Privacy Policy

1. Who We Are

Dubai Syndicate (operated by Internext Information Technology, United Arab Emirates) is the data controller responsible for the personal data described in this policy. This policy explains what we collect, how we use it, how long we keep it, and your rights under the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).

This notice covers our website, member and job-seeker services, AI assistant and connected mobile-app services. Some features depend on configuration or app version. Where we describe a proposed retention period or a safeguard awaiting confirmation, it is not a claim that the control is already implemented.

2. Information We Collect

When you interact with Dubai Syndicate, we may collect the following types of information:

• Personal and business details you provide (name, mobile number, email, business name, business category)
• Communication data through email or other correspondence
• Usage data through cookies and analytics tools when you browse our website
• Membership and payment information for Premium Members
• Billing addresses, tax references and bank details you supply for payment administration; job applications and CVs; meetup participation, referrals, lead activity and support records
• AI chatbot questions and replies, conversation identifiers, supplied contact details, and a hashed IP identifier used for abuse prevention; a hash is not necessarily anonymous
• KYC verification documents you choose to upload (e.g. trade licence, Emirates ID, passport, residence visa, VAT certificate)
• Mobile-app technical data: a randomly generated installation identifier, device model, operating platform, app version and, if you enable notifications, a native push token linked to your member account
• Google sign-in in the mobile app: if you choose this option, the app sends a Google identity token to our server for verification. We read your Google account identifier, verified email address and name. We use the verified email to find your existing active membership and link its Google account identifier, or use your name and email to prefill registration if no membership exists. On successful Google sign-in or Google-assisted registration, we store the Google account identifier with your member record and mark your email as verified. This verifies email ownership; it is not KYC or business verification.
• Google Sign-In on the website: when you choose Google for member or job-seeker access, Google supplies account identity information such as your identifier, name and email for authentication and account linking. This does not give us access to your Gmail messages or Google Drive files.
• Mobile signup network information: we record the IP address of your signup request and, when available, approximate city and country information supplied in Cloudflare request headers. These are stored with your member record, separately from the profile city you enter during registration. This signup location information comes from network request headers, not device GPS.

3. Purposes and Lawful Basis Categories

The PDPL generally requires consent unless a specific exception applies. The categories below explain the purposes and bases relevant to our services; they are not blanket permission to use all information for all purposes.

• Contract and requested steps: account creation, authentication (including Google Sign-In), membership administration, requested introductions, job applications, meetups, billing, support and necessary service messages, where necessary to provide the service you request (Article 4(9)). Essential session and security processing also supports this service.
• Consent: separate optional directory/profile publication, marketing, networking participation and optional analytics/advertising. Planned AI document extraction would require its own assessment and choice before activation. Verification-document processing requires a clear explanation of the purpose and the consequences of declining. Acceptance of general terms is not consent to these unrelated optional uses (Articles 4 and 6).
• Specific legal obligations: records or disclosures required by an applicable law, such as applicable accounting requirements (Article 4(10)). We must identify the actual obligation; calling a process “KYC” does not itself create a statutory retention duty.
• Legal claims and protection: necessary evidence for establishing or defending rights or relevant judicial/security proceedings (Article 4(3)); protection of the data subject's interests only where that specific exception applies (Article 4(7)). These are not general permission for marketing or indefinite fraud-prevention retention.

We do not rely on a general “legitimate interests” category as an unrestricted UAE PDPL basis. Optional AI assistance is described in section 4a; the necessity of a particular AI use and its consent requirements must be assessed separately from the underlying service.

3a. Optional Member Networking

Where networking features are available, discovery, one-to-one requests and networking notifications are off by default. If you enable them, we record your choices and the consent version and time. Member discovery is separate from publishing your profile in the public directory.

