Privacy Policy

Who we are

TriLink is a B2B procurement platform operated in the United Arab Emirates. We are the data controller for the personal data described in this policy.

What we collect

We collect only the personal data we need to operate the procurement workflows you ask us to run on your behalf:

Account details (name, email, phone, role within your company)
Company information (trade licence, tax registration number, address, banking details)
KYC and beneficial ownership data required by UAE AML laws (Federal Decree-Law 20/2018)
Transactional data — purchase requests, RFQs, bids, contracts, payments, shipments
Technical data — IP address, browser, audit log entries (mandatory for security and compliance)

Legal basis for processing

We process your data on the basis of: (a) performance of our contract with you and your company, (b) compliance with UAE legal obligations including AML, VAT and commercial transactions law, (c) your explicit consent for marketing communications and optional analytics cookies, and (d) our legitimate interest in keeping the platform secure.

Where your data lives

Your personal data is hosted in India under the legal basis: signed Standard Contractual Clauses (PDPL Article 22). Any sub-processor that handles your data is listed below; transfers outside the UAE rely on either an adequacy decision or signed Standard Contractual Clauses.

Sub-processors

Name	Purpose	Location
Hostinger International	Primary hosting — database (MySQL), application server, Redis (sessions + queues), file storage, Reverb websockets	IN
PayTabs (UAE region)	Card payment gateway (PAYTABS_REGION=ARE)	AE
Local Ollama (in-country)	AI classification + bug-report triage (AI_DRIVER=ollama, no external API call)	IN
Anthropic Claude API (fallback only)	AI classification fallback when AI_DRIVER=anthropic (not primary; primary is local Ollama)	US
OpenSanctions	Sanctions list screening (KYC/AML)	DE
AWS S3 (me-south-1, Bahrain)	Encrypted database + file backups (BACKUP_S3_BUCKET)	BH
Al Etihad Credit Bureau (AECB)	Credit scoring (active when CREDIT_PROVIDER=aecb; currently mock)	AE
UAE bank SFTP counterparties	Outbound MT103 / pacs.008 / UAEFTS file delivery (per-bank, per-payment)	AE
Dubai Trade	Customs declarations (active when enabled)	AE

Your rights under PDPL

Federal Decree-Law 45 of 2021 grants you the following rights, exercisable at any time from the Privacy & Data screen in your dashboard:

Access — receive a copy of every piece of personal data we hold about you
Rectification — correct any inaccurate or outdated personal data
Erasure — request that we delete your personal data subject to lawful retention obligations
Objection — object to processing based on legitimate interest
Withdraw consent — for marketing or optional cookies, at any time, without affecting prior lawful processing

How long we keep your data

Commercial and tax records are kept for at least five years from the end of the relationship as required by Federal Decree-Law 50/2022 and Federal Decree-Law 8/2017. Audit logs are kept for seven years. Marketing consent records are kept for as long as the consent is active and for two years after withdrawal as proof.

How we protect your data

Sensitive personal data — Emirates ID, passport number, beneficial owner financial profile, IBAN — is encrypted at rest with AES-256-CBC. All connections use TLS. Access is restricted by role-based permissions and every access is logged in a tamper-evident audit trail.

Data breach notification

If a personal data breach is likely to harm your rights and freedoms, we will notify you and the UAE Data Office within 72 hours of becoming aware of the breach, in accordance with PDPL Article 9.

Data Protection Officer

Email: privacy@trilink.ae

Complaints

If you believe we have processed your personal data unlawfully you may file a complaint directly with the UAE Data Office. We would also welcome hearing from you first so we can try to resolve the matter directly.