1. Data controller

The data controller is Kehkashan International L.L.C-FZ, a UAE Free Zone licensed entity, Licence Number 2534446.01, registered for VAT under TRN 105112073900003, with its trade desk at Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates. Privacy contact: [email protected].

2. Personal data we collect

We collect personal data when you (a) submit an RFQ form (company name, contact name, email, phone, WhatsApp, country, product preferences, destination port); (b) submit a sample-request form (name, email, courier address, product); (c) submit a contact form (name, email, optional company, message); (d) email or WhatsApp the trade desk (message content and the contact identifiers you choose to share); (e) browse the Site (IP address, user-agent string, pages visited, referring URL, GA4 pseudonymous client identifier, Yandex.Metrica visitor ID, Meta Pixel cookie, LinkedIn Partner cookie — only after consent).

3. Lawful basis (GDPR, where applicable)

Where GDPR applies, we rely on (a) the necessity for the performance of a contract or to take steps prior to entering into a contract — for RFQ, sample, contract and shipment data; (b) our legitimate interest in operating and improving the Site, screening for sanctions and KYC, and recovering trade debt — for analytics and security data; (c) your explicit consent — for marketing cookies and any direct marketing emails; (d) compliance with a legal obligation — for tax, customs, and KYC records under UAE law.

4. How we use your data

We use personal data to (a) respond to your RFQ, sample request, or contact form; (b) prepare quotations, sales contracts, Letters of Credit, shipping documents and post-shipment correspondence; (c) screen counterparties, beneficial owners, banks, destinations and lots against UN, EU, US and UK sanctions lists; (d) operate the Site, monitor performance and security, and analyse usage in aggregated form; (e) comply with UAE record-keeping obligations under the Federal Tax Authority and the Dubai Free Zone authority; (f) defend or pursue legal claims; (g) send you transactional emails about your specific request.

5. Cookies and tracking

Strictly necessary cookies (session, language preference, consent state) operate without consent. Analytics and marketing cookies — Google Analytics 4 (GA4), Yandex.Metrica, Meta Pixel, LinkedIn Insight Tag — fire only after you grant consent through the cookie banner. You may withdraw consent at any time by clearing the consent cookie or contacting [email protected]. Cookie lifespans range from session-only to thirteen months; specific durations are listed in the cookie banner detail panel.

6. Data sharing

We share personal data with (a) freight forwarders, customs brokers and inspection agencies (SGS, Bureau Veritas) where required to ship and document your contract; (b) tier-one international banks for Letter of Credit advising and confirmation; (c) sanctions screening providers; (d) hosting and email providers (Vercel, Cloudflare, Resend) under data-processing addenda; (e) analytics providers (Google, Yandex, Meta, LinkedIn) where you have consented to marketing cookies; (f) the UAE Federal Tax Authority and the Dubai Free Zone authority where law requires; (g) legal counsel and dispute-resolution forums where law requires. We do not sell personal data.

7. Retention

Trade-related personal data — RFQ, sample, contract, shipment, KYC and sanctions screening records — is retained for seven (7) years from the closure of the underlying contract or interaction, in line with UAE Federal Decree-Law No. 14 of 2018 on the Central Bank and the regulation of financial institutions and Federal Tax Authority record-keeping requirements. Analytics data is retained for fourteen (14) months in GA4 and twelve (12) months in Yandex.Metrica unless you withdraw consent earlier.

8. International transfers

Your personal data may be transferred to and processed in countries other than your home country, including the United Arab Emirates, the European Union, the United States, and the Russian Federation, depending on which service providers and counterparties are involved in your specific transaction. Transfers from the European Economic Area to third countries rely on adequacy decisions where applicable, on Standard Contractual Clauses where adequacy does not apply, or on contract-necessity derogations under Article 49 GDPR. For Russian data subjects, primary processing of personal data of citizens of the Russian Federation collected through the Site is, where required, performed on Russian-territory servers in compliance with Federal Law No. 152-FZ; the Yandex-stack infrastructure planned for Phase 2 of the Site delivers this localisation.

9. Your rights

Subject to the law applicable to you, you may have the right to (a) access the personal data we hold about you; (b) request rectification of inaccurate data; (c) request erasure («right to be forgotten»); (d) request restriction of processing; (e) request portability of data you have provided to us; (f) object to processing based on legitimate interest; (g) withdraw consent for marketing cookies and direct marketing at any time; (h) lodge a complaint with a supervisory authority — for EU data subjects, the data protection authority of your country of residence; for Russian data subjects, Roskomnadzor; for UAE data subjects, the UAE Data Office. To exercise any right, write to [email protected].

10. Security

We protect personal data with administrative, technical and physical safeguards proportionate to the risk: TLS 1.3 in transit, encryption at rest in our hosting and email providers, role-based access control on the trade desk, staff training, and breach-response procedures. No system is perfectly secure; we will notify you and the relevant supervisory authority within seventy-two (72) hours of becoming aware of a personal data breach where law requires.

11. Minors

The Site is not directed at children under the age of sixteen (16). We do not knowingly collect personal data from minors. If you believe a minor has submitted personal data to us, write to [email protected] so we can remove it.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The «Last updated» date at the top reflects the latest version. Material changes will be communicated through a banner on the Site for at least thirty (30) days following publication.

13. Contact

Privacy queries, rights requests and complaints: [email protected]. General trade-desk correspondence: [email protected]. Postal address: Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates.