Privacy Policy.

1. Introduction

This Privacy Policy sets out how cMatter Enterprises Inc. ("we", "us", or "our") collects, uses, discloses, and protects personal data obtained through our website, any subdomains or extensions, https://cmatter.com (the "Website"). This Privacy Policy also applies to your use of our cMatter software-as-a-service platform, dashboards, mobile applications, and all in-app analytics and user-interaction tools made available as part of the services ("Services"). It is intended to inform you, as a user of the Website or our interactive platforms, of your rights and our obligations in relation to your personal data.

We are committed to handling your personal data responsibly and in accordance with applicable data protection laws, including, where relevant, the Federal Decree Law No. 45 of 2021 on the Protection of Personal Data in the United Arab Emirates, the General Data Protection Regulation (EU) 2016/679, the Delaware Personal Data Privacy Act, and similar data protection regimes as may be applicable from time to time.

By using our Website, you consent to the practices described in this Privacy Policy.

2. Data we collect

We may collect and process the following categories of personal data:

a) Information you provide directly

• Full name
• Email address
• Company name
• Phone number
• Job title
• Any personal data you provide via contact forms, email correspondence, surveys, or other communication channels on our Website

b) Information collected automatically

• IP address
• Device type and operating system
• Browser type
• Location data (where permitted)
• Website usage data (for example pages visited, interaction logs)

This data is collected using cookies and similar technologies. For further details, please refer to our Cookie Policy.

When you access or use our Services, we automatically collect usage metrics such as feature interactions, clicks, navigation paths, timestamps, session duration, crash logs, and other in-app behavioural data. Where you are a registered user, we may associate this information with your account details (including your business email address, role and permissions) for the purposes described in this Policy.

3. Legal basis for processing

We collect and process your personal data on the following legal bases:

• Consent: where required, we will obtain your consent to process personal data (for example marketing emails)
• Contractual necessity: to respond to enquiries or perform pre-contractual or contractual obligations
• Legitimate interests: to improve our Website, ensure IT security, and maintain business operations
• Legal obligation: where we are required to retain or disclose data under applicable law

For our analytics, platform monitoring and session recording activities, we rely on our legitimate interests in operating, improving and securing our Services and assisting our customers with adoption and support. Where processing is necessary to provide the Services under our agreement with your organisation, we rely on contractual necessity. In jurisdictions requiring consent for analytics technologies, we will rely on your consent obtained through our cookie banner or similar mechanisms.

4. Use of personal data

We may use your personal data for the following purposes:

• To respond to your enquiries and provide information or support
• To enable access to certain features of our Website
• To personalise and enhance your user experience
• To analyse Website traffic and usage
• To comply with legal or regulatory obligations
• To send you updates, thought leadership, or marketing materials (where legally permissible or with your consent)
• To monitor, analyse and improve usage of our Services (including at an individual user-account level), support user onboarding, measure adoption, troubleshoot issues, and enhance functionality. This includes linking in-app activity to your email or account profile.

We use certain analytics tools to generate anonymised or pseudonymised session recordings that help us understand how users navigate and interact with our Services. These recordings may capture cursor movements, clicks, scrolls and navigation patterns but are configured to avoid capturing sensitive data fields such as passwords, financial information, free-text fields likely to contain personal data, or customer content. We implement masking, minimisation and strict access restrictions for these tools.

5. Disclosure of personal data

We do not sell or rent your personal data. However, we may disclose your personal data to:

• Our group entities, affiliates, and trusted service providers who process data on our behalf
• Legal and regulatory authorities, if required to comply with applicable laws or protect our legal interests
• Prospective acquirers or investors, in connection with a potential merger, acquisition, or restructuring
• Any third party where you have provided consent for such disclosure

All third parties are bound by contractual obligations to maintain the confidentiality and security of your data and to use it solely for authorised purposes.

6. International data transfers

Where your personal data is transferred outside the UAE to jurisdictions that may not provide the same level of data protection, we implement appropriate safeguards such as:

• Standard contractual clauses (where applicable)
• Adequate contractual obligations on data recipients
• Transfer based on your explicit consent (where applicable)

7. Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, regulatory, accounting, or reporting requirements.

Where we no longer require personal data, we will securely delete or anonymise it in accordance with our data retention procedures.

8. Data security

We implement appropriate technical and organisational measures to safeguard your personal data from unauthorised access, disclosure, alteration, or destruction. These include encryption, access controls, and secure data storage.

However, no transmission or storage system is completely secure. While we strive to protect your data, we cannot guarantee its absolute security.

9. Your rights

Subject to applicable law, you may have the right to:

• Access your personal data
• Correct or update inaccurate data
• Request deletion of your data
• Object to or restrict processing
• Withdraw consent (where processing is based on consent)
• Lodge a complaint with a data protection authority

Please note that exercise of these rights could amount to deleting the authorised user. To exercise these rights, please contact us at hello@cmatter.com.

10. Third-party links and services

Our Website may include links to third-party websites or services. We do not control these third parties and are not responsible for their privacy practices. We encourage you to read the privacy policies of any third-party websites you visit.

11. Children's data

Our Website is not directed to children under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data without parental consent, please contact us and we will take steps to delete such information.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any material changes will be posted on this page. We encourage you to review this Privacy Policy periodically.

13. Contact us

If you have any questions or concerns about this Privacy Policy or our data handling practices, please contact hello@cmatter.com.