Updated on Oct, 10, 2025

ORBITRA GLOBAL DMCC

Privacy Policy

Introduction

Document Version
2.0
Effective Date
June 8th 2026
Data Controller
Orbitra Global DMCC
Primary Legal Framework
UAE Federal Decree-Law No. 45 of 2021 (PDPL)
International Alignment
EU GDPR  |  CCPA / CPRA (California)
Registered Address
Unit No: UT-12-CO-240, DMCC Business Centre, Level No 12, Uptown Tower, Dubai, United Arab Emirates
Data Protection Contact
contact@orbitra.global

Introduction

Orbitra Global DMCC ("Orbitra," "we," "our," or "us") is committed to protecting your privacy and handling your personal data with transparency, integrity, and in compliance with applicable law.

This Privacy Policy ("Policy") explains how we collect, use, store, share, and protect personal data when you visit orbitra.framer.website (the "Website") or submit your details through our Early Access Registration Form.

Orbitra is a trade finance infrastructure company registered in the Dubai Multi Commodities Centre (DMCC) Free Zone, Dubai, United Arab Emirates. We are the data controller for all personal data collected through the Website.

This Policy is designed to comply with UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection ("UAE PDPL") as our primary governing framework. It is also designed to be compatible with EU General Data Protection Regulation ("GDPR") transparency principles and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA") for visitors from those jurisdictions.

By using the Website or submitting the Early Access Registration Form, you confirm that you have read and understood this Policy.

How We Collect Your Personal Data

We may use the information we collect from you for various purposes, including:

  • When you purchase our services, register for an account
  • Personalizing your experience on our website
  • Communicating with you about your account and any updates or promotions
  • Analyzing website traffic and user behavior to enhance our offerings

Information We Collect

2.1   Personal Data Collected Through the Early Access Registration Form

When you submit your details through the Early Access Registration Form on the Website, we collect the following categories of personal data:

  • Category: Your sector or role category within the trade finance ecosystem (e.g., Financial Institution, Importer/Exporter, Logistics Provider, Technology Partner);
  • Role: Your specific professional role or function within your organisation;
  • Full Name: Your given name and surname;
  • Company Name: The name of your employer or the legal entity you represent;
  • Country: Your country of residence or principal business location; Email Address: Your business or professional email address; and
  • Contact Number: Your telephone number (this field is optional and not required for form submission).

Why this data matters: The combination of Category, Role, Company Name, and Country constitutes structured B2B market intelligence. This data allows Orbitra to segment early demand by industry sector, organisational function, and geography — directly informing product development priorities, go-to-market sequencing, and regulatory strategy. This purpose is explicitly disclosed under Section 3 below.

We do not collect payment card details, national identification numbers, passport data, government-issued identifiers, health data, financial account information, or any other categories of sensitive personal data as defined under UAE PDPL and GDPR through the Website.

2.2  Personal Data Collected Through the Early Access Registration Form

When you access the Website, our hosting infrastructure and analytics tools may automatically collect certain technical and usage data, including:

  • IP address and approximate geolocation derived from your IP;
  • Browser type, version, language settings, and device type;
  • Operating system information;
  • Referring URLs, entry and exit pages, and navigation paths;
  • Time spent on pages and interaction patterns; and
  • Cookie identifiers and similar tracking data (see Section 6).

2.3   Directly Provided Communications Data

If you contact us directly by email or through the Website's Contact page, we may collect your name, email address, telephone number, company details, and the content of your message. Provision of any information beyond name and email is voluntary.

How We Use Personal Data

We use the personal data we collect for the following purposes:

  • Early Access Programme management: To process, evaluate, and manage your registration of interest for the Orbitra platform Early Access Programme, including determining eligibility for priority access invitations;
  • Outreach and communications: To contact you regarding your registration, provide updates about the Orbitra platform development, announce Early Access invitations, and respond to your enquiries — subject to applicable consent requirements;
  • Industry research and product development insights: To conduct structured analysis of early adopter demand by industry sector, professional role, organisational type, and geographic market. This analysis informs Orbitra's product roadmap prioritisation, feature development sequencing, and go-to-market strategy;
  • Market segmentation and commercial planning: To aggregate and analyse registration data to identify demand concentration across trade corridors, industry verticals, and geographies relevant to Orbitra's expansion strategy;
  • Legal and regulatory compliance: To comply with applicable UAE laws, including anti-money laundering (AML) and know-your-customer (KYC) pre-screening obligations relevant to trade finance platform participants, and any other applicable regulatory requirements;
  • Website analytics and improvement: To understand how visitors interact with the Website, identify areas for improvement, and optimise content and user experience; and
  • Security and fraud prevention: To detect, investigate, and prevent unauthorised access, fraudulent submissions, abuse of the Website, or any other illegal activity.

