Open Platform Privacy Policy
Policy Last Updated: April 28th, 2026
Effective Date: April 30th, 2026
The "Open Platform Privacy Policy" (hereinafter referred to as "this Policy") applies exclusively to the products and services of the AI Open Platform (available via the website https://ksa.xfyun.com/) provided by AIME MENA Technology FZ-LLC (hereinafter referred to as "we", "us", "our" or "AIME"), an entity licensed in the United Arab Emirates. The Platform is hosted on Huawei Cloud with data stored in the Kingdom of Saudi Arabia. We have developed this privacy policy (hereinafter referred to as the "Privacy Policy") to inform you of how we process your personal data when you use the Open Platform Services.
Please carefully review our privacy protection practices to understand the details of how we process your personal data. Please contact us if you have any questions regarding this Policy.
This Policy represents a general framework for data protection across the scope of the Services. Additional jurisdiction-specific requirements may apply, which will be set out in the annexes to this Policy, and such provisions shall prevail in the event of any conflict with this Policy.
Please note that this Policy is supplemented by specific provisions for the United Arab Emirates, the Sultanate of Oman, the Kingdom of Bahrain, the State of Qatar, the Kingdom of Saudi Arabia, the Arab Republic of Egypt and the Hashemite Kingdom of Jordan as set out in the country-specific annexes to this Policy.
Contents
- Definitions and Terms
- Personal Data We Collect
- Processing Purposes
- Retention Conditions
- How We Share Your Personal Data
- How to Exercise Your Rights
- Security
- Children's Privacy
- How We Transfer Your Personal Data Globally
- Notice Regarding Updates
- Data Protection Officer and Contact Information
- Contact Us
- Additional Information for Certain Countries
Definitions and Terms
Open Platform Services: refers to the services we provide to users through the AI Open Platform, including account registration, application programming interfaces (APIs) for speech recognition and text conversion, machine translation interfaces, natural language processing interfaces, and other AI services available through the Platform, collectively referred to hereinafter as the "Services".
Account: refers to the user account provided to you upon completion of registration with correct information. You are responsible for protecting this account and bear legal liability for all activities carried out through it.
Personal Data: means data relating to an individual who can be identified from such data alone or in conjunction with other information that an organisation (i.e. an individual, company, association or entity of persons, whether incorporated or not) has access to or is likely to have access to. If applicable law contains a specific definition of this term, the definition in that law shall prevail.
Sensitive Personal Data: refers to personal data that requires a higher level of protection due to its nature and whose leakage or unlawful use could easily lead to a violation of an individual's human dignity or cause harm to their personal or financial safety. This includes, without limitation, biometric data, religious beliefs, specific social status, medical and health data, financial accounts, location tracking data, data of minors and other sensitive personal data or special categories of data as defined by the applicable laws of your country of residence.
Personal Data Controller: means the legal entity that determines the purposes and means of processing personal data. AIME is the data controller unless otherwise determined under the laws of your country.
Processing of Personal Data: includes the collection, storage, use, processing, transfer, provision, disclosure, deletion and other related activities of personal data as defined by the laws of your country of residence.
Users: refers to any individual or entity that registers, logs in and uses the Platform to access the Open Platform Services through activation, browsing or use of application programming interfaces, and is referred to primarily in this Policy as "you" or "your".
Data Subject: refers to the natural person who is identified by or associated with the processed personal data. If any applicable law contains a specific definition of the above terms, the definition in that law shall prevail.
Automated Decision-Making: refers to the process of using computer programmes to automatically analyse and evaluate an individual's behavioural habits, personal interests, financial situation, health, creditworthiness and the like, and to make decisions based thereon.
De-identification: means the process of processing personal data so that a specific natural person cannot be identified without the use of additional information.
Device: refers to any device that can be used to access the Services, such as a desktop computer, laptop, tablet or smartphone.
Cross-Border Transfer: means the transfer of personal data to the territory of a foreign state or region outside your country; or to a public authority of a foreign state that is not your country; or to a foreign individual or foreign legal entity.
Unique Device Identifier: A unique device identifier (Unique ID or UUID) is a string of characters embedded by the manufacturer in the device and can be used to uniquely identify that device (such as an IMEI number for mobile devices). Unique device identifiers serve various purposes, including displaying advertisements when cookies are unavailable.
Internet Protocol (IP) Address: Each device connected to the internet is assigned a number known as an Internet Protocol (IP) address. These numbers are typically assigned based on geographical regions. IP addresses can usually be used to determine the location from which the device connects to the internet.
Secure Sockets Layer (SSL): is a security protocol implemented on top of the Transmission Control Protocol/Internet Protocol (TCP/IP). SSL supports different types of networks and provides three basic security services, relying primarily on public key encryption and symmetric key encryption for confidentiality.
Information Collection Technologies:
Cookie: A small text file placed by a website server on your client device (such as a computer, mobile phone or other smart device) during browsing and may be used to improve the user experience.
Log Files: Store automatically collected data. This data includes Internet Protocol (IP) addresses, browser type, Internet Service Provider (ISP), referring/exit pages, operating system, date/time stamps and clickstream data.
Entity Tag (ET Tag): An HTTP protocol header that passes behind the scenes between the web browser and the web server and can be used as an alternative to cookies to track individual users, enabling us to better understand and improve our services.
JavaScript: A programming language used to create more interactive and dynamic web pages. JavaScript can set, read and delete cookies.
Personal Data We Collect
The following is a description of the types of personal data we may collect and process when you use our AI Open Platform (available via the website https://ksa.xfyun.com/), depending on the services and functions you use on the Platform. The Platform is operated by an entity licensed in the United Arab Emirates and is hosted in the cloud. We process personal data only to the extent necessary to provide, improve and secure the Services, and in accordance with the applicable data protection laws of the United Arab Emirates, the Kingdom of Saudi Arabia, the Sultanate of Oman, the Kingdom of Bahrain, the State of Qatar, the Arab Republic of Egypt, the Hashemite Kingdom of Jordan, and any other applicable laws:
Information you provide when registering your account: If you choose to use the Open Platform functions, you need to register an account on the Open Platform. When registering an account on the Open Platform using a mobile phone number or email address, you will be asked to provide an email address and set a login password to protect your account from unauthorised access.
Information provided by you through our customer service centre or during participation in events organised by AIME: The questionnaire you complete when participating in the online activities of the Open Platform may include information such as your name, phone number, email address and home address.