• Discovery and suggestions: other opted-in members can see your name and business profile, including business category, city, chapter, description, interests, what you offer and what you are looking for. Suggestions compare your interests, what you offer and what you are looking for using matching rules; they are not endorsements or identity-verification results. Dedicated email, telephone, WhatsApp and identity-document fields are not included in networking profiles. Information you type in a description or other shared text can still be seen, so do not add sensitive information there.
• One-to-one requests: we store the participants, purpose, proposed time and location, status and history. The two participants can read their request. Cancelling closes that request but permits a new request if both members remain eligible. Blocking prevents new requests between the pair and cancels active requests. Neither action erases the request history; permanent account deletion is handled separately.
• Your private notebook: saved connections, notes and follow-up tasks are stored on our servers and are not shared with other members. Authorised operators and service providers may access this data where necessary to operate, support or secure the service. This is not end-to-end encrypted storage. Deleting a saved connection also deletes its notes and tasks from the active notebook; it does not delete separate requests or safety reports.
• Controls and safety: you can withdraw networking participation, change notification preferences, block members or submit a report. Withdrawing discovery or requests cancels pending and accepted one-to-one requests; your notebook and history remain until deleted separately or handled through an account-deletion request. When an administrator permanently deletes either member, the related connection, notes, tasks and requests are removed, including that connection's entry in the other member's notebook. Reports may be retained where needed for safety or dispute review under the retention principles below. Reports, their details and moderation records are restricted to authorised founder-level reviewers and necessary service operations, not shown to the reported member through the networking feature.
• Notifications: opted-in request notifications contain a generic update rather than private notes or request text. Personal follow-up tasks do not currently send scheduled reminders.

For access or deletion requests covering networking history, consent records, reports or account data, use the contact details and account-deletion instructions in section 9. Backup copies are not changed immediately when you delete an item from the active service; access remains restricted and retention is subject to the operational and legal requirements described below.

4. KYC Documents — Storage, Use, Retention & Deletion

We use identity and business documents to assess membership verification and feature eligibility. You may decline to upload documents, but some meetings or opportunities require verified identity. Please ask support about the applicable requirement and any available manual alternative; declining verification may limit access. Do not upload unrelated documents or other people's identification without authority.

• Access and storage: identity documents are not directory content and are not shared with other members. The service restricts document access to the account holder and authorised reviewers, with necessary hosting/service-provider access. Pending files rely on access-controlled delivery and server restrictions. Eligible verified files are moved to an off-web archive when archival succeeds; this is not a guarantee of immediate deletion of every copy, backup or failed archival source.
• Planned KYC extraction via Anthropic — not an active upload flow: no live application caller sending KYC images to Anthropic has been identified in the current baseline. KYC AI extraction is treated as disabled/planned, not current processing. If introduced, it could send document images or text to Anthropic to extract details such as expiry dates, but would require prior notice, an appropriate lawful basis, a separate choice where consent is required, and confirmed provider/transfer safeguards. Manual expiry entry and authorised human verification are the current approach; an AI-extracted date would not prove identity.
• Provider terms: AI-provider retention, training restrictions, permitted human access and deletion depend on the applicable commercial contract and configuration. We do not promise zero retention or an unconditional no-training guarantee. Contract and transfer safeguards require confirmation before enabling or expanding document extraction.
• Closure and withdrawal: contact us to withdraw consent or request deletion of documents and archived copies. We review each storage location, any specific legal hold and effects on verified features. Archiving is not deletion. See the proposed schedule in section 7 and the manual request flow in section 9.

4a. AI Chatbot, Conversations and Lead Matching

Our AI assistant uses Anthropic when enabled. Messages, recent conversation history, information you supply about yourself or your business, and relevant service context may be sent to that provider to answer questions or prepare a requested enquiry. We also store conversation transcripts, supplied names/contact details and technical identifiers on our servers so authorised staff can follow up, investigate problems and review service quality. These conversations are not end-to-end encrypted.

AI can screen leads for relevance or promotional content, improve wording, suggest a category and rank matches. Inputs can include lead titles/descriptions, supplied contact details, the poster's business, member identifiers and members' “looking for”/“can offer” text. These inputs are not necessarily anonymous. Matching can change who receives an opportunity first. Public enquiries may be held for review following screening; confirmed authenticated-member posts are not necessarily blocked by the AI verdict. Rule-based eligibility and rotation also affect distribution.

AI outputs can be inaccurate or biased. Not every automated output is reviewed before it is used. You can ask for an explanation, correction, object to an automated decision and request human review by contacting us with the relevant lead or conversation details. An authorised person should consider your evidence and can correct or override an outcome within the service's rules; contacting the team is not a promise of approval or of a particular commercial result.

Do not put passwords, payment-card details, identity documents or unnecessary sensitive information in chat or free-text lead fields. You can contact our team directly instead of using the chatbot. Withdrawing optional AI consent may mean that the AI feature cannot be provided; it does not itself close your membership.

5. Analytics, Session Recording, Advertising & Cookies

Essential cookies maintain sessions and protect requests. The following optional tools can also process browser identifiers, device information, network information and usage events:

• Google Analytics 4 (GA4) — traffic measurement, including pages viewed, approximate location, device, referral source and browser identifiers. Reports may be aggregated, but collection is not necessarily anonymous. Google provides an Analytics Opt-out Browser Add-on; its coverage depends on the browser and implementation.
• Microsoft Clarity — session recording and usability analysis, including clicks, scrolling, pointer activity and page content. Masking depends on configuration and page structure; we do not guarantee that all personal information is masked. See Microsoft's privacy statement.
• Google AdSense (Google LLC) — advertising. Google may use cookies and web beacons to serve ads based on your prior visits to this or other websites. You can opt out of personalised advertising in Google's Ads Settings. AdSense is not served inside the Dubai Syndicate mobile app.
• Web push notifications — if you switch on alerts in the member portal, your browser gives us a push subscription containing an endpoint URL and encryption keys. We associate that browser subscription with your member account so requested lead and meetup alerts reach you. You can revoke it at any time from the portal's alert settings or your browser's site settings.
• Mobile-app notifications and delivery — if you allow notifications, Apple Push Notification service or Google Firebase Cloud Messaging can process push tokens and notification payloads. We associate device registrations with your member account, platform and app version. Expo provides app build/update infrastructure where used; this does not mean all notifications pass through Expo or that it receives KYC files. You can disable alerts in device settings; signing out asks the service to remove that device registration.

You can block or delete cookies at any time in your browser settings. Doing so does not affect your membership, though parts of the member portal rely on a session cookie to keep you signed in.

Cookie choices: where the cookie-choice controls are available, use Reject non-essential or Manage choices, and reopen Cookie settings to change or withdraw your choices. These controls are designed to keep optional analytics and advertising off until you opt in and reload the page when you withdraw permission. Deployment and provider-side behaviour still require verification; this notice is not a certification that every tracker or version is correctly gated. Withdrawal stops future optional collection through those controls but does not by itself erase data already held by a provider. Reading this policy or continuing to browse is not consent to optional tracking.

5a. Marketing Choices

Marketing needs a separate, affirmative choice; membership, Google Sign-In, KYC consent and directory publication are not marketing consent. You can withdraw marketing consent or object to direct marketing, including associated profiling, through an unsubscribe link where provided, available notification settings, or by contacting us. Necessary security, verification, billing and requested-service messages are distinct from promotional campaigns. A minimal suppression record may be retained to prevent unwanted future marketing. Existing preference controls are not proof that consent has been recorded for every historical recipient.

