Privacy Policy

1Introduction

Welcome to Zirca.

Zirca is an AI-powered financial ecosystem designed to bring an individual's financial world together in one secure platform.

Zirca enables users to connect supported financial accounts and services, add financial information manually, and view, track, analyse and understand their financial position across accounts, assets, investments and liabilities.

Our services may include financial dashboards, transaction categorisation, net worth tracking, cash-flow analysis, investment and cryptocurrency portfolio tracking, financial goals, reports, notifications, analytics and AI-powered financial insights.

This Privacy Policy explains how ZIRCA SOFTWARE SOLUTIONS - FZCO, operating under the brand name Zirca ("Zirca", "we", "us" or "our"), collects, receives, uses, stores, protects and shares personal data when you:

• visit our websites;
• create or use a Zirca account;
• use the Zirca application;
• connect financial accounts or other supported services;
• upload or import financial information;
• manually enter financial information;
• communicate with us;
• contact customer support; or
• otherwise interact with Zirca's products and services.

We take the privacy and security of financial information seriously. Our approach is based on the principle that your financial information belongs to you and should be used to provide and improve the Zirca service, not sold as a product.

This Privacy Policy should be read together with Zirca's Terms & Conditions and, where applicable, our Cookie Policy and other notices presented to you when using particular features.

2Who Is Responsible for Your Personal Data?

The entity responsible for the processing described in this Privacy Policy is:

• ZIRCA SOFTWARE SOLUTIONS - FZCO
• Trade name: Zirca
• Licence Number: 91222
• Premises: DSO-IFZA
• Registered address: IFZA Properties, Dubai Silicon Oasis, United Arab Emirates

For privacy and data-protection enquiries, email info@zirca.co.

Zirca may appoint a Data Protection Officer or other privacy contact where required by applicable law. If one is appointed, the relevant contact details will be published or provided through the appropriate privacy channel.

3Our Privacy Principles

Zirca's approach to personal data is built around the following principles.

Your data is yours

We provide tools for you to understand and manage your financial information. We do not sell your personal data.

Purpose matters

We collect and use information for specific purposes connected with providing, securing, improving and supporting Zirca.

Minimum necessary access

We seek to access and process only the information reasonably necessary to provide the relevant feature or service.

Security by design

We use appropriate technical and organisational safeguards designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

Transparency

We aim to explain what information we collect, why we collect it, how it is used, and with whom it may be shared.

User control

Where applicable, we provide mechanisms for you to access, correct, export, disconnect, restrict or delete your information.

4What Personal Data We Collect

The information we collect depends on how you use Zirca.

4.1 Account and Registration Information

When you create a Zirca account, we may collect:

• Name
• Email address
• Telephone number, where provided
• Country or jurisdiction of residence
• Account credentials
• Authentication information
• Account preferences
• Communication preferences
• Subscription and billing information
• Information you provide during onboarding

We do not require you to provide financial information merely to browse publicly available information on our website.

4.2 Waitlist Information

If you join the Zirca waitlist through our website, we collect your email address, together with the date you joined and the part of the website from which you joined.

We use this information to operate the waitlist and to send you communications relating to the waitlist and early access to Zirca.

Waitlist information is stored and processed using Supabase, and waitlist emails are sent using Loops.

5Financial Information

Financial information is central to Zirca's service.

Depending on the features you use and the integrations available to you, Zirca may process information relating to the following.

Bank and Cash Accounts

• Account identifiers
• Account names
• Account types
• Balances
• Available balances
• Transaction history
• Transaction dates
• Transaction descriptions
• Merchants or counterparties
• Currencies
• Income
• Expenditure
• Recurring transactions
• Transaction categories

Investment Accounts

Where supported:

• Investment account information
• Holdings
• Securities
• Quantities
• Prices and valuations
• Transaction history
• Dividends
• Investment performance
• Related portfolio information

Cryptocurrency and Digital Assets

Where supported:

• Wallet addresses
• Cryptocurrency balances
• Digital asset holdings
• Transaction history
• Exchange account information
• Asset prices and valuations
• Related portfolio information

Liabilities

Where entered or supported:

• Loans
• Mortgages
• Credit balances
• Outstanding balances
• Interest information
• Repayment information
• Other liability information

Manually Added Assets

You may choose to manually record information relating to assets such as:

• Property
• Cash
• Precious metals
• Private investments
• Other investments
• Other assets you choose to track

The information you enter manually may be stored and processed by Zirca in order to provide the relevant feature.

6Connected Financial Accounts

Zirca may allow you to connect supported banks, financial institutions, investment platforms, exchanges or other financial services through third-party connectivity and open-banking providers.

When you connect an account, Zirca may receive financial information made available through that connection, depending on:

• the provider;
• the permissions you authorise;
• the account type;
• the jurisdiction;
• the technical integration; and
• the services available at the time.

Where an integration is designed as read-only, Zirca uses that connection to retrieve information for viewing, analysis and related features.

Zirca's current product is not designed to allow Zirca to move money or make payments on your behalf through connected read-only financial connections.

The exact permissions associated with a connection are presented during the connection process where supported.

You may disconnect a supported financial account through Zirca or, where applicable, through the relevant third-party provider.

Disconnecting an account stops future synchronisation through that connection, but does not necessarily delete financial information that was previously synchronised and retained in your Zirca account. You may separately request deletion subject to applicable law and legitimate retention requirements.

7Information You Upload or Import

Zirca may allow you to import financial information, including through CSV files or other supported formats.

Such information may include:

• account information;
• transaction information;
• balances;
• asset information;
• investment information;
• liability information; and
• other financial information contained in the uploaded file.

You are responsible for ensuring that you have the appropriate authority to provide information relating to another person.

For example, if you upload information relating to a spouse, partner, family member, employee or another individual, you should only do so where you have a lawful basis or appropriate authority to provide that information to Zirca.

8Information We Collect Automatically

When you use Zirca, we may automatically collect technical and usage information such as:

• IP address
• Device type
• Device identifiers
• Operating system
• Browser type
• Application version
• Language and regional settings
• Time zone
• Date and time of access
• Pages or screens viewed
• Features used
• Interaction information
• Session information
• Diagnostic information
• Crash reports
• Performance information
• Security logs
• Information concerning how you interact with our Services

We use this information to operate, secure, troubleshoot and improve Zirca.

9Cookies and Similar Technologies

Zirca may use cookies, local storage, software development kits, pixels, tags and similar technologies.

These technologies may be used for:

• Authentication
• Maintaining sessions
• Remembering preferences
• Security
• Fraud prevention
• Analytics
• Website performance
• Application performance
• Understanding how users interact with Zirca
• Marketing, where permitted and appropriately disclosed

Where applicable law requires consent for non-essential cookies or similar technologies, we will request that consent before using them.

You may control certain cookies through your browser or device settings and, where provided, through Zirca's cookie-management tools.

On the Zirca website, Google Analytics is used only with your consent and is not loaded before you accept analytics cookies. You can change your choice at any time using Cookie Settings, the floating control at the bottom left of every page of the website. Further information is provided in Section 30 of this Privacy Policy and in our Cookie Policy.

10Information We Receive from Third Parties

We may receive personal data from third parties where necessary to provide Zirca.

These sources may include:

• Banks
• Financial institutions
• Open-banking providers
• Account aggregation providers
• Investment platforms
• Brokerage providers
• Cryptocurrency exchanges
• Blockchain networks
• Payment and billing providers
• Identity and verification providers
• Security providers
• Analytics providers
• Cloud infrastructure providers
• Other service providers supporting Zirca

Where information is obtained from a source other than you, we will provide the information required by applicable law concerning the source and processing of that information, unless an applicable legal exception applies.

11How We Use Your Personal Data

We use personal data for the following purposes.