Audio, text and image information you provide when using product functions: We will collect the content of your speech, texts and images when you use the speech synthesis, voice dictation, audio transcription, text recognition, image recognition and online real-time translation services provided by the Open Platform, as the collection of this information is necessary to achieve the above-mentioned functions. We will process the content provided by you in real time and return it to you without retaining your data for more than one week, or for the duration necessary to fulfil the purpose for which it was collected, whichever is sooner.
Information you have provided to AIME by other means: When you access the account information page on the Open Platform, you may voluntarily complete a nickname and geographic location information. AIME may use this information to create user profiles to provide you with more accurate and personalised product services.
Operational log information: When you use the Open Platform and API/SDK products or services provided through the Platform website, the system may automatically collect certain information through cookies or other means and save it as related network logs. The purpose of collecting this information is to: improve and develop the product experience, and ensure service stability and network security through data statistics. This information includes: details of your use of the Open Platform, including your product service usage history, search and query content, visited page addresses, browser type, network status, telecommunications operator, language used, access date and time, system logs of activities and web pages you visit.
Processing Purposes
Cookies and Tracking Technologies
We may use cookies and similar tracking technologies to collect data about your interaction with the website. The cookies we may use include: (a) essential cookies necessary for the operation and security of the website; (b) functional cookies to save user preferences and language settings; (c) analytical cookies to understand website usage patterns and improve services; (d) marketing cookies to deliver personalised advertising content and measure the effectiveness of marketing campaigns. You can control cookies through your browser settings or through the cookie consent management mechanism available on the website. In accordance with the data protection laws applicable in your country, non-essential cookies (including marketing and analytical cookies) will not be placed without your explicit consent. Please note that refusing certain cookies may affect your experience of using the website.
Marketing and Commercial Communications
We may use the contact data you have provided to us (such as your email address) to send marketing communications relating to our services and products, including newsletters, promotional offers and Platform updates. We will only send you marketing communications after obtaining your prior explicit consent, in accordance with applicable data protection and privacy laws. You may unsubscribe from marketing communications at any time through the dedicated link in each marketing message or by contacting us at service@aimemena.com. Unsubscribing from marketing communications will not affect your right to receive service-related communications or messages necessary for the operation of your account.
Personalised content
We may use your Platform usage data and your interaction with our services to create user profiles for the purpose of personalising the display of content and services provided to you. This includes analysing browsing patterns, preferences, preferred language and frequently used services to deliver a personalised experience. In accordance with the data protection laws applicable in your country, you have the right to object to any decision based solely on automated processing, including profiling, where such decision produces legal effects concerning you or similarly significantly affects you. You may exercise this right by contacting us at service@aimemena.com.
Please note that by choosing to provide personal data of other individuals while using our services, you acknowledge and undertake the following:
- You have fully informed the relevant individual(s) in advance of the contents of this Policy, including how we collect, use, store and share their personal data;
- You have obtained the explicit and free consent of the relevant individual(s), as required by applicable law in your country, authorising you to provide their personal data to us and process it in accordance with this Policy;
- You acknowledge and bear responsibility for the accuracy and validity of the legal basis on which you rely in providing such data;
- Nevertheless, the processing of personal data remains subject to the provisions of applicable laws and regulations, and the foregoing does not prejudice any statutory obligations incumbent upon us as data controller, in accordance with the relevant regulations.
Data Retention Conditions
We process your personal data for as long as necessary to fulfil the purpose of its processing and in accordance with applicable law.
When there is no longer a need to retain your personal data, we will delete the personal data we hold from our systems, unless there is a need to retain it for longer periods (for example, to comply with applicable laws and regulations, or for archiving purposes in the public interest, or for scientific or historical research purposes, etc.). We endeavour to permanently erase your personal data once it reaches the end of its retention period; however, some of your personal data may temporarily remain in our systems, for example if it is awaiting overwriting.
How We Share Your Personal Data
We may share personal data with third parties to the extent necessary to achieve the purposes set out in this Policy, and in accordance with applicable laws. These cases include the following:
Integration with Technology Partners and Affiliates
We may share necessary personal data with our trusted technology partners, specifically Google LLC and Microsoft Corporation, to provide core functions such as speech recognition and translation services. This processing is carried out on our behalf and subject to contractual obligations that ensure the protection of personal data.
Data Processing and Privacy
While we use their technologies to provide these services, data processed by affiliates is subject to their strict security procedures and their own privacy terms:
- Google: You can learn more about how Google handles data at https://policies.google.com/privacy.
- Microsoft: You can learn more at https://www.microsoft.com/en-us/privacy/privacystatement.
In addition, we may share personal data with any affiliates or joint venture partners we may be associated with in the future. These parties may use cookies or similar technologies to support the services. We recommend that you review their privacy policies to understand their specific data practices.
We may also share your personal data with third parties, including in the following cases:
- To comply with applicable laws or regulations, a court order, a subpoena or any other legal process;
- Legal Authorities and Law Enforcement. We may be required to disclose your personal data by local judicial or governmental authorities or agencies or as required by applicable laws;
- Change of Control / New Owners. In the event of any merger, acquisition, restructuring or bankruptcy, AIME may provide your personal data to the relevant third parties, and we will notify you of such change in accordance with applicable laws and regulations.
We may provide some of your personal data to third-party service providers who may process personal data on our behalf, or for one or more of the purposes described in this Policy.
Third-party service providers provide us with services, including the following:
- Speech-to-text services in certain languages;
- Voice translation services in certain languages;
- Voice translation and/or image translation services in certain languages when our servers experience cloud service failures or fail to respond quickly to voice translation and image translation requests in certain languages from the translator device;
- Customer services and after-sales services in the event you have any questions/comments/suggestions or otherwise regarding the Services.
- Servers (as a carrier for data processing) that we use.
We may also share personal data with any affiliates or joint venture partners we may be associated with in the future.
We may also share personal data with any affiliates or joint venture partners we may deal with in the future.
In all cases, we ensure that personal data is shared only to the extent necessary and with appropriate safeguards in place to protect it.
How to Exercise Your Rights
Subject to the data protection laws applicable to you, you may have the following rights in relation to your personal data that we process as data controller:
Right to Information: The right to obtain clear and comprehensive details regarding the categories of personal data we collect, the purposes and methods of such collection, and the types of recipients with whom such data is shared.
