1. Introduction
Swenta Solutions (“Swenta Solutions”, “we”, “us” or “our”) is a technology transformation, consulting, systems integration and implementation company based in the Dubai International Financial Centre (DIFC), Dubai, United Arab Emirates, and part of the Swenta Global group.
We are committed to protecting the privacy and confidentiality of the personal data entrusted to us. We process personal data in accordance with the DIFC Data Protection Law, DIFC Law No. 5 of 2020 (as amended) and its regulations (the “DP Law”), and any other data protection laws that apply to our activities.
This Privacy Policy explains what personal data we collect, how and why we use it, who we share it with, how we protect it and the rights you have. Please read it carefully.
2. Who we are
This Privacy Policy applies to [Swenta Solutions legal entity name], registered in the DIFC under registration number [DIFC registration number], with its registered office at [registered office address], DIFC, Dubai, United Arab Emirates.
For most of the personal data described in this policy, Swenta Solutions is the controller, meaning we decide how and why the data is processed. Where we process personal data on behalf of a client as part of a project, we act as a processor on that client’s instructions (see section 7).
3. What personal data we collect
We collect only the personal data we need to run our business and deliver our services. This typically includes:
- Contact details: name, company, job title, business email address, phone number and business address.
- Enquiry and correspondence details: the information you send us through our website, by email or in meetings, such as your area of interest and the details of your requirement.
- Business relationship details: information needed to set up and manage client, partner and supplier relationships, including contract, billing and payment details for the organisation you represent.
- Event and marketing details: registrations for our events, webinars and training sessions, and your communication preferences.
- Recruitment details: CVs, employment history, qualifications and references if you apply to work with us.
- Technical details: limited information that your device shares when you visit our website, such as IP address, browser type and the pages you view (see section 10).
We do not intend to collect sensitive (special category) personal data through our website or general business activities. If such data is needed for a specific, lawful purpose, for example a project where a client instructs us to process it, we will handle it with additional safeguards as required by the DP Law.
4. How we collect personal data
Directly from you, when you:
- contact us through our website, by email or by phone, or give us your business card;
- register for or attend our events, webinars or training sessions;
- engage us to provide services, or work with us as a partner or supplier;
- apply for a role with us.
From other sources, including:
- public sources such as company registers (including the DIFC public register), regulator websites, news articles and sanctions lists;
- professional networking sites such as LinkedIn, within the limits of your privacy settings;
- other Swenta Global group companies, technology partners and people who refer you to us;
- our clients, where they share personal data with us so that we can deliver a project;
- recruitment agencies and referees, for job applicants.
5. Our lawful bases for processing
We process personal data only where the DP Law allows us to. Depending on the situation, we rely on one or more of the following:
- Contract: the processing is needed to enter into or perform a contract with you or the organisation you represent.
- Legitimate interests: the processing is needed for our legitimate business interests, such as responding to enquiries, managing client and partner relationships, marketing our services to business contacts and keeping our systems secure, and those interests are not overridden by your rights.
- Legal obligation: the processing is needed to comply with laws and regulations that apply to us, including anti-money laundering, sanctions and record-keeping requirements.
- Consent: where you have given consent for a specific purpose. You can withdraw your consent at any time.
- Vital interests: in rare cases, to protect someone’s life or physical safety.
6. Why we use personal data
We use personal data to:
- respond to your enquiries and prepare proposals;
- deliver our services, including advisory, technology transformation, AI, data, systems integration, cybersecurity, payments and digital product services, and managed services;
- manage our relationships with clients, technology partners and suppliers;
- register and coordinate opportunities with technology partners where we act as a reseller, System Integrator, implementation partner or Managed Service Provider;
- send you insights, event invitations and information about our services that are relevant to you as a business contact, which you can opt out of at any time;
- run events, webinars and training sessions;
- recruit and assess candidates;
- operate, secure and improve our website and IT systems;
- carry out client due diligence and comply with our legal and regulatory obligations;
- establish, exercise or defend legal claims.
7. Personal data we process for our clients
When delivering projects, such as systems integration, data migration, AI implementation or managed services, we may have access to personal data held in our clients’ systems. In these cases we act as a processor. We process that data only on our client’s documented instructions, under a written agreement, and with appropriate confidentiality and security measures. If your personal data is held by one of our clients, please contact that organisation first about your rights.
8. Who we share personal data with
We share personal data only where needed for the purposes above, and with recipients who are required to protect it. Recipients may include:
- other companies in the Swenta Global group, for administration and service delivery;
- technology partners and vendors, where needed to register, quote for, deliver or support a solution for you or your organisation;
- service providers who support our business, such as IT, cloud hosting, email, collaboration and event management providers;
- professional advisers, such as lawyers, auditors and insurers;
- regulators, courts, law enforcement and other authorities, where required by law;
- a prospective buyer or successor, if our business or part of it is sold or restructured.
We do not sell personal data, and we do not share it with third parties for their own direct marketing.
9. International transfers
As part of an international group working with global technology partners, we may transfer personal data outside the DIFC, including to the United Kingdom, Pakistan, the Kingdom of Saudi Arabia and other countries where our group companies, partners or service providers operate.
We transfer personal data outside the DIFC only where the DP Law permits it: to jurisdictions recognised as providing an adequate level of protection, or with appropriate safeguards in place, such as contractual clauses approved under the DP Law, or where another lawful condition for the transfer applies.
11. Your rights
Under the DP Law, and subject to certain conditions and exemptions, you have the right to:
- Access the personal data we hold about you and receive a copy;
- Rectification of inaccurate or incomplete personal data;
- Erasure of your personal data in certain circumstances;
- Restriction of processing in certain circumstances;
- Data portability, to receive your personal data in a structured, machine-readable format or have it sent to another organisation;
- Object to processing based on our legitimate interests, and to direct marketing at any time;
- Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects for you;
- Withdraw consent at any time, where we rely on consent.
To exercise any of these rights, email hello@swenta.com. We may ask you to verify your identity before responding. We aim to respond within one month of receiving your request, as required by the DP Law.
If you are not satisfied with how we have handled your personal data, you also have the right to lodge a complaint with the DIFC Commissioner of Data Protection.
12. How we protect personal data
As a technology and cybersecurity company, we take security seriously. We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, including access controls, encryption, secure cloud services and staff confidentiality obligations. No transmission over the internet is completely secure, so we cannot guarantee absolute security, but we will notify you and the DIFC Commissioner of Data Protection of a personal data breach where the DP Law requires it.
13. How long we keep personal data
We keep personal data only for as long as we need it for the purposes described in this policy, including to meet legal, regulatory, accounting and reporting requirements and to resolve disputes. In most cases we keep business records for up to seven years after our relationship ends, unless a longer period is required by law. Enquiries that do not lead to a business relationship are kept for a shorter period. When personal data is no longer needed, we securely delete or anonymise it.
14. Children
Our website and services are intended for businesses and professionals. They are not directed at children, and we do not knowingly collect personal data from anyone under 18 through our website.
15. Links to other websites
Our website contains links to other websites, including those of the Swenta Global group and our technology partners. Those websites have their own privacy policies, and we are not responsible for how they handle personal data. Please review their policies before sharing personal data with them.
16. Contact us
If you have any questions about this Privacy Policy or how we handle personal data, please contact us:
- Email: hello@swenta.com
- Post: Data Protection, [Swenta Solutions legal entity name], [registered office address], DIFC, Dubai, United Arab Emirates
17. Changes to this policy
We review this Privacy Policy regularly and will publish any changes on this page. Where changes are significant, we will take reasonable steps to let you know.
This Privacy Policy was last updated on [date].