1. Introduction
NAIWA ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our SME Certification Platform.
NAIWA, the independent management-consultancy operator described in our Legal Notice, is the controller responsible for the personal data processed through the Services. For any privacy question, or to exercise your rights, you can reach our privacy contact at privacy@naiwa.ae.
This policy has regard to Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and related UAE data-protection principles. NAIWA aims to handle personal data consistently with these principles and continues to develop its data-protection practices; this policy is not a representation of certified or audited compliance. Where a specific legal requirement applies to your data, that requirement prevails over any general statement here.
By using our services, you consent to the collection and use of information in accordance with this policy and the PDPL.
2. Information We Collect
Personal Information
- Name and contact information (email, phone number, address)
- Business information (company name, trade license details)
- Identity documents (Emirates ID, passport copies)
- Financial documents submitted for certification
- Account credentials and authentication data
Automatically Collected Information
- Device information and browser type
- IP address and location data
- Usage patterns and interaction with our platform
- Cookies and similar tracking technologies
3. How We Use Your Information
We use the information we collect to:
- Process certification applications and assessments
- Verify submitted documentation and evidence
- Maintain the public certification registry
- Communicate with you about your application status
- Improve our services and user experience
- Comply with legal and regulatory requirements
- Prevent fraud and ensure platform security
4. Data Sharing and Disclosure
We may share your information with:
- Public Registry: Certification status and basic enterprise information is published in our verification registry
- Service Providers: Third-party vendors who assist in operating our platform
- Legal Requirements: When required by law or to protect our rights
- Business Transfers: In connection with any merger, acquisition, or sale of assets
We do not sell your personal information to third parties for marketing purposes.
5. Data Security
We implement appropriate technical and organizational security measures to protect your information, including:
- Encryption of data in transit and at rest
- Access controls and authentication mechanisms
- Regular security assessments and audits
- Employee training on data protection
While we strive to protect your information, no method of transmission over the Internet is 100% secure.
6. Data Retention
We retain your information for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law. Certification and verification records may be retained on a long-term basis to support the integrity of the public register, subject to the retention principles described below and applicable legal requirements.
7. Your Rights Under the PDPL
Under Federal Decree-Law No. 45 of 2021 (PDPL), you have the following rights with respect to your personal data:
- Right of Access: Request a copy of the personal data we hold about you and information on how it is processed.
- Right to Rectification: Request correction of inaccurate or incomplete personal data.
- Right to Erasure: Request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal obligations and legitimate interests (including certification record-keeping).
- Right to Restriction: Request that we limit the processing of your data in certain circumstances.
- Right to Data Portability: Request that we transfer your data to another controller in a structured, commonly used format where technically feasible.
- Right to Object: Object to processing based on our legitimate interests.
- Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.
- Rights Regarding Automated Decisions: Not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, and to request human intervention, express your view, and contest such a decision. NAIWA's certification outcomes are not decided by automated means alone (see the automated-processing disclosure below).
To exercise any of these rights, submit a written request to privacy@naiwa.ae. We will respond within 30 days. For certification records, certain data may be retained as required by applicable UAE commercial and regulatory law.
If you have a concern about how we handle your personal data, please contact us first at privacy@naiwa.ae so that we can try to resolve it. You also have the right to lodge a complaint with the competent UAE supervisory authority, the UAE Data Office, or with the data-protection authority in your place of residence or work if that is different. Raising a concern with us first does not limit your right to contact the authority.
8. Cookies and Tracking
We use cookies and similar technologies to enhance your experience, analyze usage patterns, and improve our services. You can control cookie preferences through your browser settings.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page with an updated "Last Updated" date.
10. Additional Data-Processing Disclosures
Categories of data we process
Depending on your role and use of the Services, we may process: account and contact data; SME profile and business data; uploaded SME documents; KYC/KYB and identity documents; financial documents and figures; certification and registry information; investor interest and introduction data; marketplace listing data; AI-assisted assessment outputs and AI processing logs; support messages and attachments; and payment-related metadata (such as payment status, references, and amounts) processed by our third-party payment processor. We do not store full payment-card numbers.
Reasons for processing
We process data to provide and operate the Services; to perform assessments and issue, maintain, suspend, or revoke certification; to operate the verification registry, marketplace, and introduction features; to maintain audit, evidence, and security records; to comply with legal obligations; to detect and prevent fraud and misuse; and for legitimate business administration. Where required, we rely on your consent, the performance of a contract with you, a legal obligation, or our legitimate interests as the basis for processing.
Marketing communications and your choices
We may use your contact details to tell you about NAIWA features, content, and services that may interest you, and we do so only where we have a lawful basis, such as your consent where it is required, or our legitimate interest exercised in a way that is consistent with your expectations and applicable law. Marketing is separate from the service and transactional messages that are necessary to operate the Services, such as messages about your account, security, payments, assessment and certification status, the registry, introductions, legal updates, and the email that delivers the result of a free readiness check; opting out of marketing does not stop those necessary messages. Your consent to marketing is captured separately from any transactional or result email, so you can receive your readiness result without agreeing to marketing. You can opt out of marketing at any time using the unsubscribe link in a marketing email, your notification preferences where available, or by contacting privacy@naiwa.ae, and we will action your request within a reasonable period. We do not sell your personal data and do not share it with third-party advertising networks for their own marketing.
Marketplace visibility and investor disclosure
If you publish a marketplace listing or make your profile visible, information you choose to disclose may be visible to other users, including investors. You control what is published. Expressing or receiving interest creates a communication record visible to the relevant parties and to NAIWA for audit purposes. NAIWA does not sell personal data and does not share contact details beyond what is necessary to operate the introduction workflow you initiate or accept.
AI processing notice
Some features use AI to assist with assessment, summarization, and discovery. AI outputs are advisory only, are subject to human review, and do not finalize any decision. AI processing may involve third-party AI service providers acting as processors. AI summaries do not overwrite or replace your source documents or submitted evidence, which are preserved as the authoritative record.
Automated processing, AI assistance, and profiling
We use automated processing in parts of the Services. AI models assist with assessing and summarizing submitted evidence; a deterministic, versioned scoring method calculates readiness results from the governed assessment; and we use signals such as the businesses you follow, save, or express interest in to personalize discovery and suggest relevant results. These uses are based on data you choose to provide and actions you choose to take, and they are not used to make eligibility, credit, or suitability decisions about you.
Important decisions are not made by automated means alone. Certification outcomes are governed by a human reviewer who holds final authority: AI outputs are advisory and reviewable, deterministic scoring is calculated from the governed assessment state, and an authorized admin may approve, reject, request correction, or override with a recorded reason. Under the PDPL you have the right not to be subject to a decision based solely on automated processing that produces legal consequences for you or similarly significantly affects you; where such processing would occur, you may request human intervention, express your point of view, and contest the outcome by contacting privacy@naiwa.ae.
Where AI providers process data, they act as our processors on our instructions and receive only the minimum information needed for their task. We do not send passwords, API keys, payment credentials, or unrelated private material to AI providers, and AI summaries never overwrite your source documents or submitted evidence.
Source evidence preservation
We preserve submitted source documents and evidence, together with related audit records, to support the integrity of assessments and certification. These records may be retained after account closure for legitimate legal, audit, and dispute-resolution purposes.
Service providers (processors)
We use third-party service providers to host infrastructure, send email, process payments, and provide AI capabilities. These providers process data on our instructions for the purposes described in this policy. Each provider operates under its own terms and security arrangements.
Cross-border transfers
Some service providers may process data outside the United Arab Emirates. Where data is transferred across borders, we take steps intended to ensure an appropriate level of protection consistent with applicable law. By using the Services, you acknowledge that such transfers may occur.
Retention by category
Retention periods vary by category. In general: account data is retained while your account is active and for a reasonable period afterward; certification, registry, audit, and evidence records are retained for longer periods to preserve the integrity and verifiability of past assessments and to meet legal and dispute-resolution needs; payment metadata is retained as required for financial record-keeping; AI logs are retained for a limited operational period. Specific periods may change and are applied in light of legal requirements.
Registry retention caveat
The public verification registry may continue to reflect that a certificate existed, expired, was suspended, or was revoked, even after certification ends, so that third parties can verify historical status. Removal from the registry is at NAIWA's discretion and subject to the integrity and audit purposes described above.
No sale of personal data
NAIWA does not sell personal data.
Children's privacy
The Services are intended for business and professional use and are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided personal data through the Services, please contact privacy@naiwa.ae and we will take appropriate steps to remove it.
Security and breach
We apply administrative, technical, and organizational measures intended to protect personal data. No system is completely secure, and we cannot guarantee absolute security. If we become aware of a personal-data breach that requires notification, we will act in accordance with applicable law. To report a security concern, contact privacy@naiwa.ae.
Exercising your rights
Subject to applicable law, you may request access to, correction of, or deletion of your personal data, and may object to or restrict certain processing. To make a request, contact privacy@naiwa.ae. We may need to verify your identity and may retain certain records where we have a legal basis or obligation to do so. Some certification, registry, audit, and evidence records may be retained even after a deletion request to preserve the integrity of past assessments and to meet legal requirements.
11. Joining the launch waitlist
Before the platform opens, naiwa.ae hosts a launch waitlist. This section describes that, and only that.
If you join it, we collect the details you enter on the form and the date and time you submitted it, which is our record of your consent. Only your email address and whether you are here to discover businesses or you run one are required; your name, phone number, business name and how you heard about us are optional and the form works without them. We use them for one purpose: to email you when NAIWA launches. Our lawful basis is your consent, given by submitting the form after being told on the page what it is for. You can withdraw it at any time by writing to privacy@naiwa.ae, and withdrawing does not affect anything we did lawfully beforehand. You do not need to give a reason to be removed.
We do not add waitlist addresses to unrelated marketing, sell them, or share them with advertising networks. Waitlist addresses are held until we send the launch email and for up to twelve months after launch, and are then deleted. If you ask to be removed earlier we do that, and keep only the minimum needed to make sure we do not email you again by mistake.
The waitlist page sets no cookies of its own and runs no analytics or advertising trackers. It does load typefaces from Google Fonts, which means your browser requests them from a Google server and Google receives your IP address as part of that request. Our form provider and our hosting provider act as processors on our instructions and may process data outside the United Arab Emirates, as described in the cross-border transfers disclosure above.
Joining the waitlist does not create an account and does not sign you up to the Services. The rest of this policy applies once the platform itself is open to you.
Contact Us
For questions about this Privacy Policy or your personal data, please contact us at privacy@naiwa.ae