1. Introduction

2403 Group ("2403", "we", "us" or "our") is committed to protecting your privacy and handling your personal data responsibly, lawfully and transparently. This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and the rights available to you.

2403 Group is registered in the United Arab Emirates under the Meydan Free Zone Authority (MFZA). Our registered address is 2403 Group, Meydan Free Zone Authority (MFZA), 6th Floor, Meydan Grandstand, Meydan Road, Nad Al Sheba 1, P.O. Box 9305, Dubai, United Arab Emirates.

We provide fractional leadership, technology, data and operations consultancy services to clients principally in the sport and automotive sectors. This policy applies to personal data we collect through our website at https://www.2403group.com (the "Site"), through direct correspondence with us by email, telephone or messaging platforms, in the course of providing our services, and through our recruitment and business development activity.

For the purposes of applicable data protection law, 2403 Group is the controller of the personal data described in this policy, meaning we determine the purposes and means of processing it. Where we handle personal data on behalf of a client as part of a consultancy engagement, we generally act as a processor, and that processing is governed by the terms of our agreement with that client rather than by this policy.

This policy should be read alongside our Cookie Policy, which explains in detail how we use cookies and similar technologies, and our Terms of Use, which govern your use of the Site.

2. The personal data we collect

2.1 Information you provide to us

When you contact us through the Site, by email, by telephone or through messaging platforms such as WhatsApp, we collect the information you choose to give us. This typically includes your name, your email address, your telephone number, the organisation you work for, your job title or role, and the content of your enquiry or message together with any attachments you send.

If you apply to work with us or express interest in joining our team, we collect the information contained in your application. This typically includes your name and contact details, your curriculum vitae or professional profile, your employment and education history, your professional qualifications and skills, your right to work and visa status where relevant to the role, your salary or rate expectations, and any references or supporting information you or a referee provide.

If you engage us as a client, or if you act as a contact for a client organisation, we collect the information necessary to deliver our services and administer the relationship. This typically includes your contact and role details, correspondence and meeting records, project documentation, and the billing, invoicing and payment information required to administer the engagement.

2.2 Information we collect automatically

When you visit the Site, we and our service providers may automatically collect technical information about your visit. This typically includes your internet protocol address, your approximate location derived from that address, your browser type and version, your operating system and device type, your screen resolution and language settings, the pages you viewed and the time spent on them, the website or source that referred you to us, and the dates and times of your visits.

Some of this information is collected using cookies and similar technologies. Non-essential cookies are only used where you have consented to them through our cookie banner. Full details are set out in our Cookie Policy.

2.3 Information we obtain from other sources

In the course of business development, we may collect professional contact information from publicly available and commercially available sources. These typically include professional networking platforms such as LinkedIn, company websites, publicly accessible business registers and directories, industry publications and event materials, and business data providers that supply verified professional contact details.

The information obtained from these sources is limited to business contact and professional role information, such as your name, job title, employer, business email address, business telephone number and professional profile. We do not seek personal or non-professional information from these sources.

We may also receive personal data about you from your employer or from a client organisation where you are a contact for a project we are delivering, from recruiters or referees in connection with an application, and from mutual professional contacts who introduce us.

2.4 Sensitive personal data

We do not seek to collect sensitive personal data, meaning data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data concerning a person’s sex life or sexual orientation. Where such data is unavoidably provided to us, for example where an applicant discloses a health condition in connection with an adjustment to a recruitment process, we will only process it where we have a lawful basis to do so and, where required, your explicit consent.

3. How and why we use your personal data

We use your personal data to respond to enquiries and correspondence you send to us, and to provide the information or proposals you have requested. We use it to negotiate, enter into and administer engagements, including scoping work, delivering our consultancy services, managing projects and communicating with client teams. We use it to issue invoices, process payments, maintain financial records and recover sums due.

We use your personal data to manage recruitment, including assessing applications, arranging and conducting interviews, verifying qualifications and references, making offers and, where relevant, keeping suitable applicants on file for future opportunities where they have agreed to this.

We use your personal data to operate, maintain, secure and improve the Site, to understand how the Site is used, to diagnose faults and to protect against fraud, misuse and security incidents. We use it to carry out business development and marketing, including contacting professionals whose role suggests our services may be relevant to their organisation, sending updates about our work and capabilities where we are permitted to do so, and measuring the effectiveness of that activity.

