Mazewerk Technology Limited Ver 1.0 | Effective Date: 2 May 2026 Controller: Mazewerk Technology Limited Contact: privacy@mazewerk.com Registered Address: IH-00-01-01-OF-01, Level 1, Innovation One, Dubai International Financial Centre, Dubai, United Arab Emirates

Overview

Mazewerk Technology Limited ("Mazewerk", "we", "us", "our", or "Studio") is a design engineering studio registered and operating within the Dubai International Financial Centre ("DIFC"), Dubai, United Arab Emirates. We provide design and engineering services for product and digital technology development, and consult and assist clients in developing the solutions they require. Our services are directed primarily at businesses; however, we also provide services to individual professionals upon request.

This Notice describes how we collect, use, store, and protect the personal data of individuals who interact with our studio, access our services, or communicate with us in any capacity — including visitors to our website or digital products, enquirers, and participants in research activities, pilot programmes, or events conducted by our studio. We value your privacy, we do not sell your data, and you have rights over it at any time.

Our data practices are governed by the DIFC Data Protection Law No. 5 of 2020 (the "DP Law" or "DIFC DPL"). (Article 5, DP Law) Our processing activities are registered with the DIFC Commissioner of Data Protection in accordance with Article 14(7) of the DP Law. Where applicable, we also observe relevant data protection laws and regulatory frameworks from other jurisdictions.

Amendments to this Notice will be posted on our website and will be effective when posted. Where changes are material, we will notify you by email or through a prominent notice on our website prior to the change taking effect.

Your Consent

Where you fill in a form, correspond with us by email, or otherwise contact us through any of our communication channels, you voluntarily provide personal data such as your name, job title, company name, email address, telephone number, postal address, and any additional information you include in your message. We collect and process personal data only where we have a lawful basis to do so, and only to the extent necessary for the purposes described in this Notice. (Article 9(1)(f), DP Law)

We process personal data on the basis of one of the following lawful bases:

Contract Performance — necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into such a contract, including delivering client engagements, processing invoices, and onboarding contractors. (Article 10(b), DP Law)

Legal Obligation — necessary for compliance with a legal obligation to which we are subject, including DIFC regulatory requirements and applicable UAE obligations. (Article 10(c), DP Law)

Legitimate Interests — necessary for our legitimate business interests, including business development, fraud prevention, network security, and service improvement, provided those interests are not overridden by your rights and freedoms. (Article 10(f), subject to Article 13, DP Law)

Consent — where you have provided freely given, specific, informed, and unambiguous consent for a defined purpose, such as participation in research activities or receipt of marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. (Article 10(a), subject to Article 12, DP Law)

Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights and freedoms. You may request details of that assessment at privacy@mazewerk.com.

Information We Collect About You

Personal Details and Contact Information. Information you provide when filling in forms, corresponding by email, or contacting us through any of our communication channels or third-party platforms. When you contact us, we retain at least an electronic record of that correspondence. This may include your full name, job title or position, company name, email address, telephone number, postal address, company location and registered address, and professional profiles.

Website and Technical Data. When you visit our website or interact with our digital products, we may automatically collect limited technical and operational data as necessary for the functioning, security, and improvement of our services. This may include usage, performance, authentication, and infrastructure data depending on the technologies and service providers employed at the time. Further details on cookies and tracking technologies are set out below.

Design and Research Data. Where you participate in research, design, pilot programmes, or sprint activities conducted by Mazewerk, we may collect responses, feedback, notes, recordings, or observational data relevant to the scope of the engagement, where your consent has been obtained. We do not sell, share, rent, or licence any identifiable data arising from our research activities to any third party, and we do not collect or process sensitive personal data during our research processes. Further details are set out under "Research and Design Activities" below.

Technical Access Data. Where we are engaged to provide technical services, we may process operational data including system access credentials and configuration information, solely for service delivery purposes. Such data is governed by the terms of the applicable service or engagement agreement and is not retained beyond the duration of that engagement.

