Data Protection Policy

1. Purpose

SDL Pro FZ-LLC is committed to protecting personal data and complying with applicable data protection laws.

This policy explains how we manage personal data, meet our legal obligations, and protect the rights of individuals whose information we process.

It should be read alongside our Privacy Policy, Cookie Policy, Terms of Service, and Data Processing Agreement “DPA”.

2. Scope

This policy applies to:

• SDL Pro employees and authorised personnel;

• Contractors and consultants working on behalf of SDL Pro;

• Suppliers and service providers who process personal data for SDL Pro; and

• Personal data processed through the SDL Pro website, cloud platform, mobile applications, and support services.

3. Our Commitment

SDL Pro is committed to:

• Processing personal data fairly, lawfully, and transparently;

• Collecting only the information needed to provide our services;

• Keeping personal data accurate and up to date where practical;

• Protecting information with appropriate technical and organisational measures;

• Retaining information only for as long as necessary;

• Respecting the rights of individuals; and

• Continually improving our privacy and security practices.

4. Data Protection Principles

Where UK GDPR or EU GDPR applies, SDL Pro follows these principles:

• Lawfulness, fairness, and transparency — we explain how and why we process personal data.

• Purpose limitation — personal data is collected only for specified purposes.

• Data minimisation — we collect only the information needed.

• Accuracy — we take reasonable steps to keep information accurate.

• Storage limitation — information is not kept longer than necessary.

• Integrity and confidentiality — we protect personal data against unauthorised access, loss, or misuse.

• Accountability — we are responsible for demonstrating compliance with applicable data protection laws.

5. Roles and Responsibilities

Depending on the service being provided, SDL Pro may act as either a Data Controller or a Data Processor.

As a Data Controller

We are responsible for personal data relating to:

• Website visitors;

• Enquiries;

• Customer accounts;

• Billing;

• Marketing communications;

• Supplier relationships; and

• Support requests.

When acting as a Data Controller, we determine why and how personal data is processed.

As a Data Processor

Our customers may use SDL Pro to manage projects, personnel, compliance records, and other operational information.

In these cases:

• The customer is the Data Controller; and

• SDL Pro acts as the Data Processor.

We process customer data only on documented instructions from the customer, unless required by law to do otherwise.

6. Lawful Bases for Processing

Where required, SDL Pro relies on one or more lawful bases for processing personal data, including:

• Performance of a contract;

• Compliance with legal obligations;

• Legitimate business interests; and

• Consent, where required.

The lawful basis depends on the nature of the processing activity.

7. Privacy by Design

Privacy and security are considered throughout the design, development, and operation of SDL Pro.

This includes:

• Secure software development practices;

• Access controls;

• Authentication measures;

• Encryption where appropriate;

• Audit logging; and

• Regular updates and security improvements.

We review new features to identify and reduce privacy risks before they are introduced wherever practical.

8. Data Security

SDL Pro uses technical and organisational measures designed to protect personal data from:

• Unauthorised access;

• Accidental loss;

• Destruction;

• Alteration;

• Disclosure; and

• Misuse.

Examples of these measures include:

• Secure cloud infrastructure;

• Encrypted communications, including HTTPS/TLS;

• Role-based access controls;

• Password protection;

• Multi-factor authentication where supported;

• Activity logging;

• Regular backups; and

• System monitoring.

Although we work hard to protect personal data, no online system can guarantee absolute security.

9. Data Retention

Personal data is retained only for as long as necessary to:

• Provide our services;

• Meet contractual obligations;

• Comply with legal requirements;

• Resolve disputes; or

• Protect our legal rights.

When information is no longer required, it is securely deleted or anonymised where appropriate.

Further information is available in our Data Retention Policy.

10. International Data Transfers

SDL Pro is based in the United Arab Emirates and provides cloud-based services to customers in multiple countries.

Where personal data is transferred internationally, we take reasonable steps to ensure appropriate safeguards are in place, which may include:

• Contractual commitments;

• Recognised transfer mechanisms;

• Security controls; and

• Other measures required by applicable law.

11. Individual Rights

Where UK GDPR or EU GDPR applies, individuals may have the right to:

• Access their personal data;

• Request correction of inaccurate information;

• Request deletion of personal data;

• Restrict processing;

• Object to certain processing activities;

• Receive personal data in a portable format where applicable; and

• Withdraw consent where processing is based on consent.

Requests should be sent to:

[email protected]

We will respond within the timeframes required by applicable law.

12. Personal Data Breaches

If a personal data breach occurs, SDL Pro will:

1. Assess the incident;

2. Contain and investigate the issue;

3. Minimise any impact;

4. Notify affected customers where appropriate;

5. Notify relevant authorities where legally required; and

6. Take steps to prevent similar incidents in the future.

Further information is available in our Personal Data Breach Response Policy.

13. Third-Party Providers

We work with trusted third-party providers to deliver our services, including cloud hosting and other business systems.

Where third parties process personal data on our behalf, we require them to maintain appropriate security measures and comply with applicable data protection obligations.

14. Staff Responsibilities

Anyone authorised to access personal data on behalf of SDL Pro must:

• Protect confidential information;

• Use personal data only for authorised purposes;

• Follow security procedures;

• Report suspected security incidents promptly; and

• Complete any required privacy or security training.

15. Policy Review

This policy will be reviewed at least annually or sooner if there are significant changes to our services, technology, or legal obligations.

16. Contact Us

If you have questions about this policy or our approach to data protection, please contact:

SDL Pro FZ-LLC
Compass Building
Ras Al Khaimah
United Arab Emirates

Email: [email protected]
Website: https://sdl.pro