Privacy Policy

1. About this policy

This Privacy Policy explains how WXTECH SOFTWARE SOLUTIONS - FZCO ("WxTrade", "we", "us" or "our") collects, uses, discloses and protects personal data. "Personal data" means any information relating to you that can identify you, directly or indirectly, such as your name, email address, IP address or a cookie identifier.

This policy applies when you:

• visit www.wxtrade.com (the "Website");
• send us an enquiry or ask for a demo;
• sign up for our blog updates; or
• deal with us as a business contact, for example as a representative of a brokerage or a partner company.

We are the data controller for this personal data. The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the "UAE PDPL") applies to how we handle it. If you are in the European Economic Area (EEA) or the United Kingdom, the EU General Data Protection Regulation or the UK General Data Protection Regulation (together, the "GDPR") also applies, to the extent that it applies to how we handle your personal data. This policy gives you the information that applicable law requires: the personal data we process, why we process it, who we share it with inside and outside the United Arab Emirates, how we protect it when it is transferred, how long we keep it, and your rights.

This policy does not cover personal data that we process on behalf of our clients through the WxTrade platform. Our clients control that data, and their own privacy notices apply. If you are a client's customer, please contact that client directly.

2. Who we are and how to contact us

• Company: WXTECH SOFTWARE SOLUTIONS - FZCO
• Address: DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates
• Email: [email protected]

3. The personal data we collect

3.1 Information you give us

• Enquiries through our Contact Us form: your name, email address, company name, company website, the service you are interested in (such as Client Portal, CRM, Client Portal and CRM integration, or a platform demo), and if you choose, your country and another way to reach you (LinkedIn profile, phone number or Telegram username).
• Blog sign-ups: your email address and the address of the page where you signed up.
• Correspondence: the content of the emails and other messages you send us, and the contact details they contain.

No law or contract requires you to give us personal data. Fields marked as required are needed for us to respond; if you leave them empty, we cannot process your enquiry or sign-up. All other fields are optional.

3.2 Information we collect automatically

• Technical information: IP address, browser and device type, operating system, language settings, approximate location derived from your IP address, the referring page, and the date and time of your visit.
• Traffic statistics: the number of visits and the pages you visit, collected from the requests your browser makes.
• Analytics information, only if you accept analytics: how you use the Website, such as the pages you view and how you arrived, recorded by Google Analytics.
• Session recordings, only if you accept them: clicks, scrolling and mouse movements, recorded by Microsoft Clarity to create heatmaps and session recordings. Microsoft Clarity masks what you type into our forms, so it is not recorded.
• Form information: the address of the page from which you sent a form.
• Cookie choices: a random consent ID, your choice, the banner version, and the date and time you made it.

Our Cookie Policy explains the cookies we use.

3.3 Information from other sources

We may receive business contact details (name, job title, company, work email address, work phone number and professional profile) from public professional profiles (such as LinkedIn) and company websites where you have published your work contact details, or where you have agreed that we may contact you. When we collect your details in this way, we tell you where we got them and link to this policy no later than our first message to you, and in any case within one month (Article 14(3)(a) of the GDPR, for people in the EEA and the UK).

3.4 Sensitive personal data

We do not ask for sensitive personal data, such as information about racial or ethnic origin, political opinions, religious or philosophical beliefs, health, biometric data or criminal records. Please do not include it in your messages.

4. How we use personal data and our legal bases

In some countries, the law requires us to have a legal reason, known as a "legal basis", to use your personal data. The legal basis we rely on depends on the purpose and on the applicable law. The table below sets out what we do, the personal data we use, and the legal basis for each activity under the UAE PDPL and, if it applies to you, the GDPR.

We count visits and produce statistics about how the Website is used only if you accept analytics through your cookie settings. Under the UAE PDPL and, if it applies to you, the GDPR, we rely on your consent for this processing.

We also process technical information, including IP addresses, to deliver the Website, keep it and our forms secure, and prevent spam and misuse. These activities are necessary for the Website to work, apply to all visitors, and help us meet our duty under the UAE PDPL to keep personal data secure. If the GDPR applies to you, we rely on our legitimate interests in keeping the Website secure.

When you make a choice in our cookie banner, we keep a record of it so that we can respect your choice and show that we asked for your consent. Under the UAE PDPL and, if it applies to you, the GDPR, we rely on your consent, given when you make your choice.

The UAE PDPL applies to all the processing described in this policy. The GDPR basis applies only if the GDPR applies to you. We rely on legitimate interests only under the GDPR, and only where your rights do not override them.

