Privacy Policy

1. Regulatory Framework

This Privacy Policy is issued in compliance with the following UAE laws and regulations, as amended from time to time:

• Federal Decree-Law No. (45) of 2021 on the Protection of Personal Data (the "UAE PDPL");
• Federal Decree-Law No. (34) of 2021 on Combatting Rumours and Cybercrimes;
• Federal Decree-Law No. (31) of 2021 issuing the Penal Code;
• Federal Law No. (1) of 2006 on Electronic Commerce and Transactions, as amended;
• Cabinet Decision No. (57) of 2020 on the Implementing Regulation of Federal Law No. (1) of 2006;
• Telecommunications Regulatory Authority ("TDRA") guidelines and any applicable Free Zone data regulations (e.g., DIFC Data Protection Law No. 5 of 2020 or ADGM Data Protection Regulations 2021 where relevant).

Where the platform processes personal data of data subjects located in the European Economic Area or the United Kingdom, we additionally align our practices with the General Data Protection Regulation (EU 2016/679) ("GDPR") and the UK Data Protection Act 2018.

2. Data Controller and Contact

Opera Ones is the "Data Controller" as defined under the UAE PDPL. Our registered place of business and contact details for all data protection matters are:

3. Personal Data We Collect

We only collect personal data that is necessary, adequate, and proportionate to the purposes for which it is processed. The categories of personal data we may process include:

4. Legal Basis for Processing

Under the UAE PDPL, we process personal data only where a lawful basis exists, including:

• The data subject has given clear, specific, and free consent (Articles 5 & 6 of the PDPL);
• Performance of a contract to which the data subject is a party, or to take steps prior to entering into a contract;
• Compliance with a legal obligation to which Opera Ones is subject;
• Protection of the vital interests of the data subject;
• Performance of a task carried out in the public interest; or
• The legitimate interests of Opera Ones or a third party, where such interests do not override the rights and freedoms of the data subject.

For sensitive personal data (such as health data, biometric data, or racial/ethnic origin) as defined under Article 25 of the PDPL, we rely on explicit consent or other lawful bases permitted by law.

5. Purposes of Processing

• Provision of the Opera Ones enterprise operations platform (procurement, inventory, HR, finance, and marketplace modules);
• Account creation, authentication, and security of the platform;
• Processing payments, issuing invoices, and subscription billing;
• Generating operational, financial, and AI-driven forecasting reports;
• Facilitating communications between companies and their suppliers;
• Customer support and technical issue resolution;
• Compliance with legal, regulatory, and tax obligations in the UAE;
• Product improvement, analytics, and aggregated, anonymized business intelligence.

6. Sharing and Disclosure of Personal Data

We do not sell personal data. We may share personal data with the following categories of recipients:

• Group companies: affiliates acting as processors under our control;
• Cloud & sub-processors: hosting providers, payment processors (e.g., Stripe), email delivery providers (e.g., Resend), and analytics providers, each bound by written data processing agreements;
• Suppliers & Partners: solely for the purpose of fulfilling orders placed via the marketplace;
• Competent Authorities: where required by UAE law, court order, or legitimate request from the relevant UAE Data Office, public prosecution, or law enforcement agencies.

Any cross-border transfer of personal data outside the UAE is conducted in accordance with Articles 22 and 23 of the PDPL, ensuring an adequate level of protection or appropriate safeguards are in place.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this policy or as required by UAE law. Financial and tax records are retained for a minimum of five (5) years in line with UAE Federal Tax Authority requirements. HR and payroll records are retained in accordance with UAE Labour Law. Upon expiry of the retention period, data is securely deleted or anonymized.

8. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. These measures include encryption in transit and at rest, role-based access controls, tenant isolation (multi-tenant data separation), audit logging, rate limiting, and regular security assessments. In the event of a personal data breach affecting your rights, we will notify the relevant UAE Data Office and affected data subjects in accordance with the timelines prescribed by the PDPL (currently within seventy-two (72) hours of becoming aware of the breach).

9. Your Rights as a Data Subject

Under the UAE PDPL, data subjects have the following rights:

• The right to be informed about how their data is processed;
• The right of access to their personal data;
• The right to rectify inaccurate or incomplete personal data;
• The right to erase personal data ("right to erasure");
• The right to restrict or object to processing;
• The right to data portability;
• The right to withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal;
• The right to lodge a complaint with the relevant UAE Data Office.

To exercise any of these rights, contact our Data Protection Officer at dpo@operaones.com. We will respond within thirty (30) days, in line with PDPL requirements.

10. Cookies and Tracking Technologies

We use cookies, local storage, Meta Pixel, and similar technologies to operate the platform, remember your preferences, and understand how the platform is used. You may control cookies through your browser settings; however, disabling cookies may affect platform functionality. Marketing pixels, such as the Meta Pixel, are used to measure the effectiveness of our campaigns and are governed by Meta's Data Policy.

11. Children's Privacy

The platform is a B2B service intended for businesses and is not directed at individuals under the age of eighteen (18). We do not knowingly collect personal data from children. If you believe a child has provided personal data, please contact us and we will promptly delete such data.

12. Third-Party Links

Our platform may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the platform after changes take effect constitutes acceptance of the revised policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: