Data Protection Policy

1. Company Information

GATE MAIN operates as a travel-technology company providing B2B technology and marketplace solutions to travel businesses, suppliers, agencies, operators, and other commercial partners.

2. Purpose of This Policy

The purpose of this Policy is to establish principles and responsibilities for protecting personal data processed by GATE MAIN.

This Policy is intended to help ensure that personal data is:

• Processed lawfully, fairly, and transparently;
• Collected for legitimate and specified purposes;
• Limited to what is reasonably necessary;
• Accurate and kept up to date where appropriate;
• Retained only for as long as reasonably necessary;
• Protected against unauthorized access, loss, misuse, alteration, disclosure, or destruction; and
• Handled in accordance with applicable data-protection laws and contractual obligations.

3. Scope

This Policy applies to personal data processed by GATE MAIN in connection with:

• Employees and personnel;
• Job applicants;
• Clients and their representatives;
• Suppliers and their representatives;
• Business partners;
• Travel agents and agencies;
• Travelers and guests;
• Users of our websites and platforms;
• API and integration users;
• Customer-support interactions;
• Vendors and service providers; and
• Other individuals whose personal data is processed by GATE MAIN.

It applies to personal data processed electronically and, where applicable, in physical form.

4. What Is Personal Data?

“Personal data” means information relating to an identified or identifiable individual, or any other information considered personal data under applicable law.

Depending on the circumstances, this may include:

• Name;
• Email address;
• Telephone number;
• Business contact details;
• Address;
• Account information;
• Login and authentication information;
• IP address and technical identifiers;
• Booking information;
• Travel dates and destinations;
• Payment and transaction information;
• Customer-support correspondence;
• Identification or verification information where required;
• Employment or professional information; and
• Other information associated with an identifiable individual.

Certain information may constitute sensitive or special-category data under applicable law and may receive additional protection.

5. Data Protection Principles

GATE MAIN applies the following principles when processing personal data.

5.1 Lawfulness, fairness, and transparency

Personal data must be processed on a lawful basis and in a manner that is fair and transparent to the individual where required by applicable law.

5.2 Purpose limitation

Personal data should be collected and used for specific, legitimate purposes and should not be processed in ways incompatible with those purposes.

5.3 Data minimization

GATE MAIN seeks to collect and process only personal data that is reasonably necessary for the relevant business, contractual, operational, security, or legal purpose.

5.4 Accuracy

Reasonable steps should be taken to ensure that personal data is accurate and, where necessary, kept up to date.

5.5 Storage limitation

Personal data should not be retained for longer than reasonably necessary, taking into account business, contractual, legal, regulatory, security, and dispute-resolution requirements.

5.6 Integrity and confidentiality

Personal data must be protected using appropriate technical and organizational measures.

5.7 Accountability

GATE MAIN seeks to maintain appropriate processes and records demonstrating compliance with applicable data-protection requirements.

6. Lawful Processing

GATE MAIN processes personal data only where there is an appropriate legal basis under applicable law.

Depending on the circumstances, this may include:

• Performance of a contract;
• Compliance with a legal or regulatory obligation;
• Legitimate business interests;
• Consent;
• Protection of vital interests; or
• Another lawful basis recognized by applicable law.

The applicable legal basis depends on the nature and circumstances of each processing activity.

7. Collection of Personal Data

GATE MAIN may collect personal data directly from individuals or through authorized business clients, suppliers, partners, service providers, and other sources.

Personal data may be collected through:

• Website forms;
• Account registration;
• Booking transactions;
• APIs and integrations;
• Customer-support communications;
• Contracts;
• Business correspondence;
• Supplier and partner onboarding;
• Payment and transaction processes;
• Security and authentication systems; and
• Other legitimate business interactions.

GATE MAIN seeks to avoid collecting unnecessary personal data.

8. Data Relating to Travelers

Because GATE MAIN operates within the travel-technology sector, our systems may process information relating to travelers, guests, passengers, and other individuals associated with travel bookings.

Such information may include:

• Name;
• Contact details;
• Booking information;
• Travel dates;
• Destination;
• Accommodation information;
• Transportation details;
• Transfer information;
• Activity information;
• Special requests; and
• Other information necessary to fulfill a travel service.

Where a GATE MAIN client provides traveler information to us, that client is responsible for ensuring that it has an appropriate legal basis and has provided any notices required by applicable law.

GATE MAIN processes traveler data only for legitimate purposes associated with the relevant Services, contractual instructions, security, compliance, or other lawful purposes.

9. Controller and Processor Roles

Depending on the circumstances, GATE MAIN may act as:

• A data controller, where GATE MAIN determines the purposes and means of processing personal data; or
• A data processor/service provider, where GATE MAIN processes personal data on behalf of a client according to that client's documented instructions.

The applicable role will depend on the specific service, contractual arrangement, and processing activity.

Where GATE MAIN acts as a processor, it will process personal data in accordance with applicable law and the relevant contractual data-processing requirements.