Third Party and Client-Supplied Data. Clients may provide us with data sets, research materials, user information, or other content relating to individuals who are not party to our engagement — including their own customers, users, or employees. We process such data solely for the purposes of delivering the agreed services and strictly in accordance with the client's instructions. The client, as the originating data controller, bears sole responsibility for ensuring that any personal data supplied to us has been lawfully collected and complies with applicable data protection obligations prior to transfer; we accept no liability for the provenance, lawfulness, or accuracy of data supplied to us by a client or any third party. Any incidental personal data received outside the scope of an agreed engagement is not processed further and will be deleted or returned to the sender upon identification.

Use of Personal Information

We may use or disclose your personal information for the following purposes, each processed on the lawful basis indicated:

To respond to enquiries, deliver services, and manage general correspondence — Contract Performance

To maintain our website and digital products — Legitimate Interests

To conduct research and design activities — Consent

To engage in business development outreach with commercial contacts whose details are available through public professional channels — Legitimate Interests (Article 10(f), DP Law)

To fulfil our legal and regulatory obligations — Legal Obligation

Processing is limited to what is necessary for each specific purpose. Recipients of business development outreach may opt out at any time by contacting privacy@mazewerk.com or requesting to be placed on our do-not-engage list.

Sharing Your Personal Information

We do not sell, rent, or trade your personal data. We share personal data only where necessary for the delivery of our services, the fulfilment of our legal obligations, or the legitimate operation of our business, strictly on a need-to-know basis. (Article 9(1)(j), DP Law) Recipients fall into the following categories:

Infrastructure and service providers — bound by data processing agreements requiring them to handle personal data in accordance with the DP Law. (Article 24, DP Law)

Professional advisers — legal, financial, or compliance advisers, where disclosure is necessary and proportionate.

Subcontractors and project partners — subject to confidentiality obligations and data handling requirements consistent with this Notice.

Legal and regulatory authorities — where required by applicable law, court order, or legitimate regulatory request. (Article 10(c), DP Law)

Sub-processors. The following third-party sub-processors process personal data on our behalf under data processing agreements, on our documented instructions and in accordance with the DP Law: (Article 24(1), DP Law)

Amazon Web Services EMEA SARL — cloud infrastructure and hosting. Primary processing locations: Luxembourg and the United States, under the AWS Data Processing Addendum.

Google Ireland Limited — workspace, productivity, and analytics services, under Google's Data Processing Agreement. Processing within the EEA and, where applicable, the United States.

DocuSign Inc. — document execution and electronic signing, under DocuSign's Data Processing Agreement. Processing in the United States.

PandaDoc Inc. — document preparation and electronic signing, under PandaDoc's Data Processing Agreement. Processing in the United States.

Resend Inc. — transactional email and form submission routing, under Resend's Data Processing Agreement, incorporating European Standard Contractual Clauses. Form data is routed via Resend to our Google Workspace, with TLS encryption applied in transit.
Framer, Inc. — website hosting and website form submission handling (Framer Forms), under Framer's Data Processing Addendum. Framer acts as a data processor in this arrangement, processing personal data on our documented instructions.

Website Infrastructure. Our website is currently built and hosted on Framer, which also processes any data submitted through Framer Forms on our behalf. Communications and form submissions routed through the site are handled by Framer and, where applicable, the relevant downstream communication service, in accordance with this Notice. (Article 14(2), DP Law)

Transfers Outside the DIFC. Where personal data is transferred from within the DIFC to a recipient located outside the DIFC, transfers are conducted in accordance with Part 4 of the DP Law and Regulation 5 of the DIFC Data Protection Regulations 2020. Transfers to jurisdictions not recognised as adequate by the DIFC Commissioner of Data Protection are governed by the Standard Contractual Clauses approved by the DIFC Authority. (Article 27, DP Law) Where sub-processors are located in jurisdictions recognised as adequate, or other appropriate transfer mechanisms are in place, we rely on those mechanisms accordingly. (Article 26, DP Law) The DIFC Abbreviated Standard Contractual Clauses (2023) are available on the DIFC Authority website.