6. Data Sharing

We do not sell your personal data. We may share limited information with:

• The public: directory and public-profile publication require separate opt-in, not merely acceptance of membership terms. Published content can include your name, business, description, category, city, logo and selected links/contact channels. Our member directory and published profiles are open to anyone and may be indexed by search engines. Directory listing, direct profile publication and contact visibility are distinct settings; switching off a directory listing may not remove a separately published profile. Contact us to withdraw all public publication. Search-engine caches and copies made by others may remain after our own page is removed.
• Relevant participants: lead/referral information and contact details may be shared with authorised recipients to fulfil a requested introduction; job applications go to the relevant recruiting member. Networking sharing is described in section 3a. Do not submit someone else's private contact information unless you are authorised to share it for this purpose.
• Cloudflare and hosting: Cloudflare handles website traffic and security and may process IP addresses, request information and approximate location headers. Our hosting, database, storage, backup and administration providers can process stored service data. Hosting location and subcontractor details are subject to provider confirmation; we do not promise UAE-only storage.
• Local email and Brevo: email is normally sent through our hosting server's local mail service; Brevo is an available emergency delivery fallback. Recipient addresses, message content and delivery metadata are processed in the relevant mail path. Email logs and tracking links/pixels can record delivery status, opens and clicks; an open is not proof that you personally read a message. Necessary operator alerts may also be routed through configured messaging integrations such as Telegram.
• Other named providers: Anthropic, Google Sign-In, GA4/AdSense, Microsoft Clarity, Apple, Firebase and Expo have the roles described above. If you choose WhatsApp to contact us, WhatsApp/Meta also handles that communication under its own terms. Providers may have separate purposes under their terms; not every provider acts solely as our processor.
• Legal or regulatory authorities when required by law

We do not transfer your KYC documents to other members under any circumstances.

6a. International Transfers and Safeguards

These services may process information outside the UAE, including in the United States, Europe and other countries used by providers or their support teams. Exact hosting, backup, support and subprocessor locations require confirmation for each service. Overseas access counts as a transfer even when a server is located in the UAE.

The applicable transfer route must be assessed under Articles 22–23 of the PDPL: an approved adequate-protection route, or an applicable exception such as qualifying contractual safeguards, explicit transfer consent or a necessary contractual/legal-claims transfer. We do not claim that every destination is UAE-approved or that an EU contract automatically satisfies UAE requirements.

Our required safeguards include limiting disclosed data, secure transmission, restricted access, appropriate written processing terms, controls on onward transfers and deletion/incident assistance. The executed contracts, locations and enforceability of these safeguards remain subject to contract and legal confirmation. You may ask us for information about a transfer affecting your data and the safeguards available.

7. Data Retention

Our retention principle is to keep identifiable data only while necessary for a stated purpose or a specific legal requirement. Current records may remain until manually reviewed; automatic deletion across every store has not been verified.

Proposed operational retention schedule — not yet implemented or legally approved: the following targets guide the retention work requiring approval and verified deletion procedures. They are not promises of deletion already taking place or statutory periods.

• Accounts: active membership, then deletion/anonymisation of eligible profile data within 30 days after verified closure approval; review inactive accounts after 24 months without activity, with 30 days' notice before closure.
• KYC files: delete raw uploads and archived images within 90 days after the verification decision; rejected, abandoned or superseded files within 30 days after rejection, abandonment or replacement. Keep minimal verification status/type/date while membership needs it, then up to 12 months after closure, subject to necessity review. An approved earlier erasure request takes precedence unless a documented hold applies.
• Chat and enquiries: conversation transcripts, associated contact fields and enquiry logs for 90 days after the last interaction; a separately confirmed lead follows the lead schedule. Closed leads/referrals and job applications: 12 months after closure; support cases: 12 months after resolution.
• Networking: saved notes/tasks while retained by the member; delete from the active notebook when the connection is deleted. Review request history 12 months after completion/cancellation and safety reports 24 months after resolution. Account deletion also requires review of related records and reports.
• Technical records: routine access, signup-network and email-delivery/tracking logs for 90 days from collection; security/audit logs for 12 months. Remove inactive device/push registrations after 90 days without use, or earlier on successful unregistration or approved account deletion.
• Analytics: target GA4 event/user retention of 2 months and Clarity recordings of 30 days from collection, subject to provider-supported settings and verified deletion. Provider defaults and exceptions must be checked; these settings are not confirmed as active.
• Marketing: contact lists until withdrawal or 24 months without engagement; minimal consent/withdrawal evidence for 3 years after withdrawal and a minimal suppression identifier while needed to honour the objection, reviewed annually.
• Finance and requests: proposed accounting retention of 7 years after the end of the relevant financial year, only for records for which finance/legal confirms that period applies. Privacy-request and breach case records: 3 years after closure, with unnecessary identity evidence removed within 30 days after verification.
• Backups: proposed rolling expiry within 90 days of backup creation. Backups are not erased immediately when active data is removed; restored data must be checked against completed deletion requests before returning to use.