10. Data Subject Rights

Subject to applicable law, individuals may have rights concerning their personal data, including the right to:

• Request access to personal data;
• Request correction of inaccurate data;
• Request deletion of personal data;
• Request restriction of processing;
• Object to certain processing;
• Request data portability where applicable;
• Withdraw consent where processing is based on consent; and
• Lodge a complaint with an applicable data-protection authority.

Requests should be submitted to:

info@gatemain.com

GATE MAIN may take reasonable steps to verify the identity of the person making a request before disclosing or modifying personal data.

Where GATE MAIN processes data on behalf of a client, we may refer the request to that client or assist the client in responding, as required by the applicable contractual arrangement and law.

11. Data Security

GATE MAIN maintains technical and organizational measures designed to protect personal data.

Depending on the nature of the processing, these measures may include:

• Access controls;
• Authentication and authorization mechanisms;
• Role-based access;
• Password and credential controls;
• Secure communications;
• System monitoring;
• Security logging;
• Backup and recovery measures;
• Vulnerability and security management;
• Malware and threat protection;
• Physical security controls;
• Personnel confidentiality obligations;
• Data-access restrictions; and
• Incident-response procedures.

Security measures are reviewed and adjusted as appropriate based on technological developments, business requirements, identified risks, and applicable legal obligations.

No security measure can guarantee absolute protection against every possible threat.

12. Access Control

Access to personal data should be limited to authorized individuals who require access for legitimate business purposes.

GATE MAIN applies the principle of least-privilege access where appropriate.

Access permissions may be based on:

• Job responsibilities;
• Business requirements;
• System roles;
• Client or supplier responsibilities;
• Security requirements; and
• Applicable contractual or legal obligations.

Access rights should be reviewed and removed or modified when no longer required.

13. Employee and Personnel Responsibilities

Individuals working for or on behalf of GATE MAIN who have access to personal data are expected to:

• Maintain confidentiality;
• Use personal data only for authorized purposes;
• Follow applicable security procedures;
• Protect passwords and authentication credentials;
• Avoid unauthorized disclosure;
• Report suspected security incidents promptly; and
• Follow GATE MAIN policies and contractual obligations.

Personnel may be subject to confidentiality obligations that continue after their employment or engagement ends.

14. Third-Party Service Providers

GATE MAIN may use third-party providers to support its business and technology operations.

These may include providers of:

• Cloud infrastructure;
• Hosting;
• Data storage;
• Payment processing;
• Cybersecurity;
• Analytics;
• Customer support;
• Communications;
• Software;
• Authentication;
• Fraud prevention; and
• Other business services.

Where a third party processes personal data on GATE MAIN's behalf, GATE MAIN seeks to implement appropriate contractual, technical, and organizational safeguards consistent with applicable law.

Third parties may be subject to their own legal obligations and privacy policies.

15. Travel Suppliers and Business Partners

GATE MAIN may transmit relevant personal data to travel suppliers and business partners when necessary to fulfill a booking or provide requested Services.

Examples may include:

• Hotels;
• Airlines;
• Transportation providers;
• Transfer companies;
• Activity providers;
• Car-rental companies;
• Cruise or ferry providers;
• Train providers; and
• Other travel-service providers.

Only information reasonably necessary for the relevant transaction should be shared, subject to the requirements of the applicable service and law.

16. International Data Transfers

GATE MAIN operates in an international travel environment, and personal data may be transferred to or accessed from countries outside the country where the data was initially collected.

Where applicable law requires safeguards for international transfers, GATE MAIN will use an appropriate lawful transfer mechanism.

Depending on the circumstances, safeguards may include:

• Adequacy decisions;
• Standard contractual clauses or equivalent contractual protections;
• Data-processing agreements;
• Consent where legally valid; or
• Other legally recognized transfer mechanisms.

17. Data Retention

GATE MAIN retains personal data only for as long as reasonably necessary for the purposes for which it was collected, including where necessary to:

• Provide Services;
• Complete bookings and transactions;
• Maintain business records;
• Fulfill contractual obligations;
• Meet tax, accounting, regulatory, or legal requirements;
• Resolve disputes;
• Prevent fraud;
• Maintain security; or
• Establish, exercise, or defend legal claims.

Different categories of information may have different retention periods.

When personal data is no longer required, GATE MAIN will take reasonable steps to delete, anonymize, or securely dispose of it, subject to applicable legal and operational requirements.

18. Data Accuracy

GATE MAIN seeks to maintain accurate personal data appropriate to the purposes for which it is processed.

Where individuals or clients identify inaccurate or incomplete information, they may request correction through the appropriate GATE MAIN contact or account-management process.

Clients are responsible for the accuracy of personal data they submit to GATE MAIN where they control that information.

19. Data Breach and Security Incident Management

A data breach or security incident may include unauthorized access to, disclosure of, alteration of, loss of, or destruction of personal data.

GATE MAIN maintains procedures for identifying, assessing, containing, investigating, and responding to suspected security incidents.

Where a personal-data breach occurs, GATE MAIN will:

1. Assess the nature and scope of the incident;
2. Take reasonable steps to contain and mitigate the incident;
3. Investigate the cause and potential impact;
4. Document relevant facts and actions;
5. Notify clients, regulators, or affected individuals where required by applicable law or contractual obligations; and
6. Implement reasonable corrective or preventive measures.

Employees, contractors, clients, and partners should report suspected personal-data breaches or security incidents promptly.

20. Privacy by Design and Default

Where appropriate, GATE MAIN seeks to consider privacy and data-protection requirements during the design, development, implementation, and modification of products and Services.

This may include:

• Minimizing data collection;
• Restricting access;
• Applying appropriate security controls;
• Considering retention requirements;
• Protecting data throughout its lifecycle; and
• Evaluating privacy risks associated with new technologies or processes.

21. Data Protection Impact Assessments

Where required or considered appropriate, GATE MAIN may conduct privacy or data-protection impact assessments for processing activities that may present significant risks to individuals.

Such assessments may consider:

• The nature and purpose of processing;
• Categories of personal data;
• Individuals affected;
• Potential risks;
• Security measures;
• Data retention;
• Third-party involvement;
• International transfers; and
• Measures available to reduce identified risks.

22. Special Categories of Personal Data

Certain information may be considered sensitive or special-category data under applicable law.

GATE MAIN seeks to avoid processing sensitive personal data unless there is a legitimate and lawful reason to do so.

Where such information is necessary for a travel service, booking, legal requirement, safety purpose, or other legitimate purpose, it should be handled with appropriate safeguards and only to the extent permitted by applicable law.

23. Payment Information

GATE MAIN may process transaction and payment-related information in connection with its Services.

Where payment-card or other financial information is processed by an external payment provider, the provider may process such information directly in accordance with its own contractual, security, and privacy obligations.

GATE MAIN seeks to limit access to financial information to authorized personnel and systems where reasonably necessary.

24. Cookies and Tracking Technologies

GATE MAIN may use cookies and similar technologies for purposes including:

• Website operation;
• Authentication;
• Security;
• Preferences;
• Analytics;
• Performance;
• Marketing, where permitted; and
• Other legitimate purposes.

Further information is provided in GATE MAIN's Cookie Policy.

25. Marketing and Communications

GATE MAIN may process business contact information to provide service communications, product updates, announcements, and marketing communications where permitted by applicable law.

Individuals may opt out of marketing communications by using available unsubscribe mechanisms or contacting GATE MAIN.

Service-related communications necessary to operate an account, complete a booking, provide security information, or fulfill contractual obligations may continue where permitted or required by law.

26. Children's Data

GATE MAIN primarily provides B2B travel technology services and does not intentionally target children through its platform.

However, travel bookings may involve information relating to minors.

Where children's information is processed as part of a legitimate travel booking or service, GATE MAIN will process such information only for relevant and lawful purposes and in accordance with applicable data-protection requirements.

27. Data Processing Records

Where required by applicable law, GATE MAIN may maintain appropriate records concerning its personal-data processing activities.

Such records may include information about:

• Processing purposes;
• Categories of personal data;
• Categories of individuals;
• Recipients;
• International transfers;
• Retention periods; and
• Security measures.

28. Training and Awareness

GATE MAIN may provide appropriate privacy and information-security guidance or training to personnel whose responsibilities involve processing personal data.

Personnel are expected to understand and comply with applicable data-protection and information-security requirements relevant to their role.

29. Complaints

Individuals who have concerns about GATE MAIN's processing of personal data should first contact GATE MAIN so that the matter can be reviewed.

Complaints may be submitted to:

Email: info@gatemain.com

Individuals may also have the right to contact an applicable data-protection or regulatory authority under the laws applicable to them.

30. Governing Legal Requirements

GATE MAIN seeks to comply with applicable data-protection and privacy laws and regulations relevant to its activities.

Depending on the circumstances, this may include applicable requirements under:

• United Arab Emirates data-protection legislation;
• Applicable Dubai or UAE regulatory requirements;
• GDPR where applicable;
• Other applicable international privacy laws; and
• Contractual data-protection requirements.

Where different legal requirements apply, GATE MAIN will assess the applicable requirements based on the relevant processing activity, location, individuals concerned, and contractual arrangements.

Nothing in this Policy is intended to reduce or remove rights provided by mandatory applicable law.

31. Policy Governance

GATE MAIN may review this Data Protection Policy periodically to ensure that it remains appropriate to:

• Changes in our Services;
• Changes in technology;
• Changes in business operations;
• Changes in applicable law;
• Changes in regulatory guidance; and
• Changes in identified privacy or security risks.

Relevant internal procedures may be developed to support implementation of this Policy.

32. Changes to This Policy

GATE MAIN may update this Data Protection Policy from time to time.

The updated version will be published on our website and will include a revised “Last Updated” date.

Where changes are material and applicable law requires additional notice, GATE MAIN will provide such notice through appropriate means.

33. Contact Information

For questions, requests, complaints, or other matters relating to data protection, please contact: