Privacy Policy

OppSure Gulf Partners is the data controller responsible for the personal data collected on this website. We are a B2B sales development company providing outsourced cold calling and qualified lead generation services to businesses operating in the Gulf Cooperation Council (GCC) region.

For UK GDPR purposes, our UK representative can be contacted at the same email address above. We do not currently have a mandatory obligation to appoint a Data Protection Officer (DPO) under Article 37 UK/EU GDPR, as we do not carry out large-scale systematic monitoring of individuals or process special category data. However, our privacy contact above handles all data protection enquiries.

Under UK GDPR Article 6 and EU GDPR Article 6, we must have a lawful basis for each processing activity. Under UAE PDPL and KSA PDPL, consent is the default basis unless an exemption applies. The table below sets out our lawful basis for each activity.

Where we rely on consent, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent, email [email protected].

Where we rely on legitimate interests, we have carried out a balancing test and determined that our interests in improving our services and responding to business enquiries do not override your fundamental rights and freedoms, particularly given that we only contact individuals who have actively engaged with our website.

We use your personal data only for the specific purposes for which it was collected (purpose limitation principle). We will not use your data for any new purpose without notifying you and, where required, obtaining fresh consent. Specifically, we use your data to:

• Respond to your enquiry and schedule a sales consultation
• Deliver your personalised ROI projection from the calculator
• Send the OppSure newsletter to which you have subscribed
• Prepare and send a personalised service proposal following a fit assessment
• Maintain records of consent for regulatory accountability
• Analyse anonymised website usage to improve performance
• Comply with applicable legal obligations

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. Our retention periods are as follows:

After the applicable retention period, data is securely deleted from our database. You may request early deletion at any time — see Section 8 (Your Rights) below.

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share data only with the following categories of recipients, and only to the extent necessary:

Where data is transferred to countries outside the UK, EU, UAE, or KSA, we ensure appropriate safeguards are in place. For transfers to the USA, we rely on Standard Contractual Clauses (SCCs) adopted by the European Commission, which also satisfy UK GDPR transfer requirements under the International Data Transfer Agreement (IDTA) framework. For UAE and KSA cross-border transfers, we ensure the recipient country provides an adequate level of protection or that appropriate contractual safeguards are in place.

We use cookies and similar technologies on this website. Under UK PECR (Privacy and Electronic Communications Regulations), EU ePrivacy Directive, and UAE PDPL, we must obtain your consent before placing non-essential cookies on your device.

You can manage your cookie preferences at any time via the cookie banner displayed on your first visit, or by adjusting your browser settings. Withdrawing consent for analytics cookies will not affect your ability to use the website.

Depending on your location, you have the following rights regarding your personal data. We will respond to all valid requests within 30 days (UK/EU GDPR), 30 days (UAE PDPL), or 30 days (KSA PDPL).

To exercise any of these rights, or to submit a data deletion request, please email [email protected] with the subject line "Data Subject Request" and include your name and the email address you used when submitting a form on our website. We will verify your identity before processing the request.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS (HTTPS)
• Database access restricted to authenticated server-side processes only
• IP addresses stored only as one-way cryptographic hashes (SHA-256) for consent audit purposes
• Access to the admin leads dashboard restricted to authenticated site owners only
• Regular security reviews of our hosting infrastructure

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by UK/EU GDPR Article 33 and UAE PDPL. Where the breach is likely to result in a high risk to you, we will also notify you directly.

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the relevant supervisory authority:

• UK: Information Commissioner's Office (ICO) — ico.org.uk
• EU: Your local EU Data Protection Authority (DPA)
• UAE: UAE Data Office — uaedataoffice.gov.ae
• Saudi Arabia: Saudi Data and Artificial Intelligence Authority (SDAIA) — sdaia.gov.sa

We would appreciate the opportunity to address your concerns before you contact a supervisory authority, so please reach out to us first at [email protected].