Privacy policy.

Effective date: 22 April 2026

1. Introduction

[LEGAL ENTITY NAME] (“Qantaris”, “we”, “us”, “our”) respects your privacy and is committed to handling your personal data transparently and lawfully. This Privacy Policy explains how we collect, use, store, share, and protect personal data when you visit qantaris.ae (the “Website”) or otherwise interact with us.

This Policy is drafted to comply with, among others:

• the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and its implementing regulations;
• the EU General Data Protection Regulation (Regulation 2016/679) (“GDPR”);
• the UK General Data Protection Regulation and the Data Protection Act 2018;
• the California Consumer Privacy Act and California Privacy Rights Act (together, “CCPA/CPRA”);
• other applicable data protection laws in jurisdictions where our partners, clients, and visitors are located.

Where specific rights or obligations apply only under a particular framework, this is noted within the relevant section.

2. Data Controller

For the purposes of applicable data protection law, the data controller is:

For privacy-related enquiries, please use the email above and reference “Privacy” in the subject line.

3. Personal Data We Collect

3.1 Information you provide directly

When you contact us via the Website’s contact form or by email, we collect and process the personal data you choose to provide. This typically includes:

• full name;
• business email address;
• company or organisation name;
• job title or position;
• country or region;
• any information included in your message or enquiry.

Submission of this information is voluntary. However, if you choose not to provide certain information (for example, a working email address), we may be unable to respond to your enquiry.

3.2 Information collected automatically

When you visit the Website, certain information is collected automatically by our hosting infrastructure for security and delivery purposes. This includes:

• IP address and approximate geographic location;
• browser type and version;
• device type and operating system;
• referring URL and exit pages;
• pages visited, time spent, and navigation path;
• date and time of access.

We do not currently use any analytics, advertising, or tracking tools. If we deploy analytics in the future, this Policy and our Cookie Policy will be updated, and your consent will be requested before any non-essential cookie is placed.

3.3 Information from third parties

We do not routinely obtain personal data from third parties in connection with the Website. If this changes in the future (for example, if we introduce contact-enrichment tools or acquire business contact data from professional databases), this Policy will be updated and you will be notified through appropriate means.

3.4 Special categories of data

The Website is not designed to collect special categories of personal data (such as health data, racial or ethnic origin, religious beliefs, or biometric data). Please do not submit such information through the contact form or by email.

3.5 Children

The Website is intended for professional business use and is not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact office@qantaris.ae and we will delete it.

4. Why We Collect Your Data and Legal Bases

5. Data Sharing and Recipients

We share personal data only with parties who have a legitimate need to access it. These include:

5.1 Service providers (processors): third parties who process data on our behalf under written contracts requiring confidentiality, security, and purpose limitation. These currently include:

• Vercel Inc. (United States): Website hosting and infrastructure;
• transactional email and deliverability providers, where applicable.

We maintain an up-to-date list of processors and the safeguards applicable to each. A copy is available on request at office@qantaris.ae.

5.2 Group companies and affiliates: entities within the Qantaris group, to the extent relevant for the purposes described above and under equivalent safeguards.

5.3 Professional advisors: lawyers, auditors, accountants, and consultants bound by professional confidentiality obligations.

5.4 Competent authorities: where required by applicable law, court order, or lawful regulatory request.

5.5 No sale of personal data. We do not sell personal data and we do not share personal data for cross-context behavioural advertising within the meaning of the CCPA/CPRA.

6. International Data Transfers

Qantaris is established in the United Arab Emirates. Some of our service providers are located outside the UAE, including in the United States and the European Economic Area. When we transfer personal data across borders, we rely on appropriate safeguards, which may include:

• EU/UK → third countries: adequacy decisions of the European Commission or the UK Secretary of State; the EU Standard Contractual Clauses (2021/914); the UK International Data Transfer Addendum or UK IDTA; and supplementary technical, contractual, and organisational measures where required;
• Transfers to the United States: reliance, where applicable, on the EU-US Data Privacy Framework and its UK extension, supplemented by SCCs as a fallback;
• UAE → third countries: the cross-border transfer framework under the UAE PDPL, including adequacy assessments published by the UAE Data Office and equivalent contractual safeguards.

You may request a copy of the safeguards applied to a specific transfer by contacting office@qantaris.ae.

7. Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal obligations, or to establish, exercise, or defend legal claims. Indicative retention periods:

Where longer retention is required by applicable law or necessary to defend legal claims, we will retain data accordingly and no longer than is proportionate.

8. Your Rights

Depending on your jurisdiction of residence, you may have the rights set out below. We will honour all applicable rights in full and, where operationally possible, extend them as a matter of policy to all users regardless of location.

8.1 Rights under GDPR and UK GDPR

• Access: obtain confirmation of whether we process your data, and receive a copy;
• Rectification: correct inaccurate or incomplete data;
• Erasure(“right to be forgotten”): request deletion, subject to exceptions;
• Restriction of processing in certain circumstances;
• Data portability: receive your data in a structured, commonly used, machine-readable format;
• Objection: object to processing based on legitimate interest;
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of prior processing;
• Lodge a complaint with a supervisory authority, in the EU, your national data protection authority (list at edpb.europa.eu); in the UK, the Information Commissioner’s Office (ico.org.uk).

8.2 Rights under UAE PDPL

• right to information;
• right to request transfer of your data;
• right to request correction;
• right to request deletion;
• right to restrict or stop processing;
• right to object to processing.

Complaints may be lodged with the UAE Data Office.

8.3 Rights under CCPA/CPRA (California residents)

• right to know what personal information is collected, used, shared, or sold;
• right to delete personal information;
• right to correct inaccurate personal information;
• right to opt out of sale or sharing. We do not sell or share personal information within the meaning of the CCPA/CPRA;
• right to limit use of sensitive personal information;
• right to non-discrimination for exercising your rights.

8.4 Automated decision-making

We do not use personal data collected through the Website for automated decision-making that produces legal or similarly significant effects on you.

9. How to Exercise Your Rights

To exercise any of the rights above, please email office@qantaris.ae with “Data Subject Request” in the subject line. We will respond within the timeframes required by applicable law, generally within 30 days under GDPR and UK GDPR, extendable to 90 days in complex cases.

To protect your data, we may need to verify your identity before processing a request. We will not charge a fee unless the request is manifestly unfounded or excessive, as permitted by applicable law.

10. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include encryption in transit (TLS), access controls, infrastructure hardening by our hosting provider, and regular security reviews.

No system is perfectly secure. If you believe your interaction with the Website is no longer secure, or if you become aware of a vulnerability, please report it to office@qantaris.ae.

11. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, services, or applicable law. The “Effective date” at the top of the Policy indicates when it was last revised. For material changes, we will provide prominent notice (for example, via a banner on the Website) before the changes take effect.

12. Contact