1. Who We Are (Data Controller)

This Privacy Policy explains how we handle your personal data when you use QuotesDone, an online B2B anonymous quotation marketplace.

The data controller is:

• QuotesDone Technologies, a Dubai Sole Establishment
• Dubai DET E-Trader (Professional) Licence No. 1633275
• Commercial Register No. 2883503
• Owner: Ahmad Mhd Nabil Alzain
• Address: Dubai, United Arab Emirates
• Email: management@quotesdone.com; Phone: +971 56 791 8605

We process personal data in accordance with the UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021 (PDPL), and its implementing regime overseen by the UAE Data Office, which from June 2026 operates within the new UAE Federal Authority for Artificial Intelligence and Data. This policy applies to customers, suppliers and visitors. Where you act on behalf of a business, references to your personal data mean the personal data of the individuals concerned.

2. Personal Data We Collect

Depending on how you use the platform, we collect:

• Customer identity and contact data: your name, email address and mobile number, with the mobile number verified by one-time password (OTP).
• Request content: the job or request you submit as text, voice recordings, photographs or drawings, including any personal data you choose to include.
• Supplier data: business details and Know Your Customer (KYC) documents provided for vetting and onboarding.
• Payment data: a payment reference returned by our third-party payment processor. We do not store full card numbers; card and Apple Pay details are handled by the processor.
• Usage and technical data: logs, device and connection information, and records of platform activity.

We do not intentionally collect special categories of data. Please avoid including sensitive details in request content unless necessary.

3. Purposes and Lawful Bases

We process personal data for clear purposes, each supported by a lawful basis under the PDPL:

• To create and manage your account, verify your mobile by OTP, and provide the marketplace, including matching requests to suppliers and enabling paid reveals (performance of a contract).
• To calculate and collect the customer Reveal Fee of 3% of the quoted value at the point you choose to reveal a supplier, and to keep accounting records (performance of a contract and legal obligation). Suppliers pay no commission or success fee on jobs they win.
• To vet suppliers and verify KYC documents, prevent fraud and misuse, secure the platform and improve our services (legitimate interests).
• To share a chosen supplier's contact details on a paid reveal, and for optional marketing (your consent, which you may withdraw at any time).

Where we rely on legitimate interests, we balance these against your rights and interests.

4. AI and Automated Processing

QuotesDone uses automated tools, including artificial intelligence, to operate the marketplace. These tools:

• Structure and standardise the requests you submit (including converting voice, photos and drawings into a structured brief).
• Match each request to vetted suppliers likely to be able to quote.
• Summarise requests and quotes to make them easier to compare.

This automated processing supports our service but does not produce binding legal effects on you without human involvement, and you remain free to accept, reject or ignore any quote. You may contact us to ask questions about, or object to, automated processing as described in the Your Rights section. Where automated processing could significantly affect individuals, we assess its impact before deploying it.

5. How We Share Data

Anonymity is central to QuotesDone. We share personal data only as follows:

• Request content is shared with matched suppliers WITHOUT revealing your identity, so suppliers can prepare anonymised quotes.
• Your contact details are disclosed to a single supplier only after you pay the Reveal Fee and consent to the reveal for that chosen supplier; suppliers receive customer contact data only for jobs revealed to them.
• Our third-party payment processor receives the data needed to take payment (card or Apple Pay) and returns a payment reference.
• Service providers (such as hosting, communications and analytics) process data on our behalf under written instructions.

We may also disclose data where required by UAE law, a court of competent authority, or to protect our legal rights. We do not sell personal data.

6. Cross-Border Transfers

Some of our service providers may process personal data outside the United Arab Emirates. Where this happens, we apply the safeguards required by Articles 22 and 23 of the PDPL.

• We transfer data to countries the UAE Data Office recognises as providing an adequate level of protection; or
• Where adequacy is not established, we rely on appropriate safeguards such as contractual clauses obliging the recipient to protect the data to UAE standards, or on your explicit consent, in each case in a manner that does not conflict with the public and security interests of the State.

You may contact us for more information about the specific safeguards applied to a transfer.

7. Data Retention

We keep personal data only for as long as necessary for the purposes described above and to meet legal obligations.

• Account data is kept while your account is active and for a reasonable period afterwards.
• Request content is retained to operate and improve matching, then deleted or anonymised when no longer needed.
• Transaction and financial records, including Reveal Fee and registration-fee records, are retained for the periods required by UAE accounting and tax law.
• Supplier KYC documents are retained for the duration of the relationship and any legally required period thereafter.
• Logs are kept for limited periods for security and audit purposes.

When a retention period ends, we securely delete or irreversibly anonymise the data. Our internal Data Protection and Retention Policy sets out the detailed schedule.

8. Your Rights Under the PDPL

Subject to the conditions and exceptions in the PDPL, you have the right to:

• Access your personal data and obtain information about how it is processed.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data where the legal grounds apply.
• Object to, or request restriction of, certain processing, including processing based on legitimate interests and certain automated processing.
• Request that your personal data be provided to you, or transferred to another controller, in a structured, commonly used, machine-readable format (data portability), where technically feasible.
• Request that your data be transferred to you or another controller in a structured format, where applicable.
• Withdraw consent at any time, without affecting processing carried out before withdrawal.

To exercise any right, contact us at management@quotesdone.com. We will respond within the timeframes required by the PDPL. If you are not satisfied, you may lodge a complaint with the UAE Data Office.

9. Electronic Marketing and Communications

We send transactional messages you need to use the service — for example mobile one-time passwords (OTP), request and quote notifications, and account or payment confirmations — on the basis of our contract with you; these are not marketing.

We send marketing or promotional messages by email, SMS or other electronic means only where you have given consent, and you can withdraw consent or unsubscribe at any time using the link or instructions in the message, or by emailing management@quotesdone.com. We handle electronic communications in line with the UAE telecommunications and electronic-marketing rules overseen by the Telecommunications and Digital Government Regulatory Authority (TDRA) and the Electronic Transactions and Trust Services Law (Federal Decree-Law No. 46 of 2021). We do not sell your contact details for third-party marketing.

10. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure, consistent with the PDPL and the Electronic Transactions and Trust Services Law, Federal Decree-Law No. 46 of 2021.

• Access to personal data is restricted to authorised personnel on a need-to-know basis.
• We use encryption in transit, OTP verification for customer mobile numbers, and segregation of anonymised request content from identity data.
• Payment card data is handled by our PCI-compliant payment processor, not stored by us.

No system can be guaranteed to be completely secure. If a personal data breach occurs that meets the legal threshold, we will notify the UAE Data Office and affected individuals as required by the PDPL.

11. Children, Changes and Contact

QuotesDone is a business-to-business platform intended for users aged 18 and over. It is not directed at minors, and we do not knowingly collect personal data from children. If you believe a minor has provided us data, please contact us so we can delete it.

We may update this Privacy Policy from time to time to reflect changes in our services or the law. The current version is always available on our platform, and material changes will be notified where appropriate.

For any privacy question, to exercise your rights, or to reach our data protection contact, please use:

• Email: management@quotesdone.com
• Phone: +971 56 791 8605
• Post: QuotesDone Technologies, Dubai, United Arab Emirates

This policy is governed by the laws of the UAE, and disputes are subject to the courts of Dubai.