Baway Logo

EXPLICIT CONSENT AGREEMENT FOR THE COLLECTION AND PROCESSING OF PERSONAL DATA

(Drafted pursuant to the United Arab Emirates Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and other applicable provisions)

1. IDENTIFICATION OF THE DATA CONTROLLER

In accordance with Articles 2 and 3 of Federal Decree-Law No. 45 of 2021 (hereinafter the “Data Protection Law” or the “Law”), please be advised that the entity responsible for the processing of personal data is:

BAWAY MIDDLE EAST LTD
Bayswater Tower, Level 1812,
Al Abraj South Street,
Business Bay,
P.O. Box 309071,
Dubai, United Arab Emirates
info@baway.net

The Company acts as the data controller within the meaning of Articles 5 and 6 of the Law, and assumes the responsibility to ensure the protection, confidentiality, and integrity of the personal data collected.

2. PURPOSE OF THIS AGREEMENT

Pursuant to Article 4 of the Data Protection Law, this Explicit Consent Agreement (hereinafter, the “Agreement”) aims to:

  1. Formalize the free, specific, informed, and unambiguous consent of the data subjects (hereinafter, the “Data Subject” or “Data Subjects”).
  2. Establish the legal grounds for the collection, use, retention, disclosure, and/or transfer of personal data for affiliation or membership purposes.
  3. Ensure full compliance with the provisions of the Law and other regulations in force in the UAE.

3. TYPE AND CATEGORIES OF PERSONAL DATA PROCESSED

According to the definitions of “Personal Data” and “Sensitive Personal Data” set forth in Articles 1 and 2 of the Law, the Company will collect only the data strictly necessary for affiliation, which may include:

  • Identification Data: Full name, official identification number, date of birth.
  • Contact Data: Telephone number, email address, postal address.
  • Other: Any additional information required to verify identity or working experience, or to fulfill legal requirements in the UAE.

Unless specifically authorized or legally required, the processing of sensitive data (e.g., health information, religious beliefs, or any other protected category) under Articles 9 and 10 of the Law is excluded, except when strictly necessary and always with prior and explicit consent.

4. PURPOSES OF PROCESSING

In compliance with Articles 4 and 5 of the Law, the Company will process personal data for the following purposes:

  1. Identity verification and validation of contact information (email and phone).
  2. Affiliation process management: evaluation, approval, administration, and maintenance of the affiliate status.
  3. Communication and notifications: sending relevant information about the affiliation program, policy changes, service updates, or any other information inherent to the contractual relationship.
  4. Compliance with legal obligations: meeting local and international regulations, including any requirements issued by UAE authorities.

5. LEGAL BASIS FOR PROCESSING

The legal basis for the processing of your data is grounded in:

  1. Explicit consent (Articles 4(2) and 6 of the Law) granted by the Data Subject upon acceptance of this Agreement.
  2. Compliance with legal obligations (Article 6(1)(c)) when necessary to meet regulatory demands of the UAE or other jurisdictions, in the case of international data transfers.
  3. Performance of a contractual or pre-contractual relationship (Article 6(1)(b)) when it pertains to managing and maintaining your affiliation with the Company.

6. CONSENT AND OPT-IN

In accordance with Article 4 of the Law, explicit consent for the processing of personal data is formalized through the unequivocal expression of will by the Data Subject (e.g., by signing electronically, checking a box, or completing a registration form). The Data Subject acknowledges:

  1. Having been provided clear and sufficient information regarding the purposes and scope of the data processing.
  2. That consent is given freely, voluntarily, specifically, and in an informed manner.
  3. The ability to exercise the rights described in Section 10 of this Agreement at any time.

7. STORAGE, RETENTION, AND SECURITY MEASURES

In compliance with Articles 20 and 21 of the Law regarding security and confidentiality, the Company commits to:

  1. Store the data in secure systems, implementing appropriate technical and organizational measures (encryption, access controls, internal audits, etc.) to prevent unauthorized access, alterations, or improper disclosures.
  2. Retain personal data only as long as necessary to fulfill the stated purposes and to meet applicable legal requirements. Afterwards, data will be securely deleted or anonymized, in accordance with the requirements of the Law.
  3. Periodically update security protocols, conducting impact assessments and audits as required by the Law.