We use your personal data to comply with our legal, regulatory, tax and accounting obligations, to establish, exercise or defend legal claims, to take professional advice, and to manage the general administration and governance of our business.

4. Our legal basis for processing

Under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL"), and where applicable under the EU General Data Protection Regulation and the UK GDPR, we must have a lawful basis for processing your personal data. The basis we rely on depends on the purpose.

We rely on the performance of a contract, or steps taken at your request prior to entering into a contract, where we process personal data to negotiate and deliver an engagement, to administer a client relationship, to process payments, and to respond to enquiries about our services.

We rely on our legitimate interests where we process personal data to operate and secure the Site, to carry out business to business marketing and business development to professional contacts, to understand and improve how our services and Site perform, to maintain records of our dealings, and to protect our legal position. Where we rely on legitimate interests we assess whether those interests are overridden by your interests and rights, and you may object to this processing as described below.

We rely on your consent where we set non-essential cookies, where we send marketing communications in circumstances where consent is required, and where we retain the details of an unsuccessful applicant for future opportunities. Where we rely on consent, you may withdraw it at any time, and doing so will not affect the lawfulness of processing carried out before withdrawal.

We rely on compliance with a legal obligation where we process personal data to meet tax, accounting, corporate, anti money laundering, sanctions screening and other statutory requirements applicable to us in the United Arab Emirates or elsewhere.

5. Marketing communications

Where we send marketing or business development communications, we do so in a manner consistent with applicable law. Communications sent to business contacts at their professional email address relate to services relevant to their professional role and are sent on the basis of our legitimate interests, except where consent is required by the law of your jurisdiction, in which case we will obtain it first.

You can ask us to stop sending marketing communications at any time, either by using the unsubscribe mechanism in any message or by emailing us at sam@2403group.com. We will action your request promptly. We may still need to send you administrative or service related communications about an engagement, and these are not marketing communications.

6. Who we share your personal data with

We do not sell your personal data, and we do not share it for the independent marketing purposes of third parties.

We share personal data with service providers who process it on our behalf under contract and on our instructions. These typically include our website host and platform provider, our email, calendar, file storage and productivity providers, our analytics providers, our accounting, bookkeeping and payment providers, our customer relationship and business development tools, and our information technology support and security providers.

We may share personal data with our professional advisers, including lawyers, accountants, auditors and insurers, where necessary for them to advise us. We may share it with regulators, courts, law enforcement and government authorities where we are required to do so by law, or where disclosure is necessary to establish, exercise or defend legal claims.

Where an engagement requires it, we may share personal data with our associates, subcontractors and delivery partners who form part of the team working on a client project, on the basis of appropriate confidentiality and data protection obligations. We may also share personal data with a client where you are a participant in, or contact for, work we are delivering for them.

If we sell, transfer, merge or reorganise part or all of our business, we may disclose personal data to a prospective or actual buyer and their advisers, subject to appropriate confidentiality protections. If a change of ownership occurs, the recipient will use your personal data in a manner consistent with this policy.

7. International transfers

We operate internationally and some of our service providers, associates and clients are located outside the United Arab Emirates, including in the European Economic Area, the United Kingdom and the United States. This means your personal data may be transferred to, stored in, or accessed from countries whose data protection laws differ from those of your own country.

Where we transfer personal data internationally, we take steps to ensure it remains protected to a standard consistent with this policy and with applicable law. Depending on the transfer, this may include transferring to a country recognised as providing an adequate level of protection, entering into contractual safeguards such as standard contractual clauses with the recipient, or relying on a specific derogation permitted by the PDPL or, where applicable, the GDPR and UK GDPR, such as your explicit consent or the necessity of the transfer for the performance of a contract.

You may request further information about the safeguards applied to a particular transfer by contacting us using the details in this policy.

8. How we protect your personal data

We maintain technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, alteration, disclosure or destruction. These include access controls and authentication on the systems we use, encryption of data in transit, restriction of access to personal data to those who need it for a legitimate business purpose, use of reputable service providers with their own security commitments, and periodic review of our practices.

No method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. Information you send to us by unencrypted email or messaging platforms travels at your own risk, and we would ask you not to send us sensitive information through those channels without arranging a secure method first.