Right of Access: The right to obtain confirmation as to whether or not your personal data is being processed, and where so, to access such data and obtain a copy thereof.
Right to Rectification: The right to request the immediate correction or updating of any inaccurate or incomplete personal data we hold about you.
Right to Erasure ("Right to be Forgotten"): The right to request the deletion of your personal data in specific circumstances as provided by law.
Right to Restrict Processing: The right to request a temporary or permanent restriction on the processing of your personal data under certain legal conditions.
Right to Data Portability: Where applicable, the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and to transfer such data to another controller without hindrance. Where technically feasible, you may also request the direct transfer of such data between controllers.
Right to Object: The right to object, on grounds relating to your particular situation, to the processing of your personal data, including profiling based on such grounds. This includes an unconditional right to object to the processing of your personal data for direct marketing purposes at any time, free of charge and through an easy-to-use mechanism.
Rights Related to Automated Decision-Making: The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless the legally authorised exceptions apply.
Right to Withdraw Consent: The right to withdraw your prior consent to the processing of your personal data at any time without affecting the lawfulness of processing carried out based on consent before its withdrawal.
Right to Lodge a Complaint: The right to lodge a complaint with a competent supervisory authority within your jurisdiction and/or to seek judicial remedy before a competent court if you believe that the processing of your personal data violates applicable data protection laws.
To exercise any of the above rights, please contact us using the following information and provide the required verification information, as described below:
By emailing us at service@aimemena.com.
Verification Process and Required Information: Please note that we may need to request additional information from you to verify your identity or to understand the scope of your request. You will not be required to create an account with us to submit or process a request. We will ask you to provide, at a minimum, your Platform account identifier and/or your name and phone number.
Authorised Agent: Subject to the laws and regulations applicable in your country, you may also appoint an authorised agent to submit requests on your behalf through written authorisation or by virtue of a power of attorney. We will require the agent to provide us with proof of their authorisation to submit requests on your behalf before accepting the agent's requests.
In addition, for users in the following countries, please refer to country-specific annexes regarding the specific rights under applicable local laws.
Security
We take security measures designed to protect your information, including, without limitation, administrative, technical and physical measures.
Children's Privacy
Our services are not directed at children (under the age of 18 or the equivalent minimum age in your jurisdiction). We do not knowingly collect any personal data from children. If we become aware that we have collected personal data from a child without verified parental consent, we will proceed to delete such information immediately unless we are legally required to retain it.
If you are a parent or legal guardian and believe that your child has provided us with their personal data without your consent, please contact us at the email address stated in Section [12] below. After verifying your identity and relationship with the child, we will promptly delete the child's personal data from our active systems and take reasonable steps to ensure its deletion from any backup systems, in accordance with applicable law.
How We Transfer Your Personal Data Globally
Your use of our services involves the transfer, storage and processing of your personal data within and outside your country/region of residence when necessary. Personal data is primarily stored in the Kingdom of Saudi Arabia in the cloud, and your personal data may also be transferred to the United Arab Emirates (where the Platform operating entity is located) or to other countries as necessary to provide the Services.
We adopt appropriate safeguards for cross-border transfers of your personal data as required by applicable local law, to ensure that your personal data remains protected. Personal data may be transferred outside the United Arab Emirates in accordance with the following:
- To countries that provide an adequate level of protection for personal data; or
- Pursuant to contractual agreements that ensure data protection; or
- Based on the explicit consent of the data subject; or
- If the transfer is necessary for the performance of a contract or a legal obligation.
We ensure that all necessary measures are taken to protect transferred data.
Please refer to the specific provisions on cross-border data transfers for each country, as set out in the country-specific annexes, where additional legal requirements apply.
Notice Regarding Updates
We review the Privacy Policy periodically based on changes in business and technology, and may update this Privacy Policy. If we make a material change to this Policy, we will notify you through the Platform so that you can know what personal data we collect and how we use it. These changes to the Privacy Policy shall take effect from the effective date specified in the Policy. We encourage you to review this page regularly for the latest information on our privacy practices.
Data Protection Officer and Contact Information
We have appointed data protection officers to oversee the protection of your personal data. If you have questions about this Privacy Policy or about data protection at AIME in general, you may contact the data protection officer responsible for your country at any time.
The contact details of the Data Protection Officer are:
- Address: Office 301, 3rd Floor, Building 1, Dubai Internet City, Dubai, United Arab Emirates
- Email: service@aimemena.com
Contact Us
If you have any questions about how we handle your personal data that are not answered in this Policy, or any complaints or other enquiries, you may contact us by sending an email to service@aimemena.com.
We will respond and coordinate with the Data Protection Officer, local representative or customer service staff to contact you within two weeks or any other period required by the laws of your country of residence.
When we receive privacy questions or requests for access/download of personal information, we have a professional team to resolve your issues. If your question involves a significant matter in itself, we may request further information from you. If you consult with us, we will provide you with information about relevant complaint channels that may apply based on your actual situation.
Annex 1
Provisions Specific to the United Arab Emirates
(For Users Residing in the United Arab Emirates)
This Annex 1 applies in addition to the provisions set out in the body of the Privacy Policy to users in the United Arab Emirates. By ticking our consent box, and to the extent required by the laws of the United Arab Emirates, you consent and grant your explicit consent to AIME and its affiliates, employees, contractors and relevant third parties to process, transfer and disclose your personal data in accordance with this Privacy Policy.
You may withdraw your consent at any time by sending us an email (email address: service@aimemena.com). Such withdrawal of consent shall not affect the lawfulness of any processing carried out based on the consent provided before its withdrawal.
Applicable Laws
The processing of personal data is subject to the provisions of Federal Decree-Law No. 45 of 2021 on Personal Data Protection.
Definitions and Terms
Sensitive Personal Data: refers to any data that directly or indirectly reveals a natural person's family or racial origin, political or philosophical opinions, religious beliefs, criminal record, or biometric data, or any data relating to their health, physical, psychological, mental, genetic or sexual condition, including information relating to the provision of healthcare services to him/her that reveals his/her health status.
