Privacy Policy

This Privacy Policy explains how ApeX by Wrap_OS ("ApeX", "we", "us", or "our") collects, uses, discloses, and protects your personal data when you access or use the ApeX platform, website, and related services (collectively, the "Services").

This Privacy Policy is aligned with the requirements of UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL") and any implementing regulations issued thereunder.

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

ApeX is the Data Controller responsible for the processing of your personal data as described in this Privacy Policy.

If you are a business customer subscribing to the ApeX platform, the relationship between ApeX and your organization is further governed by our Data Processing Agreement, which sets out the respective roles and obligations of Controller and Processor.

Our Data Protection Officer can be contacted at privacy@apx-erp.com for any questions, requests, or concerns regarding this Privacy Policy or the processing of your personal data.

Account Data: Name, email address, phone number, company name, job title, and password credentials when you create an account.

Business Data: Company registration details, trade license information, tax registration numbers, and financial configuration data submitted through the platform.

Financial Data: Transaction records, invoices, payments, bank account details, payroll data, and tax filings processed through the platform.

Contact Data: Information about your customers, vendors, employees, and other contacts that you submit to the platform.

Usage Data: IP address, browser type, device information, access times, pages visited, and interaction data collected automatically when you use the Services.

Communication Data: Content of messages, support tickets, and communications you send to us through the platform or via email.

To provide, operate, and maintain the Services, including processing financial transactions, generating invoices, and producing reports.

To create and manage your account, authenticate your identity, and enforce access controls.

To provide customer support, respond to inquiries, and resolve issues.

To send service notifications, security alerts, and administrative communications.

To comply with legal obligations, including tax filing, financial record retention, and regulatory reporting under UAE law.

To detect, prevent, and address fraud, security incidents, and other malicious activity.

To improve the Services, develop new features, and conduct analytics on platform usage.

With your consent, to send marketing communications about products, services, and promotions. You may opt out of marketing communications at any time.

We process your personal data on the following legal bases:

• Consent: Where you have provided explicit consent to the processing of your personal data for a specific purpose.

• Contract Performance: Where processing is necessary for the performance of a contract to which you are a party, including the provision of the Services.

• Legal Obligation: Where processing is necessary to comply with a legal obligation under UAE law, including tax and financial record-keeping requirements.

• Legitimate Interests: Where processing is necessary for our legitimate interests in operating and securing the platform, provided such interests are not overridden by your rights and freedoms.

We do not sell your personal data to any third party.

We may share your personal data with the following categories of recipients:

• Sub-processors and service providers that assist us in providing the Services, including cloud hosting providers, payment processors, and communication gateways. These parties are bound by data protection obligations no less protective than those in this Privacy Policy.

• Government authorities, regulators, and law enforcement agencies where required by law or to protect our legal rights.

• Professional advisors, including auditors and legal counsel, for the purpose of providing professional services to us.

• A successor entity in the event of a merger, acquisition, or asset transfer, subject to the protections of this Privacy Policy.

Your personal data may be transferred to and processed in countries outside the UAE, including the United States and European Union, for the purpose of providing and maintaining the Services.

Where personal data is transferred to a third country, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and data processing agreements with sub-processors that provide a level of protection comparable to that required under the PDPL.

UAE-only data residency options are available for business customers upon request. Contact our Data Protection Officer for more information.

We retain your personal data for as long as your account is active and for a period of 7 years following account termination, as required for financial record retention under UAE Federal Law and Federal Tax Authority (FTA) regulations.

Usage data and log records are retained for a period of up to 12 months, unless longer retention is required for security or legal purposes.

When personal data is no longer needed, we securely delete or anonymize it in accordance with applicable data protection laws.

We implement and maintain appropriate technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• TLS 1.2+ encryption for all data in transit and AES-256 encryption for all data at rest.

• Row-level database security and company-scoped data isolation.

• Multi-factor authentication (MFA) and secure password hashing.

• Rate limiting, audit logging, and constant-time webhook verification.

• Regular security assessments, vulnerability scanning, and penetration testing.

For details on the security measures applicable to business customers, please refer to our Data Processing Agreement.

Under the PDPL, you have the following rights regarding your personal data:

• Right of Access: You may request a copy of the personal data we hold about you.

• Right to Rectification: You may request that we correct any inaccurate or incomplete personal data.

• Right to Erasure: You may request that we delete your personal data, subject to legal retention requirements.

• Right to Data Portability: You may request a machine-readable copy of your personal data for transfer to another service.

• Right to Object: You may object to the processing of your personal data for direct marketing or other purposes based on legitimate interests.

• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact our Data Protection Officer at privacy@apx-erp.com. We will respond to your request within 30 days.

We use cookies and similar tracking technologies to operate and improve the Services, analyze usage, and provide a personalized experience.

You may control cookies through your browser settings. Disabling cookies may affect the functionality of the Services.

We do not use cookies for cross-site advertising or profiling without your consent.

The Services are intended for business and professional use. We do not knowingly collect personal data from individuals under the age of 18.

If you believe we have collected personal data from a minor, please contact our Data Protection Officer so we can take appropriate action.

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and, where appropriate, by sending a notification to the email address associated with your account.

We will update the "Effective Date" at the top of this page whenever the Privacy Policy is revised. Your continued use of the Services after the effective date of any changes constitutes acceptance of the updated Privacy Policy.

If you have any questions, requests, or concerns regarding this Privacy Policy or the processing of your personal data, please contact our Data Protection Officer at privacy@apx-erp.com.

You may also contact us by mail at our registered office in the United Arab Emirates.