1. Who controls your Personal Data
XPERDO Technologies Ltd., Commercial Licence No. CL13865, with its registered office at IH 00 01 03 OF 05, Level 3, Innovation One, Dubai International Financial Centre, Dubai, United Arab Emirates, operates the XAINA platform and is the controller of Personal Data described in this policy. Contact: info@xaina.ae.
2. Information we collect
- Provider and representative identity, business contact and application information.
- Service categories, delivery model, territories, capacity, availability and operating capabilities.
- Website, Google Business, social media and booking platform profiles supplied by you or identified from selected public business sources.
- Public ratings, reviews, reputation signals, portfolio information and other relevant business evidence.
- Trade licence, professional permit, insurance and verification information when an application proceeds.
- Technical information including IP address, browser, device, security and access logs.
3. How we use information
We use information to create a preliminary XAINA Fit Profile, assess category and territory alignment, identify potentially suitable XAINA modes, manage waitlists and provider applications, verify business readiness, communicate with applicants, protect the platform, prevent fraud and meet legal or regulatory obligations.
4. Provider Matching Engine and public sources
The Provider Matching Engine may compare information submitted by you with selected public business sources. Its result is a preliminary, evidence-informed assessment only. It is not approval, certification, eligibility confirmation or a guarantee of onboarding, bookings or revenue. Activation requires human review, legal verification and operational checks.
5. Lawful bases
Depending on the processing activity, we rely on consent, steps requested before entering a contract, performance of contractual obligations, compliance with legal duties and legitimate interests such as provider assessment, platform security, service quality and fraud prevention.
6. Sharing and international transfers
Information may be shared with authorised XPERDO personnel, affiliated operating entities, cloud and security providers, verification partners, professional advisers and competent authorities where required. Provider leads and enquiries may be processed using Google Workspace. If you accept analytics, measurement information may also be processed by Google Analytics and Meta Platforms. These providers may process information outside the DIFC or the United Arab Emirates. Where required, appropriate contractual, technical and organisational safeguards are applied. We do not sell provider personal data.
7. Retention and security
Provider applications, enquiries and related consent records are retained only for as long as reasonably necessary for assessment, onboarding, waitlist management, communication, security, dispute handling and legal obligations. Consent-based analytics data is initially retained for up to 14 months. Anonymous first-party event information is retained only for the period needed to evaluate and improve the provider journey and is reviewed periodically. We use role-based access controls, secure hosting, encryption where appropriate and operational safeguards designed to protect information.
8. Your rights
Subject to applicable DIFC data protection law, you may have rights to access, correct, erase, restrict or object to processing, request portability and withdraw consent. We may need to verify your identity and authority. Requests may be sent to info@xaina.ae.
9. Website measurement, cookies and external services
Essential hosting, security and font-delivery services may receive limited technical information required to deliver and protect the website. XAINA also records limited, aggregate first-party events to understand whether pages, calls to action and Provider Matching Engine steps function effectively. This essential measurement does not use cookies or local storage, does not create a persistent visitor profile and does not store full IP addresses, full referrer URLs, advertising click identifiers or cross-session identifiers in XAINA's analytics records.
Essential measurement may include page and section views, scroll milestones, selected interface interactions, Provider Matching Engine step progress, technical errors, a device category and a coarse traffic category such as Direct, Organic Search, Referral, Social, Email or Paid. A temporary page-session identifier expires when the page is closed and is not used to recognise the visitor on a later visit.
If you select “Accept analytics”, XAINA additionally uses Google Analytics 4 and the Meta Pixel to measure campaign performance and understand how visitors use the provider journey. Consent-based analytics may include session and anonymous visitor identifiers, page and section views, scroll depth, button and form-step interactions, device information, referring pages and campaign parameters such as UTM, GCLID or FBCLID values. Names, email addresses, telephone numbers, uploaded documents and free-text form entries are not sent as analytics event data.
The Meta Pixel is provided by Meta Platforms and may process browser, device, page-view and conversion-event information for campaign measurement, attribution and audience reporting in accordance with Meta’s applicable terms and privacy information. XAINA does not send provider form contents or contact details to the Meta Pixel.
Google Analytics and the Meta Pixel remain disabled unless you accept analytics. Selecting “Continue without analytics” keeps these external services disabled and does not restrict the website. Your choice is stored on your device. You may change or withdraw it at any time through “Privacy & analytics settings” in the footer. Simply using the website does not constitute consent to analytics or marketing technologies.
When you voluntarily submit a provider application or contact enquiry, XAINA records the source page and available campaign parameters with the submitted record so that we can understand and respond to the enquiry. These details form part of the submitted business record and are not used to activate Google Analytics or the Meta Pixel without your separate permission.
10. Changes
We may update this policy as the Provider Matching Engine, application workflow or legal requirements develop. The date shown above identifies the latest version.