1. Who we are

1.1. This Privacy Policy explains how TREVEX Technology Limited (“TREVEX”, “we”, “our”, “us”) collects, uses, shares, and protects personal data. TREVEX is a company registered in the Dubai International Financial Centre (“DIFC”) under registration number 5069, with its registered office at Unit GA-00-SZ-L1-RT-201, Level 1, Gate Avenue, South Zone, Dubai International Financial Centre, Dubai, United Arab Emirates. We operate the website and the directory platform, and we are the controller of the personal data described in this policy, except where clause 1.4 says another TREVEX group company is the controller.

1.2. TREVEX operates the UAE Business Directory: a directory where every UAE business has a profile, and where businesses can claim their profile, become a Member, and complete Verification, alongside related products such as Credit Reports, Payment Endorsements, Business Matching, referrals, and trade services. This policy covers the website at trevex.io and the directory application at app.trevex.io.

1.3. TREVEX is registered in the DIFC. It is not regulated by the Dubai Financial Services Authority, and the directory is not a regulated financial service.

1.4. TREVEX is a group. TREVEX Technology Limited operates the website and the directory platform and is the controller for that processing. Some products are provided by other companies in the TREVEX group, each licensed for the relevant activity and each a controller for the personal data it processes to deliver its product: TREVEX Credit and Risk Solutions L.L.C-FZ (Meydan) for credit and business information products, and for supplying buyer data to an insurer where you request insurance; and TREVEX FZCO (DMCC) for Verification and related services. When you request one of these products, we share the personal data needed to fulfil your request with the relevant group company, under intra-group data-sharing arrangements. Each group company handles that data in line with this policy.

2. The law that applies

2.1. As a company incorporated in the DIFC, we are subject to the DIFC Data Protection Law No. 5 of 2020, as amended (the “DIFC DPL”). Under Article 6 of the DIFC DPL, the law applies to our processing of personal data wherever that processing takes place.

2.2. Because the directory covers businesses and individuals across the United Arab Emirates, we also comply with the UAE Federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) (“PDPL”) in respect of data subjects in the wider UAE. Where we offer services to, or monitor, individuals in the European Economic Area, we also apply the EU General Data Protection Regulation (“GDPR”).

2.3. We apply the highest standard common to these laws. Where they conflict in respect of processing within the scope of the DIFC DPL, the DIFC DPL governs and the DIFC Courts have jurisdiction. This does not remove any mandatory right or remedy available to you under the law that applies to you as a data subject.

3. Who this policy is for

3.1. The website and the directory are intended for businesses and for individuals acting in a business capacity. They are not intended for anyone under the age of 18, and we ask that individuals under 18 do not provide personal data to us.

4. The data we collect

4.1. Business information. Information about businesses, including registered name, trade licence, registration details, ownership and management, sector, address, contact details, and trade activity. Much of this is information about a company rather than an individual.

4.2. Personal data. Information that identifies or can identify an individual, such as the name, role, business contact details, and identification information of the directors, shareholders, managers, signatories, and contacts connected to a business, and of the people who use the website and the app. For a corporate entity, the information we hold includes its business records and related documents, such as constitutional documents, certificates of incorporation, trade licences, and financial statements.

4.3. Data you provide. Information you give us when you claim a business, become a Member, complete Verification, request a product, complete a form, subscribe, or contact us.

4.4. Data from third parties. We compile business information from third-party sources, including licensed business-information providers, public registries and authorities, and conferences, events, and introductions. A current list of our data sources is available as described in clause 11.6. This is how a business can appear on the directory before it has engaged with us. See clause 6.

4.5. Data generated by use. Information created as you use the directory, such as Payment Endorsements, report requests, search and activity data, and the monitoring and analytics data described in clause 10.

4.6. Data about third parties you give us. Where you use the Partner Program, you provide us with information about your buyers or counterparties, including the businesses and the people connected to them. We process this to onboard and verify those buyers and to show you how they pay. See clause

5. How we use data, and our lawful basis

5.1. We process personal data only where the DIFC DPL (Article 10), and the PDPL and GDPR where they apply, give us a lawful basis. We rely on the following bases for the following purposes:

5.2. To provide the directory, your account, and our products (creating and managing your profile and account, Membership, Verification, Payment Endorsements, the Partner Program, Credit Reports, Business Matching, referrals, and related services). Basis: performance of a contract with you, and our legitimate interests in operating the directory.

