Data Protection Policy

1Purpose

ZIRCA SOFTWARE SOLUTIONS - FZCO, trading as Zirca (“Zirca”, “we”, “us” or “our”), operates an AI-powered financial management platform designed to bring an individual’s financial world together in one secure platform.

Zirca’s purpose is to consolidate fragmented financial information and provide users with a complete, real-time understanding of their financial position.

Zirca may enable users to connect supported financial accounts and track assets, investments, liabilities, transactions, income, spending, cash flow, financial goals and other financial information through a unified platform.

Zirca may also provide financial analytics, transaction categorisation, budgeting, financial goals, investment and digital-asset tracking, reports, notifications and AI-powered financial insights.

Because Zirca may process highly confidential financial information, protecting Personal Data is a fundamental part of Zirca’s product design, technology, security, governance and operations.

This Data Protection Policy establishes the principles and controls governing Zirca’s collection, use, storage, disclosure, transfer, protection and deletion of Personal Data.

This Policy should be read together with Zirca’s:

• Privacy Policy
• Cookie Policy
• Terms and Conditions
• Information Security policies
• Data Retention procedures
• Incident Response and Data Breach procedures
• Other applicable notices and contractual terms

Where mandatory applicable law imposes requirements that differ from this Policy, the applicable law will prevail.

2Zirca’s Data Protection Principles

Zirca’s approach to data protection reflects the principle that financial information is entrusted to Zirca for the purpose of providing its services.

Zirca therefore seeks to operate according to the following principles:

3Scope

This Policy applies to Personal Data processed by or on behalf of Zirca through:

• The Zirca website
• Zirca web applications
• Zirca mobile applications
• Connected financial accounts
• Financial-data APIs
• Open Finance integrations where applicable
• Authorised financial-data providers
• Customer-support channels
• Communications
• AI-powered features
• Analytics systems
• Business accounts
• Third-party integrations
• Zirca’s internal systems
• Other Zirca products and services

This Policy may apply to Personal Data relating to:

• Individual users
• Prospective users
• Business users
• Business owners
• Directors
• Employees
• Authorised representatives
• Account administrators
• Customer-support users
• Other individuals whose Personal Data Zirca lawfully receives

4Zirca’s Current Product and Regulatory Position

Zirca’s current MVP is focused on providing users with a unified and intelligent view of their financial position.

The MVP is intended to include:

• Secure authentication and onboarding
• Supported bank and financial-account connections
• Manual account, asset and liability creation
• Transaction categorisation
• Net-worth tracking
• Income tracking
• Spending tracking
• Cash-flow tracking
• Investment tracking
• Cryptocurrency and digital-asset tracking where supported
• Financial goals
• Budgeting
• AI-powered financial insights
• Personalised financial notifications
• Dashboards
• Reports
• Data exports

The following activities are not part of Zirca’s current MVP unless and until Zirca expands its services and satisfies all applicable legal and regulatory requirements:

• Payments
• Money transfers
• Lending
• Credit products
• Tax preparation or filing
• Financial marketplaces
• Regulated investment advice
• Custody of customer assets
• Holding customer funds
• Execution of financial transactions
• Advanced regulated financial planning
• Other regulated financial services requiring a licence or approval

If Zirca expands into regulated financial services, the relevant regulatory requirements, licensing structure, data-processing arrangements and privacy framework will be reviewed before those activities commence.

5Regulatory Framework

Zirca will comply with applicable data-protection, privacy, cybersecurity and financial-sector requirements in the jurisdictions in which it operates.

For its UAE operations, the principal federal data-protection framework is Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data (“UAE PDPL”), subject to its scope, exclusions and any applicable sector-specific legislation.

The UAE PDPL establishes requirements concerning, among other matters:

• Lawful processing
• Consent
• Transparency
• Data-subject rights
• Security
• Processing by third parties
• Data breaches
• Data Protection Officers
• Impact assessments
• Automated processing
• Profiling
• Cross-border transfers

Where a specific Zirca activity falls within another UAE regulatory regime, Zirca will comply with the requirements applicable to that activity.

Where Zirca participates in the UAE Open Finance Framework, Zirca will comply with applicable CBUAE requirements in addition to applicable data-protection law.