Where a personal data breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority and, where required, affected individuals, within the timeframes set by applicable law.

9. How long we keep your personal data

We keep personal data only for as long as necessary for the purposes for which it was collected, including to satisfy any legal, tax, accounting or reporting requirements, and to establish or defend legal claims.

Enquiries that do not lead to an engagement are generally retained for up to two years from the last meaningful contact, so that we can maintain continuity if you approach us again. Client engagement records, contracts and related correspondence are generally retained for the duration of the relationship and for a period of at least six years afterwards, reflecting limitation periods for legal claims and our record keeping obligations. Financial and tax records are retained for the periods required by applicable law in the United Arab Emirates, which is generally at least five years.

Recruitment records for unsuccessful applicants are generally retained for up to twelve months following the conclusion of the process, unless you have agreed that we may keep your details on file for longer in connection with future opportunities. Marketing and business development contact records are retained until you object or ask us to stop contacting you, or until the contact information is no longer accurate or relevant, after which a minimal suppression record may be kept to ensure we honour your request.

Website analytics data is retained in line with the periods described in our Cookie Policy. When personal data is no longer required, we delete it or anonymise it so that it can no longer be associated with you.

10. Your rights

Subject to the conditions and exemptions in applicable law, you have rights in relation to your personal data. The rights available to you depend on the law that applies to the processing in question.

You have the right to be informed about how we use your personal data, which this policy is intended to satisfy. You have the right to request access to the personal data we hold about you and to receive a copy of it. You have the right to request that inaccurate or incomplete personal data be corrected. You have the right to request erasure of your personal data where there is no continuing lawful reason for us to hold it.

You have the right to request that we restrict processing in certain circumstances, for example while we verify the accuracy of data you have contested. You have the right to object to processing that we carry out on the basis of our legitimate interests, and an absolute right to object to processing for direct marketing purposes. You have the right, in certain circumstances, to receive personal data you provided to us in a structured, commonly used and machine readable format, and to have it transmitted to another controller. You have the right to withdraw consent at any time where our processing is based on consent.

We do not carry out automated decision making that produces legal effects concerning you or that similarly significantly affects you. If this changes, we will update this policy and inform you of your rights in relation to that processing.

To exercise any of these rights, please contact us at sam@2403group.com. We may ask you for information to verify your identity before we act on a request, which helps ensure that personal data is not disclosed to the wrong person. We will respond within the period required by applicable law, which is generally one month, and we will tell you if we need longer because a request is complex. Exercising your rights is free of charge, although we may charge a reasonable fee or decline to act where a request is manifestly unfounded or excessive.

11. Complaints

If you are concerned about how we have handled your personal data, we would ask you to contact us first at sam@2403group.com so that we have the opportunity to resolve the matter.

You also have the right to lodge a complaint with the relevant supervisory authority. In the United Arab Emirates, this is the UAE Data Office established under the PDPL. If you are located in the European Economic Area or the United Kingdom, you may complain to the data protection authority in the country where you live or work, or where you believe an infringement occurred. In the United Kingdom this is the Information Commissioner’s Office.

12. Children

Our Site and our services are directed at businesses and professional audiences and are not intended for children. We do not knowingly collect personal data from children. If you believe that a child has provided personal data to us, please contact us and we will take steps to delete it.

13. Third-party websites and platforms

The Site contains links to third-party websites, platforms and services, including email, telephone and messaging links, professional networking profiles and client or partner websites. We are not responsible for the privacy practices or content of those third parties. When you leave our Site or interact with a third-party platform, we encourage you to read the privacy policy that applies to that service.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or legal and regulatory requirements. Any changes will be posted on this page with a revised Last Updated date. Where changes are material, we will take reasonable steps to bring them to your attention, and where required by law we will seek your consent. We recommend reviewing this page periodically.

15. Contact us

If you have any questions about this Privacy Policy, about how we handle your personal data, or if you wish to exercise your rights, please contact us using the details below.

2403 Group, Meydan Free Zone Authority (MFZA), 6th Floor, Meydan Grandstand, Meydan Road, Nad Al Sheba 1, P.O. Box 9305, Dubai, United Arab Emirates.

Email: sam@2403group.com

Telephone: +971 56 369 7995

Website: https://www.2403group.com

© 2403 Group. All rights reserved.