Acyy L.L.C-FZ

Effective Date: 14 September 2026

Version 1.0

1. Introduction and Scope

This Privacy Policy explains how Acyy L.L.C-FZ (“we”, “us”, “our” or the “Company”), a company established in a free zone of the United Arab Emirates, handles personal data in connection with its website at www.acyy.io (the “Website”).

The Website is a corporate information website. It exists solely to present information about the Company, its history, its mission and vision, its values and its areas of activity. The Website does not sell goods, does not provide any online service, does not host user accounts or memberships, does not process payments, does not operate contact or enquiry forms, and does not collect email addresses or subscriber details.

Because of that limited purpose, the personal data we come into contact with through the Website is minimal. It consists of the technical information that is generated automatically whenever any device connects to any website on the internet, together with the measurement data that would be generated by a website analytics tool if one is activated in the future. This Policy describes that data in full, explains why it exists, and sets out the rights available to you in relation to it.

This Policy applies to the Website only. It does not apply to any other website, platform or application, and it does not apply to personal data that we process outside the Website in the ordinary course of our business, such as data relating to employees, suppliers, counterparties or contractual relationships.

2. Who We Are and How to Contact Us

The Company is the controller of the personal data described in this Policy. That means the Company determines the purposes for which, and the means by which, that data is processed.

Controller: Acyy L.L.C-FZ, Meydan FZ, Dubai, United Arab Emirates.

Privacy contact: [email protected].

We have not appointed a Data Protection Officer, and we are not required to appoint one, because we do not carry out large scale processing of personal data, we do not carry out large scale processing of special categories of personal data, and our core activities do not consist of regular and systematic monitoring of individuals. Privacy enquiries should be addressed to the privacy contact above.

3. The Nature of the Website and What That Means for Your Data

We consider it important to state clearly what the Website does not do, because that is the most accurate description of our data practices.

The Website does not offer any product for sale and does not take orders.

The Website does not offer any service that can be requested, booked, subscribed to or consumed online.

The Website has no registration, login, account or membership function.

The Website does not process payments and does not handle card, bank or financial data.

The Website contains no contact form, enquiry form, quotation request, callback request or application form.

The Website does not collect email addresses, does not operate a newsletter or mailing list, and does not build marketing lists.

The Website does not host user generated content, comments, reviews, uploads or forums.

The Website does not use advertising cookies, retargeting pixels, social media tracking pixels, or cross site advertising identifiers.

The Website does not sell, rent, share or otherwise disclose personal data to third parties for money or for any other valuable consideration, and does not disclose personal data for cross context behavioural advertising.

If any of these positions changes in the future, for example if we add a contact form or begin a mailing list, this Policy will be updated before the new function goes live, and the updated version will be published on the Website.

4. Personal Data We Collect

We collect the following categories of personal data through the Website.

4.1 Technical and connection data. Whenever a browser requests a page, the request itself carries technical information that our hosting provider and our content delivery and security provider receive and log. This includes the internet protocol (IP) address of the connecting device, the date and time of the request, the page or file requested, the HTTP response code, the referring page where one is transmitted by the browser, the browser type and version, the operating system, the device type, and language settings.

4.2 Security and abuse prevention data. Our content delivery and security provider processes connection data in order to distinguish human visitors from automated traffic, to filter malicious requests, and to protect the Website against denial of service attacks and other attacks. This includes short lived identifiers placed for bot management purposes, which are described in the Cookie Policy.

4.3 Website analytics data. Website analytics is not active at the effective date of this Policy. If analytics is activated in the future, and where you consent to analytics cookies, the analytics tool will collect information about how the Website is used. This includes pages viewed, the order in which they are viewed, time spent on pages, approximate geographic location derived from a truncated IP address at country, region or city level, device and browser characteristics, the traffic source that brought you to the Website, and a randomly generated identifier stored in a cookie so that repeat views within a period can be counted as one visitor rather than several. Analytics data would be used in aggregate only. We will not use it to identify individual visitors, and we will not attempt to combine it with any other data set in order to do so.

4.4 Data you choose to send us directly. The Website may display a corporate email address or telephone number. If you choose to contact us using those details, you will be sending us your own name, contact details and whatever information you choose to put in your message. That data is processed for the purpose of answering you. It is not collected by the Website, it is volunteered by you, and you control what it contains.

5. Personal Data We Do Not Collect

We do not knowingly collect, and the Website is not designed to collect, any of the following: government identification numbers or copies of identity documents; payment card numbers, bank account details or other financial account information; precise geolocation data; biometric data; login credentials; or special categories of personal data, meaning data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data processed for the purpose of uniquely identifying a person, data concerning health, or data concerning a person’s sex life or sexual orientation.

