Privacy Policy

Data: 20 August 2025

This Privacy Policy (the “Policy”) describes how Sandy Media Ltd, registered under the laws of Abu Dhabi Global

Market with registration number 14805, , operating under tradename “The Sandy Times” (“The Sandy Times,” “we,”

“us,” or “our”) collect, use, disclose, and retain Personal Data about individuals that interact with the website

www.sandytimes.ae and STR by The Sandy Times mobile applications – computer programs on mobile devices on

Android and iOS planforms, including, mobile site, marketing campaigns, subscriptions, emails, newsletter, and other

online activities, offering, or publication that links to or references this Policy (collectively, the “Service(s)”). This

Policy also describes the rights that you may have regarding our processing of your personal information under Abu

Dhabi Global Market Laws. It tells you how you can contact us if you have any suggestions, questions or concerns

about how we handle your Personal Data.

By accessing or using any of our Services, you acknowledge and agree that your Personal Data will be handled as

described in this Policy. Your use of the Services, and any dispute over privacy, is subject to this Policy and our Terms

of Use, including its applicable limitations of liability and the resolution of disputes.

We will be the Controller in relation to the Processing of your Personal Data.

The Data Protection Regulations 2021 (the “DP Regulations”) apply to how we approach data privacy.

Certain terms used in this Policy are explained in the Glossary. To make it easier to read, we may still use or define

terms that are defined in the Glossary in full, in the body of this Policy as well.

You may download a printable copy of this Policy (PDF) here.

1. Categories of Personal Data we collect and process

Personal Data is information that identifies, relates to, describes, is reasonably capable of being associated with, or

could reasonably be linked, directly or indirectly to you. Depending on the Services you use, we may collect the

following categories of personal information about you directly from you, automatically through your use of the

Services, and from third parties.

• Identifiers, such as your name, email address, telephone number.

• Internet or other electronic network activity, device information, such as your IP address, browser type and

operating system; browsing history, clickstream data, search history on the Services, and information regarding your

interaction with an internet website, application, email, newsletter, or advertisement, including access logs and other

activity information related to your use of our Services; the length of time you visit our Services; and the referring

URL, or the website or application that led you to our Services.

• Geolocation data, such as the general physical location of your device.

We do not collect any Special Categories of Personal Data about you.

Information we collect directly from you. We collect Personal Data directly from you when you use our Services, such

as when you provide us with information online or at an in-person event (e.g., enter a contest, submit a survey, upload

or otherwise provide content or comments). If you contact us, we may collect information such as your name, email

address, social media handles, the contents of a message or attachments that you may send to us, and other information

that you choose to provide.

Social Network Integration. If you choose to interact with us on social networking services or use features, such as

plugins, widgets, or other tools made available by third party social networking services in connection with our

Service, we may collect Personal Data that has been made available to those services, including personal information

about your contacts on those services.

Information We Collect Automatically. We, and our third party business partners, automatically collect Personal Data

when you use our Services using cookies, pixel tags or similar technologies. This may include information such as

your IP address and the types of personal information described as “Internet or other electronic network activity.”

Please review our section below on “Our Use of Cookies and Related Technologies” for additional information

regarding our use of cookies and related technologies.

Minors (i.e. individuals under the age of 18) should not provide us with their Personal Data, as the Service is not

intended for users under the age of 18.

2. Lawful basis for collection and Processing of Personal Data

We collect Personal Data only where it is relevant to and necessary for specified, explicit and legitimate purposes.

Generally, we Process Personal Data on one or more of the following grounds set out in Section 5 of the

DP Regulations:

(a) To provide and improve our Services (performance of a contract). We use your Personal Data to provide and

maintain our Services, to process and fulfil your requests or orders, to communicate with you about your use of our

Services, to respond to your inquiries, and for other customer service and business administration purposes. We use

your information to understand and analyse our user base and how you use the Services, to improve and enhance the

Services, and to develop new products, services, features and functionality (Section 5(1)(b) of the DP regulations);

