Privacy Policy

Who we are

Billions Labs is the trading name of Billions Works FZE LLC, a software development company licensed in Ajman NuVentures Centre Free Zone, United Arab Emirates. We are the controller of the personal data described in this policy.

Scope of this policy

This policy covers personal data we collect through this website, through business correspondence, and in the course of managing our commercial relationships with clients, suppliers and applicants.

Personal data we collect

Data you give us

• Enquiry form and email: name, company, business email address, telephone number, and whatever you choose to write in your message.
• Contract administration: names, business contact details and job titles of client and supplier personnel; signatory details; billing and bank details of the contracting entity.
• Recruitment: information contained in a CV or application you send us.

Data collected automatically

• Server and security logs: IP address, date and time of request, requested URL, HTTP status, referring page, user-agent string.
• Cookies and similar technologies, as described in our Cookie Policy.

We do not knowingly collect special categories of personal data, and we ask you not to send them to us.

How and why we use it

• To respond to your enquiry and to correspond with you about a possible engagement.
• To negotiate, conclude and perform contracts, and to invoice and collect payment.
• To operate, secure and troubleshoot this website, and to detect and prevent abuse.
• To meet our legal, accounting, tax and record-keeping obligations, and to conduct the sanctions and counterparty checks we run before accepting a client.
• To assess an application for employment or contract work.
• To establish, exercise or defend legal claims.

We do not sell personal data, we do not share it with third parties for their own marketing, and we do not use it for automated decision-making that produces legal or similarly significant effects.

Legal bases

We process personal data on the bases set out in UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and, where the UK GDPR or EU GDPR applies to a visitor, on the corresponding bases in that legislation:

• Performance of a contract or steps taken at your request before entering into one — enquiries, proposals, delivery and invoicing.
• Legitimate interests — running and securing our website, business correspondence, counterparty due diligence, and defending legal claims. We balance these against your interests and rights.
• Legal obligation — accounting, tax and sanctions-screening record keeping.
• Consent — where we ask for it, for example for non-essential cookies. You may withdraw consent at any time without affecting processing already carried out.

Who we share it with

We disclose personal data only where necessary, and only to:

• Service providers acting on our instructions — website and infrastructure hosting, email and productivity services, document storage, accounting and payroll — each engaged under a written contract that restricts their use of the data.
• Professional advisers — auditors, lawyers, accountants and insurers — bound by duties of confidentiality.
• Banks and financial institutions, where they require information about us or a transaction as part of their own onboarding or compliance obligations.
• Public authorities, regulators or courts, where we are required by applicable law to disclose.
• A purchaser or successor entity, in the event of a reorganisation, merger or sale of the business.

International transfers

We are established in the United Arab Emirates, and some of our service providers are located elsewhere. Where personal data is transferred to a country that is not recognised as providing an adequate level of protection, we put appropriate safeguards in place — normally standard contractual clauses together with technical and organisational measures — so that the level of protection travels with the data. You may request details of the safeguards used by writing to [email protected].

How long we keep it

When a retention period ends we delete the data or irreversibly anonymise it.

Security

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, least-privilege access control with multi-factor authentication, separation of environments, centralised secret management, logging and monitoring, and confidentiality obligations on everyone who works with us. Our practices are aligned to ISO/IEC 27001 and OWASP ASVS; we are not currently certified to ISO/IEC 27001.

No method of transmission or storage is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the competent authority and, where required, you, without undue delay.

Your rights

Subject to the conditions and exemptions in the applicable law, you may:

• Request access to the personal data we hold about you, and information about how we process it.
• Ask us to correct data that is inaccurate or incomplete.
• Ask us to delete data where there is no longer a valid reason for us to hold it.
• Ask us to restrict processing, or object to processing carried out on the basis of legitimate interests.
• Request a copy of data you provided to us in a structured, commonly used, machine-readable format, and ask us to transmit it to another controller where technically feasible.
• Withdraw consent, where processing is based on consent.

Write to [email protected]. We respond within 30 days. We may need to verify your identity before acting on a request, and we will tell you if an exemption applies.

Cookies

This website uses a small number of cookies and similar technologies. What they are, what they do and how to control them is set out in our Cookie Policy.

Children

Our services are directed at businesses. This website is not intended for children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, write to us and we will delete it.

Changes to this policy

We may update this policy to reflect changes in our practices or in the law. The effective date at the top of the page shows when the current version took effect. Where a change materially affects how we use your personal data, we will take reasonable steps to notify you.

Contact and complaints

For any question about this policy, or to exercise a right, contact:

If you are not satisfied with our response, you may lodge a complaint with the UAE Data Office or, where the GDPR applies to you, with the supervisory authority in your country of residence.