Consent. Where we rely on consent, you can withdraw it at any time, as easily as you gave it, through the unsubscribe link in our emails, the "Cookie Settings" link at the bottom of every page, or by emailing [email protected]. If you withdraw consent, we stop the processing that relied on it: we stop sending you updates, stop the analytics or session recordings you withdrew from and delete the related cookies stored under our domain, or stop handling your enquiry, as applicable. Withdrawing consent to updates, analytics or session recordings does not affect how we handle your enquiries, and no withdrawal affects the lawfulness of processing carried out before you withdrew.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

5. How we share personal data

We do not sell your personal data. We share personal data only with the following recipients.

• Our team: staff who handle sales, client support and marketing, on a need-to-know basis.
• Service providers that process personal data on our behalf, only on our instructions and under contracts that require them to protect it:
  • companies that provide sales, client support, technical and administrative services to us;
  • website hosting and content management providers;
  • our content delivery and security provider, Cloudflare;
  • Google, for website analytics (Google Analytics). Google explains its use of this data in How Google uses information from sites or apps that use our services;
  • providers of email, business communication and customer relationship management tools.
• Microsoft: if you accept session recordings, Microsoft collects personal data from the Website through Microsoft Clarity. Microsoft and we are jointly responsible for collecting this data on the Website and sending it to Microsoft. For this stage, we are responsible for informing you and for asking for your consent, and you can exercise your rights with us or with Microsoft. Microsoft then decides on its own how to use the data, as an independent controller, including to provide Microsoft Advertising and to create user profiles for advertising. You can exercise your rights about that use with Microsoft. See the Microsoft Privacy Statement.
• Messaging platforms and phone providers: if you ask us to contact you through LinkedIn, Telegram or phone, the service you choose handles the conversation under its own privacy policy.
• Professional advisers, such as lawyers and auditors, who are bound by confidentiality.
• Authorities, courts and regulators, where the law requires it or where it is necessary to protect our legal rights.
• A buyer or successor of all or part of our business, in the event of a merger, acquisition or reorganisation.

6. International transfers

We are based in the United Arab Emirates. Members of our team, our service providers, Google and Microsoft may access or process personal data in other countries, including the United States. We protect these transfers as follows:

• Under the UAE PDPL: we transfer personal data outside the United Arab Emirates only in the cases permitted by the UAE PDPL:
  • (a) Countries with adequate protection (Article 22): in the cases approved by the UAE data protection authority, namely where the receiving country has personal data protection legislation that covers the key provisions, measures, controls and rules for protecting the confidentiality and privacy of personal data, allows data subjects to exercise their rights, and allows a regulatory or judicial authority to impose appropriate measures on the controller or processor; or where the United Arab Emirates has a bilateral or multilateral agreement on personal data protection with that country.
  • (b) Other countries (Article 23): where the transfer is covered by a contract that obliges the recipient to protect the data as the UAE PDPL requires (Article 23(1)(a)); where you have given your explicit consent, which we ask for through our cookie banner for analytics and session recordings and which tells you that the data may be processed in the United States (Article 23(1)(b)); where the transfer is necessary to establish, exercise or defend legal claims (Article 23(1)(c)); or where it is necessary for a contract with you, or with a third party in your interest (Article 23(1)(d)).
• If you are in the EEA or the UK: when we share personal data with recipients outside the European Economic Area and the United Kingdom, we use the standard contractual clauses approved by the European Commission, with the UK International Data Transfer Addendum for personal data covered by UK law, where these are in place with the recipient.

Your consent: if you are in a country whose law allows these transfers only with your consent, we rely on the consent you give through our cookie banner for analytics and session recordings. The United States may not protect personal data to the same standard as the law of your country.

To get a copy of the safeguards that apply to your data, email [email protected].

7. How long we keep personal data

We keep personal data only for as long as we need it for the purposes described in this policy. When the purpose has been met, we delete the data or anonymise it so that it can no longer identify you. The general retention periods are:

If you unsubscribe from our emails or object to marketing, we keep your email address and the date of your request for as long as we need them to make sure that we do not contact you again.

At the end of the retention period, we delete or anonymise the data. We keep it for longer only where the law requires it, or where it is needed to establish, exercise or defend legal claims.

8. How we protect personal data

We use technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), access controls that limit personal data to the staff who need it, and spam protection on our forms. These measures follow applicable law. No method of transmission or storage is completely secure. If a personal data breach is likely to affect the privacy, confidentiality or security of your personal data, we will tell the competent authority and you, within the period and in the way that applicable law requires, and explain the steps we have taken.

