Privacy

Introduction

Nuva Resources is committed to protecting your personal information. This Privacy Policy explains what data we collect, how we use it, and the choices you have when you visit NUVAResources.com.

This Privacy Policy is governed by the laws of the United Arab Emirates and, in particular, by Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data Protection (the "PDPL") and its Executive Regulations, together with other applicable UAE legislation including Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes. References in this policy to "personal data", "processing", "controller", "processor" and "data subject" have the meanings given to them under the PDPL.

Regulatory framework

As a company established in the United Arab Emirates, NUVA FZCo acts as a controller of personal data within the meaning of the PDPL and is subject to the oversight of the competent supervisory authority, the UAE Data Office. Where the Executive Regulations to the PDPL impose further obligations on controllers and processors — including registration, impact assessments or certification requirements — we will implement those obligations as and when they enter into force.

Information we collect

We may collect information you provide directly, such as your name, email address, phone number, company name, job title, country and other company details when you contact us, request information, subscribe to updates or register for member services. We also collect records of your correspondence with us, including the content and metadata of emails and messages you send, and any preferences or consents you express.

We collect technical and usage data automatically as you interact with the Site, including your IP address, unique device identifiers, browser type and version, operating system, device characteristics and settings, language preferences, referring and exit URLs, pages viewed, links clicked, features used, time spent on pages, dates and times of your visits, approximate geographic location derived from your IP address, and other diagnostic and log data. This data may be collected through cookies, log files, analytics tools and similar technologies described below.

We may also combine information collected through the Site with information obtained from other sources, such as publicly available sources, business partners or service providers, where permitted by applicable law.

How we use your information

We use your information to respond to enquiries, provide access to member services, improve the Site, understand how visitors use our pages, and comply with legal or regulatory obligations. We do not sell personal information to third parties.

Cookies and similar technologies

We and our service providers use cookies, pixels, web beacons, SDKs, server log files and similar technologies (collectively, "cookies") to operate the Site, remember your preferences, measure and analyse traffic, detect and prevent fraud and security incidents, and improve your experience. A cookie is a small text file placed on your device when you visit a website; web beacons and pixels are small code snippets that allow us to know whether a page or email has been viewed.

We use the following categories of cookies:

Strictly necessary cookies. These cookies are essential for the operation of the Site and to enable core functionality such as security, network management, load balancing and accessibility. Because the Site cannot function properly without them, they do not require your consent and cannot be switched off in our systems.

Functional and preference cookies. These cookies allow the Site to remember choices you make — such as your language or region — and provide enhanced, more personal features. They may be set by us or by third-party providers whose services we have added to our pages.

Analytics and performance cookies. These cookies collect information about how visitors use the Site, including which pages are visited most often, whether visitors receive error messages, and how they arrived at the Site. We use this information to improve how the Site works. These cookies collect aggregated, statistical information and, where possible, IP addresses and identifiers are truncated or masked.

Through these technologies we and our service providers may collect and process information including your IP address, unique device or advertising identifiers, browser and device characteristics, referring URLs, pages and content viewed, interactions with the Site, approximate location derived from your IP address, timestamps of visits, and other usage and diagnostic data. Some of this data may be linked with other information we hold about you where you have an account or have otherwise interacted with us.

Legal basis. Where required by applicable law — in particular under the PDPL — we place non-essential cookies only with your consent, which you may withdraw at any time through your browser settings or by contacting us. We rely on strictly necessary cookies on the basis of our legitimate interest in operating a secure and functional website. Where we process personal data collected through cookies for analytics purposes, we do so on the basis of your consent or, where consent is not required, our legitimate interest in measuring and improving the performance of the Site, subject always to your right to object under the PDPL.

Third-party cookies. Some cookies on the Site are set by third parties, such as analytics or hosting providers acting on our behalf. These third parties may process data collected through cookies outside your country of residence, including the United Arab Emirates, subject to appropriate safeguards. We do not control third-party cookies; their use is governed by the respective third party's own privacy policy. At present, we do not use cookies for advertising or cross-site tracking, and we do not sell personal information collected through cookies.

