
• 9.1.5. take legal, organizational, and technical measures to protect Personal Data from unauthorized or unlawful access, destruction, modification, blocking, copying, provision, dissemination, and other unlawful actions;
• 9.1.6. cease the transfer (dissemination, provision, access) of Personal Data, cease Processing, and destroy Personal Data in the manner and cases prescribed by applicable law;
• 9.1.7. maintain confidentiality of Personal Data obtained in the course of its activities;
• 9.1.8. conduct internal monitoring and/or audits of the compliance of Personal Data Processing with applicable data protection legislation and the requirements set out in this Policy.

9.2. Where the Client entrusts the Processing of Personal Data to the Operator, the Client bears responsibility to the Data Subject for the actions of the Operator. The Operator processing Personal Data on behalf of the Client bears responsibility to the Client.

10.1. The Operator may transfer Personal Data to recipients located outside the DIFC and the UAE, provided that appropriate safeguards are in place to ensure an adequate level of protection for the Personal Data being transferred.

10.2. Cross-border transfers of Personal Data may take place in the following circumstances:

• 10.2.1. the receiving jurisdiction ensures an adequate level of protection for Personal Data as recognized by the DIFC Commissioner of Data Protection;
• 10.2.2. appropriate safeguards have been provided, such as standard contractual clauses, binding corporate rules, or other approved mechanisms;
• 10.2.3. the Data Subject has given explicit consent to the proposed transfer after having been informed of the possible risks;
• 10.2.4. the transfer is necessary for the performance of a contract between the Operator and the Data Subject, or for the implementation of pre-contractual measures taken at the Data Subject's request.

10.3. The Operator shall ensure that any such transfer is carried out in compliance with the DIFC Data Protection Law and, where applicable, the GDPR.

11.1. The Operator engages third-party service providers to process Personal Data on its behalf, solely under data processing agreements that ensure confidentiality and data protection in accordance with applicable law.

11.2. Such agreements specify the scope, purposes, and conditions of Processing, as well as the obligations of the third-party processor to maintain the confidentiality and security of Personal Data.

11.3. The current list of engaged processors is available upon request at info@qoo.qa.

11.4. Transfer of Personal Data to other third parties is only permitted to the extent necessary to achieve the purposes of Processing and in the volume required to achieve such purposes.

12.1. Compliance with applicable data protection legislation and this Policy is monitored by the Operator and/or the employee of the Operator to whom the Operator has delegated responsibility for Personal Data Processing.

12.2. Persons found to have violated applicable data protection laws shall bear liability in accordance with the laws of the relevant jurisdiction.

12.3. Data Subjects may obtain clarification on any matters relating to the Processing and protection of their Personal Data by contacting the Operator at the following email addresses: info@qoo.qa / support@qoo.qa, or by sending a written request to: Unit 2, Level 7, Gate Village Building 10, DIFC, Dubai, UAE.

12.4. This Policy shall remain in force indefinitely until replaced by a new version. The Operator reserves the right, at its sole discretion, to amend, supplement, and/or remove any part of this Policy at any time. All changes to this Policy shall take effect immediately upon their publication on the Website. Please periodically check the Website for updates to this Policy. Continued use of the Website by the Data Subject and/or consent to email communications from the Operator following the publication of changes to this Policy shall constitute the Data Subject's acceptance of any and all changes to this Policy.