Privacy Policy of Samarkanda Technology

SAMARKANDA TECHNOLOGY FZCO (hereinafter, the “Company”, “we”, or “our”) is committed to respecting and protecting the privacy and personal data of users of its website and of the persons who relate to the Company.

This Privacy Policy explains what personal data we can collect, how and for what purpose we use it, with whom we may share it, how long we keep it, and what rights data subjects may exercise.

The processing of personal data will be carried out in accordance with the data protection regulations applicable to the Company, including, where applicable, the Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data of the United Arab Emirates (UAE PDPL) and its implementing regulations.

Where, due to the nature of the Company’s activities or the location of the interested parties, other data protection regulations are applicable —including, where applicable, Regulation (EU) 2016/679 (GDPR)— the Company will process personal data in accordance with the obligations that apply.

Controller: SAMARKANDA TECHNOLOGY FZCO.

Legal form: Free Zone Company (FZCO).

Authority / Free Zone: International Free Zone Authority (IFZA), Dubai, United Arab Emirates.

License number: 11972.

Registered address: Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates.

Privacy email: legal@samarkanda.tech.

Website: https://www.samarkanda.tech/.

Depending on the relationship you maintain with the Company and the way you use our Website, we may collect different categories of personal data.

These categories may include:

a) Identifying and contact data: name and surname, email address, phone number, company or organization to which you belong, professional position and other contact details provided by you.

b) Information provided voluntarily: information included in contact forms, information requests, communications, inquiries or other fields available on the Website.

c) Data relating to clients or potential clients: information necessary to manage commercial relationships, prepare proposals, provide services or respond to requests.

d) Professional and recruitment data: CVs, professional experience, training, contact details and other information provided when a person submits a candidacy to work or collaborate with the Company.

e) Technical and usage data: IP address, browser type and version, device type, operating system, technical identifiers, pages visited, date and time of access, links used and other information relating to interaction with the Website.

f) Cookies and similar technologies: information obtained through cookies, pixels, identifiers and similar technologies in accordance with our Cookies Policy.

We will not deliberately request personal data that is not reasonably necessary for the purposes described in this Policy.

We may obtain your personal data:

• directly from you when you contact us, complete a form, request information, hire our services, send us your CV or maintain any other communication with the Company;

• automatically when you use our Website, through technologies necessary for its operation and, where legally appropriate, cookies and similar technologies;

• from providers, partners or legitimate sources when necessary to develop our activities and permitted by applicable law.

We may process your personal data for the following purposes, depending on the relationship maintained with you:

5.1. Inquiries and information requests: to receive, manage and respond to the inquiries or requests sent to us through the Website, email, phone or other contact channels.

5.2. Provision of services and commercial relationships: to manage relationships with clients, potential clients, suppliers, collaborators and other professional contacts, including communications, proposals, contracting, provision of services, invoicing and administrative management.

5.3. Operation and security of the Website: to administer and maintain the Website, ensure its security, prevent fraudulent or unlawful uses, diagnose technical problems and improve its operation.

5.4. Analysis and improvement: where permitted, we may analyze Website usage in order to understand its operation and improve our content, products and services. When such activities require consent, they will only be carried out after obtaining the corresponding consent.

5.5. Commercial communications: where legally permitted, we may use your contact details to send information about our products, services, activities or news. When applicable law requires prior consent, such communications will only be sent after obtaining that consent. The interested party may request at any time to stop receiving commercial communications.

5.6. Recruitment processes: when you send us a CV or application, we may use the data provided to manage present or future selection processes compatible with your profile.

5.7. Compliance with legal obligations: we may process personal data when necessary to comply with legal or regulatory obligations, respond to valid requests from competent authorities, exercise or defend legal rights or prevent fraudulent or unlawful activities.

Depending on the circumstances and applicable law, the processing of personal data may be based on, among other legally permitted cases:

• the consent of the data subject;

• the need for processing to take steps at the request of the data subject before entering into a contractual relationship or to manage and execute such relationship;

• compliance with legal or regulatory obligations applicable to the Company;

• the formulation, exercise or defence of claims or rights;

• the protection of certain interests recognized by applicable legislation; or

• any other basis permitted by applicable data protection regulations.

When the processing is based on consent, such consent must comply with the requirements established by applicable legislation.

The Website may use cookies and other similar technologies to allow its operation, maintain its security, remember preferences and, where appropriate, carry out measurement, analysis, personalization or marketing activities.

When applicable laws require consent to use certain cookies or technologies, these will only be activated after obtaining such consent.

The User may obtain additional information about the technologies used and configure their preferences through the Cookies Policy and, where available, the cookie settings panel on the Website.

The Company does not sell users' personal data.

However, to develop our activity and operate the Website, certain personal data may be processed or made available to third parties when necessary and legally permitted.

These third parties may include, depending on the services actually used:

• web hosting and cloud service providers;

• email and communication providers;

• IT and cybersecurity service providers;

• CRM and business management platforms;

• web analytics providers;

• marketing and communication providers, where applicable;

• professional advisors, auditors, lawyers and consultants;

• financial institutions and payment service providers, when necessary;

• public authorities, regulators, courts or other entities when there is a legal obligation or valid request.

When a third party processes personal data on behalf of the Company, the contractual and organizational measures required by applicable law will be adopted to guarantee an adequate level of protection.

Due to the international nature of the Internet and certain technology services, some of our providers may store or process personal data outside the United Arab Emirates.

When personal data is transferred outside the UAE, the Company will adopt the necessary measures to ensure that such transfer is carried out in accordance with applicable data protection regulations.

In particular, where UAE PDPL is applicable, international transfers will be carried out in accordance with the mechanisms and conditions established by that legislation, including, where applicable, transfers to jurisdictions offering an adequate level of protection or other legally permitted mechanisms.

Where GDPR applies to a particular processing activity, transfers of data subject to that regime will also be carried out using the mechanisms provided by the GDPR.

Personal data will be kept for the time reasonably necessary to fulfill the purposes for which it was collected.

Subsequently, it may be retained, duly protected and with restricted access where appropriate, for the periods necessary to:

• comply with legal or regulatory obligations;

• address possible liabilities arising from the relationship maintained;

• formulate, exercise or defend claims; or

• comply with other legitimate requirements provided by applicable legislation.

When data is no longer necessary, it will be deleted, anonymized or processed otherwise in accordance with applicable regulations.

CVs and applications: unless there is a legitimate reason to retain them for a different period, data relating to applications may be retained for a maximum period of one year from receipt, after which they will be deleted or anonymized, unless the applicant authorizes or requests otherwise or applicable law allows or requires different retention.

In accordance with the data protection regulations that apply, the interested party may have the right to request, where applicable:

• information about the processing of their personal data;

• access to their personal data;

• correction or updating of inaccurate or incomplete data;

• deletion of their personal data when appropriate;

• restriction or suspension of certain processing when legal requirements are met;

• objection or cessation of certain processing when legally appropriate;

• portability or transfer of their data when applicable;

• withdrawal of consent;

• review of certain decisions based on automated processing, where applicable; and

• any other right recognized by applicable law.

The existence and scope of each right will depend on the specific circumstances and the law applicable to the processing.

To exercise your rights, you may contact:

SAMARKANDA TECHNOLOGY FZCO

Email: legal@samarkanda.tech

Address: Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates.

The Company may request reasonable information to verify the identity of the person making the request and prevent unauthorized access or modification of personal data.

When processing is based on consent, the data subject may withdraw it in accordance with the procedures made available by the Company.

Withdrawal of consent will not affect, where applicable law so provides, the lawfulness of processing carried out validly before such withdrawal.

Withdrawal of consent may mean that certain services or functionalities that necessarily require such data can no longer be provided.

The Company will not adopt decisions based solely on the automated processing of personal data that produce legal effects or significant consequences for the data subject, unless such processing is permitted by applicable law and the corresponding safeguards are adopted.

If the Company were to begin using such processes in a relevant way, it will provide the additional information required by applicable law.

The Company will adopt appropriate and reasonable technical and organizational measures, taking into account the nature of the personal data, the risks associated with the processing and the circumstances of each activity.

These measures are designed to protect personal data against destruction, loss, alteration, disclosure, unauthorized access or unlawful processing.

When third parties process personal data on behalf of the Company, they will be required to adopt the corresponding protective measures in accordance with applicable law and the contractual conditions established.

However, no computer system, data transmission or Internet service can guarantee absolute security.

The Company will treat personal data confidentially.

Personnel, suppliers and authorized third parties who may access personal data will be subject to the corresponding confidentiality obligations and must use such data exclusively for the authorized purposes and in accordance with applicable law.

The interested party should ensure that the personal data they provide is correct, complete and up to date.

If any of your data changes, you may inform us through the contact details indicated in this Policy so that we can keep the information updated.

The Website and the Company’s services are not directed, unless expressly stated otherwise, to minors.

The Company does not intend to deliberately collect personal data from minors in breach of the requirements established by applicable law.

If we become aware that personal data of a minor has been provided in a manner contrary to applicable law, we will adopt the reasonable measures corresponding to such situation.

The Website may contain links to websites, platforms or services managed by third parties.

The Company does not control the privacy practices of such third parties. The use of those services will be subject to their own privacy policies and terms.

We recommend reviewing the privacy policies of external services before providing them with personal data.

If you consider that your personal data has not been treated properly or you wish to make a query or complaint related to privacy, we recommend that you contact the Company initially through:

Email: legal@samarkanda.tech.

The Company will study the request and respond in accordance with applicable regulations.

The interested party may also submit a complaint to the competent authority or body in data protection matters when that right corresponds to them under applicable law.

Where another jurisdiction’s legislation applies to the processing, the interested party may also have the right to address the competent data protection authority in accordance with that legislation.

The Company may update this Privacy Policy to reflect legislative, regulatory, technological changes or changes related to our processing activities.

When relevant modifications occur, the updated version will be published on the Website and, where necessary, additional measures will be taken to inform interested parties.

We recommend checking this Privacy Policy periodically.

For any query related to this Privacy Policy or the processing of your personal data, you may contact:

SAMARKANDA TECHNOLOGY FZCO

Address: Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates.

Email: legal@samarkanda.tech.

Website: https://www.samarkanda.tech/.

Last updated: September 2026.