1. General Provisions

This Personal Data Processing Policy has been prepared in accordance with applicable data protection laws, including UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and sets out the procedure for processing personal data and the measures taken to ensure its security by Master Software and Advertising LLC (the "Operator").
1.1. The Operator's most important goal and condition for carrying out its activities is respect for the rights and freedoms of individuals when processing their personal data, including the protection of the rights to privacy and to personal and family confidentiality.
1.2. This Operator's Policy on the processing of personal data (the "Policy") applies to all information the Operator may obtain about visitors to the websites https://mave.digital, https://app.mave.digital, and https://a.mave.digital. This Policy applies to personal data processed by Master Software and Advertising LLC in connection with the international version of the mave platform and paid features purchased from Master Software and Advertising LLC.

2. Key Terms Used in the Policy

2.1. Automated processing of personal data means the processing of personal data using computer technology.
2.2. Blocking of personal data means the temporary suspension of the processing of personal data (except where processing is necessary to correct the personal data).
2.3. Website means the collection of graphic and informational materials, as well as computer programs and databases, that make them available on the internet at https://mave.digital, https://app.mave.digital, and https://a.mave.digital.
2.4. Personal data information system means the personal data contained in databases, together with the information technologies and technical means that enable its processing.
2.5. Anonymization of personal data means actions as a result of which it is impossible, without the use of additional information, to determine whether personal data belongs to a specific User or other data subject.
2.6. Processing of personal data means any action (operation) or set of actions (operations) performed with personal data, with or without automation, including collection, recording, organization, accumulation, storage, adaptation (updating, alteration), retrieval, use, transfer (dissemination, provision, access), anonymization, blocking, erasure, and destruction of personal data.
2.7. Operator means a public authority, municipal body, legal entity, or individual that, alone or jointly with others, organizes and/or carries out the processing of personal data and determines the purposes of processing, the categories of personal data to be processed, and the actions (operations) performed with personal data.
2.8. Personal data means any information relating directly or indirectly to an identified or identifiable User of the websites https://mave.digital, https://app.mave.digital, and https://a.mave.digital.
2.9. User means any visitor to the websites https://mave.digital, https://app.mave.digital, and https://a.mave.digital.
2.10. Provision of personal data means actions aimed at disclosing personal data to a specific person or a specific group of persons.
2.11. Dissemination of personal data means any actions aimed at disclosing personal data to an indefinite group of persons (transfer of personal data) or at making personal data available to an unlimited group of persons, including publishing personal data in the media, posting it on information and telecommunications networks, or providing access to it in any other way.
2.12. Destruction of personal data means any actions as a result of which personal data is irreversibly destroyed, making it impossible to restore the content of the personal data in the personal data information system, and/or the physical media containing personal data are destroyed.

3. Personal Data the Operator May Process

3.1. Name.
3.2. Email address.
3.3. The website also collects and processes anonymized data about visitors (including cookies) using web analytics services (Google Analytics and others).
3.4. When a User purchases a paid subscription, payment card details are entered on the page of our payment provider, Stripe, Inc. and its affiliates ("Stripe"), and are processed by Stripe. The Operator does not receive or store full card numbers; it receives only limited payment information from Stripe (such as the card brand, the last four digits, the expiry date, the billing country, and the payment status).
3.5. The data listed above are referred to collectively in this Policy as "Personal Data".
4. Purposes of Processing Personal Data
4.1. The purpose of processing the User's personal data is to inform the User by sending emails; to provide the User with access to the services, information, and/or materials contained on the website; and to process payments for paid subscriptions.
4.2. The Operator may also send the User notifications about new products and services, special offers, and various events. The User may opt out of informational messages at any time by sending an email to the Operator at hello@mave.digital with the subject line "Opt out of notifications about new products, services and special offers".
4.3. Anonymized User data collected by web analytics services is used to gather information about Users' actions on the website and to improve the quality of the website and its content.

5. Legal Grounds for Processing Personal Data

5.1. The Operator processes the User's personal data only where the User has filled in and/or submitted it themselves through the special forms on the website https://mave.digital. By filling in the relevant forms and/or sending their personal data to the Operator, the User agrees to this Policy and consents to the processing of their personal data. The User's consent to the processing of personal data is expressed through conduct on the website https://mave.digital. Payment data is also processed where necessary to perform the contract with the User for a paid subscription.
5.2. The Operator processes anonymized data about the User if this is permitted by the User's browser settings (cookies and JavaScript are enabled).

6. Measures to Ensure the Security of Personal Data

• ensuring the confidentiality of personal data that is not publicly available;
• appointing an employee responsible for organizing the processing and ensuring the security of personal data (the personal data processing officer);
• checking contracts for, and where necessary including, clauses on ensuring the confidentiality of personal data;
• issuing internal policies on the processing of personal data and familiarizing the Operator's employees with them;
• ensuring the physical security of premises and processing equipment;
• restricting and segregating employees' and other persons' access to personal data and processing equipment, and monitoring actions with personal data;
• identifying threats to the security of personal data during processing and developing threat models based on them;
• using security tools (antivirus software, firewalls, protection against unauthorized access, cryptographic protection of information), including tools that have passed conformity assessment in the established manner;
• backing up information to enable recovery;
• carrying out internal monitoring of compliance with the established procedures, checking the effectiveness of the measures taken, and responding to incidents.

7. Procedure for Collecting, Storing, Transferring, and Otherwise Processing Personal Data

The security of personal data processed by the Operator is ensured through the legal, organizational, and technical measures necessary to fully comply with applicable data protection laws.
7.1. The Operator ensures the safety of personal data and takes all possible measures to prevent access to personal data by unauthorized persons.
7.2. The User's personal data will never, under any circumstances, be transferred to third parties, except (a) where required by applicable law, and (b) to service providers that process personal data on the Operator's behalf and only to the extent necessary to provide the Services, including Stripe for payment processing and hosting and email delivery providers. Such providers are bound by confidentiality and data protection obligations.
7.3. If the User finds inaccuracies in their personal data, they may update it themselves by sending a notice to the Operator's email address hello@mave.digital with the subject line "Update of personal data".
7.4. The period of personal data processing is unlimited. The User may withdraw their consent to the processing of personal data at any time by sending a notice by email to the Operator at hello@mave.digital with the subject line "Withdrawal of consent to the processing of personal data".

8. Cross-Border Transfer of Personal Data

8.1. Before carrying out a cross-border transfer of personal data, the Operator must ensure that the foreign country to which the personal data is to be transferred provides adequate protection of the rights of personal data subjects.
8.2. Cross-border transfer of personal data to foreign countries that do not meet the above requirements may be carried out only with the written consent of the personal data subject to the cross-border transfer of their personal data and/or where necessary to perform a contract to which the personal data subject is a party.

9. Final Provisions

9.1. The User may obtain any clarification on matters relating to the processing of their personal data by contacting the Operator by email at hello@mave.digital.
9.2. Any changes to the Operator's personal data processing policy will be reflected in this document. The Policy is valid indefinitely until replaced by a new version.
9.3. The current version of the Policy is freely available on the internet at https://mave.digital/en/privacy.

Operator: Master Software and Advertising LLC, Shams Business Center, Sharjah Media City Free Zone, Al Messaned, Sharjah, United Arab Emirates. License / registration no.: 2219750. Email: hello@mave.digital.