Privacy Notice

ExpandUs L.L.C-FZ, trading as ExpandUs Global, is a market-entry consultancy and project-management provider. We provide market Snapshots and coordinate agreed expansion projects; regulated work is performed and filed by independent licensed partner firms. Our registered address is Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba 1, Dubai, United Arab Emirates. Our Meydan Free Zone licence number is 2651986.01.

We are the controller of personal data used to operate our website, accounts, Snapshots, enquiries, partner network and business relationships. This notice covers those activities and the services that link to it. Information about an identifiable business owner, sole trader, employee or professional is personal data even when supplied for business purposes.

Contact our privacy lead at privacy@expandusglobal.com. If that address is unavailable, use hello@expandusglobal.com and mark the message “Privacy”. These contacts handle rights requests and complaints.

Independent lawyers, accountants and other professionals, including firms engaged and paid by ExpandUs as principal for package work, usually control the data they need for their own advice, client acceptance, regulatory duties and records. Their privacy notices apply to that processing. Where a particular service instead involves processing solely on another organisation’s instructions, the relevant agreement defines that role and its safeguards.

We collect information you provide through forms, accounts, chat, email, calls, meetings and authorised document uploads. It can include:

We may also receive information from your organisation, a person authorised to act for you, a referring contact, an independent professional, or public business and professional registers. For partner selection, we may check supplied information against professional registers, websites and references. We identify the source when providing the required privacy information or answering a request, subject to lawful restrictions.

Please provide only information relevant to your request and make sure you are entitled to share other people’s information. Do not put passwords, payment-card details, passport or national identity numbers, or information about health, religion or other sensitive personal matters into public forms or chat. If an assignment requires identity or authority documents, we explain the need and provide an appropriate collection route. Our business services are intended for people aged 18 or over. Contact us if you believe a child has supplied personal data.

We use information to provide requested reports and accounts; arrange calls; answer enquiries; explain results; manage assignments; assess and maintain partner relationships; keep accurate business records; protect systems; prevent misuse; and handle legal obligations, disputes and privacy requests.

Following up your Snapshot: we use your phone number and request details to contact you about your Snapshot and our related services. You can ask us to stop at any time, and we record that request.

For processing subject to EU or UK data protection law, our principal bases are:

Legitimate interests is not a universal basis under every country’s law. Where UAE data protection law applies, we rely on consent or an applicable statutory exception, such as necessary contractual steps, legal obligations or legal claims. For processing governed by Indian law, we use the consent or other permitted ground available under the provisions in force. We do not treat an EU or UK legitimate-interests assessment as an independent permission under UAE or Indian law.

Where information is necessary to supply a requested service or meet a legal duty, we explain that in the relevant process. Without it, we may be unable to provide that part of the service. Optional marketing is not a condition of receiving a Snapshot, account or enquiry response.

We send messages needed to deliver your request, such as confirmation codes, report delivery, appointment details, security notices and assignment updates. We use the channels you provide or choose for those purposes. Promotional messages require the applicable permission and our separate marketing choice. You can unsubscribe through the message or contact us. We keep a limited suppression record where needed to respect that choice.

Business-initiated WhatsApp messages from ExpandUs Global require recorded permission covering those messages. We may also answer a message you initiate, within the platform’s rules. Giving a phone number alone does not authorise unrelated WhatsApp marketing. If we use automated WhatsApp replies, we provide a clear, direct route to human support. Avoid sending sensitive documents through WhatsApp; request a secure route instead.

Before sharing information with an independent firm for an introduction or package assignment, we identify it, explain the purpose and information to be shared, and record your instruction. We share the information needed for the introduction or assignment. That instruction does not remove either organisation’s duty to have its own lawful basis and protect the data.

AI contributes materially to our Snapshots. Our rules shortlist markets and apply exclusions. OpenAI researches public sources, assigns ratings to assessment areas and helps write explanations and next steps. Rules then calculate and order scores using the available ratings and evidence. Scores express an indicative assessment based on the inputs and sources available. Snapshot reports carry this notice:

Your Snapshot is prepared by our system using defined rules, public data and AI. It may contain errors or be out of date, and it is not legal, tax or financial advice. Please confirm important points before acting.

The standard Snapshot request to OpenAI contains structured business context, including the market assessed, industry and activity, buyers, goals, home and existing markets, sourcing, assessment areas and public facts. It excludes customer name, email, phone number, company name, website and free-text notes. Business context may nevertheless identify someone indirectly, particularly a sole trader.

For the automated chat route, OpenAI receives the current question, limited to 500 characters, with email addresses and phone numbers removed, together with permitted answer topics. Names, company names and websites typed into the question can remain. This is not complete anonymisation. That route does not send your full conversation history or Snapshot report. Separate storage of conversations by ExpandUs is described below.