A documented legal hold may override a normal target for the specific records needed, not the entire account by default. On a request, we will explain any retained categories, reason and applicable period or review date. Provider-side retention and older mailbox/archive copies need separate checks. Contact us for the status of your own data; do not assume a proposed target has already been applied.

8. Data Security

The service uses authentication, role-based restrictions and protected document handling. No method of transmission or storage is guaranteed completely secure, and an off-web archive is not itself proof of encryption or complete deletion elsewhere. We assess suspected breaches, contain harm and notify the UAE Data Office and affected individuals where required by applicable law. We do not describe a generic 72-hour deadline as the UAE PDPL rule.

Report suspected exposure or misuse to info@dubaisyndicate.com with the subject Privacy incident, or contact +971 55 713 3786 on WhatsApp. Give a brief description, affected page and time; do not send passwords or copies of exposed identity documents.

9. Your Rights under the UAE PDPL

Subject to applicable law, you have the right to:

• access the personal data we hold about you and request a copy;
• request correction of inaccurate or incomplete data;
• request deletion of your data;
• object to or request restriction of certain processing;
• withdraw consent at any time (including consent to store KYC documents or to feature you in marketing);
• request that your data be transferred where technically feasible;
• obtain information about purposes, recipients, retention and international safeguards, object to automated decisions (subject to applicable exceptions), and request human review; and
• lodge a complaint with the UAE Data Office.

Use our account deletion instructions for the manual support route, including access, correction, objection or partial-deletion requests without closing an account. Email from your registered address if possible, state what you want, and include your member number if known. If you cannot access that address, contact support for proportionate alternative verification. Do not send identity documents in the initial email or WhatsApp message.

Our service targets are acknowledgement within 3 working days and a substantive response within 30 calendar days of receipt; these are internal targets, not a statement of statutory UAE deadlines. We will explain any necessary identity checks, delay, refusal or limited retention and the next review date. Applicable legal requirements take precedence. Information requests under Article 13 are free of charge. Portability applies subject to the PDPL's conditions, including automated processing based on consent or contract.

10. Governing Law

This Privacy Policy is governed by the laws of the United Arab Emirates, including the PDPL, as applied in the Emirate of Dubai.

See the official UAE PDPL text and the UAE Government's data protection information. The applicable implementing rules and complaint channels should be checked when a request is made; the official Arabic legislation prevails over translations.

10a. Minors

Dubai Syndicate is intended for adults aged 18 and over, not children. Please do not submit a child's information in profiles, leads, chat or verification uploads. We do not claim that every visitor's age has been verified. If you believe we hold a child's information, contact us so we can restrict its use, investigate and arrange deletion where appropriate, subject to applicable child-safety and evidence-preservation duties.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with the updated date.

12. Contact Us

For any questions about this Privacy Policy or to exercise your rights, contact us at:

Email: info@dubaisyndicate.com
Website: dubaisyndicate.com

Data controller: Internext Information Technology, United Arab Emirates.

DPO assessment: whether a Data Protection Officer must be appointed requires assessment of our technology, risk, profiling and sensitive-data scale under Article 10. This notice does not claim that a DPO has been appointed. The contact above is the operational privacy contact while that assessment and any required appointment are confirmed.