Your Rights
The Data Protection Law grants the data subject the following rights:
- Right to Obtain Information
- Right to Data Portability
- Right to Rectification/Completion
- Right to Erasure
- Right to Restrict Processing
- Right to Object to/Cease Processing
- Right Relating to Automated Decision-Making
- Right to Withdraw Consent
- Right to Notification of Certain Data Breaches
- Right to Complain to the UAE Data Protection Office. If we fail to comply with the applicable data protection laws of the United Arab Emirates, you also have the right to lodge a complaint with the UAE Data Protection Office, the competent data protection authority in the country, established pursuant to Federal Decree-Law No. 45 of 2021.
Cross-Border Transfer
In the absence of adequacy decisions, we will only transfer your personal data when: (1) there are compliant contractual safeguards with the recipient, (2) your explicit consent does not conflict with the security and interest of the United Arab Emirates, (3) there is contractual necessity, (4) the transfer is necessary for the establishment, exercise or defence of legal rights, (5) the transfer is necessary for the implementation of a measure relating to international judicial cooperation or the protection of the public interest.
We will apply the protection measures required under Federal Decree-Law No. 45 of 2021 to any such transfers, and we can make information about the applicable transfer mechanism available upon request.
Legal Basis for Processing
We may process personal data in accordance with any legal basis recognised under the laws applicable in the United Arab Emirates, including where processing is necessary for the performance of a contract to which the data subject is a party, or for compliance with a legal obligation, or for the protection of legitimate interests, or for the establishment, exercise or defence of rights, or in any other cases permitted by the law applicable in the United Arab Emirates.
Personal Data Security
We apply appropriate technical and organisational measures to protect personal data in accordance with the nature of the processing and the potential risks to the privacy and confidentiality of the data, including measures aimed at preventing unauthorised access, disclosure, alteration or unlawful destruction of personal data, in accordance with the requirements of the laws applicable in the United Arab Emirates.
Automated Processing
Where our services involve automated processing of personal data, including the use of artificial intelligence technologies or profiling, this will be carried out in accordance with the laws applicable in the United Arab Emirates and in a manner that does not adversely affect the rights of the data subject. The data subject may object to decisions resulting from automated processing where permitted by law.
Data Protection Impact Assessment
In cases where the processing of personal data may involve high risks to the privacy or confidentiality of data, including when using modern technologies, we may conduct a data protection impact assessment as required by the laws applicable in the United Arab Emirates.
Third-Party Data Sharing
We may share your personal data with the following parties in accordance with the provisions of Federal Decree-Law No. 45 of 2021 on Personal Data Protection:
- Huawei Cloud as the cloud infrastructure provider, where the Platform is hosted on its servers in the Kingdom of Saudi Arabia;
- Our subsidiaries and affiliates for operational and administrative purposes related to the provision of services;
- Approved payment processors for the completion of financial transactions;
- Judicial and enforcement authorities where there is a legal obligation to disclose or pursuant to an order issued by a competent authority in accordance with the laws applicable in the United Arab Emirates;
- Any third parties in cases of business transfers such as merger, acquisition or restructuring. We do not sell your personal data to any third party under any circumstances.
Data Storage and Retention
Your personal data is primarily stored on Huawei Cloud in the Kingdom of Saudi Arabia. Without prejudice to the data retention periods set out in Section 4 of the Policy, and without prejudice to Federal Decree-Law No. 45 of 2021, we retain your personal data in accordance with the following retention periods:
- Account data: For the duration of the account plus one (1) year after its closure;
- Transaction data: For a period of up to five (5) years;
- API logs: For a period of up to ninety (90) days;
- Analytical data: For a period of up to twelve (12) months.
We apply the necessary technical measures to protect your data in accordance with the requirements of Federal Decree-Law No. 45 of 2021. We also apply the following organisational measures: employee training on data protection, confidentiality agreements, and periodic security assessments. In the event of a personal data breach, we are committed to assessing the scope and impact of the breach and taking immediate corrective action, and notifying the Data Protection Office and affected individuals in accordance with the requirements set out in Federal Decree-Law No. 45 of 2021. We will also notify affected individuals without undue delay where the breach is likely to pose a high risk to their privacy and confidentiality.
Additional Data Subject Rights
Right to Data Portability: You have the right, in accordance with the provisions of Federal Decree-Law No. 45 of 2021, to request to obtain your personal data that you have provided to us in a structured, commonly used and machine-readable electronic format, and to request its transfer to another controller where technically feasible.
Right to Object to Profiling and Automated Decisions: You have the right to object to any decision based solely on automated processing, including profiling (content personalisation), where such decision produces legal effects concerning you or similarly significantly affects you, in accordance with the provisions of Federal Decree-Law No. 45 of 2021. You may exercise these rights by contacting us at service@aimemena.com.
Annex 2
Provisions Specific to the Sultanate of Oman
(For Individuals Located in the Sultanate of Oman or Who Access Our Services from the Sultanate of Oman)
This Annex 2 applies in addition to the provisions set out in the body of the Privacy Policy to users in the Sultanate of Oman. In the event of any conflict between this Annex and this Privacy Policy, the provisions of this Annex shall prevail with respect to the processing of personal data. To the extent required by the laws applicable in the Sultanate of Oman, you consent and grant your explicit consent to AIME, its affiliates and relevant third parties to collect, use, process, store, transfer and disclose your personal data in accordance with this Privacy Policy.
You may withdraw your consent at any time by sending an email to service@aimemena.com. The withdrawal of consent shall not affect the lawfulness of any processing carried out based on the consent provided before its withdrawal.
Applicable Laws
The processing of personal data is subject to the provisions of Royal Decree No. 6 of 2022 issuing the Personal Data Protection Law and its Executive Regulations No. 34 of 2024.
Definitions and Terms
Personal Data: means any data relating to a natural person who is identified or identifiable, directly or indirectly, by reference to one or more identifiers.
Sensitive Personal Data: includes data relating to genetic data, biometric data, health data, racial origin, sexual life, political opinions, religious beliefs, convictions, criminal records, or security measures.
Consent
By using our services or providing your personal data, you consent to the collection, use, processing, storage and disclosure of your personal data in accordance with this Privacy Policy.
Consent to the processing of personal data shall be:
- Explicit, clear, freely given and without coercion;
- Written, electronic or by any other means that allows its verification.
You may withdraw your consent at any time by sending an email to service@aimemena.com. The withdrawal of consent shall not affect the lawfulness of any processing carried out based on the consent provided before its withdrawal.
Deletion of Personal Data
You may request the erasure of your personal data in cases permitted by law, including the following:
- The purpose for which the data was collected has been fulfilled;
- Withdrawal of consent to processing;
- Non-compliance of the processing with the provisions of applicable laws.