11.1 Providing Zirca

We process information to:

• create and maintain your account;
• authenticate you;
• connect supported financial accounts;
• synchronise financial information;
• display balances and transactions;
• calculate and display net worth;
• track income and spending;
• analyse cash flow;
• track investments and digital assets;
• manage budgets and goals;
• generate reports and exports;
• provide financial dashboards;
• provide notifications;
• provide customer support; and
• deliver other features you request.

11.2 Financial Analysis and Insights

Zirca analyses information you provide or connect in order to help you understand your financial position.

This may include:

• identifying spending patterns;
• analysing income and expenditure;
• identifying recurring transactions;
• highlighting unusual transactions;
• identifying changes in spending;
• analysing account balances;
• analysing investment performance;
• identifying trends;
• generating financial summaries;
• providing forecasts where the relevant feature is available; and
• generating actionable financial insights.

12Zirca AI

Insight is the product. The dashboard is where it lands.

Zirca uses artificial intelligence and advanced analytics to transform financial data into information designed to help you understand your finances and what may require your attention.

Depending on the feature you use, Zirca AI may:

• analyse your financial information;
• explain financial activity;
• identify patterns and trends;
• identify unusual charges or changes;
• identify recurring commitments;
• provide financial summaries;
• generate forecasts;
• highlight areas requiring attention;
• provide personalised insights; and
• generate recommendations concerning your financial information.

Zirca AI may process information associated with your Zirca account and connected financial information in order to provide these features.

Where Zirca uses third-party technology providers to support AI functionality, those providers may process information on Zirca's behalf subject to appropriate contractual, technical and organisational controls.

Zirca does not sell your personal data to AI providers.

Where applicable, Zirca will disclose material changes to how personal data is processed by AI features through this Privacy Policy, just-in-time notices or other appropriate communications.

13AI Does Not Replace Your Judgement

Zirca AI provides information, analysis, predictive insights and intelligent forecasts.

Zirca AI does not provide regulated financial advice, investment advice, legal advice or tax advice unless expressly stated otherwise.

14Automated Processing and Profiling

Zirca may use automated processing and analytical techniques to understand information within your account and generate personalised insights.

For example, automated processing may be used to:

• categorise transactions;
• identify recurring transactions;
• identify unusual activity;
• calculate financial metrics;
• analyse spending patterns;
• analyse investment information;
• generate forecasts; and
• generate personalised insights.

These processes are intended to provide information and functionality within Zirca.

Unless expressly disclosed otherwise for a particular feature, Zirca does not use automated processing to make decisions that produce legal or similarly significant effects on you, such as decisions concerning your eligibility for credit, employment, insurance, housing or access to essential services.

If Zirca introduces a feature involving automated decision-making that materially affects users, we will provide the information and safeguards required by applicable law.

15Purposes and Legal Bases for Processing

Where the GDPR, UK GDPR or another law requiring a legal basis applies, Zirca may rely on one or more of the following legal bases, depending on the circumstances.

Performance of a Contract

We may process information where it is necessary to provide the Zirca Services you have requested or to perform our agreement with you.

Examples include:

• creating your account;
• connecting financial accounts;
• synchronising data;
• providing dashboards;
• calculating financial information;
• providing requested AI features; and
• administering your subscription.

Consent

We may rely on your consent where required by law.

Examples may include:

• certain marketing communications;
• certain non-essential cookies;
• certain optional data processing; or
• other processing where consent is the applicable legal basis.

Where processing is based on consent, you may withdraw consent at any time, subject to applicable law and the consequences explained when consent is given.

Legal Obligations

We may process personal data where necessary to comply with applicable legal, regulatory, accounting, tax, security or law-enforcement obligations.

Legitimate Interests

Where permitted by law, we may process personal data where necessary for our legitimate interests, provided those interests are not overridden by your rights and interests.

These interests may include:

• maintaining and improving Zirca;
• information security;
• fraud prevention;
• service analytics;
• network and system security;
• preventing misuse;
• protecting users;
• responding to enquiries;
• enforcing our agreements; and
• establishing, exercising or defending legal claims.

Where we rely on legitimate interests, we consider the impact of the processing on users and apply appropriate safeguards.

16Financial Data Is Used to Provide Zirca

Financial information connected to your Zirca account is processed to provide the financial-management functionality you request.

This includes using financial information to:

• calculate your financial position;
• display account information;
• categorise transactions;
• analyse spending;
• analyse cash flow;
• track investments;
• calculate net worth;
• monitor goals;
• generate reports;
• provide alerts;
• generate AI insights; and
• provide other features described in the Zirca Services.

We do not sell your financial information.

We do not use your financial information to provide advertising to third parties.

17Does Zirca Sell Your Personal Data?

In particular, Zirca does not sell:

• your name;
• your contact information;
• your bank information;
• your transaction history;
• your investment information;
• your cryptocurrency information;
• your financial balances;
• your financial profile; or
• other personal financial information

to data brokers, advertisers or other third parties for their own commercial use.

Zirca may use service providers to process information on our behalf, as described below.

18When We Share Personal Data

We may share personal data in limited circumstances necessary to operate Zirca.

Service Providers

We may use third-party service providers for:

• Cloud hosting
• Secure data storage
• Database infrastructure
• Financial account connectivity
• Open-banking connectivity
• Investment data
• Analytics
• Security
• Fraud prevention
• Customer support
• Communications
• Email delivery
• Subscription management
• Payment processing
• Identity verification
• AI infrastructure
• Other technical services

These providers process personal data according to their contractual relationship with Zirca and applicable law.

The providers currently supporting the Zirca website and waitlist are:

• Google: Google Analytics, where you have consented, and Google Fonts;
• Vercel: website hosting, Vercel Web Analytics and Vercel Speed Insights;
• Supabase: waitlist storage and processing; and
• Loops: waitlist email communications.

The Zirca website loads its fonts from Google Fonts. When a page is displayed, your browser requests the font files from Google's servers, which involves technical information such as your IP address being sent to Google.

19Financial Account Providers

When you choose to connect an external financial account, information may be exchanged between Zirca and the relevant provider or integration partner.

The information made available to Zirca depends on the permissions, APIs and services provided by that provider.

The external provider may have its own privacy policy and terms. You should review those terms where appropriate.

Zirca is not responsible for the independent privacy practices of third-party financial institutions or services.

20Legal and Regulatory Disclosures

We may disclose personal data where reasonably necessary to:

• comply with applicable law;
• comply with a court order or valid legal process;
• respond to lawful requests from government authorities;
• investigate suspected fraud or security incidents;
• protect the rights, property or safety of Zirca, our users or others;
• establish, exercise or defend legal claims; or
• enforce our Terms & Conditions.

We will seek to limit such disclosures to what is legally required or reasonably necessary for the relevant purpose.

21Corporate Transactions

If Zirca is involved in:

• a merger;
• acquisition;
• financing;
• restructuring;
• reorganisation;
• sale of assets;
• sale of substantially all of its business; or
• similar corporate transaction,

personal data may be transferred as part of that transaction where permitted by applicable law.

Where required, we will provide appropriate notice concerning such changes.

22International Data Transfers

Zirca is based in the United Arab Emirates and may use service providers or infrastructure located in other countries.

As a result, personal data may be transferred to or accessed from countries outside your country of residence.

This may include personal data processed by the website and waitlist providers identified in Section 18.

Where applicable law imposes requirements on international transfers, Zirca will use an appropriate lawful transfer mechanism and appropriate safeguards.

Depending on the jurisdiction and circumstances, these safeguards may include:

• adequacy decisions or regulations;
• contractual safeguards;
• standard contractual clauses;
• the UK International Data Transfer Agreement or UK Addendum, where applicable;
• transfer risk assessments or equivalent assessments where required;
• other legally recognised safeguards; or
• a lawful derogation where applicable.

For users protected by the UAE Personal Data Protection Law, Zirca will handle cross-border transfers in accordance with applicable UAE requirements.

For UK users, restricted international transfers must be covered by an applicable UK adequacy regulation, appropriate safeguard or lawful exception.

23Data Security

Financial information requires a high level of protection.

Zirca implements technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration, misuse or disclosure.

Depending on the relevant system and feature, these measures may include:

• Encryption in transit
• Encryption at rest
• Access controls
• Authentication controls
• Multi-factor authentication where available
• Least-privilege access
• Secure credential management
• Monitoring and logging
• Vulnerability management
• Security testing
• Backup and recovery procedures
• Incident response procedures
• Employee and contractor security controls

Security measures may change as Zirca's technology and infrastructure develop.

No internet-based service can guarantee absolute security. Accordingly, while Zirca takes reasonable and appropriate measures to protect personal data, we cannot guarantee that information will never be subject to unauthorised access, loss or disclosure.

24Your Financial Account Credentials

Where Zirca connects to a supported financial account through an external authentication or open-banking provider, authentication may occur directly with that provider.

Where the connection architecture supports it, Zirca does not receive your bank username or password.

Instead, Zirca receives authorised connection credentials or tokens required to access the permitted information.

The exact authentication and credential-handling process may vary depending on the provider and integration.

25Data Retention

We retain personal data for as long as reasonably necessary for the purposes described in this Privacy Policy.

The period for which information is retained depends on:

• the type of information;
• the purpose for which it was collected;
• whether you continue to use Zirca;
• whether you request deletion;
• applicable contractual requirements;
• legal and regulatory obligations;
• security and fraud-prevention requirements;
• dispute resolution; and
• our legitimate business needs.

Where we no longer have a legitimate reason to retain personal data, we will delete, anonymise or securely dispose of it in accordance with applicable law and our retention procedures.

Where precise retention periods differ by data category, Zirca may use defined internal retention schedules rather than a single retention period for all information.

26Account Closure and Data Deletion

You may request closure of your Zirca account.

Where deletion is requested and applicable law permits it, Zirca will delete or anonymise personal data that is no longer required.

Some information may need to be retained for a limited period where necessary to:

• comply with legal obligations;
• comply with regulatory requirements;
• establish, exercise or defend legal claims;
• prevent fraud or abuse;
• maintain security;
• resolve disputes;
• maintain accounting records; or
• satisfy another lawful retention requirement.

Deleting your Zirca account does not necessarily cause third-party financial institutions, banks, brokers or exchanges to delete information they independently hold.

27Your Privacy Rights

Depending on where you live and the laws that apply to you, you may have rights concerning your personal data.

These may include the following.

Right to Information

You may request information about:

• the categories of personal data we process;
• the purposes of processing;
• automated processing and profiling;
• categories of recipients;
• retention practices;
• cross-border transfers; and
• applicable safeguards.

Right of Access

You may request access to personal data we hold about you, subject to applicable legal exceptions.

Right to Correction

You may ask us to correct inaccurate or incomplete personal data.

Right to Erasure

You may request deletion of your personal data where the applicable legal conditions are satisfied.

Right to Restrict Processing

You may request that processing of your personal data be restricted in circumstances provided by applicable law.

Right to Object

You may object to certain processing where the applicable legal conditions are satisfied, including certain processing based on legitimate interests and, where applicable, direct marketing.

Right to Data Portability

Where applicable, you may request your personal data in a structured and machine-readable format and, where technically feasible and legally required, request that it be transferred to another controller.

Right to Withdraw Consent

Where we rely on consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Right to Lodge a Complaint

You may have the right to complain to the relevant data-protection authority in your jurisdiction.

The UAE Personal Data Protection Law specifically provides rights concerning information, portability, correction and erasure, and further rights concerning restriction and objection, subject to the conditions in the law.

28How to Exercise Your Rights

To exercise a privacy right, contact info@zirca.co.

Please provide sufficient information for us to understand your request and verify your identity.

We may request additional information where reasonably necessary to confirm that the request relates to your personal data and to prevent unauthorised disclosure.

We will respond within the period required by applicable law.

If a request is subject to a lawful limitation or exemption, we will explain this where legally permitted.

29Marketing Communications

We may send service-related communications that are necessary to operate your Zirca account.

These may include:

• security alerts;
• account notifications;
• service announcements;
• transaction or connection notifications;
• changes to the Services;
• important legal notices; and
• other operational communications.

Where required by law, we will obtain your consent before sending promotional communications.

You may unsubscribe from promotional communications at any time using the unsubscribe mechanism provided or by contacting us.

Unsubscribing from marketing communications does not necessarily stop essential service or security communications.

30Analytics and Product Improvement

Zirca may analyse usage and technical information to understand how the Services are used and improve them.

This may include analysing:

• Feature usage
• Application performance
• Error rates
• Crashes
• Account-connection performance
• Synchronisation performance
• User journeys
• Engagement
• Aggregated financial patterns
• Other product metrics

Where possible and appropriate, we may use aggregated, anonymised or de-identified information for analytics, research, product development and business planning.

Information that has been genuinely anonymised so that an individual can no longer reasonably be identified is not treated as personal data to the extent permitted by applicable law.

Website Analytics

On the Zirca website, we use the following analytics and measurement tools:

• Google Analytics 4, provided by Google;
• Vercel Web Analytics, provided by Vercel; and
• Vercel Speed Insights, provided by Vercel.

We use these tools to:

• understand website traffic and usage;
• measure engagement;
• understand waitlist and conversion activity; and
• understand website performance.

Google Analytics is consent-based. It is not loaded before you accept analytics cookies, and you can change or withdraw your choice at any time using Cookie Settings, the floating control at the bottom left of every page of the website.

If your browser sends a Global Privacy Control (GPC) signal, we treat it as a rejection of analytics, and Google Analytics is not loaded while the signal is active.

Google Analytics event data and user data are each retained for 14 months.

We have configured Google Analytics with the following privacy controls:

• email redaction is enabled;
• URL query-parameter redaction is enabled, including for the "email" parameter;
• User-ID is not used;
• user-provided data collection is not used; and
• Google Signals is disabled.

Vercel Web Analytics and Vercel Speed Insights do not use cookies and are not controlled by the cookie consent banner. They measure website traffic and website performance.

31Aggregated and De-Identified Information

Zirca may create aggregated, statistical or de-identified information from data collected through the Services.

For example, we may analyse aggregated information to understand:

• product usage;
• feature adoption;
• transaction-category trends;
• application performance;
• general financial behaviour patterns; or
• other trends relevant to improving Zirca.

We will not represent de-identified information as personal data where it has been genuinely anonymised in accordance with applicable law.

Zirca does not use de-identification as a means of circumventing applicable privacy rights.

32Children's Privacy

Zirca is intended for adults.

You must not use Zirca if you are under the minimum age required to use the Services under applicable law.

Zirca does not knowingly collect personal data from children in violation of applicable law.

If we learn that we have collected personal data from a child in circumstances where collection was not permitted, we will take appropriate steps to delete or otherwise handle that information in accordance with applicable law.

33Third-Party Websites and Services

Zirca may contain links to websites, applications or services operated by third parties.

This Privacy Policy does not govern those third parties.

Third-party services may have their own:

• privacy policies;
• terms of service;
• security practices; and
• data-processing practices.

You should review the applicable privacy information before providing personal data to third-party services.

34Data Breaches and Security Incidents

Zirca maintains procedures for identifying, assessing and responding to security incidents.

If Zirca experiences a personal-data breach, we will assess the incident and take the steps required by applicable law.

Where notification is legally required, we may notify:

• the relevant data-protection authority;
• affected users;
• relevant service providers; and/or
• other appropriate parties.

Notifications will contain information required by applicable law and will be provided within the legally applicable timeframe.

