Privacy Policy — ArabyAds Group of Companies

Last updated: 12 August 2026

1. Introduction and Scope

This Privacy Policy (the “Policy”) governs the collection, use, disclosure, and processing of personal data by ArabyAds and its group companies, subsidiaries, and affiliates (collectively, “ArabyAds,” the “Company,” “we,” “us,” or “our”) in connection with arabyads.com and the Company’s affiliated websites, platforms, applications, and sub-domains, including but not limited to the brands, services, and platforms listed at [https://adfalcon.com/en/User/Login, https://backoffice.boostiny.com/login, https://account.ritelo.io/en/User/Login, https://dashboard.ritelo.io, https://missioncontrol.arabyads.com, https://hhg.adfalcon.com/login] (collectively, the “Group Websites” or “Services”). Where a specific Group Website publishes its own privacy policy or addendum tailored to its particular services (for example, for consumer-facing platforms), that document supplements and, in the event of any conflict, takes precedence over this Policy in respect of that Group Website.

This Policy is issued with reference to UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, as amended from time to time (“PDPL”) and its Implementing Regulation (Cabinet Decision No. 21 of 2024). This Policy, and any dispute or claim arising out of or in connection with it or your use of any Group Website, is governed by and construed in accordance with the laws of the United Arab Emirates, without regard to conflict-of-laws principles, as set out further in Section 17.

By accessing, browsing, registering for, or otherwise using any Group Website, you acknowledge that you have read, understood, and agree to be bound by this Policy in its entirety. If you do not agree to any part of this Policy, your sole and exclusive remedy is to immediately discontinue use of the relevant Service. Continued use of any Group Website following any update to this Policy constitutes your acceptance of the revised terms.

2. Data Controller Information

Arabyads FZ-LLC Registered Address: premises no.501, Floor: 05 Building: CYS & CO INC, Dubai media city, Dubai, UAE. Contact: legal@arabyads.com

The Company acts as Controller for the purposes of the PDPL in respect of the Group Websites, except where the Company processes personal data strictly on the documented instructions of an advertiser, publisher, or partner client, in which case the Company acts solely as Processor and disclaims Controller-level responsibility for that client’s own data practices, representations, or legal basis for collection.

3. Personal Data We Collect

The Company collects the categories of personal data reasonably necessary to operate the Group Websites and deliver the Services, including but not limited to: device and browser identifiers; cookie and mobile advertising identifiers; usage, click, and conversion data; account, billing, and payment/payout details; business contact information; campaign performance data; social media handles and engagement statistics; and any other information voluntarily submitted by you through registration forms, account settings, correspondence, or otherwise.

You are solely responsible for the accuracy, completeness, and lawfulness of any personal data you submit, including any personal data of third parties you provide to us (e.g., in connection with referral programs, team accounts, or campaign management), and you represent and warrant that you have all necessary rights and consents to provide such data to the Company for processing in accordance with this Policy.

The Company reserves the right to collect additional categories of data as reasonably necessary for the operation, security, or improvement of the Services, and to determine, in its sole discretion, the means and purposes of such collection, subject to applicable law.

4. How We Use Personal Data

The Company processes personal data for its legitimate business purposes, including without limitation: operating, securing, and improving the Group Websites; delivering, personalizing, measuring, and attributing advertising campaigns; calculating and disbursing payouts; preventing fraud and abuse; enforcing the Company’s Terms of Use and other agreements; complying with applicable legal and regulatory obligations; developing new products, features, and services; and generating aggregated, de-identified, or anonymized data and analytics, which the Company may use, license, sell, or otherwise exploit for any lawful business purpose without further notice to or compensation of any individual, as such aggregated or de-identified data does not constitute personal data.

5. Legal Bases for Processing

The Company processes personal data on the broadest legal bases available to it under the PDPL, including consent, performance of a contract, compliance with a legal obligation, and the Company’s legitimate interests (including interests in fraud prevention, platform security, network integrity, and business analytics), which the Company has determined are not overridden by the interests or fundamental rights of the data subject. By using the Services, you acknowledge and agree that such legitimate interests apply to the processing described in this Policy. Where consent is relied upon, your continued use of the Services following notice of this Policy constitutes such consent to the fullest extent permitted by applicable law.

6. Disclosure of Personal Data

The Company may disclose personal data, at its sole discretion and without further notice except where required by applicable law, to: other Company group entities; advertisers, publishers, agencies, and partners participating in the Company’s advertising network; payment processors and financial institutions; hosting, analytics, cloud, and other service providers engaged by the Company; ad exchanges, DSPs/SSPs, and measurement partners; professional advisors; regulators, courts, law enforcement, or other governmental authorities; and any successor, acquirer, or assignee in connection with a merger, reorganization, financing, or sale of all or part of the Company’s business or assets. The Company shall have no liability to any individual for disclosures made in good-faith reliance on this Policy, a partner’s representations, or a request purporting to be from a competent authority.

7. Cross-Border Data Transfers

You acknowledge and agree that, given the Company’s regional and international operations, personal data may be transferred to, stored, and processed in jurisdictions outside the UAE, including jurisdictions that may not offer a level of data protection equivalent to the UAE. The Company will implement safeguards it considers appropriate and consistent with the PDPL and its Implementing Regulation (including standard contractual clauses or reliance on your consent to the transfer), and your continued use of the Services constitutes your consent to such transfers.