The CBUAE Open Finance Regulation, C 03/2025, establishes the UAE framework governing the licensing, supervision and operation of Open Finance Services, including data sharing and transaction initiation.

6Controller and Processor Status

Zirca’s legal role in relation to Personal Data will depend on the particular processing activity.

Zirca may act as:

• A Data Controller
• A joint controller where legally applicable
• A Data Processor acting on behalf of another controller

For example, Zirca may act as a Controller for information relating to a user’s Zirca account, service usage and product analytics.

Zirca may act as a Processor where it processes Personal Data solely on documented instructions from a business customer.

Zirca will determine and document its role for material processing activities and will apply the corresponding legal and contractual obligations.

7Categories of Personal Data

Depending on the services used, Zirca may process the following categories of Personal Data.

7.1  Identity Information

This may include:

• Name
• Date of birth
• Identification information where required
• Account identifiers
• Profile information
• Other information necessary to establish or maintain an account

7.2  Contact Information

This may include:

• Email address
• Telephone number
• Address
• Communication preferences
• Other contact information provided by the user

7.3  Authentication and Security Information

This may include:

• Authentication information
• Security settings
• Session information
• Multi-factor authentication information
• Account-recovery information
• Security logs

8Financial Information

Financial information is central to Zirca’s services.

Depending on the connected accounts and services used, Zirca may process:

• Bank-account information
• Account identifiers
• Account balances
• Transaction information
• Transaction descriptions
• Income
• Expenditure
• Spending information
• Recurring payments
• Subscriptions
• Savings
• Investments
• Investment positions
• Investment performance
• Cryptocurrency information
• Digital-asset information
• Assets
• Liabilities
• Debts
• Loans
• Financial goals
• Budgets
• Reserves
• Net worth
• Cash flow
• Financial ratios
• Financial trends
• Other information required to provide Zirca’s services

9Personal Data within Business Information

Zirca may provide functionality for business users as the product and business model develop.

Business information may include:

• Revenue
• Expenses
• Cash flow
• Assets
• Liabilities
• Reserves
• Financial ratios
• Transaction information
• Performance metrics
• Financial targets
• Operational information

Business information may also contain Personal Data relating to:

• Business owners
• Directors
• Employees
• Customers
• Suppliers
• Contractors
• Authorised representatives

Where business information contains Personal Data, Zirca will process that Personal Data in accordance with applicable data-protection requirements.

10Technical and Usage Information

Zirca may process technical information necessary to operate, secure and improve the platform, including:

• IP address
• Device information
• Operating system
• Browser information
• Application version
• Device identifiers
• Authentication logs
• Security logs
• Crash reports
• Diagnostic information
• Feature usage
• Session information
• Other technical information

11Financial Goals, Preferences and Behaviour

Zirca may process information relating to a user’s financial objectives, preferences and interaction with the platform, including:

• Savings goals
• Spending goals
• Budgets
• Financial targets
• Spending categories
• Account thresholds
• Savings progress
• Financial preferences
• Financial habits
• Financial-health metrics
• Interaction with Zirca’s financial insights

This information may be used to provide personalised functionality within Zirca.

For example, Zirca may provide a notification when a user:

• reaches a savings goal;
• exceeds a user-defined target;
• reduces spending;
• increases savings;
• experiences a significant change in a financial metric; or
• achieves another user-defined financial objective.

12Sources of Personal Data

Zirca may receive Personal Data from:

Users

Including information supplied during:

• Registration
• Onboarding
• Account setup
• Manual account creation
• Financial-goal creation
• Budgeting
• Support interactions
• AI interactions

Connected Financial Accounts

Where users choose to connect supported financial accounts, Zirca may receive information through:

• Authorised APIs
• Open Finance infrastructure
• Licensed financial-data providers
• Financial-data aggregators
• Other lawful connection mechanisms

Business Customers

Zirca may receive Personal Data from business customers where Zirca provides services to them.

Service Providers

Zirca may receive information from service providers supporting:

• Identity verification
• Authentication
• Security
• Analytics
• Communications
• Customer support
• Financial-data connectivity
• Other legitimate services

Other Lawful Sources

Zirca may receive information from other sources where permitted by applicable law and where reasonably necessary for its services.