(b) Personalization. We use your information to tailor the content and information that we may send or display

to you, to offer location customization, to provide personalized offers, personalized help and instructions, and to

otherwise personalize your experiences while using the Services (Section 5(1)(b) of the DP regulations);

updates, and to communicate with you about new features, events, or products offered by us or our third party business

partners, including our advertising, marketing, and sponsorship clients. Your general geolocation data may specifically

be used to show you content (including advertising and sponsored messaging) based on your general geographic

location (Section 5(1)(a),(b) of the DP regulations);

(d) To comply with legal obligations. We may use your information where we believe necessary to comply with

our legal obligations or to exercise or defend our rights or the rights of a third party, including complying with law

enforcement or government authority requests and participating in compliance audits, cooperation with public and

government authorities, courts, or regulators, to the extent this requires the processing or disclosure of Personal Data

to protect our rights (Section 5(1)(f) of the DP regulations);

(e) To protect us and others. We may use your information where we believe necessary to investigate, prevent,

or take action regarding suspected or actual illegal activities, fraud, situations involving potential threats to the safety

of any person or to otherwise enforce this Policy or the integrity of the Services (Section 5(1)(f) of the DP regulations).

3. Sharing Personal Data

We may share Personal Data for our business and commercial purposes as follows:

(a) Related entities. We may share Personal Data we collect about you to our Affiliated Entities.

(b) Service providers and third parties. We may share Personal Data we collect about you to service providers,

contractors, agents, and third party business partners who perform functions and business operations on our behalf,

for the purposes set out above, who are under a duty of appropriate safeguards for the rights of Data Subjects. We may

also disclose the personal information we collect about you to third party business partners, such as: (i) data storage

and security providers; (ii) advertising, marketing, social media, subscription sales and advertising facilitating

companies; (iii) consumer data suppliers/resellers, data enrichment providers and aggregators, and other entities in the

online behavioural advertising ecosystem for purposes of OBA (as described below in this Policy); (iv) social media

and social networking services; (v) companies that help us with our products and product recommendations; and (vii)

professional advisors such us lawyers, auditors, accountants, consultants.

by another company, or (ii) if any of our assets are or may be transferred to another company, whether as part of a

bankruptcy or insolvency proceeding or otherwise, we may transfer the information we have collected about you to

the other company. As part of the business transfer process, we may disclose certain of your information to lenders,

auditors, and third party advisors, including attorneys and consultants.

(d) In response to legal process. We may disclose your personal information where we believe necessary to

comply with the ADGM Laws, any court, tribunal, or regulatory, supervisory, law enforcement, governmental or

quasi-governmental authority. This includes disclosure to other regulators, official bodies and authorities and law

enforcement agencies both inside and outside ADGM and the UAE.

(e) To protect us and others. We disclose your personal information where we believe it is appropriate to do so

to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats

to the safety of any person, violations of our Terms of Use or this Policy, or as evidence in litigation in which we are

involved.

(f) Aggregate and deidentified information. We may disclose aggregate, anonymized, or deidentified

information about you for any purpose permitted under ADGM Laws.

In most cases, ADGM Laws allow us to share this information without the consent of the individual to whom the

Personal Data relates. Where we are required to obtain such consent, we ensure that we obtain adequate consent from

the relevant individual in accordance with the DP Regulations. In other cases, we may be compelled to disclose

Personal Data due to a mandatory legal obligation or by order of a court or other adjudicatory body or tribunal of

competent jurisdiction.

Your Personal Data may be processed by us, our Affiliated Entities and those other parties described above, outside

of the ADGM. Where the ADGM Commissioner of Data Protection has not issued an adequacy decision in relation to

the jurisdiction where your Personal Data is processed, we will ensure that there are adequate mechanisms in place to

protect your personal information in accordance with applicable data protection and privacy law. We will do this

through use of data transfer agreements implementing standard data protection clauses.

4. Where we store your Personal Data

The Personal Data that we collect from you may be securely transferred to and securely stored on databases, located

on secure servers in the United Arab Emirates or abroad.

5. Data security

We store Personal Data in electronic and digital format. We have put in place appropriate security measures to prevent

your Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In

addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who

have a business need to know. They will only Process your Personal Data on our instructions, and they are subject to

a duty of confidentiality.

We have put in place procedures to deal with any suspected or actual Personal Data breach and will notify you and

any applicable regulator of a breach where we are legally required to do so. Where a direct communication to you will

involve disproportionate effort, we may instead inform you via a public communication or other similar measures that

are equally effective.