8. Cookies and Similar Technologies

The Group Websites use cookies, SDKs, pixels, and similar technologies as described in the Company’s Cookie Policy/consent tool, incorporated herein by reference. The Company disclaims liability for any loss of functionality resulting from your election to disable or restrict cookies, and reserves the right to require certain cookies as a condition of accessing the Services.

9. Your Rights

Subject to the conditions, exceptions, and limitations set out in the PDPL — including exceptions for requests that are manifestly unfounded, excessive, repetitive, or that would adversely affect the rights of others, the Company’s legitimate business interests, or the integrity of ongoing fraud-prevention or legal processes — you may request to access, correct, or erase your personal data, restrict or object to certain processing, request portability, or withdraw consent, by submitting a request in accordance with Section 18. The Company reserves the right to charge a reasonable administrative fee for manifestly unfounded or excessive requests, to the extent permitted by law, and to decline requests it is not legally obligated to fulfil. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal, nor does it obligate the Company to delete data it is otherwise entitled or required to retain.

10. Data Retention

The Company retains personal data for such period as it determines, in its reasonable discretion, is necessary to fulfil the purposes described in this Policy, to satisfy legal, regulatory, tax, or accounting requirements, to establish, exercise, or defend legal claims, and to enforce its agreements. The Company is not obligated to retain data for any minimum period for the benefit of any individual, except where required by applicable law.

11. Data Security; Disclaimer

The Company implements technical and organizational measures it considers appropriate, consistent with the PDPL. However, no method of electronic transmission or storage is completely secure, and the Company makes no representation or warranty, express or implied, that any personal data will be immune from unauthorized access, loss, misuse, or alteration. To the fullest extent permitted by applicable law, the Company disclaims all liability for any breach of security or unauthorized access not directly and solely caused by the Company’s gross negligence or wilful misconduct, and you agree that your use of the Services is at your own risk.

12. Limitation of Liability

To the maximum extent permitted by applicable law, in no event shall the Company, its officers, directors, employees, affiliates, or agents be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or any loss of profits, revenue, data, or goodwill, arising out of or relating to this Policy or the processing of personal data, regardless of the theory of liability, even if the Company has been advised of the possibility of such damages. Where liability cannot be excluded under applicable law, the Company’s aggregate liability arising out of or relating to this Policy shall not exceed USD 10,000, or the minimum amount permitted by applicable mandatory law, whichever is greater.

13. Indemnification

You agree to indemnify, defend, and hold harmless the Company, its officers, directors, employees, and affiliates from and against any and all claims, liabilities, damages, losses, costs, and expenses (including reasonable legal fees) arising out of or related to: (a) your breach of this Policy; (b) your provision of inaccurate, unlawful, or unauthorized personal data (including of third parties) to the Company; or (c) your violation of any applicable law or the rights of any third party in connection with your use of the Services.

14. No Warranty

The Services, and any data-processing functionality made available through them, are provided “as is” and “as available,” without warranties of any kind, whether express, implied, or statutory, including without limitation implied warranties of merchantability, fitness for a particular purpose, accuracy, or non-infringement, to the fullest extent permitted by applicable law.

15. Children’s Privacy

The Group Websites are not directed at individuals under the age of 18. The Company does not knowingly collect personal data from persons under 18 without appropriate consent and disclaims any liability arising from a user’s misrepresentation of their age.

16. Data Breach Notification

Where required by the PDPL, the Company will notify the UAE Data Office and affected individuals of a personal data breach likely to result in a risk to their rights and freedoms, within the timeframe and in the manner required by applicable law, and no more expansively than legally required.

17. Governing Law and Dispute Resolution

This Policy shall be governed by and construed in accordance with the federal laws of the United Arab Emirates and, to the extent applicable, the laws of the Emirate of Dubai, without giving effect to any choice of law principles. Any dispute, controversy, or claim arising out of or relating to this Policy, including its interpretation, breach, termination, or validity, shall be subject to the exclusive jurisdiction of the competent courts of Dubai, UAE. You waive any objection to the exercise of jurisdiction by such courts/tribunal and to venue in such forum.

18. Contact Us

Requests to exercise rights under Section 9, or other inquiries regarding this Policy, should be submitted in writing to:

ArabyAds Group — Data Protection Email: legal@arabyads.com 

The Company will endeavor to respond within the timeframe required by the PDPL, subject to the exceptions described in Section 9. You may also lodge a complaint with the UAE Data Office.

19. Amendments; Severability; Entire Agreement

The Company reserves the right, in its sole discretion, to amend this Policy at any time by posting the revised version on the applicable Group Website, with the “Last updated” date revised accordingly. Except where mandatory law requires additional notice or consent, no further notice is required for such amendments to take effect, and continued use of the Services after posting constitutes acceptance. If any provision of this Policy is held invalid or unenforceable, that provision shall be limited or eliminated to the minimum extent necessary, and the remaining provisions shall remain in full force and effect. This Policy, together with the Company’s Terms of Use and Cookie Policy, constitutes the entire agreement between you and the Company with respect to the processing of your personal data, and supersedes all prior understandings on that subject.