PrometaV (PMV) Privacy Policy

The data controller responsible for the personal data described in this policy is:

Where a client organization enrolls its own members into a module and provides their data, that organization is responsible for that data as the controller, and PMV processes it on the organization’s behalf and under its instructions.

2.1 Information You Provide

When you create an account or sign in, we collect:

• Name
• Email address
• Password (stored securely in encrypted / hashed form)

2.2 Authentication & Cookies

PMV uses the following essential cookies and authentication data to provide secure access to the Platform:

• access_token
• refresh_token
• remember_me
• Authentication session information

These cookies are strictly necessary. They authenticate users, maintain secure login sessions, and remember login preferences. Because they are essential to operating the Platform, they are always active and not subject to consent.

2.3 Automatically Collected Information

When you use the Platform, we automatically collect certain technical information:

• Current page URL
• Browser viewport / screen dimensions
• Timestamps of user activity
• Website identifier used for analytics

2.4 Usage & Analytics

Subject to your cookie consent choice (see Section 5), PMV uses Google Analytics (GA4) and Umami Analytics to collect usage information, including:

• Pages visited
• Navigation events
• Website usage statistics
• User interaction events
• Technical information required for analytics

Where you have accepted analytics, collection may continue while you use the Platform, including authenticated areas such as the dashboard, to help us monitor platform usage, improve performance, and troubleshoot issues. Google Analytics is provided by Google and may involve transfer of data to the United States (see Section 7).

2.5 Interface Interaction Data

To improve the Platform and assist with debugging, PMV may collect:

• The rendered structure of webpages (DOM snapshots)
• User interface state relevant to analytics and troubleshooting

This data is used only for analytics and troubleshooting, and access to it is restricted to authorized personnel.

We use the personal data described above for the purposes below. Where a lawful basis is required under applicable data protection law, each purpose relies on the basis shown:

The legal bases referenced above mean:

• Contract: processing needed to create your account, take payment, and provide the Platform you signed up for.
• Legitimate interests: processing to secure, maintain, troubleshoot, and improve the Platform, balanced against your rights and freedoms.
• Consent: processing for non-essential analytics and for marketing communications, which you may withdraw at any time.
• Legal obligation: processing we must carry out to comply with the law.

When you first visit our website, we present a cookie consent banner with “Accept” and “Decline” options. Strictly necessary cookies (listed in Section 2.2) are required to log you in securely and are always active. Non-essential cookies — including analytics cookies from Google Analytics and Umami, and any campaign measurement or conversion-tracking technologies — are only set if you accept them, both on our public site and in authenticated areas such as the dashboard.

You can change or withdraw your choice at any time through the cookie settings on our website, or by clearing cookies in your browser (which will also log you out).

We share limited data with trusted service providers who process it on our behalf, under agreements that require them to protect it. We do not sell your personal data to anyone.

PMV operates from the UAE and uses the service providers listed in Section 6, which store or process data outside the UAE and Saudi Arabia, including in the European Union and the United States. Where we transfer personal data internationally, we rely on appropriate safeguards to protect it — such as contractual data-protection clauses incorporated into our agreements with these providers, or transfers to providers covered by a recognized certification framework — consistent with the UAE PDPL and Saudi PDPL.

We use technical and organizational measures to protect your data, including:

• Encryption of data in transit using TLS/HTTPS
• Hashed storage of passwords
• Secure authentication tokens and session management
• Restricted, role-based access to personal data
• Use of reputable infrastructure providers with their own security certifications

While no system is completely secure, we work to protect your information and to notify you and the relevant authorities of any personal data breach as required by law.

We keep personal data only as long as needed for the purposes described in this policy:

• Member information: deleted within 30 days after the account or membership is closed or a deletion request is made.
• Other data: retained in a de-activated (soft-deleted) state and kept only as long as necessary for the purposes described above, or as required for security, dispute resolution, backups, and legal, tax, or regulatory obligations.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data (“right to be forgotten”)
• Restrict our processing of your data
• Object to processing based on legitimate interests
• Withdraw consent for analytics or marketing at any time
• Data portability — receive a copy of your data in a portable format
• Rights relating to automated decision-making

We do not use your personal data to make automated decisions that produce legal or similarly significant effects on you.

To exercise any of these rights, contact us using the details in Section 12. You can unsubscribe from marketing emails using the link in any such email. You also have the right to lodge a complaint with the competent data protection authority — in the UAE, the UAE Data Office; in Saudi Arabia, the Saudi Data & Artificial Intelligence Authority (SDAIA).

PMV is intended for organizations and their members, and is not directed to children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you through the Platform or by email. We encourage you to review this policy periodically to stay informed about how we protect your data.