Legal Basis for Processing Personal Data

We process your personal data on the following legal grounds, aligned with both UAE PDPL and GDPR principles:

  • Consent (UAE PDPL Article 4; GDPR Article 6(1)(a)): Where you have expressly consented to a specific processing purpose, such as receiving marketing communications or product updates. You may withdraw consent at any time by contacting us at [INSERT DATA PROTECTION EMAIL]. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
  • Legitimate interests (UAE PDPL Article 4; GDPR Article 6(1)(f)): Where processing is necessary to pursue our legitimate business interests, including conducting industry research and market segmentation from Early Access registration data, improving the Website and Platform, maintaining system security, and managing our business operations — provided these interests are not overridden by your fundamental rights and freedoms.
  • Legal obligation (UAE PDPL Article 4; GDPR Article 6(1)(c)): Where processing is required to comply with applicable UAE laws and regulations, including AML, KYC, and other regulatory obligations applicable to trade finance platforms.
  • Pre-contractual steps (GDPR Article 6(1)(b)): Where processing is necessary in connection with steps taken at your request prior to entering into an agreement with Orbitra.

Cookies and Analytics

5.1   What Are Cookies

Cookies are small text files placed on your device when you visit a website. The Website may use cookies and similar technologies — including web beacons, pixels, session tokens, and browser local storage — to deliver, secure, and improve the Website.

5.2   Types of Cookies We Use

  • Strictly necessary cookies: Essential for the Website to function. These cannot be disabled without affecting Website performance.
  • Analytics cookies: Used to understand how visitors interact with the Website, including pages visited, time on site, and navigation patterns. These may include third-party tools such as Google Analytics or equivalent services.
  • Preference cookies: Used to remember your language selection or other preferences to personalise your experience.

5.3   Your Cookie Choices

You may control, restrict, or delete cookies through your browser settings at any time. Disabling certain cookies may affect Website functionality. Where required by applicable law — including for EU/EEA visitors — we will request your explicit consent before placing non-essential cookies.

If and when third-party analytics or advertising tracking tools are activated on the Website, a separate Cookie Policy will be published as required by EU GDPR and equivalent frameworks.

Third-Party Service Providers

The Website is built and hosted on the Framer platform (framer.com). Data submitted through the Website's forms is processed by Framer and its underlying infrastructure providers. Framer's own privacy policy governs their data handling practices.

We may also share your personal data with trusted third-party service providers who support our operations, including:

  • Website hosting, infrastructure, and content delivery providers;
  • Email delivery and business communications platforms;
  • Customer relationship management (CRM) systems;
  • Marketing automation and outreach tools;
  • Analytics and website performance monitoring services; and
  • Legal, compliance, and professional advisory firms.

All third-party service providers are required to maintain appropriate technical and organisational security measures, to process your personal data only on our documented instructions, and to comply with applicable data protection law. We do not permit our service providers to use your personal data for their own independent purposes.

International Data Transfers

Orbitra is headquartered in the United Arab Emirates. The Website serves a global audience, and data you submit may be transferred to, stored in, and processed in countries outside your country of residence — including the UAE, the European Economic Area (EEA), and other countries where our service providers maintain operations.

Where we transfer personal data internationally, we implement appropriate transfer safeguards, which may include:

  • Transfer to countries recognised by applicable law as providing an adequate level of data protection;
  • Execution of standard contractual clauses (SCCs) or equivalent contractual transfer mechanisms; or
  • Your explicit consent to the transfer, where required by applicable law.

EU/EEA residents may contact us at contact@orbitra.global to request further information about the safeguards applicable to transfers of their data.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations.

  • Early Access Registration Form data: Retained for a maximum of 24 months from the date of submission, unless you enter into a commercial relationship or platform agreement with Orbitra, in which case applicable contractual and legal retention periods will apply.
  • Analytics and server log data: Retained for a maximum of 12 months, after which data is aggregated and anonymised.
  • Communications and enquiry data: Retained for a reasonable period necessary to manage your enquiry and fulfil Orbitra's legal obligations.

At the end of applicable retention periods, personal data is securely deleted or irreversibly anonymised in accordance with Orbitra's data management procedures.

Data Security

Orbitra implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, disclosure, or misuse. These measures include:

  • Secure encrypted transmission (TLS/HTTPS) for all data in transit between your browser and the Website;
  • Access controls restricting personal data access to authorised Orbitra personnel with a documented business need;
  • Vendor security due diligence requirements applied to all third-party service providers handling personal data;
  • Regular review and testing of our information security practices; and
  • Incident response procedures to address any identified data security events.