Our chat identifies itself as an AI assistant. These tools support business planning; they do not make decisions granting or denying credit, employment or legal rights. Ask us for an explanation or correction of a result before relying on it for an important decision. If a future service involves a materially different automated decision, we provide the information and safeguards required for that use.

Authorised team members and service providers receive information needed for their duties. Our Service Providers page describes hosting, database, AI, email, security and error-monitoring providers. Our business email service handles correspondence. Specialist calls take place on a video-call service, and booking invitations are sent by email. Authorised document services support agreed assignments. Independent professionals receive information through the introduction or package-engagement process described above. Some infrastructure providers also act as independent controllers for limited purposes identified on the Service Providers page.

We may disclose relevant information where required by law, to protect legal rights, or to advisers and a prospective successor in a genuine business transaction, with appropriate confidentiality and data protection measures.

We operate from the UAE. Providers may process data in Germany, the United States and other countries through their infrastructure, support teams and subprocessors. A database location does not determine the location of every copy or all remote access. Processing locations vary by provider and service configuration.

Where the applicable law requires a transfer safeguard, our policy is to put it in place before permitting the transfer. Depending on the countries and parties involved, this may involve an adequacy decision, appropriate contractual safeguards such as EU standard contractual clauses or a UK transfer agreement or addendum, and any required assessment or supplementary protection. For transfers governed by the UAE PDPL, the relevant route is considered separately under Article 22 or 23: an Article 22 transfer to a country with data protection legislation, in cases approved by the UAE Data Office; where the destination has no data protection legislation, contractual safeguards meeting Article 23(1)(a); or another permitted route such as explicit transfer consent, contract necessity or legal claims where its specific conditions are met. EU standard contractual clauses and UK transfer documents do not by themselves establish permission under UAE law. Other jurisdictions have their own requirements. We do not treat consent to this notice as a general waiver of transfer protections. Contact us for information about the safeguards relevant to your data or a copy, subject to necessary redactions.

The following periods are our normal schedule. A deletion request can result in earlier deletion where the law requires it. Mandatory retention and specific legal holds can justify keeping relevant records longer.

We retain minimal consent, preference, suppression and rights-request records for as long as needed to demonstrate and respect the relevant choice or meet a legal requirement. We do not keep an entire marketing profile merely to record an opt-out.

Depending on the law that applies, you may request access and a copy, correction, deletion, restriction, portability, withdrawal of consent, or an objection to particular processing. You can object to direct marketing at any time. Withdrawal does not invalidate processing lawfully carried out beforehand. Applicable law may also provide safeguards concerning significant automated decisions; EU and UK rules are not identical.

For India, when the relevant DPDP provisions apply, section 11 gives access to a summary of your personal data and its processing, the identities of recipients and a description of the data shared, subject to statutory exceptions. That access right concerns consent-based processing, including the voluntarily provided data use addressed by section 7(a). Applicable rights also include correction, completion, updating, erasure and nomination of another person to exercise rights if you die or become incapable. Our privacy contact handles grievances; use that route before escalating to the Data Protection Board where the Act requires it. When Rule 14 applies, our grievance-response period will not exceed 90 days, without delaying a shorter applicable duty. We apply the provisions in force when you make your request.

Where another country's privacy law applies, we also give effect to its applicable rights and complaint routes. These may include information about use and disclosure, anonymity or a pseudonym where lawful and practicable, opting out of sale, sharing or targeted advertising, and appealing a refusal of a rights request. Tell us your location so we can identify the relevant rules. We do not sell personal information or share it for cross-context behavioural advertising, and do not unlawfully discriminate against you for exercising a privacy right. A request may be subject to lawful conditions or exemptions, which we explain.

Send requests to our privacy contact. We may ask for proportionate information to verify identity or authority, without routinely requiring identity documents. We explain any lawful refusal or limitation. We meet the applicable response deadline; EU and UK rights requests normally require a response within one calendar month, subject to permitted extensions and other statutory rules.

You may complain to us or to the competent data protection authority. We acknowledge privacy complaints within two business days and aim to give a substantive response within ten business days. If the investigation needs longer, we keep you informed and respond without undue delay. Applicable statutory deadlines prevail. A complaint does not remove your right to approach an authority or court.

We use access controls, appropriate service-provider arrangements and organisational and technical measures proportionate to the information and risks. No system is completely secure. Report a suspected exposure promptly, without sending additional sensitive information unnecessarily.

We update this notice when our processing changes. The date above identifies the current version. We provide additional notice or seek a new choice where a material change or applicable law requires it.