5.3. To compile and maintain the directory, including publishing business profiles and keeping them current. Basis: our legitimate interests in a complete and reliable UAE business directory, and the public and commercial interest in business information. See clause 6.

5.4. To verify identity and prevent fraud and financial crime, including Verification of a business and, where we offer them, identity and compliance checks. Basis: compliance with our legal obligations, and our legitimate interests in a trustworthy platform.

5.5. To produce analytics, insights, benchmarks, and aggregated and derivative data products (clause 8), and to improve and develop our products. Basis: our legitimate interests.

5.6. To market our products and those of our partners, and to share data with partners who can offer you finance, banking, insurance, or related services. Basis: your consent where required, and our legitimate interests for our own existing-customer marketing. You can withdraw consent or object at any time (clause 16).

5.7. To communicate with you about your account, changes to our terms or services, and other administrative matters. Basis: performance of a contract and our legitimate interests. You cannot opt out of essential service communications while you hold an account.

5.8. To comply with law and to establish, exercise, or defend legal claims, and to protect the security of our systems and data. Basis: legal obligation and legitimate interests.

5.9. Where you request insurance for a buyer, to supply that buyer's data to the insurer for underwriting and monitoring. Basis: performance of your request and our legitimate interests. The insurer is the controller for its own underwriting. See clauses 7 and 11.

6. Business profiles for businesses that have not engaged with us

6.1. Every UAE business can appear on the directory as a profile before it has claimed it, compiled from the third-party and public sources in clause 4.4. A buyer may also request a profile of a business that has not claimed it.

6.2. Where a profile includes personal data of the individuals connected to a business, we process that personal data on the basis of our legitimate interests in maintaining a complete and reliable directory and enabling commerce, balanced against the rights of those individuals. We limit the personal data in a profile to business-role and business-contact information that is proportionate to that purpose, and we do not publish special-category or private personal data on this basis.

6.3. You have the right to object to this processing and to ask us to correct or remove personal data. See clause 16. We tell you the source of the data on request.

7. Partner Program and information about your buyers

7.1. The Partner Program lets a Member share its list of buyers so that we can onboard and verify those buyers and show the Member how each buyer pays across the network. This service is provided through TREVEX Credit and Risk Solutions L.L.C-FZ (Meydan) as the controller for the credit and business information it produces, supported by TREVEX FZCO (DMCC) for verification.

7.2. Where the buyer information includes personal data of the individuals connected to a buyer, we process it on the basis of our legitimate interests, and those of the Member, in enabling businesses to manage trade credit, balanced against the rights of those individuals, and on the same proportionate basis as clause 6. Those individuals keep the right to object and to ask us to correct or remove their personal data.

7.3. Where a Member requests insurance on a buyer, we supply the buyer's data to the insurer so it can underwrite and monitor the cover. The insurer is a separate controller for its underwriting. We are a data partner to the insurer for this purpose and are not the insurer.

8. Aggregated and derivative data

8.1. We create, use, license, and sell aggregated, de-identified, statistical, and derivative datasets, insights, benchmarks, and analytics derived from data on the platform. These outputs are aggregated or anonymised so that individuals are not identifiable, and they are the intellectual property of TREVEX.

8.2. Because this data does not identify individuals, it is not personal data, and we may use it for any lawful purpose, including developing and commercialising products.

9. Consent

9.1. Where we rely on your consent, you give it by a clear affirmative act, and you can withdraw it at any time. Withdrawing consent is as easy as giving it and does not affect processing carried out before you withdrew. Where consent is required for separate purposes, such as marketing and sharing with partners, you can give or withhold it for each separately.

10. Cookies, monitoring, and tracking

10.1. We use cookies and similar technologies (including pixels, tags, and analytics tools) to operate the website and app, understand how they are used, and improve and market our services. Essential cookies are needed for the website to work. Where we use non-essential cookies, we ask for your consent, and you can withdraw it. You can also control cookies through your browser settings. We are introducing a cookie consent tool and a fuller Cookie Notice, and we will update this section when they are live.

10.2. We also collect monitoring data such as device, browser, and usage information. Unless combined with personal data, this does not identify you and we may use it for any purpose.

11. Who we share data with

11.1. Service providers (processors) who process data on our instructions, such as hosting providers, payment providers, analytics providers, and, where we offer identity-verification and compliance checks, our verification and compliance partners. We put legally binding written agreements in place with these providers, containing the controls required by Article 24 of the DIFC DPL.

