Applicable Law: UAE Federal Decree‑Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its Executive Regulations.
This Data Processing Notice explains how AvaronX processes your personal data when you visit our company website, why we process it, and what rights you have under UAE law. This notice supplements our Privacy Policy and is directed to individuals in the United Arab Emirates.
This Data Processing Notice explains how AvaronX processes your personal data when you visit our company website, why we process it, and what rights you have under UAE law. This notice supplements our Privacy Policy and is directed to individuals in the United Arab Emirates.
Data Protection Notice
Data Protection Notice
Applicable Law: UAE Federal Decree‑Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its Executive Regulations.
At AvaronX, your privacy matters to us.
At AvaronX, your privacy matters to us.
At AvaronX, your privacy matters to us.
INFORMATION WE COLLECT
1. Categories of Personal Data We Process
Based on the Privacy Policy, applied to a company website without user accounts or password collection, we process the following categories of personal data:
Category
Contact and Inquiry data
Marketing data
Technical & device data
(automatic)
Usage metrics
Third-party integration data
Examples
Name , email address, content of messages
sent via inquiry forms or to support email.
Email address provided for newsletter or marketing updates.
IP address, browser type and version, device identifiers, operating system.
Pages visited, session duration, features used, referring website URLs.
Verified email address, public name (if you log in via social media – though unlikely for a simple company website, included for completeness per the policy).
Includes Sensitive Personal Data? (Under UAE PDPL)
NO
NO
NO
NO
NO
No passwords are collected. No sensitive personal data (as defined under UAE PDPL – e.g., health, biometric, genetic, financial account data, criminal records, or data revealing racial origin, political opinions, religious beliefs) is collected or processed by AvaronX.
1
Category
Contact and Inquiry data
Category of Data Purpose of Processing
Name , email address, content of messages sent via inquiry forms
or to support email.
Includes Sensitive Personal Data? (Under UAE PDPL)
NO
2
Category
Marketing data
Examples
Email address provided for newsletter or marketing updates.
Includes Sensitive Personal Data? (Under UAE PDPL)
NO
3
Category
Technical & device data(automatic)
Examples
IP address, browser type and version, device identifiers, operating system.
Includes Sensitive Personal Data? (Under UAE PDPL)
NO
4
Category
Usage metrics
Examples
Pages visited, session duration, features used, referring website URLs.
Includes Sensitive Personal Data? (Under UAE PDPL)
NO
5
Category
Third-party integration data
Examples
Verified email address, public name (if you log in via social media – though unlikely for a simple company website, included for completeness per the policy).
Includes Sensitive Personal Data? (Under UAE PDPL)
NO
2. Purposes of Processing for Each Category of Data
1
Category of Data
Contact and inquiry data
Purpose of Processing
Respond to your inquiries, support requests, and messages sent via our contact forms or email
2
Category of Data
Marketing data
Purpose of Processing
Send newsletters and promotional materials (only with your explicit consent)
3
Category of Data
Technical and device data
Purpose of Processing
Ensure system stability, detect and prevent fraud or unauthorised access, maintain website security
4
Category of Data
Usage metrics
Purpose of Processing
Analytics and improvement – understand how visitors use our website, identify bugs, optimise performance
5
Category of Data
Third party integration data
Purpose of Processing
Authenticate your identity if you choose to use a third party login (e.g., to post a comment or access a restricted area – though not typical for a simple company website)
Category of Data
Contact and Inquiry data
Marketing data
Technical & device data
(automatic)
Usage metrics
Third-party integration data
Purpose of Processing
Respond to your inquiries, support requests, and messages sent via our contact forms or email
Send newsletters and promotional materials (only with your explicit consent)
Ensure system stability, detect and prevent fraud or unauthorised access, maintain website security
Analytics and improvement – understand how visitors use our website, identify bugs, optimise performance
Authenticate your identity if you choose to use a third party login (e.g., to post a comment or access a restricted area – though not typical for a simple company website)
1
Purpose
Responding to your inquiries and support requests
Legal Basis
Respond to your inquiries, support requests, and messages sent via our contact forms or email
2
Purpose
Sending newsletters and promotional materials
Legal Basis
Consent – you may withdraw consent at any time
3
Purpose
Website security, fraud prevention, unauthorised access detection
Legal Basis
Legitimate interest (to protect our website and visitors) and legal obligation (where required by UAE cybercrime or data protection laws)
4
Purpose
Analytics, bug detection, performance optimisation
Legal Basis
Legitimate interest (to improve our corporate website) – provided your fundamental rights do not override our interest
5
Purpose
Compliance with legal requests (e.g., court orders, government requests)
Legal Basis
Legal obligation (Article 13(1)(c) of PDPL)
Note: Because no user accounts or passwords are collected, there is no contractual necessity for account creation or login authentication.
3. Legal Bases for Processing Under UAE PDPL
We process your personal data only on valid legal bases as required by UAE PDPL:
Purpose
Responding to your inquiries and support requests
Sending newsletters and promotional materials
Website security, fraud prevention, unauthorised access detection
Analytics, bug detection, performance optimisation
Compliance with legal requests (e.g., court orders, government requests)
Legal Basis
Legitimate interest (to communicate with visitors who contact us) – or contractual necessity if an inquiry leads to a pre contractual relationship
Consent – you may withdraw consent at any time
Legitimate interest (to protect our website and visitors) and legal obligation (where required by UAE cybercrime or data protection laws)
Legitimate interest (to improve our corporate website) – provided your fundamental rights do not override our interest
Legal obligation (Article 13(1)(c) of PDPL)
1
Collection Method
Directly from you
Description
When you fill out a contact or inquiry form, send an email to our support team, or subscribe to our newsletter.
2
Collection Method
Automatically
Description
Via cookies, web beacons, and server logs (IP address, browser type, device identifiers, operating system, pages visited, session duration, referring URLs).
3
Collection Method
Via third parties
Description
If you choose to authenticate using a third party service (e.g., social media login for any interactive feature) – those providers may share your verified email address or public name, subject to your privacy controls with that provider.
Note: Because no user accounts or passwords are collected, there is no contractual necessity for account creation or login authentication.
5. Data Retention Periods and Criteria
We retain your personal data only as long as necessary for the purposes set out above.
1
Data Category
Contact and inquiry data
Retention Criteria
Retained for the duration of the correspondence + up to 1 year thereafter for reference and legal protection, unless a longer retention is required by UAE law.
2
Data Category
Marketing data (email for newsletters)
Retention Criteria
Until you withdraw consent (unsubscribe) + a short administrative period to honour your opt out.
3
Data Category
Technical and usage data (IP addresses, analytics)
Retention Criteria
Aggregated or anonymised where possible; raw logs retained for a shorter period (e.g., 6–12 months) for security analysis, unless needed longer for legal compliance.
When data is no longer needed, we securely delete or anonymise it.
6. Processors, Third Parties, and Recipients (Including Government Entities)
We do not sell, rent, or trade your personal data. We share data only in the following circumstances:
1
Recipient Category
Service Providers (Processors)
Examples
Cloud hosting providers, email delivery services (e.g., for newsletters), analytics providers (e.g., Google Analytics)
Purpose
Perform essential functions on our behalf (hosting, email, website analytics)
Legal Basis for Sharing (UAE PDPL)
Contract with processor requiring confidentiality and security (Article 22 of PDPL)
2
Recipient Category
Business Transferees
Examples
Merger, acquisition, reorganisation, asset sale counterparties
Purpose
Transfer of user data as part of the transaction
Legal Basis for Sharing (UAE PDPL)
Legitimate interest – with prior notice to you
3
Recipient Category
Government Entities / Public Authorities
Examples
Law enforcement, courts, regulators (UAE or other jurisdictions)
Purpose
Comply with subpoenas, court orders, similar governmental requests, or protect rights, property, safety
Legal Basis for Sharing (UAE PDPL)
Legitimate interest – with prior notice to you
7. Cross Border Data Transfers (International Transfers)
AvaronX may operate using global infrastructure. Your personal data may be transferred to and processed in countries outside the United Arab Emirates.
Under UAE PDPL, we ensure appropriate safeguards are in place:
1
Transfer Mechanism
Adequacy decision
Description
If we transfer data to a country that the UAE has recognised as having adequate data protection laws, we rely on that decision.