We do not create profiles of visitors, we do not carry out automated decision making that produces legal or similarly significant effects, and we do not engage in behavioural advertising.

6. How the Data Is Collected

Personal data reaches us in three ways only.

Automatically, as an unavoidable technical consequence of your device connecting to our hosting infrastructure.

Through cookies and similar technologies placed in your browser, in the manner described in the Cookie Policy, and subject to your consent where consent is required.

Directly from you, if you choose to write to us using a published contact address.

We do not purchase personal data, we do not obtain personal data from data brokers, and we do not enrich the limited data we hold with information from external sources.

7. Purposes of Processing and Legal Bases

Where the General Data Protection Regulation (Regulation (EU) 2016/679) or the United Kingdom General Data Protection Regulation applies to our processing, we rely on the legal bases set out below. Where those regulations do not apply, the same purposes describe what we do with the data and the same limits apply to it.

7.1 Delivering the Website. We process technical and connection data in order to transmit the pages you request to your device and to render them correctly. Legal basis: our legitimate interests in operating a functioning corporate website, and, in relation to the strictly necessary data flows involved, the technical necessity of transmitting a communication over an electronic communications network.

7.2 Security, integrity and abuse prevention. We process connection and security data to protect the Website and our infrastructure against attack, intrusion, automated abuse and fraud. Legal basis: our legitimate interests in securing our systems, and compliance with our obligation to implement appropriate technical and organisational security measures.

7.3 Website analytics and improvement. This purpose applies only if and when website analytics is activated. If it is, we will process analytics data to understand which pages are read, how visitors navigate the Website, and where the Website can be improved. Legal basis: your consent, given through the cookie banner. Where consent is refused or withdrawn, analytics cookies are not set and this processing does not occur.

7.4 Responding to correspondence. Where you write to us, we process your message and contact details in order to reply and to keep a record of the exchange. Legal basis: our legitimate interests in responding to persons who contact us, and, where the correspondence concerns a possible contract, steps taken at your request prior to entering into a contract.

7.5 Legal and regulatory compliance. We process data where necessary to comply with applicable law, to respond to lawful requests from competent authorities, and to establish, exercise or defend legal claims. Legal basis: compliance with a legal obligation, and our legitimate interests in defending our legal position.

8. Cookies and Similar Technologies

The Website uses a small number of cookies. At the effective date of this Policy these are strictly necessary cookies only, meaning cookies required for security, load balancing and correct delivery of the Website, which are set without consent because the Website cannot be delivered safely without them. If website analytics is activated in the future, analytics cookies will be added, and they will be set only if you give consent through the cookie banner.

No advertising, marketing, retargeting or social media cookies are used. Full details of each cookie, its provider, its purpose and its duration are set out in our Cookie Policy, which forms part of this Policy.

9. Website Analytics

No website analytics tool is active on the Website at the effective date of this Policy. We may activate Google Analytics, a website analytics service provided by Google, at a later date. Google Analytics uses cookies and similar identifiers to generate statistical reports about visitor numbers, page popularity, traffic sources and general usage patterns.

If and when Google Analytics is activated, the following limits will apply to our use of it, and this Policy will be updated to record that it is in use before any analytics cookie is set.

Analytics cookies will be set only after consent is given through the cookie banner, and will not be set where consent is refused or withdrawn.

IP addresses will not be stored in full within the analytics reporting; the IP address will be truncated or otherwise masked so that location is derived only at an approximate level.

We will not enable advertising features, audience remarketing, or advertising personalisation within the analytics configuration.

We will not upload or attach any identifying information, such as names or email addresses, to analytics data.

We will not use analytics data to make decisions about individuals.

Where activated, Google processes analytics data as our processor under its data processing terms, and also processes certain data for its own limited purposes such as maintaining and improving the service, in the manner described in Google’s own privacy documentation. Google may transfer and store that data on servers located outside the country from which you access the Website, including in the United States. Section 12 explains the safeguards applied to such transfers.

If analytics is activated, you can prevent analytics processing at any time by declining or withdrawing consent in the cookie banner, by blocking or deleting cookies in your browser, or by installing the browser add on published by Google to opt out of Google Analytics.

10. Hosting, Content Delivery and Security Infrastructure

The Website is hosted on a managed WordPress hosting plan provided by EasyWP, a service of Namecheap. Traffic to the Website is routed through Cloudflare, which provides content delivery, caching, and security and bot management services.

Both providers process connection data on our behalf in order to deliver and protect the Website. Both maintain server and security logs which contain IP addresses and request data. These providers act as processors, are bound by contractual terms governing their processing, and are not permitted to use the data for their own independent marketing purposes.

If the Website is built on the WordPress platform, WordPress may set a small number of technical cookies in relation to administrative logins. Those cookies are relevant only to authorised administrators of the Website and are not set for ordinary visitors.

11. Disclosure of Personal Data

We do not sell personal data and we do not share personal data for advertising purposes. We disclose the limited personal data described in this Policy only in the following circumstances.

To service providers acting as our processors, namely our hosting provider, our content delivery and security provider, our analytics provider if and when analytics is activated, and, where relevant, technical contractors maintaining the Website. Each is permitted to process the data only on our documented instructions and only for the purpose of providing the service to us.

To professional advisers, including lawyers, auditors and insurers, where necessary for the provision of professional services to us.

To competent courts, regulators, law enforcement agencies or governmental authorities, where disclosure is required by applicable law or is necessary to establish, exercise or defend legal claims.

To a purchaser or prospective purchaser in connection with a merger, acquisition, reorganisation or sale of assets, in which case the recipient will be bound to treat the data in accordance with this Policy.

12. International Transfers of Personal Data

We are established in the United Arab Emirates. Our hosting, content delivery and, if activated, analytics providers operate global infrastructure. As a result, personal data described in this Policy may be transmitted to, stored in or accessed from countries other than the country in which you are located, including the United Arab Emirates, the European Economic Area, the United Kingdom and the United States.

Where personal data protected by the General Data Protection Regulation or the United Kingdom General Data Protection Regulation is transferred to a country that has not been recognised as providing an adequate level of protection, the transfer is made on the basis of an appropriate safeguard, which in practice means the Standard Contractual Clauses approved by the European Commission, the United Kingdom International Data Transfer Addendum where applicable, and, in the case of certified recipients in the United States, certification under the applicable data privacy framework. Our providers incorporate these mechanisms into their standard terms.

Where personal data is transferred out of the United Arab Emirates, the transfer is made in accordance with the transfer conditions in applicable United Arab Emirates data protection legislation, which permit transfers to jurisdictions with an adequate level of protection and, in other cases, transfers made subject to appropriate contractual safeguards or with the consent of the data subject.

You may request further information about the safeguards applied to a particular transfer by writing to the privacy contact in Section 2.

13. Retention

We keep personal data only for as long as it serves the purpose for which it was collected.

Hosting and security logs are retained for the period applied by the relevant provider, which is typically a short rolling window measured in days or weeks, after which they are deleted or overwritten in the ordinary course.

Analytics data, if and when analytics is activated, is retained in accordance with the retention setting configured in the analytics account, after which visitor and event level data is deleted automatically. Aggregate statistical reports that contain no identifiers may be retained for longer.

Correspondence you send to us is retained for as long as needed to deal with the matter and thereafter for the period required by our record keeping obligations and applicable limitation periods.

Where we are required by law to retain data for a longer period, or where data is relevant to an actual or anticipated legal claim, we retain it for that longer period and process it only for that purpose.

14. Security

We take appropriate technical and organisational measures to protect the limited personal data we hold. These include encryption of traffic in transit through HTTPS with a valid certificate, a web application firewall and bot management at the network edge, platform level patching and updates applied by our managed hosting provider, restricted administrative access to the Website, and use of reputable providers who maintain recognised security programmes.

No transmission over the internet and no storage system can be guaranteed to be completely secure. We do not claim that our measures are impenetrable. We do commit to maintaining measures appropriate to the risk, which in the case of a purely informational website with no accounts and no financial data is a low risk, and to notifying affected persons and competent authorities of a personal data breach where applicable law requires us to do so.

15. Your Rights Under European and United Kingdom Data Protection Law

If the General Data Protection Regulation or the United Kingdom General Data Protection Regulation applies to the processing of your personal data, you have the following rights.

Access. The right to obtain confirmation of whether we process your personal data and, if so, a copy of it together with information about the processing.

Rectification. The right to have inaccurate personal data corrected and incomplete data completed.

Erasure. The right to have personal data deleted where it is no longer necessary, where consent is withdrawn and no other basis applies, where you object and there is no overriding ground, or where it has been processed unlawfully.

Restriction. The right to have processing restricted in defined circumstances, including while the accuracy of data or the merits of an objection are being verified.

Objection. The right to object at any time, on grounds relating to your particular situation, to processing carried out on the basis of legitimate interests.

Portability. The right, where processing is based on consent or contract and is carried out by automated means, to receive the data in a structured, commonly used and machine readable format and to have it transmitted to another controller where technically feasible.

Withdrawal of consent. The right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

Complaint. The right to lodge a complaint with a supervisory authority, in particular in the country of your habitual residence, place of work or the place of the alleged infringement.

