ApexReachThis Privacy Policy explains how Veridra Computer Technology L.L.C – S.P.C (“ApexReach”, “we”, “us”) collects, uses, and protects personal data in compliance with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021 — PDPL) and, where applicable, the EU General Data Protection Regulation (GDPR).
2.1 Data Controller / Processor Identity
- For Client data (account holders, users): ApexReach is the data controller.
- For Prospect data (contacts reached on a Client’s behalf): ApexReach is a data processor acting on the Client’s instructions. The Client is the data controller.
- Data Protection Contact: sultan@veridra.ae
2.2 Personal Data We Collect
A. Client and Platform User Data
- Full name, job title, company name, business email address, phone number
- Billing information (processed via our third-party payment processor — ApexReach does not store card details)
- ICP parameters and campaign configuration data
- Platform login and activity logs, session data
- Support and communications records
B. Prospect Data (Processed on the Client’s Behalf)
- Business contact information: name, business email address, job title, company, LinkedIn profile URL
- Engagement signals: email open events, link click events, reply detection, opt-out events
- Opt-out status and suppression timestamps (retained to enforce suppression)
- Data sourced from ApexReach’s database and/or licensed third-party data suppliers
C. Website Visitor Data
- IP address, browser type, operating system, pages visited, time on site
- Essential cookies only (see our Cookie Policy)
2.3 Legal Basis for Processing
| Data Category | Legal Basis | Framework |
|---|---|---|
| Client account & contract data | Contract performance | PDPL Art. 4 / GDPR Art. 6(1)(b) |
| Billing records | Legal obligation (UAE tax/AML) | PDPL Art. 4 / GDPR Art. 6(1)(c) |
| Prospect outreach data | Legitimate interests (B2B) | PDPL Art. 4 / GDPR Art. 6(1)(f) |
| Opt-out / suppression records | Legal obligation + legitimate interest | PDPL / GDPR / CAN-SPAM |
| Website analytics (cookieless) | Legitimate interests | PDPL Art. 4 / GDPR Art. 6(1)(f) |
| Marketing to Clients | Legitimate interests | PDPL Art. 4 |
2.4 How We Use Personal Data
- Service Delivery: sourcing and verifying contacts, dispatching outreach sequences, processing opt-outs, reporting results.
- Account Management: billing, invoicing, platform access, customer support.
- Legal Compliance: tax and accounting obligations, anti-money laundering obligations, regulatory requests.
- Platform Improvement: aggregated and anonymised analytics.
- Marketing to Clients: service updates and feature announcements. Opt-out any time by emailing sultan@veridra.ae.
2.5 Automated Opt-Out Processing
ApexReach operates a fully automated opt-out suppression system. No human intervention is required. When a prospect opts out:
| Step | Action | Timing |
|---|---|---|
| 1. Opt-out received | System detects unsubscribe click or recognised opt-out reply | Real-time |
| 2. Sequence halt | Contact removed from all active sequences | Same sending cycle |
| 3. Suppression list | Email added to the Client’s account suppression list | Immediately |
| 4. Account-wide block | Contact blocked from the Client’s future campaigns (all service categories) | Permanent |
| 5. Audit record | Opt-out event logged with timestamp | Permanent retention |
Hard bounces and spam complaints are additionally quarantined across the platform to protect deliverability. Prospects may also email sultan@veridra.ae to be added to the suppression list; manual requests are processed within 24 hours.
2.6 Data Sharing
We do not sell personal data. We share data only in the following circumstances:
- Data suppliers: third-party providers of verified B2B contact data, under data processing agreements.
- Subprocessors: we engage a limited set of third-party providers (such as email delivery, authentication, hosting, AI, and payment providers) under data processing agreements. A list of subprocessors is available to customers on request at sultan@veridra.ae.
- Legal obligation: when required by UAE law or a valid court order.
- Business transfer: in a merger, acquisition, or asset sale — Clients will be notified in advance.
2.7 International Transfers
Where ApexReach transfers personal data outside the UAE (e.g., to cloud infrastructure or email delivery providers), we implement appropriate safeguards including standard contractual clauses or equivalent mechanisms, and transfer only to jurisdictions with adequate data protection frameworks.
2.8 Data Retention
| Data Category | Retention Period | Basis |
|---|---|---|
| Client account data | Duration of contract + 3 years | Contractual / limitation period |
| Billing and accounting records | 5 years | UAE record-keeping obligations |
| Prospect engagement data | 2 years from last interaction | Legitimate interest |
| Opt-out / suppression records | Indefinite | Legal obligation to prevent re-contact |
| Website visitor logs | 12 months | Operational necessity |
2.9 Data Subject Rights
Under the UAE PDPL and GDPR (where applicable), you have the right to:
- Access — obtain a copy of your personal data
- Rectification — correct inaccurate data
- Erasure — request deletion (subject to legal retention requirements)
- Restriction — limit how we process your data
- Objection — object to processing based on legitimate interests
- Portability — receive your data in a machine-readable format
- Withdraw Consent — where consent is the basis, at any time
Submit requests to sultan@veridra.ae. We will respond within 30 calendar days.
2.10 Security Measures
- Encryption for data at rest; TLS 1.2+ for all data in transit
- Role-based access controls with least-privilege principles
- Regular security audits and vulnerability assessments (see our Security & Disclosure page)
- Data breach notification to affected parties within 72 hours of discovery, per PDPL requirements
2.11 Cookies
We use only essential cookies plus a cookieless analytics tool, so we do not display a cookie consent banner. Details are in our Cookie Policy. You can control cookies through your browser settings.
2.12 Children
The Service is not directed at individuals under 18. We do not knowingly collect data from minors.
2.13 Policy Updates
Material changes to this Policy will be communicated by email to registered Clients and posted at apexreach.ae/privacy with 14 days’ notice.