← Back to GI Machinery

Privacy & Cookie Policy

Version 4.0 · Effective date: 18 August 2026 · gi-machinery.com/privacy

1. Who processes the data. The data controller is WORLD FIRST FZCO, licence IFZA 46921, TRN 104660176900001, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, UAE, trading as GI Machinery. Questions about processing and exercise of your rights: [email protected]. The terms "Platform", "Communication Channels", "Customer", "Supplier" and "Operator" have the meanings defined in the Terms of Use. The Company is guided by the principles of honesty and good faith in processing data and expects the same from the parties providing data to it.

2. Whose data we process. The Service is provided to persons acting for business purposes, so we primarily process the data of representatives and employees of Customers and Suppliers: contact persons, persons responsible on site, and Operators. If you provide us with data of your employees or other persons — contact details, documents, images — you are responsible for having a lawful basis for such provision and undertake to inform those persons of the processing provided for in this Policy.

Data obtained other than from you. We may obtain contact details from publicly available sources (company directories, websites, registers) and by referral — for example, where another client shares your number under a referral programme. On first contacting you, we state the source of the data and provide the opportunity to opt out of further contact; the opt-out is recorded and no repeat contact is made.

3. What data we collect.

• Contact data: name, company name, position, telephone number, e-mail.
• Order data: site address and description, geolocation coordinates of the site, requested equipment, dates, order documents.
• Correspondence: the full text of messages in the Communication Channels, voice messages, photographs and files sent. Correspondence is retained in full. Telephone conversations with the dispatch desk are recorded only where this is announced at the start of the call; without such announcement, only the fact and subject of the enquiry are logged.
• Supplier data: licences, equipment registration documents, documents confirming Operators' qualifications and certifications, insurance policies, bank details.
• Performance photographs: images of meters, equipment and the site at delivery and removal. They may contain images of people and elements of your site.
• Payment data: amount, date, payment method, transaction reference. We do not receive, store or transfer full card numbers — they are processed by a licensed payment provider.
• Technical data: anonymised website visit statistics.

Minimisation. We do not request or collect medical data, health data or biometric data. The Supplier's file contains qualification and certification documents; medical examinations and the Operator's fitness are the responsibility of the Supplier as employer, and such documents are not provided to us. If such data appears in materials sent to us, we do not use it and delete it where possible.

4. Anonymised data. We use anonymised and aggregated data — statistics on orders, prices, timings and equipment categories — to improve the Service, calculate market indicators and perform analytics. Such data does not allow you to be identified and does not constitute personal data.

5. Bases of processing (Article 4 of the PDPL):

• performance of a contract — receiving and pricing the order, transfer of information between the parties to the order, payment, documents;
• compliance with obligations imposed by law — tax and accounting records, record retention;
• establishment and defence of legal claims — retention of correspondence, work reports and photographs as evidence relating to orders;
• your consent — for the recording and storage of correspondence and voice messages, photographic documentation, transfer of data outside the UAE, analytics and marketing. Consent is requested in the chat on first contact, recorded with the date and the version of this Policy, and may be withdrawn at any time.

Withdrawal of consent does not terminate processing carried out on other bases. Data necessary for the performance of a contract, compliance with law, or the establishment and defence of legal claims — including correspondence, work reports and photographs already accumulated in relation to orders — continues to be processed on those bases after withdrawal of consent.

6. Recipients. Transfers are made to the extent necessary for the order, and in both directions:

• To the Supplier — the name and telephone number of the Customer's contact person, the site address and coordinates, and the work requirements.
• To the Customer — the details of the agreed equipment (registration number) and the Operator needed for verification upon delivery; the Supplier's name, licence and insurance policies — in the cases provided for in the Terms of Use.
• Contact persons named by the parties in the order chat become visible to both parties to the order to the extent necessary for coordination.
• To the payment provider — the data necessary to process the payment.
• To the WhatsApp business messaging provider and Meta companies — as operators of the communication channel.
• To providers of processing software, including providers of large language models (AI) — the content of messages, including transcripts of voice messages and images, to the extent necessary to recognise the substance of an enquiry and prepare a response. Such providers act as processors on our instructions and may not use the data for their own purposes, including model training.
• To accountants and auditors — to the extent required for accounting.
• To banks and payment providers in the event of a payment dispute — the work report, completion certificate, meter readings, order confirmation and related correspondence as evidence that the service was provided.
• To courts, arbitral tribunals, state authorities and our legal advisers — upon lawful request or to the extent necessary for the establishment and defence of legal claims.
• To the parties to an order in the event of a disagreement — where a dispute arises between the Customer and the Supplier, we may disclose to each of them order-related information and documents to the extent necessary for settlement, in the manner provided for in the Terms of Use.
• To a successor — upon reorganisation or sale of the business or part of it, data may be transferred to a successor assuming the obligations of this Policy; we give advance notice of such transfer.

We do not sell or transfer data to third parties for their own marketing.

7. Where data is stored and transfers outside the UAE. Data, including correspondence and order materials, may be stored and processed both within and outside the UAE — in particular, the WhatsApp channel is operated by Meta companies, message processing may be performed by software providers, and storage infrastructure may be located in other jurisdictions.

Transfers outside the UAE are made on the basis of Article 23 of the PDPL: under contracts obliging recipients to ensure a level of protection equivalent to the PDPL, and on the basis of your separate express consent requested on first contact. Consent may be withdrawn at any time; in that case we will offer an alternative communication channel, although provision of the Service via WhatsApp and the Platform may become impossible.