A practical point should be noted. Log entries, and any analytics identifiers if analytics is activated, are not linked to your name, and in most cases we have no means of connecting a request from you to a specific record without additional information from you. Where we cannot identify you within the data we hold, we are not required to acquire further information for the sole purpose of complying with a request, and we will tell you so. If you can supply information that allows the relevant records to be located, for example the approximate date and time of your visit together with the value of the analytics cookie stored in your browser, we will act on it.

16. Your Rights Under California Law

If you are a resident of California, the California Consumer Privacy Act as amended by the California Privacy Rights Act may give you the rights set out below. We extend these rights to California residents as a matter of policy whether or not we meet the statutory thresholds for a covered business.

The right to know the categories and specific pieces of personal information collected, the categories of sources, the business purposes for collection, and the categories of third parties to whom it is disclosed.

The right to delete personal information we have collected from you, subject to statutory exceptions.

The right to correct inaccurate personal information.

The right to opt out of the sale or sharing of personal information.

The right to limit the use and disclosure of sensitive personal information.

The right not to be subject to discrimination for exercising any of these rights.

In the twelve months preceding the effective date of this Policy, and on an ongoing basis, the only categories of personal information we collect through the Website are identifiers in the form of IP addresses and cookie identifiers, and internet or other electronic network activity information in the form of browsing and page interaction data. We collect these from you directly and automatically through your interaction with the Website and through our service providers. We collect them for the business purposes of delivering the Website, securing it, and measuring its use.

We do not sell personal information and have not sold personal information. We do not share personal information for cross context behavioural advertising and have not done so. We do not collect sensitive personal information. We do not use or disclose personal information for purposes other than those disclosed in this Policy. We do not offer financial incentives in exchange for personal information.

Analytics cookies, if and when analytics is activated, are set only with your consent, so declining the cookie banner already prevents the relevant processing. We also treat the Global Privacy Control signal transmitted by a browser or extension as a valid opt out request in relation to the Website.

To exercise a right, write to the privacy contact in Section 2. We will verify your request to a degree of certainty appropriate to the sensitivity of the data and the nature of the request. An authorised agent may submit a request on your behalf on provision of written authorisation.

17. Your Rights Under United Arab Emirates Data Protection Law

The Company is established in a free zone of the United Arab Emirates. Depending on the free zone in which the Company is licensed, either the federal personal data protection regime or the data protection regime of the relevant free zone will apply to our processing.

Under those regimes, individuals generally have rights to obtain information about the processing of their personal data, to request access to that data, to request correction of inaccurate data, to request erasure, to restrict or object to processing in defined circumstances, to request data portability where processing is automated and based on consent or contract, to withdraw consent, and to complain to the competent supervisory authority. Where any of those rights is available to you, we will honour it in the same manner as the equivalent right described in Section 15.

Requests should be sent to the privacy contact in Section 2 and will be answered within the period prescribed by applicable law.

18. Individuals in Other Jurisdictions

The Website is accessible worldwide. Where the law of your country of residence gives you rights in relation to your personal data that are equivalent to those described above, including under Canadian, Brazilian, Swiss, Australian, Gulf Cooperation Council or other applicable privacy legislation, we will give effect to those rights on request. Nothing in this Policy limits any right you have under mandatory law that cannot be excluded or restricted.

19. Children

The Website is a corporate information website intended for a general adult audience, in particular business contacts, counterparties, partners, jobseekers and members of the public with an interest in the Company. It is not directed at children, it contains no content designed to appeal to children, and it has no registration function through which a child could submit personal data.

We do not knowingly collect personal data from children. If you believe that a child has sent us personal data, please write to the privacy contact in Section 2 and we will delete it.

20. Third Party Links

The Website may contain links to third party websites, including social media profiles operated by the Company. Following such a link takes you to a service that we do not control and that operates under its own terms and its own privacy policy. We are not responsible for the content of those services or for the way they handle personal data. We encourage you to read the privacy policy of any website you visit through a link on the Website.

21. Changes to This Policy

We may update this Policy from time to time, in particular where the Website changes, where our providers change, or where the law changes. The current version is always published on the Website and is identified by the effective date at the top of the document. Where a change is material, we will take reasonable steps to bring it to the attention of visitors, for example through a notice on the Website. Where a change requires consent under applicable law, we will obtain that consent before the change takes effect.

22. Contact and Complaints

Questions, requests and complaints relating to this Policy or to our handling of personal data should be addressed in the first instance to [email protected]. We will acknowledge your communication and respond within the period required by applicable law.

If you are not satisfied with our response, you may complain to the supervisory authority competent for you. If you are in the European Economic Area or the United Kingdom, that is the data protection authority of your country of residence, place of work or the place where the issue arose. If you are in the United Arab Emirates, that is the competent authority under the applicable federal or free zone data protection regime.