13Financial Account Connections

A central element of Zirca’s proposition is the ability to consolidate supported financial accounts into one platform.

Where a user chooses to connect an account, Zirca may receive financial information made available through the relevant connection provider.

Zirca will:

• obtain the required user authorisation or consent;
• use supported connection mechanisms;
• request only relevant information;
• process the information for disclosed purposes;
• apply appropriate access controls;
• protect the information received;
• provide appropriate account-disconnection functionality; and
• respect applicable data-protection and financial-sector requirements.

The CBUAE Open Finance framework expressly prohibits data scraping and interception of digital connections for activities subject to that framework.

14Read-Only Account Connections

Zirca’s initial account-connection model is designed around providing visibility and financial intelligence rather than moving money.

Where a connection is read-only:

• Zirca cannot move funds through that connection;
• Zirca cannot initiate payments through that connection; and
• Zirca will not request transaction-initiation permissions that are not necessary for the relevant service.

Where Zirca introduces transaction-initiation functionality in the future, that functionality will be subject to a separate legal, regulatory, security and product review.

15Open Finance

Zirca may obtain financial information through providers participating in or authorised under the UAE Open Finance Framework.

If Zirca itself becomes an Open Finance Provider, it will comply with all requirements applicable to its licensed activities.

The CBUAE’s current framework requires applicable Open Finance Providers to obtain explicit user consent for processing Personal Data for Open Finance Services, subject to the framework’s restrictions.

Where Zirca uses a third-party Open Finance Provider, that provider’s regulated obligations will apply to its own regulated activities, while Zirca will remain responsible for processing carried out by Zirca.

16Open Finance Consent

Where Zirca itself operates as an Open Finance Provider, consent will be obtained in accordance with applicable CBUAE requirements.

Consent will be:

• Specific to the purpose
• Informed
• Unambiguous
• Freely given
• Provided through a clear affirmative action
• Separately distinguishable where multiple purposes exist
• Capable of withdrawal

The CBUAE framework also requires consent to be limited to information necessary for the relevant purpose.

Where Zirca uses a third-party Open Finance Provider, Zirca will comply with the consent and contractual requirements applicable to Zirca’s role.

17Open Finance Data Restrictions

If Zirca becomes an Open Finance Provider, Zirca will comply with the CBUAE restrictions governing the processing and use of Open Finance data.

In particular, Zirca will not use Open Finance data for purposes unrelated to the relevant authorised Open Finance service except where permitted by applicable law.

The CBUAE framework also imposes restrictions on processing certain Sensitive Data for Open Finance Services, even where a user has provided consent.

18Open Finance Record Keeping

If Zirca becomes an Open Finance Provider, Zirca will maintain the records required by the CBUAE.

The current CBUAE framework requires Open Finance Providers to maintain records including:

• User consent
• User Data provided
• Transactions initiated
• Evidence concerning disposal of relevant transaction data

The regulation requires specified Open Finance records to be retained securely for at least five years unless another applicable requirement applies.

19Open Finance Data Location

If Zirca becomes an Open Finance Provider, Zirca will comply with applicable CBUAE data-location requirements.

The current CBUAE framework requires Open Finance Providers to store Open Finance Service data within the UAE and restricts maintaining copies outside the UAE unless specified approvals and user-consent requirements are satisfied.

Where Zirca uses a third-party Open Finance Provider, the provider’s own regulatory obligations will apply to the provider’s regulated activities.

Zirca will separately assess the data-location requirements applicable to its own processing.

20Purposes of Processing

Zirca may process Personal Data for the following purposes:

Providing Zirca Services

Including:

• Account management
• Financial-account connectivity
• Financial aggregation
• Transaction categorisation
• Net-worth calculation
• Income and expenditure tracking
• Cash-flow analysis
• Investment tracking
• Digital-asset tracking
• Budgeting
• Financial goals
• Dashboards
• Reports
• Exports

Financial Intelligence

Including:

• Analysing financial information
• Identifying trends
• Explaining changes
• Identifying recurring expenses
• Calculating financial metrics
• Generating financial insights
• Providing forecasts where included in the user’s plan
• Helping users understand their financial position

AI Features

Including:

• Generating financial insights
• Answering user questions
• Explaining financial information
• Identifying patterns
• Supporting financial analysis
• Providing contextual information

Personalisation

Including:

• Personalised dashboards
• Financial notifications
• Goal-related information
• Relevant insights
• User preferences

Security

Including:

• Authentication
• Access control
• Fraud prevention
• Security monitoring
• Incident detection
• Investigation
• Prevention of misuse

Product Development

Including:

• Analytics
• Performance monitoring
• Troubleshooting
• Testing
• Product improvement
• Feature development
• Service reliability

Legal and Regulatory Compliance

Including:

• Complying with applicable laws
• Responding to lawful requests
• Maintaining required records
• Resolving disputes
• Preventing unlawful activity
• Protecting Zirca’s legal rights

21Lawful Basis for Processing

Zirca will identify and document the appropriate lawful basis for material processing activities.

Where applicable law requires consent, Zirca will obtain consent in a manner that is:

• Clear
• Specific
• Informed
• Unambiguous
• Appropriately recorded
• Capable of being withdrawn

Where another lawful basis applies, Zirca will rely on that basis to the extent permitted by applicable law.

Withdrawal of consent will not invalidate processing that was lawfully carried out before withdrawal.

Where continued processing is permitted or required under another lawful basis, Zirca may continue such processing to the extent legally permitted.

22AI-Powered Financial Intelligence

Zirca’s AI capability is a central component of its product proposition.

Zirca AI may transform financial data using analytics, forecasting and machine-learning technologies to provide users with information concerning their financial position and potential changes in their financial circumstances.

Examples may include:

• Explaining spending changes
• Identifying unusual transactions
• Identifying recurring costs
• Highlighting changes in financial behaviour
• Forecasting cash flow where available
• Explaining financial trends
• Identifying goal progress
• Generating actionable financial information

23AI Data Processing

Where a user interacts with Zirca AI, Zirca may process:

• User prompts
• Financial information relevant to the request
• Transaction information
• Financial goals
• Account information
• Generated responses
• Interaction history
• Feedback
• Relevant technical information

Zirca will apply data minimisation and purpose limitation to AI processing.

Where third-party AI providers are used, Zirca will assess:

• Security
• Confidentiality
• Data retention
• Data location
• Model-training practices
• Sub-processors
• Deletion
• International transfers
• Contractual protections

24AI Model Training

Where data is used for model improvement or product analytics, Zirca will seek to use appropriately minimised, aggregated, anonymised or otherwise protected information where appropriate.

25Profiling and Automated Processing

Zirca may use automated processing and profiling to:

• categorise transactions;
• identify spending patterns;
• analyse income and expenditure;
• calculate financial metrics;
• identify recurring expenses;
• identify financial trends;
• monitor financial goals;
• personalise information;
• generate financial insights; and
• analyse business financial performance.

Profiling may involve analysing or predicting aspects of a person’s financial performance, financial condition, preferences or behaviour.

Zirca will assess higher-risk automated processing activities and implement appropriate safeguards where required.

26Automated Decisions

Zirca’s core MVP is not intended to make decisions concerning a user’s eligibility for:

• Credit
• Lending
• Insurance
• Employment
• Investment products
• Other regulated financial services

Zirca may use automated processing to generate informational insights and analytics.

Where Zirca introduces automated decision-making that may produce legal effects or similarly significant effects on individuals, the processing will be subject to an appropriate legal, regulatory, privacy and risk assessment before implementation.

Where applicable law provides rights relating to automated decisions or profiling, Zirca will provide the relevant safeguards and mechanisms required by law.

27Financial Advice and Recommendations

Zirca’s current product is positioned as a financial intelligence and management platform.

Zirca’s insights may:

• explain financial information;
• identify trends;
• highlight changes;
• forecast financial information where available;
• identify opportunities for the user to review their finances; and
• provide general financial information.

Where a particular feature, product or jurisdiction would cause Zirca’s activity to fall within a regulated advisory service, Zirca will assess and address the applicable licensing requirements before providing that service.

Where Zirca operates as an Open Finance Provider, it will comply with the applicable CBUAE restrictions concerning advice and personal and specific recommendations relating to particular Accounts or Products.