Social Media and External Platforms

We maintain professional profiles on social media and directory platforms including LinkedIn, Instagram, X (formerly Twitter), Behance, Dribbble, Contra, and Clutch. When you engage with us through those platforms, your data is processed by the relevant platform under its own privacy policy and terms of service; we are not responsible for the data practices of those platforms. We act as an independent data controller only in respect of personal data you provide to us directly through those channels, such as direct messages or enquiries, which is handled in accordance with this Notice.

Cookies and Tracking Technologies

We use cookies and similar technologies only where necessary for the functioning, security, and improvement of our website and digital products, in accordance with the data minimisation principle and privacy-by-default requirements of the DP Law. (Article 9(1)(f) and Article 14(4), DP Law) Details of the cookies in use, their purpose, and the basis on which they are deployed are made available through our cookie consent mechanism on the website.

Non-essential cookies, including analytics or marketing cookies, are only activated upon your explicit consent via that mechanism. You may withdraw or amend your consent at any time through the cookie settings on our website; withdrawal does not affect the lawfulness of processing carried out prior to withdrawal. (Article 12, DP Law)

Research and Design Activities

Where you participate in research, design, testing, pilot programmes, or sprint activities conducted by Mazewerk — in connection with a client engagement or as part of our own programmes — we may collect responses, feedback, notes, recordings, or observational data relevant to the scope of the engagement. Participation is entirely voluntary. Prior to any session involving identifiable data, you will be provided with a clear participant information notice and your explicit consent will be obtained before the session commences; you may withdraw consent at any time without consequence. (Article 12(5), DP Law)

Research data is processed on the basis of our legitimate interests in developing and improving our services. (Article 10(f), subject to Article 13, DP Law) Where appropriate, identifiable research data is anonymised or aggregated following the conclusion of the engagement, at which point it falls outside the scope of the DP Law. Anonymised outputs may thereafter be used for research publications, case studies, or service improvement purposes. We do not sell, share, rent, or licence any identifiable personal data arising from our research activities to any third party.

Storage of Personal Information

Personal data is hosted and processed through the cloud infrastructure providers identified above under Sub-processors. These providers operate industry-standard physical, technical, and organisational security controls, and we assess their security posture prior to engagement and on an ongoing basis. We do not use high-risk methods of processing, storing, or transferring personal data.

Security Measures. Our technical and organisational measures include: Transport Layer Security (TLS) encryption applied across all data in transit, including form submissions, email routing, document execution, and workspace communications; encryption at rest as applied by our infrastructure providers as standard; access controls restricting personal data to authorised personnel on a least-privilege basis; confidentiality obligations applied to all staff and subcontractors who handle personal data; and regular assessments of our data handling practices and the security standards of our service providers. (Article 14(2), DP Law) No method of transmission or storage over the internet can be guaranteed entirely secure; whilst we take all reasonable and available measures, we cannot warrant absolute security.

Retention of Personal Information

We retain personal data only for as long as necessary for the purposes for which it was collected and in accordance with our legal and regulatory obligations. (Article 9(1)(i), DP Law)

Client and engagement records: 10 years from the conclusion of services or expiry of the relevant contract

Enquiries and unconverted leads: 3 years from the date of last contact

Research and design session data: 3 years from the date of collection, or such shorter period as agreed with the participant

Technical and operational data: the duration of service operation, or as required by applicable law, whichever is longer

Legal and compliance records: as required by applicable law and DIFC regulatory obligations

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where personal data is held by sub-processors, we will request deletion in accordance with the terms of the applicable data processing agreement.

Data Breach Notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the DIFC Commissioner of Data Protection without undue delay and, where feasible, within 72 hours of becoming aware of the breach. (Article 41, DP Law) Where a breach is likely to result in a high risk to your rights and freedoms, we will notify affected individuals directly without undue delay, providing details of the nature of the breach and the measures taken or proposed to address it. (Article 42, DP Law)

Children's Data

Our services, website, and digital products are directed exclusively at businesses, adult individuals, and professionals. We do not knowingly collect, process, or solicit personal data from individuals under the age of 18. If we become aware that personal data relating to a minor has been inadvertently collected, we will take immediate steps to delete such data without undue delay. If you believe we may have collected data relating to a minor, please contact us at privacy@mazewerk.com with the subject line "Child Data Notice".

Automated Decision-Making and Profiling

We do not engage in automated decision-making or profiling activities that produce legal or similarly significant effects on individuals. All decisions relating to our engagement with you involve human review and oversight. (Article 38, DP Law)

Your Rights and How to Exercise Them

Under the DIFC Data Protection Law No. 5 of 2020, you have the following rights in relation to the personal data we hold about you. These rights are not absolute and may be subject to conditions or limitations under applicable law.

Right of Access — confirmation of whether we hold personal data about you, and a copy of that data together with information about how and why we process it. (Article 33, DP Law)

Right to Rectification — correction of inaccurate or incomplete personal data; where shared with third parties, we will endeavour to notify them of verified corrections. (Article 33 and 36, DP Law)

Right to Erasure — deletion of personal data where we no longer have a lawful basis to retain it, where you have withdrawn consent, or where it has been processed unlawfully, unless we are required to retain it under applicable law or for the establishment or defence of legal claims. (Article 33, DP Law)

Right to Restriction of Processing — limitation of processing in certain circumstances, such as while accuracy is contested or an objection is being assessed. (Article 35, DP Law)

Right to Data Portability — receipt of your personal data in a structured, commonly used, machine-readable format, where processing is based on consent or contract performance and carried out by automated means. (Article 37, DP Law)

Right to Object — objection to processing based on legitimate interests, with an unconditional right to object to direct marketing (including related profiling); we will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests. (Article 34, DP Law)

Rights in Relation to Automated Decision-Making — we do not make decisions based solely on automated processing that produce legal or similarly significant effects; should this change, you will be informed and offered human review. (Article 38, DP Law)

Right Not to be Discriminated Against — we will not deny services, apply differential pricing, or provide diminished service quality as a result of you exercising these rights. (Article 39, DP Law)

Right to Lodge a Complaint — with the DIFC Commissioner of Data Protection, the primary supervisory authority for DIFC-registered entities, at commissioner@dp.difc.ae.

How to Exercise Your Rights. You may submit a Data Subject Access Request ("DSAR") by email to dpo@mazewerk.com with the subject line "DSAR:", by telephone on +971 54 549 2791, or via the DSAR Request Form at mazewerk.com/privacy. DSARs are processed at no cost, save that we reserve the right to impose a reasonable fee where a request is manifestly unfounded, excessive, or repetitive, notified to you in advance. We will respond to all valid requests within one month of receipt and may request verification of your identity before processing your request. (Article 33(4), DP Law)

Changes to This Notice

We may update this Notice from time to time to reflect changes in our data practices, services, or applicable law. Where changes are material, we will notify you by email or through a prominent notice on our website prior to the change taking effect. The version number and effective date at the top of this Notice will be updated accordingly. We encourage you to review this Notice periodically.

Contact Us

If you have any questions, concerns, or complaints regarding this Notice or how we handle your personal data, please contact us through any of the following:

Email: privacy@mazewerk.com

Data Protection Officer: dpo@mazewerk.com

Contact number: +971 54 549 2791

DSAR Request Form: mazewerk.com/privacy

Mazewerk Technology Limited, First Floor, Innovation One, Dubai International Financial Centre, Dubai, United Arab Emirates

If you wish to escalate a concern to the supervisory authority, you may contact the DIFC Commissioner of Data Protection directly at commissioner@dp.difc.ae.