9. Your rights

Depending on applicable law, you may have the following rights, subject to the conditions and exceptions set out in that law.

(a) Right to information and access: You can ask us, free of charge, which of your personal data we process, why we process it, who we share it with inside and outside the United Arab Emirates, how long we keep it, how we protect it when it is transferred, what we do if it is breached, and how to complain. You can also ask for a copy of your personal data and, where we did not collect it from you, where it came from.

(b) Right to data portability: Where we process your personal data based on your consent or a contract and by automated means, you can ask to receive it in a structured, machine-readable format, or ask us to send it to another organisation where this is technically possible.

(c) Right to correction: You can ask us to correct personal data that is inaccurate, or to complete personal data that is incomplete, without undue delay.

(d) Right to erasure: You can ask us to delete your personal data, for example when we no longer need it, when you withdraw your consent or object, or when we process it unlawfully. We may not be able to delete it where the law requires us to keep it or where it is needed for legal claims or investigations.

(e) Right to restrict processing: You can ask us to restrict the use of your personal data while we check its accuracy, or if we use it in breach of the law or beyond the purposes we told you about. You can also ask us to keep your personal data when you need it to establish or defend legal claims.

(f) Right to object and stop processing: You can object at any time to our use of your personal data for direct marketing, including profiling for direct marketing, and we will stop. You can also object to our use of your personal data for statistics, such as counting visits to the Website, and to any use that does not follow the rules for processing under applicable law. If you are in the EEA or the UK, you can also object, on grounds relating to your situation, to any use based on our legitimate interests; we will then stop, unless we have compelling legitimate grounds or need the data for legal claims. To object, use the unsubscribe link in our emails or email [email protected].

(g) Rights relating to automated decisions: We do not make decisions about you based solely on automated processing. If we did, you could object to them and ask for a person to review them.

(h) Right to withdraw consent: Where we rely on your consent, you can withdraw it at any time, as easily as you gave it (see section 4). Withdrawing consent does not affect processing carried out before you withdrew it.

(i) Right to complain: You can lodge a complaint with the data protection authority in the United Arab Emirates. If you are in the EEA or the UK, you can also complain to a data protection authority there, such as the authority in the country where you live or work, or where the alleged infringement took place (in the UK, the Information Commission at ico.org.uk).

Your rights may be limited by applicable law. For example, we may not be able to give you certain information if it would also reveal personal data about someone else.

How to exercise your rights

To exercise a right, email [email protected]. You can also send a complaint about how we handle your personal data to the same address, or by post to the address in section 2. We acknowledge complaints within 30 days and tell you the outcome without undue delay. We may ask you to verify your identity before we act on your request. We respond without undue delay and within one month of receiving your request, free of charge unless the law permits a fee. If a request is complex, or we receive many requests, we may take up to two further months; in that case, we tell you within the first month and explain why. If we cannot meet a request in full, we will explain why.

10. Marketing emails

We send blog articles and news by email to people who have asked to receive them. We may also email business contacts whose details we receive in the ways described in section 3.3, to introduce our services, but only at a work email address, only where the recipient made those details public or agreed to be contacted by us, and only where the law that applies to the recipient allows it. If your details did not come from you, our first email tells you where we got them and that you can object at any time. Every marketing email includes an unsubscribe link. When you unsubscribe or object, we stop sending you marketing emails straight away, and in any case within 7 days.

11. Cookies

We use strictly necessary cookies to run the Website and, only with your consent, cookies for analytics (Google Analytics) and session recordings (Microsoft Clarity). You can accept each one separately. We do not load Google Analytics or Microsoft Clarity unless you accept them. You can change your choice at any time through the "Cookie Settings" link at the bottom of every page. Our Cookie Policy explains the details.

12. Children

The Website is intended for business users. We do not knowingly collect personal data from minors. If you believe that a minor has given us personal data, please contact us and we will delete it, unless the law requires us to keep it.

13. Third-party websites

The Website links to third-party websites and services, such as our LinkedIn page. If you visit them, they may use cookies and similar technologies under their own privacy policies, which govern how they handle personal data.

14. Changes to this policy

We may update this policy from time to time. The "Last updated" date shows when it last changed. If we make significant changes, we will post a notice on the Website. If we want to use your personal data for a new purpose, we will tell you before we do so and, where the law requires, ask for your consent.