11.2. Other TREVEX group companies where they provide a product you have requested, on the basis of performing your request and our legitimate interest in operating the group, under intra-group data-sharing arrangements (clause 1.4).

11.3. Partners (separate controllers) such as banks, finance providers, and insurers to whom we refer you, or to whom we supply buyer data for underwriting, where you have consented or requested it. Once a partner receives your data as a controller, its own privacy terms apply.

11.4. Acquirers. A party that may acquire or take over some or all of our business, in connection with a corporate transaction.

11.5. Public authorities. We disclose personal data to a public authority, including authorities outside the DIFC, only after we have satisfied ourselves that the request is valid and proportionate, in line with Article 28 of the DIFC DPL.

11.6. Our sub-processors and data sources. We keep a current list of the service providers who process data on our behalf, and the third-party providers we source business information from. You can request the current list at privacy@trevex.io. We keep it up to date so that this policy does not need to name each provider individually.

12. International transfers

12.1. We may transfer personal data outside the DIFC and the UAE to our service providers, partners, and group companies. Today this includes transfers to Switzerland, where a principal business-information provider is based. As we add partners and providers, including finance and insurance partners in the European Union and elsewhere, personal data may be transferred to the countries in which they operate.

12.2. We make every such transfer only where the destination provides an adequate level of protection, or where appropriate safeguards, such as standard contractual clauses, are in place. Where we share data with a requesting authority outside the DIFC, we apply the validity-and-proportionality assessment under Article 28 of the DIFC DPL.

13. How long we keep data

13.1. We keep personal data only as long as we need it for the purposes in this policy, or as the law requires.

13.2. We keep your account and profile data while your account is active, and for 24 months after it becomes inactive or is closed, after which we anonymise or securely delete it.

13.3. Records we are required to keep by law, including tax, accounting, and any verification or anti-money-laundering records from identity checks, are kept for the period required by applicable law, then deleted. These periods override the 24-month period in clause 13.2 for those specific records.

13.4. Your business may remain on the directory as a profile on the legitimate-interests basis in clause 6 even after an account is closed, subject to your right to object. We may also retain aggregated and derivative data that no longer identifies you.

14. How we keep data secure

14.1. We have appropriate technical and organisational measures to protect personal data from loss, misuse, and unauthorised access, and we limit access to those who need it. TREVEX is certified to ISO/IEC 27001, and we are working toward SOC 2 Type II.

14.2. We have procedures for suspected personal data breaches. Where the DIFC DPL requires it, we notify the Commissioner of Data Protection under Article 41, and affected individuals under Article 42, and we notify other regulators where the PDPL or GDPR require.

15. Automated decisions

15.1. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing without human involvement. Where our products include analytical or risk-indicator outputs, a person is involved in material decisions, and you can ask us to explain the outcome, give your view, and request human review.

16. Your rights

16.1. You have the right to access your personal data, to have it corrected or erased, to restrict or object to our processing, to data portability, and to withdraw consent. You also have the right not to be discriminated against for exercising these rights, and the right described in clause 15 in relation to automated decisions.

16.2. To exercise any of these rights, contact us using the details in clause 18. Please give us enough information to identify you and tell us which right you want to exercise.

16.3. If you are unhappy with how we handle your data, you can complain to the DIFC Commissioner of Data Protection. Under the DIFC DPL (Article 64A), you may also apply directly to the DIFC Courts if a contravention causes you damage, including financial loss or distress. If the PDPL or GDPR applies to you, you keep the rights and remedies they give you, including complaint to the relevant authority.

17. Changes to this policy

17.1. We may update this policy from time to time. When we make significant changes, in particular changes to how we use personal data, we will take steps to inform you, for example by a prominent notice on the website or by email, and we will obtain fresh consent where the law requires it.

18. Contact us

18.1. For any question about this policy or your data, or to exercise a right, contact us at privacy@trevex.io, or by post to TREVEX Technology Limited, Unit GA-00-SZ-L1-RT-201, Level 1, Gate Avenue, South Zone, Dubai International Financial Centre, Dubai, United Arab Emirates.

18.2. For data-protection matters you can also reach us at privacy@trevex.io. Telephone: +971 4 401 9456. We will publish the contact details of our Data Protection Officer here once appointed.