28Data Sharing

Zirca may share Personal Data where necessary and lawful with:

• Financial-data providers
• Open Finance Providers
• Financial institutions
• Cloud infrastructure providers
• Cybersecurity providers
• Analytics providers
• AI providers
• Identity-verification providers
• Authentication providers
• Customer-support providers
• Communications providers
• Professional advisers
• Regulators
• Courts
• Law-enforcement authorities
• Other service providers

Zirca will seek to limit disclosures to information reasonably necessary for the relevant purpose.

Zirca will not disclose Personal Data for unrelated purposes without an appropriate lawful basis.

29No Sale of Personal Financial Data

Zirca’s business model is based on subscription services rather than selling users’ Personal Financial Data.

This commitment does not prevent Zirca from:

• using service providers to process data on Zirca’s behalf;
• sharing information where legally required;
• sharing information where necessary to provide a requested service;
• sharing information with authorised financial-data providers;
• using appropriately anonymised information; or
• undertaking other lawful processing disclosed to users.

30Third-Party Processors

Zirca may engage third-party processors to support its services.

Before appointing material processors, Zirca will conduct proportionate due diligence.

Where appropriate, contractual arrangements will address:

• Processing instructions
• Confidentiality
• Security
• Permitted purposes
• Retention
• Deletion
• Sub-processors
• International transfers
• Breach notification
• Data-subject rights
• Audit or assurance
• Regulatory cooperation

Zirca will remain responsible for the processing activities it controls and for appropriate oversight of processors acting on its behalf.

31International Transfers

Zirca may use service providers or infrastructure located outside the UAE.

Where Personal Data is transferred or made accessible outside the UAE, Zirca will comply with applicable cross-border transfer requirements.

Depending on the applicable legal framework, safeguards may include:

• Adequacy mechanisms
• Contractual safeguards
• Regulatory approvals
• Consent
• Transfer assessments
• Encryption
• Access controls
• Other legally recognised safeguards

Where Zirca becomes subject to sector-specific data-localisation requirements, including requirements applicable to an Open Finance Provider, those requirements will be applied to the relevant processing.

32Data Security

Zirca will implement technical and organisational measures appropriate to the nature and risk of its processing.

These may include:

• Encryption in transit
• Encryption at rest
• Pseudonymisation
• Access controls
• Least-privilege access
• Multi-factor authentication
• Privileged-access controls
• Secure API architecture
• Secrets management
• Logging
• Monitoring
• Vulnerability management
• Penetration testing
• Secure software-development practices
• Backup and recovery
• Incident response
• Security testing
• Employee training

Zirca will periodically review and improve its security controls.

33Financial Data Security

Financial information will receive heightened protection.

Zirca may implement:

• Segregated financial-data environments
• Restricted access
• Enhanced monitoring
• Encryption
• Tokenisation where appropriate
• Access logging
• Privileged-access controls
• Enhanced incident response
• Secure deletion
• Periodic security assessments

Personnel will only access financial information where necessary for their authorised responsibilities.

34Employee and Contractor Access

Employees and contractors will only receive access to Personal Data where necessary for their role.

Zirca will apply:

• Role-based access
• Least privilege
• Confidentiality obligations
• Access reviews
• Security training
• Appropriate disciplinary or contractual controls

Access to Highly Confidential / High-Risk Data will be subject to additional controls.

35Privacy by Design and Default

Privacy and security will be considered during product development rather than only after implementation.

Zirca will consider privacy when designing:

• Account connections
• APIs
• Databases
• AI features
• Analytics
• Dashboards
• Notifications
• Business features
• Third-party integrations
• Data exports
• New products

Zirca may use:

• Minimisation
• Pseudonymisation
• Anonymisation
• Encryption
• Aggregation
• Access controls
• Segregation
• Configurable retention

to reduce privacy risks.

36Data Protection Impact Assessments

Zirca will conduct Data Protection Impact Assessments (“DPIAs”) where required by applicable law and where processing presents a sufficiently high privacy risk.

DPIAs may be appropriate for:

• Extensive profiling
• High-risk AI processing
• Automated decision-making
• Large-scale processing of Sensitive Personal Data
• Substantial financial-data aggregation
• New technologies
• Major financial-data integrations
• Significant changes to data architecture
• Other high-risk processing

A DPIA may consider:

• Purpose
• Necessity
• Proportionality
• Categories of data
• Affected individuals
• Potential harm
• Security
• Third-party access
• International transfers
• Retention
• Mitigation measures
• Residual risk

37Data Protection Officer

Zirca will assess its obligation to appoint a Data Protection Officer based on its actual processing activities and applicable law.

Given Zirca’s intended processing of substantial financial information, profiling, AI and automated processing, Zirca intends to maintain appropriate senior-level privacy oversight.

Where a DPO is legally required, Zirca will appoint a suitably qualified person and provide the resources and independence required for the role.

Where a DPO is appointed, the relevant contact details will be made available through Zirca’s privacy documentation.

38Data Subject Rights

Subject to applicable law and relevant exceptions, individuals may have rights including:

• receiving information about processing;
• accessing Personal Data;
• correcting inaccurate Personal Data;
• completing incomplete Personal Data;
• requesting erasure;
• restricting processing;
• objecting to certain processing;
• requesting applicable data transfer or portability;
• objecting to certain automated processing; and
• requesting human involvement where required in relation to applicable automated decisions.

Zirca will provide appropriate mechanisms through which users can exercise applicable rights.

39Identity Verification for Privacy Requests

To protect users from unauthorised disclosure, Zirca may take reasonable steps to verify the identity of a person making a data-protection request.

Verification measures will be proportionate to the sensitivity of the information requested.

Zirca will not require unnecessary information solely for the purpose of processing a privacy request.

40Data Portability

Where applicable, Zirca will provide Personal Data in an appropriate structured and machine-readable format.

Where legally required and technically feasible, Zirca may facilitate transfer of applicable Personal Data to another controller.

Data portability will remain subject to:

• Applicable law
• Identity verification
• Third-party rights
• Security
• Technical feasibility
• Legitimate legal restrictions

41Data Accuracy

Zirca will take reasonable measures to maintain accurate Personal Data.

Where information originates from a connected financial institution or third-party data provider, Zirca may rely on information supplied by that source.

Where a user identifies an error in source information, Zirca may direct the user to the relevant financial institution or data provider where that provider is responsible for correcting the underlying information.

Zirca will correct information within its control where appropriate.

42Data Retention

Zirca will establish retention periods based on:

• The purpose for processing
• Legal requirements
• Regulatory requirements
• Contractual requirements
• Security requirements
• Dispute-resolution requirements
• Fraud-prevention requirements
• Legitimate operational requirements

Personal Data will not be retained longer than reasonably necessary unless continued retention is required or permitted by law.

Different categories of data may have different retention periods.

43Account Closure and Data Deletion

Users may request closure or deletion of their Zirca account, subject to applicable law.

Where legally and technically appropriate, Zirca may delete or anonymise:

• Account information
• Connected financial information
• Financial goals
• User preferences
• AI interaction data
• Associated analytics
• Other Personal Data

Zirca may retain certain information where required or permitted by:

• Law
• Regulation
• Security requirements
• Fraud prevention
• Legal claims
• Dispute resolution
• Accounting requirements
• Other legitimate obligations

Where immediate deletion from backup systems is not technically practicable, Zirca will protect the information from active processing and delete it in accordance with its backup lifecycle.

44Data Disposal

When Personal Data is no longer required, Zirca will seek to:

• securely delete it;
• securely destroy it;
• anonymise it; or
• otherwise render it no longer reasonably identifiable.

Where third-party processors hold information that must be deleted, Zirca will use appropriate contractual and operational mechanisms to require deletion where applicable.

45Anonymised and Aggregated Information

Zirca may create anonymised or aggregated information where lawful.

Such information may be used for:

• Product development
• Analytics
• Statistical analysis
• Benchmarking
• Research
• Business planning
• Service optimisation
• Product performance
• Improving Zirca’s services

Zirca will only treat information as anonymised where individuals cannot reasonably be identified.

Where reasonable re-identification remains possible, the information will continue to be treated as Personal Data.

46Cookies and Tracking Technologies

Zirca may use cookies, software development kits, pixels and similar technologies.

These technologies may support:

• Authentication
• Security
• Essential functionality
• Analytics
• Performance
• Personalisation
• Marketing where legally permitted

Zirca’s use of cookies and similar technologies is addressed in its separate Cookie Policy.

47Marketing Communications

Zirca may send essential service communications, including:

• Security alerts
• Account notifications
• Financial-account connection notifications
• Service announcements
• Legal notices
• Customer-support communications

Optional marketing communications will be managed in accordance with applicable law.

Users will be provided with appropriate mechanisms to opt out of optional marketing communications.

48Data Breach Management

Zirca will maintain procedures for identifying, investigating, containing, remediating and reporting Personal Data breaches.

A breach may include:

• Unauthorised access
• Unauthorised disclosure
• Loss
• Theft
• Destruction
• Alteration
• Unauthorised transfer
• Ransomware
• Compromised credentials
• Other unlawful or unauthorised processing

Where a breach meets the applicable legal threshold, Zirca will notify the competent authority and affected Data Subjects where required.

Zirca will assess incidents based on factors including:

• The type of Personal Data involved
• The number of individuals affected
• The nature of the incident
• Potential consequences
• Likelihood of harm
• Containment measures
• Applicable regulatory requirements

Zirca will maintain appropriate records of material data incidents.

49Incident Response

Zirca’s incident-response process will include, where appropriate:

1. Detection
2. Triage
3. Containment
4. Investigation
5. Risk assessment
6. Remediation
7. Regulatory assessment
8. Notification where required
9. Recovery
10. Post-incident review

Material incidents will be escalated to appropriate management, legal advisers, security personnel and the DPO where applicable.

50Third-Party AI and Technology Providers

Before using a third-party technology provider to process Personal Data, Zirca will assess relevant:

• Security practices
• Privacy terms
• Data location
• Retention
• Sub-processors
• Model-training practices
• Confidentiality
• Deletion procedures
• International transfer arrangements
• Regulatory requirements

Where appropriate, Zirca will contractually restrict providers from using Zirca user information for purposes unrelated to the services they provide to Zirca.

51Government, Regulatory and Law-Enforcement Requests

Zirca may disclose Personal Data where required or permitted by applicable law.

Requests may originate from:

• Regulators
• Courts
• Law-enforcement authorities
• Government authorities
• Financial regulators
• Other legally authorised bodies

Zirca will seek to disclose only information reasonably necessary for the applicable legal purpose.

Where legally permissible, Zirca may notify affected users.

52Corporate Transactions

If Zirca participates in any of the following:

• Merger
• Acquisition
• Investment
• Financing
• Restructuring
• Sale of assets
• Similar corporate transaction

Personal Data may be disclosed where lawful and necessary.

Any recipient will be subject to appropriate confidentiality and data-protection requirements.

Where a transaction materially changes how Personal Data is processed, Zirca will provide appropriate notice where required.

53Children’s Data

Zirca’s services are intended primarily for adults.

Zirca will not knowingly process children’s Personal Data contrary to applicable law.

Where age restrictions or other safeguards are legally required, Zirca will implement appropriate controls.

54Data Governance

Zirca will maintain a data-governance framework covering:

• Data inventories
• Processing activities
• Data classification
• Controller and processor relationships
• Access controls
• Retention
• Deletion
• Third-party processing
• International transfers
• Privacy risks
• Security
• Incident management
• Compliance monitoring

Zirca will assign appropriate responsibility for data protection across its organisation.

55Records of Processing

Zirca will maintain appropriate records concerning material processing activities where required by applicable law.

Records may include:

• Categories of Personal Data
• Categories of Data Subjects
• Processing purposes
• Processing systems
• Third-party processors
• International transfers
• Retention periods
• Security measures
• Applicable legal bases
• Relevant regulatory requirements

56Employee Training

Personnel who handle Personal Data will receive appropriate privacy and security training.

Training may include:

• Data protection
• Financial-data confidentiality
• Access control
• Cybersecurity
• Phishing
• Social engineering
• Incident reporting
• AI-data handling
• Secure data handling
• Applicable regulatory obligations

Training will be proportionate to the employee’s role and access level.

57Audits and Compliance Reviews

Zirca will periodically review its data-protection programme.

Reviews may include:

• Privacy assessments
• Security assessments
• DPIA reviews
• Access reviews
• Processor assessments
• Penetration testing
• Incident reviews
• Policy reviews
• Regulatory compliance assessments

Material deficiencies will be addressed through appropriate corrective actions.

58Policy Review

This Policy will be reviewed at least annually and whenever there is:

• a material change to Zirca’s products;
• a significant regulatory change;
• a major security incident;
• a material change to data processing;
• entry into a new jurisdiction;
• introduction of high-risk technology;
• a material change to Zirca’s regulatory status; or
• another event that materially affects Zirca’s data-protection obligations.

59Changes to this Policy

Zirca may amend this Policy to reflect changes in:

• Law
• Regulation
• Technology
• Products
• Data-processing practices
• Security requirements
• Regulatory status
• Organisational structure

Where changes materially affect users’ rights or how Personal Data is processed, Zirca will provide appropriate notice and obtain consent where legally required.

The current version of this Policy will be made available through the Zirca website.

Website: www.zirca.co

60Complaints and Privacy Requests

Users may contact Zirca regarding:

• Privacy questions
• Data-protection concerns
• Access requests
• Correction requests
• Deletion requests
• Data-portability requests
• Objections
• Consent withdrawal
• Other applicable data-protection rights

Privacy and Data Protection Contact

Emailinfo@zirca.co Webwww.zirca.co

Zirca will investigate complaints and privacy requests in accordance with applicable law.

Users may also have the right to contact the competent data-protection authority or other relevant regulator.

61Definitions

Personal Data

Data relating to an identified or identifiable natural person.

Sensitive Personal Data

Personal Data falling within the statutory definition of Sensitive Personal Data under applicable law.

Controller

An entity or person that determines the purposes and means of processing Personal Data.

Processor

An entity or person that processes Personal Data on behalf of a Controller.

Data Subject

The natural person to whom Personal Data relates.

Processing

Any operation performed on Personal Data, including collection, recording, organisation, storage, alteration, retrieval, consultation, use, disclosure, transfer, restriction or deletion.

Profiling

Automated processing used to evaluate or predict characteristics or behaviour associated with an individual, including financial performance or financial condition.

Automated Decision-Making

A decision produced through automated processing with limited or no human intervention.

Data Breach

A breach of security resulting in accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data.

Financial Data

Information concerning an individual’s or business’s financial accounts, transactions, income, expenditure, assets, liabilities, investments, savings, cash flow or related financial position.

Personal Financial Data

Financial Data that relates to an identified or identifiable natural person.

Anonymisation

Processing that results in information from which an individual cannot reasonably be identified.

Pseudonymisation

Processing that reduces the ability to attribute Personal Data to a specific individual without additional information or controls.

Open Finance Provider

An entity authorised to provide Open Finance Services under the applicable CBUAE regulatory framework.

Open Finance Service

A service falling within the applicable UAE Open Finance regulatory framework.

62Zirca’s Data Protection Commitments

Zirca’s data-protection framework is built around the following commitments.

63Future Product Expansion

Zirca’s long-term vision is to develop into a broader financial operating system.

Future phases may include additional capabilities involving:

• Advanced AI and financial intelligence
• Expanded investment intelligence
• Digital assets
• Payments
• Financing
• Broader financial services
• Other financial-management functionality

Before launching any future service, Zirca will assess:

• Applicable licensing requirements
• Regulatory permissions
• Data-protection implications
• Security requirements
• Consent requirements
• Data-processing arrangements
• Third-party relationships
• Cross-border requirements
• Applicable user disclosures

This ensures that Zirca’s data-protection framework evolves alongside its product and regulatory footprint.

64Regulatory and Legal Qualification

Zirca’s final regulatory obligations will depend on:

• The legal entity providing the service
• The jurisdiction
• The location of users
• The financial institutions connected to Zirca
• The financial-data providers used
• Whether Zirca becomes an Open Finance Provider
• Whether Zirca operates through licensed partners
• The products and accounts supported
• Whether Zirca initiates transactions
• Whether Zirca provides regulated advice
• The use of AI and automated processing
• Any future services introduced

Zirca will obtain appropriate legal and regulatory advice before commencing activities that may require additional licensing, approval or regulatory permissions.

@Contact Details

Website

www.zirca.co

Email

info@zirca.co

Registered Legal Entity

ZIRCA SOFTWARE SOLUTIONS - FZCO

Registered Address

IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates

Licence Number

91222