8. Retention periods. Tax and accounting documents — 7 years after the end of the tax period. Order correspondence, work reports, completion certificates and photographs — 3 years from order closure (the period for potential claims). The Supplier's file — for the duration of the cooperation and 3 years thereafter. Data not relating to orders — no longer than the purpose of processing requires. Logs of consents given and of rights requests are retained for the duration of the relevant processing and for 3 years after its termination, as evidence of lawfulness. Upon expiry, data is deleted or anonymised; deletion also extends to backup copies within their rotation cycle.

9. Your rights. To obtain information about the processing and a copy of the data; to correct inaccurate data; to request deletion; to restrict processing; to object to processing; to receive data in a portable format; to withdraw consent; to require cessation of processing for direct marketing. Requests — to [email protected]; response within 30 calendar days.

Before acting on a request, we must satisfy ourselves that it originates from the data subject or their authorised representative: we request reasonable confirmation of identity or send the response to a channel already linked to the data (the number or address from which the correspondence was conducted). A request whose author's identity cannot be confirmed is not acted upon, of which the requester is notified. Complaints may be made to the competent UAE personal data protection authority.

The right to deletion is limited by our obligation to retain accounting records and data necessary for defence against claims.

10. Recording of correspondence, voice messages and photographic documentation. Correspondence with us, including voice messages and attachments, is recorded and stored; the performance of works is photographed (meters, equipment, the site at delivery and removal).

You undertake to bring this to the attention of your employees, contractors and other persons engaged in dealing with us or present on the site, and to ensure their consent. We instruct Suppliers to frame photographs so as to avoid capturing people; images are not used in marketing without separate consent; upon a reasoned request, a person appearing in an image may require blurring where the image is not needed as evidence. In the event of an incident, photographing injured persons is prohibited; the equipment, location and scene are documented.

11. Automated processing and AI. To recognise the meaning of messages and prepare responses, we use software tools, including third-party large language models (AI). Processing covers text, transcripts of voice messages and images.

Preliminary price calculation may be performed automatically; only the price stated in the Invoice-Agreement is binding. Decisions with legal or significant effects — refusal of service, withholding of funds, rejection of a claim — are not made solely by automated processing. You may require human review of any decision, including an automatically calculated price, and transfer of the conversation to a member of staff. Review and transfer requests are handled in order of receipt during dispatch desk working hours; at times of high load, response times may increase, but receipt is acknowledged immediately and review is performed within a reasonable time. The response times for rights requests under clause 9 (30 calendar days) are unaffected.

12. Card data. Processed by licensed payment providers. We do not store, sell or transfer full card numbers.

13. Security. Encryption at rest and in transit, role-based access, logging of actions involving funds and access rights, masking of telephone numbers in technical logs. Absolute security of data transmission over the internet cannot be guaranteed.

14. Incidents. In the event of a breach capable of causing harm, we notify the affected persons and the competent UAE authority immediately upon discovery, in accordance with Article 9 of the PDPL. Our processors, including Suppliers in respect of data transferred to them, must notify us immediately of data incidents; this obligation is included in our contracts with them.

15. Children. The Service is addressed to persons acting for business purposes, aged 18 and over. Children's data is not knowingly collected.

16. Third-party websites. Links from the Communication Channels lead to services outside our control; review their policies.

17. Cookies, analytics and advertising technologies. We use three categories of technologies:

(a) Strictly necessary cookies — required for the operation and security of the website. Set without consent, as the requested functionality is impossible without them.

(b) Visit analytics — anonymised, without cookies and without tracking you across other websites. No consent is required; no personal data is processed.

(c) Advertising and marketing technologies — Meta Pixel, Google Ads tags and similar. They enable measurement of advertising effectiveness and the display of advertising to site visitors on other resources, and involve cross-site tracking. These technologies are loaded and set cookies only after your express consent given through the consent management banner. Without consent they are not loaded, and the website remains fully functional. You may change or withdraw your choice at any time via the "Cookie Settings" link in the website footer; withdrawal does not affect the lawfulness of processing before withdrawal. The list of advertising technologies used and their providers is published in the banner.

The Meta domain verification tag is not a tracking technology and is used to confirm ownership of the domain.

18. Marketing communications. Sent only with separate prior consent (opt-in). Consent to order correspondence does not constitute marketing consent. You may opt out at any time by a message in the chat or by e-mail; no further messages are sent after an opt-out.

19. Amendments and versions. Each version bears a number and effective date (at the bottom of the page); all versions are kept in the archive at gi-machinery.com/legal/versions/ with the SHA-256 checksum. Consent is recorded with reference to the version in force at the time it was given. We notify clients with active orders of material changes — new processing purposes, new categories of recipients, changes to retention periods — by a message in the chat before the changes take effect; where required, fresh consent is requested.

20. Language and disputes. This Policy is drawn up in English. The English version prevails; translations into other languages, where published, are provided for convenience and have no overriding force.

By contacting us and continuing to deal with us, you confirm that you have a sufficient command of English to understand this Policy or have, on your own initiative, obtained its translation and explanation. Insufficient command of English does not exempt you from this Policy or from consents you have given, and does not constitute grounds to challenge them.

Disputes in connection with this Policy are resolved in the manner established by the Terms of Use.

21. Contacts. Data enquiries — [email protected]. Formal claims — [email protected]. WORLD FIRST FZCO, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, UAE.

Contact

WORLD FIRST FZCO (trading as GI Machinery)
Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates
IFZA License 46921 · TRN 104660176900001
Dispatch line (06:00–22:00): +971 58 577 4115 · E-mail: [email protected]
Country of domicile: United Arab Emirates

Version 4.0 · Effective date: 18 August 2026 · gi-machinery.com/privacy · version archive