Privacy Policy

1. Who we are

This Privacy Policy describes how the operator of SEKRAB.AE (“SEKRAB”, “we”, “us”, or “our”) collects, uses, stores, and shares personal data when you visit or use our UAE marketplace for used auto spare parts.

The legal entity name for the controller will be confirmed before launch. Until then, you may contact us using the details in the Contact section below.

2. Scope

This policy applies to visitors, consumer accounts, supplier accounts, and related services on SEKRAB.AE, including web pages, account portals, order chat, and contact forms.

We process personal data in line with applicable UAE law, including the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) (“PDPL”), and other rules that may apply to our operations.

3. Personal data we collect

Account and identity data: full name, email address, password (stored by our authentication provider), role (consumer, supplier, or admin), phone number, avatar image URL, preferred language, and default emirate.

Supplier onboarding and KYC data: company name, trade license number, address, emirate, VAT TRN, contact person details, bank name, bank account name, IBAN, and uploaded documents such as trade license and bank certificates. Store branding (logo and banner) may also be collected.

Marketplace and vehicle data: garage vehicles (nickname, make, model, year, trim, VIN/chassis), part requests (part details, vehicle identifiers, notes, photos, emirate, delivery preferences, budget), orders, delivery addresses, quotes, reviews, and disputes.

Communications: order-scoped chat messages, moderation records of blocked content, in-app notifications, and contact or FAQ form submissions (name, email, mobile, and question).

Payment and payout data: payment session and provider references, amounts, and supplier payout or transfer proof records when payouts are processed.

Technical and cookie data: authentication and session cookies, role and password-recovery cookies used to operate the site, locale preference, theme preference, approximate request IP used for rate limiting, and your cookie consent choices (stored in your browser and, after you log in or register, linked to your account).

4. Purposes and legal bases

We use personal data to create and manage accounts, verify suppliers, match buyers with scrap-yard inventory, process orders and payments, enable in-app chat, prevent off-platform circumvention, handle disputes and reviews, send service notifications, improve security, and comply with legal obligations.

Depending on the activity, we rely on one or more of the following bases under PDPL and related rules: performance of a contract with you; compliance with a legal obligation; your consent (for example, non-essential cookies or optional marketing if introduced); and legitimate interests such as platform integrity, fraud prevention, and service improvement, balanced against your rights.

Supplier contact details are masked from buyers until the relevant order stage, consistent with our marketplace design.

5. Sharing and processors

We do not sell your personal data.

We share data with service providers who process it on our behalf, including Supabase (authentication, database, file storage, and transactional auth email). When payment providers are configured (for example Stripe, Telr, PayTabs, or Checkout.com), relevant payment data is shared with them to complete transactions. During development, payments may run in mock mode without a live processor.

Platform administrators may access personal data as needed to operate the marketplace, review KYC, moderate chat, handle disputes, contact submissions, and account deletion requests.

We may disclose data if required by law, regulation, or lawful authority request, or to protect the rights, safety, and integrity of SEKRAB, our users, or others.

6. Cookies and similar technologies

We use cookies and similar technologies that are necessary to run SEKRAB.AE, including authentication/session cookies, role routing, password-recovery gating, and locale selection.

You can manage non-essential cookie categories (preferences, analytics, and marketing) through our cookie banner or Cookie settings. Necessary cookies remain enabled so the site can function.

Your consent choice is stored in a first-party browser cookie. After you log in or register, we sync that choice to your account so it can be restored on other devices. You may withdraw or change non-essential consent at any time via Cookie settings.

We do not currently load third-party analytics or marketing pixels. If we add them later, they will only run when you have consented to the relevant category.

7. International transfers

Our primary infrastructure is provided by Supabase and related hosting. Personal data may be processed or stored outside the UAE depending on the provider’s regions.

Where international transfers occur, we take steps consistent with applicable law to protect personal data, including contractual and technical safeguards appropriate to the transfer.

8. Retention

We retain personal data only as long as needed for the purposes described in this policy, including providing the service, resolving disputes, meeting legal, tax, and accounting requirements, and maintaining security logs.

Account deletion currently works as a request reviewed by an administrator. When approved, the account is deactivated (soft delete). Related transactional records such as orders, messages, KYC documents, and payments may be retained where needed for legal, dispute, or audit purposes rather than being fully purged.

Cookie consent records linked to your account are kept while your account exists and may be updated when you change preferences. Browser consent cookies typically expire after about one year unless renewed.

9. Security

We use technical and organisational measures appropriate to the risk, including encrypted transport (HTTPS), access controls, authentication via our identity provider, and restricted access to sensitive supplier documents and payout proofs.

No method of transmission or storage is completely secure. Please use a strong password and protect your login credentials.

10. Your rights under PDPL

Subject to applicable law and exemptions, you may have rights to access your personal data, request correction of inaccurate data, request erasure or restriction of processing, object to certain processing, and withdraw consent where processing is based on consent.

In product today you can update many profile and company fields yourself, manage garage vehicles, and submit an account deletion request from your account settings. Cookie preferences can be changed through Cookie settings. We do not currently offer a self-service full data-export download.

To exercise other rights, contact us using the Contact section. We may need to verify your identity before responding. You may also have the right to lodge a complaint with the competent UAE data protection authority.

11. Children

SEKRAB.AE is intended for adults who can form a binding contract in the UAE. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us so we can take appropriate action.

12. Changes

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will change when we do. Material changes may also be highlighted in-product or by email where appropriate. Continued use of the platform after an update means you acknowledge the revised policy.

13. Contact

For privacy questions or requests, email privacy@sekrab.ae (placeholder — replace with your production privacy contact before launch) or use the Contact Us form on SEKRAB.AE.

This document is an engineering draft describing current product behaviour. Have qualified UAE counsel review and finalise it before public launch.