No method of electronic transmission or storage is completely secure. While Orbitra applies commercially reasonable and legally appropriate security standards, we cannot guarantee the absolute security of your data. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify relevant regulatory authorities and, where required, affected individuals in accordance with applicable law.

Your Privacy Rights

Depending on your location and the applicable legal framework, you have the following rights regarding your personal data. All requests should be submitted to contact@orbitra.global. We will respond within the timeframe required by applicable law and may request identity verification before processing your request.

UAE PDPL — Rights Applicable to All Users

Under UAE Federal Decree-Law No. 45 of 2021, you have the right to:

  • Access: Request confirmation of whether we hold personal data about you and, if so, receive a copy;
  • Correction: Request correction of inaccurate, incomplete, or outdated personal data;
  • Erasure: Request deletion of your personal data, subject to Orbitra's legal retention obligations and other conditions under the PDPL;
  • Objection: Object to the processing of your personal data in certain circumstances, including processing based on legitimate interests;
  • Portability: Request that your personal data be provided in a structured, commonly used, machine-readable format; and
  • Withdrawal of consent: Withdraw your consent to processing at any time where consent is the legal basis for processing (this does not affect the lawfulness of prior processing).

Response timeframe: We will respond to UAE PDPL requests within the timeframe specified by the UAE Data Office or applicable law, generally within 30 days.

EU / EEA — Additional GDPR Rights

If you are located in the European Union or European Economic Area, in addition to the rights above, you have:

  • The right to restriction of processing: Request that we limit our use of your personal data in certain circumstances;
  • The right not to be subject to solely automated decision-making: Including profiling with legal or similarly significant effects; and
  • The right to lodge a complaint with a supervisory authority: You may complain to the data protection authority in your EU member state of residence if you believe your rights have been infringed.

Response timeframe: GDPR requests will be responded to within 30 days, extendable by a further two months for complex requests.

California — CCPA / CPRA Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the following rights:

  • Right to know: Request disclosure of the categories and specific pieces of personal information collected about you, the purposes for collection, and the categories of third parties with whom information is shared or disclosed;
  • Right to delete: Request deletion of personal information we have collected from you, subject to certain exceptions permitted by law;
  • Right to correct: Request correction of inaccurate personal information we hold about you;
  • Right to opt out: Opt out of the sale or sharing of your personal information for cross-context behavioural advertising. Note: Orbitra does not sell personal information. We do not share personal information for cross-context behavioural advertising purposes;
  • Right to limit use of sensitive personal information: To the extent applicable; and
  • Right to non-discrimination: You will not receive discriminatory treatment — including denial of goods or services, different pricing, or reduced quality — for exercising any of your CCPA/CPRA rights.

To exercise CCPA/CPRA rights, contact us at orbitra.framer.website. We will respond within 45 calendar days, with a possible extension of a further 45 days where reasonably necessary.

Children's Privacy

The Website and the Early Access Programme are intended exclusively for business professionals and trade finance ecosystem participants. The Website is not directed at, and we do not knowingly collect personal data from, individuals under the age of 18 years (or the applicable age of majority in their jurisdiction).

If we become aware that personal data has been inadvertently submitted by or collected from a person under 18, we will take immediate steps to delete that data from our systems.

If you have reason to believe we hold data from a person under 18, please contact us immediately at contact@orbitra.global.

Third-Party Links

The Website may contain links to external websites, social media platforms, publications, or third-party resources. This Privacy Policy applies only to data collected by Orbitra through the Website. We are not responsible for the data processing practices of any third-party websites and encourage you to review the privacy policies of any external website you visit.

Updates to This Privacy Policy

We may update or revise this Privacy Policy at any time. Changes will be posted on this page with a revised effective date. For material changes that significantly affect how we process your data or your rights, we will provide reasonable advance notice, which may include a notice posted on the Website homepage.

Your continued use of the Website following the posting of any changes constitutes your acknowledgement of the updated Policy. You are encouraged to review this Policy periodically to remain informed about how we protect your data.

Contact Information

For all privacy-related queries, data subject rights requests, concerns, or complaints, please contact Orbitra's designated data protection point of contact:

Data Controller
Orbitra Global DMCC
Registered Address
Unit No: UT-12-CO-240, DMCC Business Centre, Level No 12, Uptown Tower, Dubai, United Arab Emirates
Data Protection Email
contact@orbitra.global
Website
orbitra.framer.website

Appendix A: Applicable Legal References

This Privacy Policy is informed by and should be read in conjunction with the following primary legal instruments: