1. Introduction & Identity of the Data Controller
1.1. BEREKE GENERAL TRADING CO. L.L.C. (hereinafter the "Company", "BEREKE", "we", "us", or "our") respects your privacy and is committed to protecting the personal data of representatives, officers, employees, and contact persons of our international B2B clients, suppliers, logistics partners, and website visitors.
1.2. For the purposes of UAE Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data ("UAE PDPL") and other applicable data protection laws, the Data Controller is:
- Legal Entity: BEREKE GENERAL TRADING CO. L.L.C.
- Licensing Authority: Department of Economy and Tourism (DET), Government of Dubai
- DET Trade License Number: 1443035
- UAE Tax Registration Number (VAT TRN): 104852498500001
- Registered Address: Dubai, United Arab Emirates
- Data Protection & Privacy Contact Email:bereke.trading@gmail.com
2. Categories of Personal Data We Collect
Because our Website operates strictly on a Business-to-Business (B2B) basis, we only collect professional business contact details and technical metadata necessary to process commercial sourcing requests and secure our Website:
2.1. Data You Voluntarily Provide via Sourcing & Contact Forms: Full Name, Company Name, Business Email Address, Phone / WhatsApp Number (including country dialing code), Product Category, Destination Country, and Request Details (specifications, quantity, and delivery terms). Where an inquiry progresses to commercial onboarding, we may also collect corporate KYB registration documents, signatory identification, and Ultimate Beneficial Owner (UBO) declarations as mandated by UAE AML/CFT laws (UAE Federal Decree-Law No. 20 of 2018, UAE Federal Decree-Law No. 10 of 2025, and Cabinet Decision No. 109 of 2023).
2.2. Technical & Automated Data: IP address, browser type and version, operating system, time zone setting, referring URL, request timestamps in standard security logs, and your cookie consent preference record.
2.3. No Sensitive Personal Data or Minors' Data: We do not intentionally collect sensitive personal data (such as health, biometric, religious, or political data) through the Website, nor is the Website directed at individuals under the age of eighteen (18) Gregorian years (the age of commercial capacity under Article 18(1) of UAE Federal Decree-Law No. 50 of 2022).
3. Purposes & Lawful Basis for Processing (UAE PDPL Articles 4 & 5)
3.1. In accordance with Articles 4 and 5 of the UAE PDPL, we process your personal data strictly for the following specified purposes and lawful bases:
- Responding to B2B Sourcing Inquiries & Preparing Proposals: Reviewing your sourcing request and contacting you via Email, Phone, or WhatsApp to provide commercial proposals, pricing, and logistics terms — based on your Explicit Consent (submitted via the form consent checkbox) and processing necessary to take steps at your request prior to entering into a contract (UAE PDPL Art. 4(2)).
- Contract Execution & Order Fulfilment: Drafting Proforma Invoices, Sales & Purchase Agreements (SPAs), shipping documentation, and customs clearances — based on Performance of a Contract (UAE PDPL Art. 4(2)).
- Legal, Tax, Customs & AML/CFT Compliance: Conducting mandatory KYB and sanctions screening, maintaining VAT/corporate tax/commercial records, and complying with UAE regulatory obligations — based on Compliance with Statutory Legal Obligations under UAE Federal Laws (UAE PDPL Art. 4(3)).
- Website Security & Anti-Bot Protection: Protecting the Website against cyber threats, DDoS attacks, and fraudulent traffic via Cloudflare security infrastructure — based on Protecting Security and Preventing Fraud & Cybercrime under UAE Law (UAE PDPL Art. 4).
3.2. International Data Protection Bridge (EU/UK GDPR & Global Counterparties): Where an international B2B visitor or counterparty representative is located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with extraterritorial data protection laws, our processing of professional business contact data is equally grounded in your explicit consent (Article 6(1)(a) GDPR), pre-contractual measures taken at your request (Article 6(1)(b) GDPR), compliance with mandatory legal obligations (Article 6(1)(c) GDPR), and our legitimate commercial interests in B2B trade coordination and network security (Article 6(1)(f) GDPR), with cross-border transfers effected as necessary for pre-contractual and contractual performance (Article 49(1)(b) GDPR).
4. Commercial Communications & Telephone/WhatsApp Outreach
4.1. When you submit an inquiry through our Website and provide your Email and/or Phone / WhatsApp Number, you expressly authorize the Company's trade specialists to contact you via email, telephone call, or WhatsApp messaging specifically in connection with your commercial sourcing request and related B2B trade follow-ups, in compliance with UAE Cabinet Resolution No. 56 of 2024.
4.2. We do not sell, rent, or trade your phone number or email address to third-party marketers or data brokers. You may opt out of follow-up communications at any time by replying "STOP" or emailing bereke.trading@gmail.com.
5. Disclosure of Personal Data & Categories of Recipients
We share personal data strictly on a need-to-know basis with: (a) authorized internal trade, logistics, and compliance personnel in Dubai; (b) IT, hosting, CDN, and email service providers (including Cloudflare, Inc.) acting as Data Processors under Article 8 of the UAE PDPL; (c) verified manufacturers, freight forwarders, shipping lines, inspection agencies, insurers, and customs brokers strictly to the extent necessary to fulfill a specific B2B quotation or shipment requested by you; and (d) UAE regulatory (DET), tax (FTA), customs, banking, or judicial authorities where required by law.
6. Cross-Border Transfers of Personal Data (UAE PDPL Articles 22 & 23)
6.1. Because the Company facilitates international cross-border trade and utilizes globally distributed cloud infrastructure (including Cloudflare's global edge network and international email servers), your personal data may be transferred to, stored, or processed in jurisdictions outside the United Arab Emirates.
6.2. In accordance with Articles 22 and 23 of the UAE PDPL, we ensure that any cross-border transfer of personal data outside the UAE takes place only where: (a) the destination jurisdiction provides an adequate level of data protection; (b) appropriate contractual and technical safeguards (including TLS encryption in transit and binding processor obligations) are implemented; (c) you have provided your express consent to such transfer by submitting your international trade inquiry through the Website (Art. 23(1)(a)); or (d) the transfer is necessary for the conclusion or performance of a contract between you/your company and us, or for pre-contractual measures taken at your request (Art. 23(1)(b)).
7. Data Retention Periods
7.1. In compliance with Article 5(4) of the UAE PDPL, we retain personal data only for as long as necessary to fulfill the purposes for which it was collected:
- General Unconverted Website Inquiries: Retained for up to twenty-four (24) months from the date of last communication to address follow-up sourcing requests, unless you request earlier erasure.
- Commercial Contracts, Corporate Tax, VAT, Customs & AML/KYB Records: Where an inquiry results in commercial onboarding or a transaction, records are retained for a minimum of five (5) to ten (10) years as mandated by the UAE Commercial Transactions Law (Federal Decree-Law No. 50 of 2022 — 10 years), UAE Corporate Tax Law (Federal Decree-Law No. 47 of 2022, Article 56 — 7 years), UAE Tax Procedures Law (Federal Decree-Law No. 28 of 2022), UAE VAT Legislation (Federal Decree-Law No. 8 of 2017), and UAE AML/CFT Legislation (Federal Decree-Law No. 20 of 2018 & Federal Decree-Law No. 10 of 2025 — minimum 5 years).
7.2. Upon expiry of the applicable retention period, personal data is securely deleted or anonymized.
8. Data Security Measures (UAE PDPL Article 20)
In accordance with Article 20 of the UAE PDPL, we implement technical and organizational security measures appropriate to the risk of processing—including HTTPS/TLS encryption across the Website, Cloudflare WAF and DDoS mitigation, strict role-based access controls, and input validation—to protect personal data against unauthorized access, alteration, disclosure, or destruction. In the event of a personal data breach that would prejudice the privacy, confidentiality, or security of your data, we will notify the UAE Data Office and affected Data Subjects in accordance with Article 9 of the UAE PDPL.
9. Your Rights as a Data Subject under the UAE PDPL (Articles 13–18)
Under the UAE PDPL, you have the following statutory rights regarding your personal data: (1) Right to Obtain Information (Art. 13) regarding processing purposes, categories, and recipients; (2) Right to Request Data Transfer / Portability (Art. 14) where applicable; (3) Right to Correction or Erasure ("Right to be Forgotten") (Art. 15), subject to mandatory UAE statutory retention obligations; (4) Right to Restrict or Stop Processing (Art. 16 & 17), including objecting to direct marketing at any time; (5) Right to Object to Automated Processing (Art. 18) (note that we do not engage in automated decision-making or profiling); and (6) Right to Withdraw Consent (Art. 6(2)) at any time without affecting prior lawful processing.
How to Exercise Your Rights: You may exercise any of these rights free of charge by emailing bereke.trading@gmail.com with the subject line PDPL Data Subject Request. We will verify your identity and respond within thirty (30) calendar days of receipt. If you are dissatisfied with our handling of your request, you have the right to lodge a complaint with the UAE Data Office pursuant to Article 24 of the UAE PDPL.