EU GDPR policy

Scope and our commitment

Lunava Digital Solutions FZCO ("Lunava") applies Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"), and the UK GDPR read with the Data Protection Act 2018, wherever we process the personal data of individuals in the European Economic Area or the United Kingdom, and wherever a client requires GDPR standards as a condition of contract.

This policy is published as a standalone document so that data subjects, procurement teams and legal reviewers can find our GDPR position directly, without reading it out of a broader notice. It sits alongside, and does not replace, our privacy policy, cookie policy, data protection and international transfers notice, subprocessor list and information security policy.

Lunava is registered in the United Arab Emirates and delivers services worldwide. Where processing falls within Article 3(2), we comply on an extraterritorial basis and will appoint an Article 27 representative in the Union or the United Kingdom where an engagement requires one.

Controller and processor roles

Our role depends on the processing concerned, and it is recorded in writing before processing begins:

• Controller. Enquiries submitted through this website, marketing correspondence you have asked to receive, supplier and vendor registration data, recruitment applications, and our own business records. We determine the purpose and means for this limited processing.
• Processor. Personal data held in platforms we build, host, support or operate on behalf of a client. We process only on the client's documented instructions, under an Article 28 data processing agreement.
• Joint controller. Only where genuinely applicable, and then under an Article 26 arrangement that sets out each party's responsibilities and a point of contact for data subjects.

Lawful bases, Article 6

Where Lunava acts as controller, we rely on the following lawful bases and record which applies to each processing activity:

• Contract, Article 6(1)(b). Delivering services you or your organisation have engaged us for, and taking pre-contractual steps at your request.
• Legitimate interests, Article 6(1)(f). Responding to business enquiries, securing our systems, and maintaining our client and supplier relationships, subject to a documented balancing test that you may request.
• Consent, Article 6(1)(a). Non-essential cookies, analytics and any optional communications. Consent is freely given, specific, informed and unambiguous, and can be withdrawn at any time through the consent preferences control on this site or by writing to us.
• Legal obligation, Article 6(1)(c). Tax, accounting, sanctions screening and other statutory record-keeping duties.

Special category data and children

We do not process special category data under Article 9, or criminal offence data under Article 10, unless an engagement genuinely requires it. Where it does, the Article 9(2) condition, additional safeguards, access restrictions, retention period and any data protection impact assessment are agreed with the controller in writing before processing starts.

Our website and services are not directed at children. Where a delivered platform processes children's data, age verification, parental consent handling under Article 8 and the applicable national age threshold are specified during design.

Our commitments as a processor, Article 28

In every engagement where we act as processor we commit in contract to:

• Process personal data only on the controller's documented instructions, including on transfers, and tell the controller if we believe an instruction infringes the GDPR
• Ensure that personnel authorised to process personal data are bound by confidentiality
• Implement the technical and organisational measures required by Article 32
• Engage subprocessors only under written terms no less protective than ours, with prior notice and a right to object; our current list is published on the subprocessors page
• Assist the controller in responding to data subject rights requests under Chapter III
• Assist with Article 32 security obligations, Article 33 and 34 breach notification, and Article 35 impact assessments and Article 36 prior consultation
• Delete or return all personal data at the end of the engagement, unless retention is required by Union or Member State law
• Make available the information needed to demonstrate compliance, and allow and contribute to audits and inspections

International transfers, Chapter V

Personal data originating in the EEA or the United Kingdom may be processed outside those territories, including in the United Arab Emirates and in the regions where our hosting and subprocessors operate. Every such transfer is made on a valid Chapter V ground:

• An adequacy decision under Article 45 where one covers the destination
• The European Commission's Standard Contractual Clauses (Decision 2021/914), and for UK transfers the ICO International Data Transfer Agreement or the UK Addendum, executed as part of contracting
• A documented transfer impact assessment, with supplementary measures such as encryption in transit and at rest, key management, access minimisation and a government access response procedure
• Article 49 derogations only in the narrow, occasional circumstances the GDPR permits, and never as a routine transfer mechanism

Data residency for EU and UK engagements

Where an engagement, tender or sector regulator requires personal data to remain in the EEA, the United Kingdom or a named Member State, we can scope hosting regions, support access paths and backup locations accordingly. Raise the requirement before design begins so residency is built into the architecture rather than retrofitted.

Your rights, Chapter III

Subject to the conditions in the GDPR, you may:

• Access the personal data we hold about you, and obtain a copy, Article 15
• Have inaccurate or incomplete data corrected, Article 16
• Have data erased where one of the Article 17 grounds applies
• Restrict processing in the circumstances set out in Article 18
• Receive your data in a structured, commonly used, machine-readable format and have it transmitted to another controller, Article 20
• Object to processing based on legitimate interests, and object at any time to direct marketing, Article 21
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, Article 22
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal, Article 7(3)

How to exercise your rights

Write to support@lunavadigital.com with enough detail for us to identify the data concerned. We acknowledge within five working days and respond within one month, extendable by two further months for complex or numerous requests, in which case we tell you why within the first month. There is no charge unless a request is manifestly unfounded or excessive.

Where Lunava acts as processor for a client, we will forward your request to that client without undue delay and support their response. In that case the client, as controller, answers you directly.

We may ask for proportionate information to verify your identity before disclosing personal data.

Retention

We keep personal data only as long as necessary for the purpose it was collected for. Enquiry correspondence is kept for 24 months from the last contact, contract and client records for the term of the engagement plus the statutory limitation and accounting periods applicable to us, recruitment data for 12 months unless you ask us to keep it longer, and consent records for the life of the consent plus the period needed to evidence it. Data processed on a client's behalf follows the retention schedule in that client's contract.

Security, Article 32

We maintain technical and organisational measures appropriate to the risk, including least-privilege access control, multi-factor authentication for administrative access, encryption in transit and at rest, environment separation, logging and monitoring, vulnerability management, secure development practice, backup and restoration testing, and personnel confidentiality and training. Our controls are described in the information security policy.

Personal data breaches, Articles 33 and 34

Where we act as processor, we notify the controller without undue delay after becoming aware of a personal data breach, with the information they need for their own notification.

Where we act as controller, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons, and we notify affected data subjects without undue delay where the breach is likely to result in a high risk to them.

Accountability and governance, Article 5(2)

We maintain records of processing activities under Article 30, apply data protection by design and by default under Article 25, carry out data protection impact assessments under Article 35 where processing is likely to result in a high risk, and review this policy at least annually and whenever our processing materially changes.

We have not appointed a statutory Data Protection Officer under Article 37 because our processing does not meet the mandatory criteria. A named privacy lead is accountable for the commitments in this policy and can be reached at the address below.

Complaints and supervisory authorities

If you are not satisfied with our response, write to support@lunavadigital.com and we will escalate the matter internally. You also have the right to lodge a complaint with the supervisory authority in your EU Member State of residence, place of work or place of the alleged infringement, under Article 77, or with the UK Information Commissioner's Office for UK matters. We would appreciate the chance to address your concern first.

Contact

Lunava Digital Solutions FZCO, IFZA Business Park, Building A2, Dubai Silicon Oasis, Dubai, UAE. Data protection correspondence: support@lunavadigital.com, marked "GDPR request". We can execute a data processing agreement, standard contractual clauses, the UK Addendum or your own GDPR annexure as part of contracting.