Privacy and Data Protection Policy

This policy explains how Biet Al Reef collects, uses, discloses, retains and protects personal data when users access the website, platform and related digital services. Biet Al Reef acts as controller where it determines the purposes and means of processing and may act as processor under a separate agreement in limited cases.

• Identity and contact data, including name, telephone number, email address, language and city.
• Business verification data, including the requester role, licences, professional documents and verification status.
• Business-profile data, including legal and trading names, services, products, projects, service areas, indicative prices and working hours.
• Project and request data, including descriptions, locations, measurements, images, budgets, schedules, quotations, responses and communications.
• Payment and billing data for paid services; full card data may be processed directly by an approved payment provider and not stored by Biet Al Reef.
• Device and usage data, including IP address, browser, operating system, viewed pages, events, session times and identifiers.
• User-submitted content, including images, files, reviews, reports and conversations with support or Weyaak.
• Approximate or precise location data where the user chooses to enable location-based search.

• Information provided directly through registration, forms, communications and service requests.
• Information generated through use of the website and Weyaak tools.
• Information supplied by an authorised customer, provider or partner within a project or request.
• Lawfully available public or commercial sources, including official websites, licences and business directories.
• Technical providers supporting hosting, analytics, payments, messaging, verification and security.

• Reviewing business-profile requests and verifying business identities, activities and documents.
• Publishing approved provider profiles, products, services and projects.
• Matching customer requests with relevant providers according to specialisation, location and available data.
• Managing quotation requests, internal tenders, communications and customer support.
• Operating Weyaak and AI-assisted tools and organising user requests.
• Processing subscriptions, payments, invoices and accounting obligations.
• Improving performance, user experience, security and fraud prevention.
• Sending operational notices and legal updates, and marketing communications where consent or another lawful basis applies.
• Complying with legal duties, regulatory requests and the defence of rights and claims.

• Performance of a contract or steps requested before entering into a contract.
• User consent where required, including certain marketing communications or precise location access.
• Legitimate interests in operating, improving and securing the platform and preventing fraud, subject to user rights.
• Compliance with legal or regulatory obligations and requests from competent authorities.
• Protection of rights, vital interests or legal claims where appropriate.

• Approved professional and business information may be published publicly, including business name, description, services, products, service areas, contact channels and project images.
• Providers must ensure that public submissions do not contain confidential or personal information they are not authorised to publish.
• Public pages may be indexed by search engines, discovery services and AI assistants in accordance with the site’s technical instructions.
• Providers may request correction, updating or removal subject to review, legal duties and contractual requirements.

• With customers or providers as necessary to process a quotation request, tender or communication initiated by the user.
• With hosting, storage, payment, messaging, analytics, security and verification providers under appropriate contractual controls.
• With legal advisers, accountants, auditors and other professional service providers where necessary.
• With governmental, judicial or regulatory authorities where required by law or necessary to protect rights, security and users.
• In a restructuring, merger or sale, subject to appropriate safeguards and notice where legally required.
• Biet Al Reef does not sell personal data as standalone data lists for data-brokerage purposes.

• Parts of a request or conversation may be sent to AI model or service providers to produce an answer, classification, summary or match, subject to available settings and agreements.
• Biet Al Reef seeks to minimise data and avoid sending unnecessary sensitive data where reasonably possible.
• Users should not submit trade secrets or highly sensitive health, financial or identity data to Weyaak unless a necessary and approved channel is available.
• AI outputs may be subject to human review for managed services, reports, support and quality assurance.
• Personal data will not be used to train a separate general-purpose Biet Al Reef model without a lawful basis and appropriate notice or consent where required.

• Some technical providers may use data centres or support teams outside the United Arab Emirates.
• Where personal data is transferred internationally, Biet Al Reef applies safeguards required by applicable law, including contractual, security and risk-assessment measures.
• Users may request general information about categories of providers and processing locations through the privacy contact channel.

• Data is retained for as long as necessary for the stated purpose, contract performance, legal compliance and dispute resolution.
• Account, transaction, consent, invoice, report and security records may be retained longer where legally or operationally necessary.
• Data is deleted or anonymised when no longer required unless a lawful reason for retention remains.
• Backups may remain for a limited period within controlled restoration and deletion cycles.

• Biet Al Reef applies appropriate technical and organisational controls, including access controls, encryption in transit, backups, monitoring, updates and least-privilege practices.
• Internal access is limited to persons who need data for authorised duties.
• No electronic system is completely risk-free, and absolute security cannot be guaranteed despite reasonable safeguards.
• Data incidents are assessed, contained and documented, and authorities or affected individuals are notified where required by law.
• Suspected account compromise, phishing or unauthorised access should be reported immediately.

• Request information about processing and obtain a copy of personal data, subject to applicable limits.
• Request correction of inaccurate data and completion of incomplete data.
• Request deletion or restriction where the legal conditions are met.
• Object to certain processing or withdraw consent without affecting earlier lawful processing.
• Request portability where technically and legally applicable.
• Challenge solely automated decisions producing legal or similarly significant effects and request human intervention where applicable.
• Submit a complaint to the competent data-protection authority if a request cannot be resolved directly.

• Requests may be sent to legal@bietalreef.ae or through the official contact form, identifying the requested action.
• Identity or authority may need to be verified before a request is completed.
• Requests are handled within the applicable legal period; extensions or refusals may apply where permitted and will be explained where required.
• Some data cannot be deleted where retention is legally required or necessary for claims, security or fraud prevention.

• The platform is primarily intended for adults, project owners and businesses and does not intentionally target children.
• Where a minor uses a service requiring parental or legal-representative consent, that consent must be obtained under applicable law.
• If data relating to a child is collected without an appropriate lawful basis, reasonable steps will be taken to delete or restrict it.

• Operational messages concerning accounts, requests, security and policies may be sent where necessary and are not optional marketing.
• Users may unsubscribe from marketing through the link, settings or support channels.
• Necessary service or legal communications may continue after marketing preferences are changed.

• Necessary storage may be used for security, language, privacy choices, forms and core website operation.
• Analytics, performance or marketing cookies may be used when activated in accordance with applicable consent requirements.
• Further details and control options are provided in the Cookie Policy.

• The platform may contain links to or integrations with third-party services governed by separate privacy policies.
• Biet Al Reef does not control third-party privacy practices, and users should review them before submitting information.

• This policy applies within the legal framework of the United Arab Emirates, including personal-data, electronic-transactions, cybercrime and digital-trade rules where applicable.
• The policy may be updated to reflect changes in services, technology or law, and the revision date will appear at the top of the page.
• Material changes will be notified where required by law or appropriate to the nature of the change.