We may refuse a deletion request if retention of the data is necessary for compliance with a legal obligation or for the defence of our rights or in the event of an existing legal dispute.
Exercise of Data Subject Rights
You, as a data subject, or through your legal representative, may request access to the personal data stored with us, or request its correction, updating or deletion.
Upon receipt of your request to exercise any of your rights, we will review the request and respond to it within forty-five (45) days from the date of receipt of the request, as required by the Executive Regulations of the Personal Data Protection Law.
You may also request the restriction or suspension of the processing of your personal data pending the consideration of your request.
You also have the right to obtain a copy of your personal data processed by us in paper or electronic format, provided that such copy does not include personal data belonging to other persons.
You or any interested person have the right to file a complaint or report to the competent department of the Ministry of Transport, Communications and Information Technology regarding any violation of the provisions of the Personal Data Protection Law and its Executive Regulations.
Cross-Border Transfer
Your personal data may be transferred outside the Sultanate of Oman to other entities for the purposes of operating or providing the Services. Such transfer is carried out in accordance with the controls and procedures set out in the laws applicable in the Sultanate of Oman.
Before carrying out any transfer of personal data, we take appropriate measures to ensure an adequate level of protection for the personal data and to prevent its unlawful use or disclosure.
Children's Privacy
The personal data of a child may not be processed except after obtaining the explicit consent of their guardian, and such processing must be carried out in the best interests of the child. The purpose of the processing must be clear, direct, safe and free from fraud and deception, and the processing must be limited to the minimum amount of personal data necessary to achieve the specified purpose.
Data Breach Notification
In the event of a personal data breach resulting in its destruction, alteration, disclosure or unauthorised access, we will take appropriate measures in accordance with the laws applicable in the Sultanate of Oman, including notifying the competent authorities within seventy-two (72) hours of becoming aware of the breach if it poses a risk to the rights of data subjects. We will also notify the data subject within seventy-two (72) hours of becoming aware of the breach where it may cause serious harm or pose high risks to the data subject.
Annex 3
Provisions Specific to the State of Qatar
(For Individuals Located in Qatar or Who Access Our Services from Qatar)
This Annex 3 applies in addition to the provisions set out in the body of the Privacy Policy to users in the State of Qatar. In the event of any conflict between this Annex and this Privacy Policy, the provisions of this Annex shall prevail with respect to the processing of personal data. To the extent required by the laws applicable in the State of Qatar, you consent and grant your explicit consent to AIME, its affiliates and relevant third parties to collect, use, process, store, transfer and disclose your personal data in accordance with this Privacy Policy.
You may withdraw your consent at any time by sending an email to service@aimemena.com. The withdrawal of consent shall not affect the lawfulness of any processing carried out based on the consent provided before its withdrawal.
Applicable Laws
The processing of personal data is subject to the provisions of Law No. 13 of 2016 on Personal Data Privacy Protection and the ministerial decisions issued in implementation thereof.
Definitions and Terms
Personal Data: means data of an individual that identifies him/her or can be reasonably identified, whether through such personal data or through combining such data with any other data.
Sensitive Personal Data: includes personal data relating to racial origin, children, health, physical or psychological condition, religious beliefs, marital relationships, or criminal offences. In addition to any other types of personal data of a special nature where their misuse or disclosure could cause serious harm to the individual.
Consent
By using our services or providing your personal data, you consent to the collection, use, processing, storage and disclosure of your personal data in accordance with this Privacy Policy. Consent to the processing of personal data shall be:
- Explicit, clear, freely given and without coercion;
- Written, electronic or by any other means that allows its verification.
You may withdraw your consent at any time by sending an email to service@aimemena.com. The withdrawal of consent shall not affect the lawfulness of any processing carried out based on the consent provided before its withdrawal.
Deletion of Personal Data
You may request the erasure of your personal data in cases permitted by law, including, without limitation, the following:
- The purpose for which the processing was carried out has been fulfilled;
- There are no remaining justifications for our retention of such personal data.
We may refuse a deletion request if retention of the data is necessary for the performance of a legal obligation or a court order, or for the protection of the vital interests of the individual, or for the achievement of scientific research purposes in the public interest.
Exercise of Data Subject Rights
You, as a data subject, or through your legal representative, may request access to the personal data stored with us, or request its correction, updating or deletion.
Upon receipt of your request to exercise any of your rights, we will review the request and respond to it within a reasonable period of time as permitted by applicable laws.
You may also request the restriction or suspension of the processing of your personal data pending the consideration of your request.
Cross-Border Transfer
Your personal data may be transferred outside the State of Qatar to other entities, including cloud hosting service providers, for the purposes of operating the Services and providing related services. In accordance with the provisions of the law, the controller is not prohibited from taking any decision or measure that may restrict the cross-border transfer of data, unless the processing of such data is contrary to the provisions of the law, or if such processing could cause serious harm to the personal data or to the privacy of the individual.
Before carrying out any transfer of personal data, we take appropriate measures to ensure an adequate level of protection for the personal data and to ensure its lawful and secure processing, preventing unauthorised access, unlawful use or disclosure.
Children's Privacy
Personal data relating to children is considered personal data of a special nature. The personal data of a child may not be processed except after obtaining the explicit consent of their guardian, and such processing must be carried out in the best interests of the child.
Data Breach Notification
In the event of a personal data breach resulting in its destruction, alteration, disclosure or unauthorised access, we will take appropriate measures in accordance with the laws applicable in the State of Qatar, including notifying the competent authorities and the data subject, as appropriate, within seventy-two (72) hours of becoming aware of the breach.
Annex 4
Provisions Specific to the Kingdom of Bahrain
(For Individuals Located in Bahrain or Who Access Our Services from Bahrain)
This Annex 4 applies in addition to the provisions set out in the body of the Privacy Policy to users in the Kingdom of Bahrain. In the event of any conflict between this Annex and this Privacy Policy, the provisions of this Annex shall prevail with respect to the processing of personal data. To the extent required by the laws applicable in the Kingdom of Bahrain, you consent and grant your explicit consent to AIME, its affiliates and relevant third parties to collect, use, process, store, transfer and disclose your personal data in accordance with this Privacy Policy.
You may withdraw your consent at any time by sending an email to service@aimemena.com. The withdrawal of consent shall not affect the lawfulness of any processing carried out based on the consent provided before its withdrawal.