Retention. Session cookies expire when you close your browser. Persistent cookies remain on your device for the period necessary to fulfil their purpose, or until they reach their expiry date or you delete them, whichever occurs first. Information collected through cookies is retained only for as long as necessary for the purposes described in this policy.

Managing cookies. Most browsers allow you to refuse or delete cookies through their settings. If you choose to block or delete cookies, some features of the Site may not function properly and your experience may be affected. By continuing to use the Site after this policy takes effect, you consent to our use of cookies in accordance with this policy, except for non-essential cookies where your prior consent is required by law. Your browser may transmit a "Do Not Track" signal; because there is no consistent industry standard for responding to such signals, the Site does not currently respond to them, and you should manage cookies through your browser settings as described above.

Data sharing

We may share personal information with trusted service providers who help us operate the Site and deliver services, provided they handle data only on our behalf and under appropriate confidentiality and security obligations. We may also disclose information where required by law or to protect our rights.

International transfers

Your information may be transferred to and processed in countries outside your country of residence, including the United Arab Emirates. In accordance with the PDPL, personal data is only transferred outside the UAE where an adequate level of protection is assured in the destination country, or where appropriate safeguards are in place — such as contractual clauses, binding corporate rules or the explicit consent of the data subject — and the transfer does not breach public order or the morals of the UAE. We take appropriate measures to ensure that any international transfers comply with applicable data protection laws.

Data retention

We keep personal information only for as long as necessary to fulfil the purposes for which it was collected, to meet legal or regulatory requirements, or to resolve disputes.

Identity Verification & Data Protection (GDPR & AML Compliance)

Purpose and Data Controller. To comply with statutory Anti-Money Laundering (AML), Counter-Terrorist Financing (CTF) and Know Your Customer (KYC) obligations, NUVA FZCo is required to verify the identity of its Members. NUVA FZCo acts as the Data Controller for the personal data processed for this purpose.

Independent verification provider. Identity verification is performed by Sumsub, a specialised provider acting as our Data Processor under a Data Processing Agreement and, where applicable, the EU Standard Contractual Clauses. Sumsub processes your data only on our documented instructions and for no other purpose.

Where your documents are kept. Identity documents, selfie and liveness images, proof of address and AML screening results are submitted directly to Sumsub and stored on its secure, certified infrastructure, primarily within the European Union. These materials are never stored on Nuva Resources' own systems.

What we keep. In line with the principle of data minimisation, we retain only the information necessary to manage your membership: a verification reference, your verification status and outcome, the date of verification, your country and your date of birth.

Security. Your data is protected by industry-standard encryption both in storage and in transit. Our verification provider maintains internationally recognised security certifications, including SOC 2 Type II and ISO/IEC 27001.

Retention. Verification records are retained for the period required by applicable AML legislation, typically five years after the end of the business relationship. During this statutory period, legal retention obligations take precedence over requests for erasure. Thereafter, the records are securely deleted.

Your rights. Subject to applicable law, including the EU General Data Protection Regulation and UAE Federal Decree-Law No. 45 of 2021, you may request access to, correction of, or restriction of your personal data, and lodge a complaint with a competent supervisory authority. Requests may be sent to legal@nuvaresources.com.

Your rights

Under the PDPL, you have the right to access, correct, delete or restrict the use of your personal information, to object to processing, to request a copy of your data in a portable format, and to withdraw any consent previously given — without affecting the lawfulness of processing carried out before such withdrawal. We will respond to your request within the time frame required by the PDPL and its Executive Regulations. You also have the right to lodge a complaint with the UAE Data Office if you believe your rights under the PDPL have been infringed. To exercise these rights, please contact us using the details below.

Changes to this policy

We may update this Privacy Policy from time to time. The revised version will be posted on this page with an updated effective date.

Contact

For questions about this Privacy Policy or how we handle your data, please contact us at legal@nuvaresources.com.