8. INTERNATIONAL DATA TRANSFERS

Should the Company need to transfer personal data to third countries or international organizations for the purposes of affiliation or service support, such transfer shall comply with Articles 22 and 23 of the Law, ensuring that:

  1. An adequate level of protection is guaranteed by the destination country, or the Company implements contractual safeguards equivalent to those required in the UAE (standard contractual clauses, confidentiality agreements, etc.).
  2. Data Subjects are notified and provide consent except in cases where the Law does not require such consent.
  3. All applicable regulations imposed by the relevant UAE data protection authority are followed, including any incident notification requirements.

9. DISCLOSURE OF DATA TO THIRD PARTIES

Except as provided by law or contractually required, the Company will not disclose or transfer personal data to third parties without the explicit consent of the Data Subject. Where such disclosures are necessary, the purpose and type of data being shared will be stated, in accordance with Articles 7 and 19 of the Law.

10. RIGHTS OF THE DATA SUBJECT

Data Subjects may exercise at any time the rights recognized under Articles 14 and 15 of the Law, which include:

  1. Access: Request confirmation of whether the Company is processing their personal data and obtain a copy thereof.
  2. Rectification: Request the correction of inaccurate or incomplete data.
  3. Erasure: Request the deletion of personal data when they are no longer necessary for the stated purposes or when consent is withdrawn.
  4. Objection: Oppose the processing of personal data in specific circumstances, unless there is a compelling legal basis for continued processing.
  5. Portability: Where applicable, receive their personal data in a structured and commonly used format.
  6. Withdrawal of consent: At any time and without retroactive effect, which does not affect the lawfulness of the processing carried out prior to such withdrawal. To exercise these rights, please send a request to the address including sufficient information to verify your identity:BAWAY MIDDLE EAST LTD
    Bayswater Tower, Level 1812,
    Al Abraj South Street,
    Business Bay,
    P.O. Box 309071,
    Dubai, United Arab Emirates

11. POLICY UPDATES AND EFFECTIVE DATE

The Company reserves the right to update or modify this Agreement in accordance with relevant legislation and any guidelines issued by UAE authorities. Any substantial changes will be communicated to Data Subjects via email. The latest version will always be available at affiliate.baway.net/data-protection-policy

12. ACCEPTANCE AND DECLARATION OF WILL

By granting this explicit consent, the Data Subject declares, in accordance with Article 4(2) of the Law:

  1. Having read and understood the terms and scope of this Agreement in its entirety.
  2. Freely and unequivocally expressing their intention for the Company to process their personal data under the conditions described herein.
  3. Recognizing their rights and understanding how to exercise them before the Company and the relevant data protection authority in the UAE.
  4. Acknowledging that withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

13. CONTACT DETAILS AND SUPERVISORY AUTHORITY

For any questions, concerns, or complaints regarding the processing of personal data, the Data Subject may contact the Company via:

  • Email: info@baway.net
  • Postal address: BAWAY MIDDLE EAST LTD
    Bayswater Tower, Level 1812,
    Al Abraj South Street,
    Business Bay,
    P.O. Box 309071,
    Dubai, United Arab Emirates

Should the Data Subject wish to lodge a complaint with the competent supervisory authority, they may address it to the UAE Data Protection Office or the relevant authority specified under the local legislation (Articles 27–29 of the Law).

By clicking “Accept” or signing this Agreement, the Data Subject acknowledges having read, understood, and agreed to the terms set forth herein, granting explicit consent in accordance with the legislation of the United Arab Emirates and, in particular, with Articles 4, 5, 6, and related provisions of Federal Decree-Law No. 45 of 2021.

Effective Date: March 28th, 2025

Last Updated: March 28th, 2025