2
Transfer Mechanism
Standard Contractual Clauses (SCCs)
Description
For transfers to countries without an adequacy decision, we use approved contractual clauses that impose UAE-equivalent obligations on the recipient.
3
Transfer Mechanism
Exemptions (where applicable)
Description
In limited cases (e.g., with your explicit consent, or for performance of a contract with you), we may rely on PDPL exemptions.
You may request a copy of the safeguards used (e.g., SCCs) by contacting us at the details below.
8. Your Rights as a Data Subject Under UAE PDPL
Under Federal Decree‑Law No. 45/2021, you have the following rights, subject to certain legal exceptions:
1
Right
Right to access
Description
Obtain confirmation of whether we process your personal data and receive a copy of that data.
2
Right
Right to correction
Description
Rectify inaccurate or incomplete personal data.
3
Right
Right to erasure (“right to be forgotten”)
Description
Request deletion of your data where there is no legal obligation to retain it.
4
Right
Right to restrict processing
Description
Temporarily limit how we use your data (e.g., while a correction request is pending).
5
Right
Right to stop processing
Description
Object to processing based on legitimate interests, or withdraw consent for marketing – we will stop unless we have compelling overriding grounds.
6
Right
Right to data portability
Description
Receive your data in a structured, commonly used, machine readable format and transfer it to another controller.
7
Right
Right to object to automated processing
Description
Object to decisions based solely on automated processing (including profiling) that produce legal or similarly significant effects – AvaronX does not perform such automated decision making on this company website.
9. How to Exercise Your Rights – Contact Details
To exercise any of your rights under UAE PDPL, please contact our Data Protection Officer (DPO) or our privacy team:
AvaronX Privacy Team / DPO
Email: privacy@avaronx.com
Website: avaronx.com
When you submit a request, we will:
Verify your identity (to protect your data from unauthorised access).
Respond within 30 days (extendable by two months for complex requests, with notice).
Provide the requested information or action free of charge, unless your request is manifestly unfounded or excessive (in which case a reasonable fee may apply).
You may also unsubscribe from marketing emails instantly by clicking the “unsubscribe” link at the bottom of any promotional email we send.
If you are dissatisfied with our response, you have the right to lodge a complaint with the UAE Data Office (the supervisory authority under PDPL).
4. How We Collect Your Data
Collection Method
Directly from you
Automatically
Via third parties
Description
When you fill out a contact or inquiry form, send an email to our support team, or subscribe to our newsletter.
Via cookies, web beacons, and server logs (IP address, browser type, device identifiers, operating system, pages visited, session duration, referring URLs).
If you choose to authenticate using a third party service (e.g., social media login for any interactive feature) – those providers may share your verified email address or public name, subject to your privacy controls with that provider.
5. Data Retention Periods and Criteria
We retain your personal data only as long as necessary for the purposes set out above.
Data Category
Contact and inquiry data
Marketing data (email for newsletters)
Technical and usage data (IP addresses, analytics)
Retention Criteria
Retained for the duration of the correspondence + up to 1 year thereafter for reference and legal protection, unless a longer retention is required by UAE law.
Until you withdraw consent (unsubscribe) + a short administrative period to honour your opt out.
Aggregated or anonymised where possible; raw logs retained for a shorter period (e.g., 6–12 months) for security analysis, unless needed longer for legal compliance.
When data is no longer needed, we securely delete or anonymise it.
6. Processors, Third Parties, and Recipients (Including Government Entities)
We do not sell, rent, or trade your personal data. We share data only in the following circumstances:
Recipient Category
Service Providers (Processors)
Business Transferees
Government Entities / Public Authorities
Legal obligation (Article 13(1)(c) PDPL)
Examples
Cloud hosting providers, email delivery services (e.g., for newsletters), analytics providers (e.g., Google Analytics)
Merger, acquisition, reorganisation, asset sale counterparties
Law enforcement, courts, regulators (UAE or other jurisdictions)
Purpose
Perform essential functions on our behalf (hosting, email, website analytics)
Transfer of user data as part of the transaction
Comply with subpoenas, court orders, similar governmental requests, or protect rights, property, safety
Legal Basis for Sharing (UAE PDPL)
Contract with processor requiring confidentiality and security (Article 22 of PDPL)
Legitimate interest – with prior notice to you
Legitimate interest – with prior notice to you
7. Cross Border Data Transfers (International Transfers)
AvaronX may operate using global infrastructure. Your personal data may be transferred to and processed in countries outside the United Arab Emirates.
Under UAE PDPL, we ensure appropriate safeguards are in place:
Transfer Mechanism
Adequacy decision
Standard Contractual Clauses (SCCs)
Exemptions (where applicable)
Description
If we transfer data to a country that the UAE has recognised as having adequate data protection laws, we rely on that decision.
For transfers to countries without an adequacy decision, we use approved contractual clauses that impose UAE-equivalent obligations on the recipient.
In limited cases (e.g., with your explicit consent, or for performance of a contract with you), we may rely on PDPL exemptions.
You may request a copy of the safeguards used (e.g., SCCs) by contacting us at the details below.
8. Your Rights as a Data Subject Under UAE PDPL
Under Federal Decree‑Law No. 45/2021, you have the following rights, subject to certain legal exceptions:
Right
Right to access
Right to correction
Right to erasure (“right to be forgotten”)
Right to restrict processing
Right to stop processing
Right to data portability
Right to object to automated processing
Description
Obtain confirmation of whether we process your personal data and receive a copy of that data.
Rectify inaccurate or incomplete personal data.
Request deletion of your data where there is no legal obligation to retain it.
Temporarily limit how we use your data (e.g., while a correction request is pending).
Object to processing based on legitimate interests, or withdraw consent for marketing – we will stop unless we have compelling overriding grounds.
Receive your data in a structured, commonly used, machine readable format and transfer it to another controller.
Object to decisions based solely on automated processing (including profiling) that produce legal or similarly significant effects – AvaronX does not perform such automated decision making on this company website.
9. How to Exercise Your Rights – Contact Details
To exercise any of your rights under UAE PDPL, please contact our Data Protection Officer (DPO) or our privacy team:
AvaronX Privacy Team / DPO
Email: privacy@avaronx.com
Website: avaronx.com
When you submit a request, we will:
• Verify your identity (to protect your data from unauthorised access).
• Respond within 30 days (extendable by two months for complex requests, with notice).
Provide the requested information or action free of charge, unless your request is manifestly unfounded or excessive (in which case a reasonable fee may apply).
You may also unsubscribe from marketing emails instantly by clicking the “unsubscribe” link at the bottom of any promotional email we send.
If you are dissatisfied with our response, you have the right to lodge a complaint with the UAE Data Office (the supervisory authority under PDPL).
4.6
Financial Services
We establish rigorous oversight for high-impact financial operations by identifying the specific entities—whether human operators or automated scripts—capable of initiating significant transactions. Our framework ensures that every action is not only governed by strict authorization protocols and monitored in real-time but is also architected for reversibility. This minimizes the blast radius of unauthorized or erroneous movements, ensuring that financial integrity is maintained even in the event of a breach.
Maritime
Our maritime security focus centers on the vulnerability of remote vessel control systems and the critical bridge between IT and Operational Technology (OT). We conduct deep-dive assessments to identify who can gain access to bridge systems or engine room controls and, more importantly, we quantify the "time-to-disruption." By understanding how quickly a system can be compromised and manipulated, we help operators implement defensive layers that prevent kinetic impact and maintain the safety of the vessel at sea.
Smart Estate
In the realm of smart estates, we govern the sophisticated digital systems where software commands translate directly into physical environmental changes. This involves securing the command-and-control architecture of integrated hardware to ensure that unauthorized access cannot manipulate physical security, climate systems, or infrastructure. We bridge the gap between cybersecurity and physical safety, ensuring that the digital interface of a luxury or high-stakes estate remains a controlled, protected environment.
CONTACT US
If you have any questions or concerns regarding this Privacy Policy or our data handling practices, please direct your inquiry to:
AvaronX Privacy Team
Email: info@avaronx.com
This Data Processing Notice explains how AvaronX processes your personal data when you visit our company website, why we process it, and what rights you have under UAE law. This notice supplements our Privacy Policy and is directed to individuals in the United Arab Emirates.