35Data Protection by Design

As Zirca develops its Financial Operating System, privacy and security considerations are intended to form part of the design and development process.

This may include considering:

• Data minimisation
• Access controls
• Encryption
• Separation of systems
• Secure authentication
• Retention limits
• Privacy-preserving analytics
• Permission management
• User controls
• Secure API integrations
• Appropriate safeguards for AI processing

The specific technical architecture and controls may evolve as Zirca develops.

36Financial Services Disclaimer

Zirca is a financial management and financial intelligence platform.

Unless expressly stated otherwise, Zirca does not act as your:

• Bank
• Broker
• Investment adviser
• Financial adviser
• Tax adviser
• Accountant
• Lender
• Legal adviser

Zirca provides tools that help users consolidate, understand and analyse their financial information.

Information, forecasts, analytics, alerts and AI-generated insights are provided for informational purposes and should not be treated as personalised financial, investment, tax or legal advice.

37Changes to This Privacy Policy

Zirca may update this Privacy Policy as:

• our Services develop;
• new features are introduced;
• our data-processing practices change;
• our technology changes;
• applicable laws change; or
• regulatory guidance develops.

We will update the Last Updated date when this Privacy Policy changes.

Where a change materially affects how we process personal data, we will provide additional notice where required by applicable law.

We will not introduce a materially different use of personal data without providing the notice, obtaining consent or establishing another lawful basis where required by applicable law.

We encourage you to review this Privacy Policy periodically.

38Additional Information for UK and European Users

This section applies where UK or European data-protection law applies to our processing.

Zirca will provide the information required under applicable law concerning:

• the identity and contact details of the controller;
• purposes of processing;
• categories of personal data;
• lawful bases;
• legitimate interests, where relied upon;
• recipients and categories of recipients;
• international transfers;
• retention periods or the criteria used to determine them;
• data-subject rights;
• withdrawal of consent;
• complaint rights;
• automated decision-making and profiling, where applicable; and
• the source of personal data where data is obtained from another source.

Where required, privacy information will be provided at the time personal data is collected or within the applicable statutory period when data is obtained from another source.

UK ICO guidance confirms that privacy information should be clear, accessible and intelligible and should explain purposes, lawful bases, recipients, transfers, retention and applicable rights.

39Additional Information for UAE Users

Where the UAE Personal Data Protection Law applies, Zirca will process personal data in accordance with applicable requirements concerning:

• lawful and transparent processing;
• data security;
• confidentiality;
• data-subject rights;
• data retention;
• processing by controllers and processors;
• international transfers; and
• personal-data breach management.

The UAE Personal Data Protection Law establishes a federal framework governing personal-data processing and includes requirements concerning security, confidentiality, individual rights and cross-border transfers.

40Additional Information for California Residents

Where applicable California privacy law applies to Zirca's processing of your personal information, California residents may have rights including:

• the right to know/access;
• the right to delete;
• the right to correct;
• the right to opt out of certain sales or sharing;
• the right to limit certain uses of sensitive personal information, where applicable;
• the right to non-discrimination; and
• other rights provided by applicable California law.

Zirca does not sell personal information.

Where applicable, requests may be submitted by email to info@zirca.co.

We may need to verify your identity before completing a request.

California privacy requirements can depend on factors including the business's activities and statutory thresholds. This section does not mean that every California privacy provision necessarily applies to Zirca at all times.

41No Sale of Personal Data

For clarity:

Zirca's business model is based on its subscription services:

• Zirca Go: Free
• Zirca Pro: $9.99/month or $99.99/year
• Zirca Plus: $14.99/month or $149.99/year

The availability of a free tier does not change Zirca's approach to personal-data protection.

Zirca does not make personal data available for sale as a substitute source of revenue.

@Contact Details

Website

www.zirca.co

Email

info@zirca.co

Registered Legal Entity

ZIRCA SOFTWARE SOLUTIONS - FZCO

Registered Address

IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates

Licence Number

91222