HomeLegalGDPR Compliance

GDPR Compliance

How we protect your data rights under the General Data Protection Regulation.

Last updated: 1 May 2026 · Effective: 1 May 2026

Your Rights Under GDPR

As a data subject, you have the following rights. We are committed to honouring them.

Right to Access

Art. 15

Request a copy of all personal data we hold about you, free of charge, within 30 days.

Right to Rectification

Art. 16

Request correction of inaccurate or incomplete personal data we hold.

Right to Erasure

Art. 17

Request deletion of your personal data where there is no compelling reason for continued processing.

Right to Restriction

Art. 18

Request that we restrict how we process your data in certain circumstances.

Right to Portability

Art. 20

Receive your data in a structured, commonly-used, machine-readable format.

Right to Object

Art. 21

Object to processing based on legitimate interests, direct marketing, or profiling.

Right to Withdraw Consent

Art. 7(3)

Withdraw your consent for any processing based on consent, at any time.

Right to Complain

Art. 77

Lodge a complaint with your national supervisory authority if you believe your rights have been violated.

1. Our GDPR Commitment

Broker Bazaar Media and Technology L.L.C-FZ (and, for U.S. users, Broker Bazaar Media & Technology LLC) is committed to compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and the UK GDPR where they apply to visitors from the EU/EEA and the United Kingdom. We act as a Data Controller for the personal data you provide to us directly. In some circumstances (such as where we process data on behalf of broker partners), we may act as a Data Processor. Our Data Protection Officer (DPO) can be contacted at: dpo@brokerbazaar.com

2. Lawful Basis for Processing

Under GDPR, we must have a lawful basis for processing your personal data. We rely on the following legal bases: Contractual necessity: Processing required to provide our services to you (e.g., account management, support) Legitimate interests: Processing for purposes such as fraud prevention, platform security, and improving our services, where these are not overridden by your rights Consent: Processing for marketing communications, non-essential cookies, and analytics. You may withdraw consent at any time Legal obligation: Processing required to comply with applicable laws and regulations (e.g., anti-money laundering, tax reporting)

3. International Data Transfers

BrokerBazaar may transfer your personal data to countries outside the U.A.E., UK and EEA, including the United States, where our service providers operate. When we transfer data internationally, we ensure appropriate safeguards are in place: • Standard Contractual Clauses (SCCs): EU/UK SCCs with all third-country processors • Adequacy decisions: Transfers to countries with an adequacy decision from the UK/EU • Binding Corporate Rules: For transfers within corporate groups You can request information about the specific safeguards used for any international transfer by contacting our DPO.

4. Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities as required by Article 35 GDPR. This includes: • Processing at scale involving sensitive personal data • Systematic profiling of users • New technologies involving novel uses of personal data • Processing that could result in a high risk to individuals DPIAs are reviewed annually and whenever we introduce new processing activities.

5. Data Breach Procedures

We have comprehensive data breach response procedures in place. In the event of a personal data breach: • We will assess the severity and scope within 24 hours of discovery • If the breach poses a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where required • If the breach poses a high risk to affected individuals, we will notify those individuals without undue delay • All breaches are documented in our internal breach register regardless of whether notification is required To report a suspected security incident, contact: security@brokerbazaar.com

6. How to Exercise Your Rights

To exercise any of your GDPR rights, please: Email: dpo@brokerbazaar.com Subject line: "GDPR Rights Request — [Type of Request]" Include: Your full name, email address on file, and a description of your request We will respond within 30 days (extendable to 3 months for complex requests). We may ask for proof of identity before processing your request. There is no charge for exercising your rights. However, we may charge a reasonable fee for manifestly unfounded or excessive requests. If you are unsatisfied with our response, you can complain to your local data protection or supervisory authority.