Last updated: 13 October 2026. This policy explains how BSS Tech World handles personal data collected through our websites, events, sales, partner and investor activities. We do not sell personal data.
1. Who we are. BSS Tech World FZCO, Dubai Digital Park, Dubai Silicon Oasis, Dubai, UAE, is the controller of the data described here. Data Protection Officer: dpo@bstech.world .
2. Our platform vs. our website. When banks and lenders use our platform, they decide what borrower data is processed and why: they are the controller and we are their processor under a Data Processing Addendum. Credit decisions, including any automated decisions about borrowers, are made by our clients under their own privacy notices. Borrowers should contact their bank or lender first.
3. Data we collect.
- Information you give us: name, job title, organisation, business email, phone, country and message when you book a demo, request documents, apply as a partner or for a job, request investor materials or contact us.
- Automatically collected data: IP address, approximate location (country), browser and device type, pages visited and referring site, through cookies as described in our Cookie Policy.
- Information from others: business contact details from reseller partners, event organisers and public professional sources.
The website does not ask for sensitive data such as health, religion or biometric information; please do not send it.
4. How we use it and our legal bases.
| Purpose | Legal basis |
|---|---|
| Respond to enquiries, arrange demos, prepare proposals | Steps before a contract; legitimate interests |
| Send product news and event invitations | Consent, or legitimate interests where the law allows; opt out anytime |
| Operate, secure and improve the websites | Legitimate interests; consent for non-essential cookies |
| Manage partner and investor relationships | Contract; legitimate interests |
| Recruitment (see Candidate Privacy Notice) | Steps before a contract; legitimate interests |
| Comply with law and protect our rights | Legal obligation; legitimate interests |
5. Sharing. With group companies and delivery centres; authorised reseller partners in your region; service providers listed on our Sub-processor List under contracts that protect your data; professional advisers; and authorities where the law requires.
6. International transfers. Your data may be processed outside your country. We use safeguards required by law: EU Standard Contractual Clauses and the UK Addendum for European data; transfer conditions and safeguards under the UAE PDPL; and, for data from Saudi Arabia, the transfer rules of the KSA Personal Data Protection Law and its regulations. Where a regulator requires data to stay in-country, we host it there.
7. Retention. Enquiry and prospect data: 24 months after last contact. Contract records: contract term plus the period the law requires. Job applications: see Candidate Privacy Notice. Analytics: up to 14 months.
8. Security. Encryption in transit and at rest, role-based access, logging and monitoring, regular security testing, and staff confidentiality duties. If a breach affects your data, we notify you and regulators where the law requires. We use Cloudflare Turnstile to protect our forms from spam and abuse. Cloudflare's processing of data for this purpose is described in the Turnstile Privacy Addendum.
9. Your rights. Depending on where you live, you may access, correct, delete, restrict or object to our use of your data, receive a portable copy, and withdraw consent at any time. These rights come from laws including UAE Federal Decree-Law No. 45 of 2021, the KSA Personal Data Protection Law, the EU and UK GDPR, and the California Consumer Privacy Act as amended by the CPRA. California and other US residents may opt out of the "sharing" of personal data for cross-context advertising through Cookie settings; we honour Global Privacy Control signals. Email privacy@bstech.world to use any right; we may verify your identity and will reply within the time the law sets. You may also complain to your data-protection authority.
10. Children. Our websites are for business audiences and not directed at anyone under 18.
11. Changes. The date at the top shows the current version; significant changes are highlighted on this page.
12. Contact. BSS Tech World FZCO — Data Protection, Dubai Digital Park, Dubai Silicon Oasis, Dubai, UAE · privacy@bstech.world