Applicable Laws
The processing of personal data is subject to the provisions of Law No. 30 of 2018 on Personal Data Protection, the decisions issued by the Board of Directors of the Personal Data Protection Authority (the "Authority") in implementation thereof, and Decision No. 42 of 2022 of the Ministry of Justice, Islamic Affairs and Endowments on the Transfer of Personal Data Outside the Kingdom of Bahrain.
Definitions and Terms
Personal Data: means any information in any form pertaining to an identified individual, or an individual who can be identified directly or indirectly, in particular through their personal identity number, or one or more of their physical, physiological, mental, cultural or economic characteristics, or their social identity.
Sensitive Personal Data: means any personal information that directly or indirectly reveals genetic data, biometric data, health data, racial origin, sexual life, political opinions, religious beliefs, convictions, criminal record, or security measures. Or any other data the misuse or disclosure of which is likely to cause serious harm to the individual.
Consent
By using our services or providing your personal data, you consent to the collection, use, processing, storage and disclosure of your personal data in accordance with this Privacy Policy.
Consent to the processing of personal data shall be:
- Explicit, clear, freely given and without coercion;
- Written, electronic or by any other means that allows its verification.
You may withdraw your consent at any time by sending an email to service@aimemena.com. The withdrawal of consent shall not affect the lawfulness of any processing carried out based on the consent provided before its withdrawal.
Deletion of Personal Data
You may request the erasure of your personal data in cases permitted by law, including the following:
- The purpose for which the data was collected has been fulfilled;
- Withdrawal of consent to processing;
- Non-compliance of the processing with the provisions of applicable laws.
We may refuse a deletion request if retention of the data is necessary for compliance with a legal obligation or for the defence of our rights or in the event of an existing legal dispute.
Exercise of Data Subject Rights
You, as a data subject, or through your guardian, custodian or trustee if you lack or have no legal capacity, may request access to the personal data stored with us, or request its correction, updating or deletion.
Upon receipt of your request to exercise any of your rights, we will review the request and respond to it within fifteen business days. For requests to object to direct marketing, to object to processing that causes material or moral harm, or to rectify, erase or block personal data, we will respond within ten (10) working days from the date of receipt. Where a request is partly or wholly declined, we will notify you of the reasons within the applicable timeframes and you shall have the right to lodge a complaint with the Personal Data Protection Authority.
You may also request the blocking of the processing of your personal data pending the consideration of your request.
You have the right to lodge a complaint with the Personal Data Protection Authority regarding any violation of the provisions of the Personal Data Protection Law or the decisions issued in implementation thereof.
Cross-Border Transfer
Your personal data may be transferred outside the Kingdom of Bahrain to other entities for the purposes of operating or providing the Services. Personal data may not be transferred outside the Kingdom except in the following cases:
- The transfer is to a country or territory listed in a schedule prepared and updated by the Personal Data Protection Authority containing the names of countries and territories that ensure an adequate level of protection for personal data as specified in Decision No. 42 of 2022 of the Ministry of Justice, Islamic Affairs and Endowments;
- The transfer is pursuant to a permit issued by the Authority on a case-by-case basis;
- The data subject's consent to such transfer;
- If the transfer is necessary for the performance of a contract between the data subject and the data manager, or for the protection of the vital interests of the data subject, or for the performance of a legal obligation.
Before carrying out any transfer of personal data, we take appropriate measures to ensure an adequate level of protection for the personal data and to prevent its unlawful use or disclosure.
Children's Privacy
If the data subject lacks or has no legal capacity, the consent of the guardian, custodian or trustee shall be relied upon within the limits prescribed by law. Such consent must be written, explicit, clear and specific to the processing of certain data, and given on the basis of full awareness of the purpose or purposes of processing.
Data Breach Notification
In the event of a personal data breach resulting in its destruction, alteration, disclosure or unauthorised access, we will take appropriate measures in accordance with the laws applicable in the Kingdom of Bahrain, including notifying the Personal Data Protection Authority within seventy-two (72) hours of discovering the breach, unless it is unlikely that the breach would pose a risk to the rights of data subjects. We will also notify the affected data subjects as appropriate where the breach may pose high risks to their rights and freedoms.
Annex 5
Provisions Specific to the Kingdom of Saudi Arabia
(For Users Residing in the Kingdom of Saudi Arabia)
This Annex 5 applies in addition to the provisions set out in the body of the Privacy Policy to users in the Kingdom of Saudi Arabia. If you reside in the Kingdom of Saudi Arabia, the processing of your personal data is subject to the provisions of the Personal Data Protection Law issued by Royal Decree No. M/19 dated 9/2/1443H, as amended by Royal Decree No. M/148 dated 5/9/1444H, and its Executive Regulations. In the event of any conflict between the provisions of this Policy and these specific provisions, these provisions shall prevail to the extent necessary.
Legal Basis for Data Processing
Your personal data is processed in accordance with the legal bases set out in the Law and its regulations, depending on the nature of the processing, including, without limitation, obtaining your consent, performing contractual obligations, complying with legal obligations, or achieving a legitimate interest, in accordance with what is permitted by the Law.
Where the data subject is a minor, the controller is obliged not to collect their personal data except in accordance with the applicable laws and regulations in the Kingdom of Saudi Arabia, through the legal guardian or statutory representative of the minor, unless the Law permits otherwise.
The controller shall take appropriate measures to verify the identity of the legal guardian or statutory representative and their authority before collecting any personal data relating to the minor.
The controller is also obliged to process the personal data of minors only for the purposes for which it was collected, and to ensure a high level of protection commensurate with the nature of this category of data.
The controller may not collect personal data directly from a minor without obtaining the statutory consent of their legal guardian, except in cases expressly permitted by the Law.
Consent
In cases where the processing of your personal data is based on your consent, such consent shall be explicit and verifiable. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out based on consent before its withdrawal.
Sensitive Personal Data
Sensitive personal data means any personal data relating to an individual's racial or ethnic origin, religious, intellectual or political beliefs, security data, criminal data, health, genetic or biometric data, or any other data specified by the Law or relevant regulations.
Data Subject Rights
Under the Personal Data Protection Law issued by Royal Decree No. M/19 dated 09/02/1443H, as amended by Royal Decree No. M/148 dated 05/09/1444H, and its Executive Regulations, the data subject has the following rights, subject to the purpose of the collection and processing of personal data:
First: Right to Be Informed
- To be informed of the methods of collecting personal data and the legal basis therefor.
- To be informed of the purpose of data collection, how it is processed, stored and destroyed.
- To know the entities with which personal data will be shared.
Second: Right to Access and Request Personal Data
- To access personal data and obtain a copy thereof through the approved communication channels.
- The entity may restrict this right in specific cases as required by the Law and its Executive Regulations.
Third: Right to Rectify Personal Data
- To request the rectification of any inaccurate, incorrect or incomplete personal data.
- To update data and notify the data subject upon completion, with the destruction of supporting documents after verification.
Fourth: Right to Destroy Personal Data
- To request the destruction of personal data in certain cases, unless the Law specifies a particular retention period or there are contractual requirements necessitating its retention.
Fifth: Right to Withdraw Consent to the Processing of Personal Data
- To withdraw consent to the processing of personal data at any time, unless there are legitimate purposes requiring the continuation of processing.
Upon receipt of a request from the data subject to exercise any of the above rights, we will act on the request within a period not exceeding thirty (30) days. This period may be extended by an additional thirty (30) days in cases where the implementation requires disproportionate effort or where we receive multiple requests from the data subject, provided that you are notified in advance of the extension and the reasons for the delay.
Transfer of Personal Data Outside the Kingdom
Your personal data may not be transferred outside the Kingdom of Saudi Arabia except in accordance with the controls set out in the Law and its regulations, including ensuring an adequate level of protection for personal data, adopting appropriate safeguards, and conducting risk assessments where required.
In the absence of an adequate level of protection, the necessary measures may be taken, or the transfer of personal data may be suspended or ceased, as determined by the competent authority.
Notification of Personal Data Breaches
In the event of any personal data breach, it will be dealt with and the necessary measures taken in accordance with the provisions of the Law and its regulations, including notifying the competent authority (SDAIA) within seventy-two (72) hours of becoming aware of the breach if such breach potentially causes harm to the personal data, or to the data subject or conflicts with their rights or interests. We will also notify the data subject without undue delay of any breach that may cause damage to their data or cause prejudice to their rights and interests.
Competent Authority
The Saudi Authority for Data and Artificial Intelligence (SDAIA) is the competent authority responsible for overseeing the implementation of the provisions of the Personal Data Protection Law in the Kingdom of Saudi Arabia.
Annex 6
Provisions Specific to the Arab Republic of Egypt
(For Users Residing in the Arab Republic of Egypt)
This Annex 6 applies in addition to the provisions set out in the body of the Privacy Policy to users in the Arab Republic of Egypt. In the event of any conflict between this Annex and this Privacy Policy, the provisions of this Annex shall prevail with respect to the processing of personal data. To the extent required by the laws applicable in the Arab Republic of Egypt, you consent and grant your explicit consent to AIME, its affiliates and relevant third parties to collect, use, process, store, transfer and disclose your personal data in accordance with this Privacy Policy.
You may withdraw your consent at any time by sending an email to service@aimemena.com. The withdrawal of consent shall not affect the lawfulness of any processing carried out based on the consent provided before its withdrawal.
Applicable Laws
The processing of personal data is subject to the provisions of the Personal Data Protection Law issued by Law No. 151 of 2020, its Executive Regulations issued by Decision of the Minister of Communications and Information Technology No. 816 of 2025, and the decisions and instructions issued by the Personal Data Protection Centre.
Definitions and Terms
Personal Data: means any data relating to a natural person who is identified or identifiable, directly or indirectly, by linking such data with other information such as name, voice, image, identification number, electronic identifier, or any data that reveals the psychological, health, economic, cultural or social identity.
Sensitive Personal Data: means data that reveals psychological, mental, physical or genetic health, biometric data, financial data, religious beliefs, political opinions, or security status. Children's data is in all cases considered sensitive personal data.
Consent
It is prohibited to collect, process, disclose or reveal personal data by any means without the explicit consent of the data subject, unless the law permits otherwise.
By using our services or providing your personal data, you consent to the collection, use, processing, storage and disclosure of your personal data in accordance with this Privacy Policy. A natural person's provision of their personal data for the purpose of obtaining lawful services shall be deemed consent to the collection and processing of such data for that purpose.
You may withdraw your consent at any time by sending an email to service@aimemena.com. The withdrawal of consent shall not affect the lawfulness of any processing carried out based on the consent provided before its withdrawal.
Data Subject Rights
The data subject has the rights established by law, in particular:
- The right to be informed of personal data, the purposes of its collection and processing, and to access it held by any holder, controller or processor;
- The right to withdraw prior consent to the retention or processing of personal data;
- The right to request the correction, amendment, deletion, addition or updating of personal data;
- The right to restrict the processing of data within a specific scope;
- The right to be notified of any breach or violation of personal data;
- The right to object to the processing of personal data or its results where they conflict with the fundamental rights and freedoms of the data subject.
Deletion of Personal Data
You may request the erasure of your personal data in cases permitted by law, including the following:
- The specific purpose for which the data was collected has been fulfilled;
- Withdrawal of consent to processing;
- There is no legitimate reason for retaining the data.
We may refuse a deletion request if retention of the data is necessary for compliance with a legal obligation or for the defence of our rights or in the event of an existing legal dispute.
Exercise of Data Subject Rights
You, as a data subject, or through your legal representative, may request access to the personal data stored with us, or request its correction, updating or deletion.
Upon receipt of your request to exercise any of your rights, we will review the request and respond to it within six (6) business days from the date of submission in accordance with the provisions of the law.
You may also request the restriction of the processing of your personal data pending the consideration of your request.
You have the right to lodge a complaint with the Personal Data Protection Centre regarding any violation of the provisions of the Personal Data Protection Law or its Executive Regulations, in accordance with the procedures set out in Article 33 of the Law.
Cross-Border Transfer
Your personal data may be transferred outside the Arab Republic of Egypt, including to cloud hosting service providers, for the purposes of operating the Services and providing related services.
In accordance with the provisions of the Egyptian Personal Data Protection Law, personal data may be transferred across borders where this is carried out in accordance with the controls and requirements set out in the law and the regulatory decisions issued in this regard, and in a manner that does not prejudice the fundamental rights of data subjects or compromise their privacy.
Before carrying out any transfer of personal data outside the Arab Republic of Egypt, we are committed to taking appropriate measures and safeguards to ensure an adequate level of protection for personal data, and to ensure its lawful and secure processing, preventing unauthorised access, unlawful use or disclosure, including ensuring an adequate level of protection for personal data, adopting appropriate safeguards, and conducting risk assessments where required.
Children's Privacy
As children's data is in all cases considered sensitive personal data, the consent of the guardian, custodian or trustee shall be relied upon for its processing, within the limits prescribed by law.
Such consent must be written, explicit and clear, specific to the processing of certain personal data, and given on the basis of full awareness of the purpose or purposes of processing.
Explicit and prior consent of the parent/guardian must also be obtained before collecting or processing the personal data of children under the age of fifteen (15).
For children aged between fifteen (15) and eighteen (18), the consent of the parent or legal guardian must be obtained, as applicable.
Data Breach Notification
In the event of a personal data breach resulting in its destruction, alteration, disclosure or unauthorised access, we are committed to taking the necessary measures in accordance with the provisions of the law, including:
- Notifying the Personal Data Protection Centre within seventy-two (72) hours from the date of becoming aware of the breach;
- Notifying the data subject within three (3) business days from the date of notifying the Centre, where the breach is likely to harm their rights or interests.
Competent Authority
The Personal Data Protection Centre (PDPC), established pursuant to Personal Data Protection Law No. 151 of 2020, is the competent authority for overseeing the implementation of personal data protection provisions in the Arab Republic of Egypt. The Centre reports to the Minister responsible for communications and information technology.
Annex 7
Provisions Specific to the Hashemite Kingdom of Jordan
(For Individuals Located in the Hashemite Kingdom of Jordan or Who Access Our Services from the Hashemite Kingdom of Jordan)
This Annex 7 applies in addition to the provisions set out in the body of the Privacy Policy to users in the Hashemite Kingdom of Jordan. In the event of any conflict between this Annex and this Privacy Policy, the provisions of this Annex shall prevail with respect to the processing of personal data. To the extent required by the laws applicable in the Hashemite Kingdom of Jordan, you consent and grant your explicit consent to AIME, its affiliates and relevant third parties to collect, use, process, store, transfer and disclose your personal data in accordance with this Privacy Policy.
You may withdraw your consent at any time by sending an email to service@aimemena.com. The withdrawal of consent shall not affect the lawfulness of any processing carried out based on the consent provided before its withdrawal.
Applicable Laws
The processing of personal data is subject to the provisions of the Personal Data Protection Law No. 24 of 2023, the Electronic Transactions Law No. 15 of 2015 and its amendments, Article 18 of the Jordanian Constitution which guarantees the inviolability of private life and the confidentiality of correspondence, and any other legislation relating to the protection of personal data in force in the Hashemite Kingdom of Jordan.
Definitions and Terms
Personal Data: any data or information relating to a natural person that can identify them directly or indirectly, regardless of its source or form, including data relating to their person, family status or places of residence.
Sensitive Personal Data: any data or information relating to a natural person that directly or indirectly indicates their origin or race, or indicates their political opinions or affiliations, religious beliefs, or any data relating to their financial status, health, physical, mental or genetic condition, biometric data, criminal record, or any information or data that the Council decides to consider sensitive if its disclosure or misuse would cause harm to the person concerned.
Consent
By using our services or providing your personal data, you consent to the collection, use, processing, storage and disclosure of your personal data in accordance with this Privacy Policy. Consent to the processing of personal data shall be explicit, clear, freely given and without coercion, in accordance with the requirements of the Personal Data Protection Law No. 24 of 2023.
Data Subject Rights
You, as a data subject, or through your legal representative, may exercise the following rights in accordance with applicable laws:
- The right to be informed of the purposes of collecting your personal data and how it is processed;
- The right to access your personal data and obtain a copy thereof;
- The right to request the correction of any inaccurate or incomplete personal data;
- The right to request the deletion of your personal data in cases permitted by law;
- The right to object to the processing of your personal data;
- The right to withdraw consent to processing at any time; and
- The right to lodge a complaint with the competent authorities.
Upon receipt of your request to exercise any of your rights, we will review the request and respond to it within a reasonable period of time as permitted by applicable laws. You may also request the restriction or suspension of the processing of your personal data pending the consideration of your request.
Deletion of Personal Data
You may request the erasure of your personal data in cases permitted by law, including: the purpose for which the data was collected has been fulfilled; withdrawal of consent to processing; non-compliance of the processing with the provisions of applicable laws. We may refuse a deletion request if retention of the data is necessary for compliance with a legal obligation or for the defence of our rights or in the event of an existing legal dispute.
Cross-Border Transfer
Your personal data may be transferred outside the Hashemite Kingdom of Jordan to other entities, including to cloud hosting service providers in the Kingdom of Saudi Arabia (Huawei Cloud) and to the United Arab Emirates (where the operating entity is located), for the purposes of operating the Services and providing related services. Such transfer is carried out in accordance with the controls and procedures set out in the laws applicable in the Hashemite Kingdom of Jordan. Before carrying out any transfer of personal data, we take appropriate measures to ensure an adequate level of protection for personal data and to prevent its unlawful use or disclosure in accordance with the measures set out in the Personal Data Protection Law No. 24 of 2023.
Children's Privacy
The personal data of a child (under the age of eighteen) may not be processed except after obtaining the explicit consent of their parent or legal guardian, and such processing must be carried out in the best interests of the child, in accordance with the Jordanian Child Law No. 17 of 2022. The purpose of the processing must be clear and specific, and the processing must be limited to the minimum amount of personal data necessary.
Data Breach Notification
In the event of a serious breach of data security and safety that could cause significant harm to the data subject, we will take the following measures in accordance with the Personal Data Protection Law No. 24 of 2023: (i) notify the affected data subjects within twenty-four (24) hours from the discovery of the breach and provide them with the necessary measures to avoid any consequences resulting from the breach; and (ii) notify the Personal Data Protection Directorate (PDPD) within seventy-two (72) hours from the discovery of the breach, including details of the source of the breach, its mechanism and the affected data subjects.
Competent Authority
The Personal Data Protection Directorate (PDPD) is the competent authority responsible for overseeing information security and data protection in cyberspace in the Hashemite Kingdom of Jordan. You have the right to lodge a complaint with the PDPD or with the competent courts regarding any violation of the provisions of applicable laws relating to the protection of your personal data.