Unfortunately, no data transmission over the internet can be guaranteed to be 100% secure. Therefore, we cannot

guarantee the security of any Personal Data you transmit to us over the internet, and you do so at your own risk.

If at any point you suspect or become aware of a security incident (e.g. you receive a suspicious communication from

someone holding themselves out to be our employee or from a unauthorised website claiming to be affiliated with us),

please forward the communication to us or report the incident by email to [email protected] or in writing to Sandy

Media Ltd at PO Box 51904 Abu Dhabi, UAE, as soon as possible.

6. Cookies and Related Technologies

Cookies. The Service will at times place and/or store code or other types of information and/or software on your device

or within your browser, such as cookies, locally shared objects, and HTML5 (collectively, “Local Device Storage”).

We and third party business partners may independently or in conjunction use Local Device Storage in connection

with the Service in a way that collects personal information for the purposes described in herein, including without

limitation to determine whether you have seen a particular advertisement before on the same or different device and

to otherwise control and tailor the display of ads to you based on your perceived preferences by collecting data to

track the movements of individual users through the Services, as well as to help diagnose problems with servers, to

conduct research, to deliver editorial content, to record registration and personalization information, to inform offers

that we may make to you, and to otherwise administer the Service.

You may disable Local Device Storage. If you do not want Local Device Storage, your device, browser, or the settings

menu within an application may include an option that allows you to not accept it. However, if you disable Local

Device Storage, some portions of the Service may not function properly.

Tracking Technologies. In addition to Local Device Storage, we and/or our third party business partners may use web

beacons, web bugs, internet or pixel tags, clear gifs, digital fingerprinting (“Machine Identification”) and similar

technologies (collectively, together with Local Device Storage, the “Tracking Technologies”) on the Service, including

in our communications with you, such as within e-mail and text messages, in-application push notifications, videos,

and throughout your use of the Services. We and our third party business partners use Tracking Technologies to

determine which messages have been opened by recipients, and for all or some of the same lawful purposes described

above for use of Local Device Storage. For additional information see the Online Behavioral Advertising (OBA)

section below.

Do Not Track. Your browser setting may allow you to automatically transmit a “Do Not Track” (DNT) signal to

websites and online services that you visit. There is no consensus as to what DNT means in this context, and since

some browsers apply DNT signals by default it does not necessarily reflect our visitors choice as to whether they wish

to receive advertisements tailored to their interests. As a result, like many websites, we do not alter our practices when

the Service receives a DNT signal from a visitor's browser. As discussed below, you may opt out of the use of your

personal information for online behavioural advertising by third parties at any time.

7. Online Behavioural Advertising (OBA) and how to opt-out of OBA

We and our third party business partners, may use Tracking Technologies on the Service for purposes of “online

behavioural advertising” (OBA). OBA allows the serving of advertisements tailored to perceived interests inferred by

your browsing on the Service and on other sites, applications, destinations, and services, over time and across

unaffiliated websites, apps, and services, using the same or a different device. To enable OBA, we and our third party

business partners, independently may use Tracking Technologies to collect certain information, some of which may

be deemed personal information, including for example the make, model, settings, specifications (e.g., CPU speed,

connection speed, browser type, operating system, device identifier, online identifier) and geographic location of your

device, as well as date/time stamp, IP address, pages visited, time of visits, content viewed, ads viewed, the site(s),

application(s), destination(s), and/or service(s) you arrived from, and other clickstream data. Your email address may

also be used by us, in coordination with third party audience authentication service providers to enable OBA.

Opt-out of OBA. If you do not want OBA, you may be able to opt-out by visiting https://youradchoices.com and/or

by clicking the “Ad Choices” icon that appears in advertising served through OBA. Please note that these opt-out

options only apply to tracking by third party business partners using cookie-based OBA across this Service and other

sites, applications, destinations, and services, and not tracking among pages within the Service itself. As may be

required under DP Regulations, to opt-out of OBA enabled by use of your email address in coordination with audience

authentication providers see the “Your privacy choices and rights. Submitting requests under DP Regulations” section

below.

8. Your privacy choices and rights. Submitting requests under DP Regulations

Under the DP Regulations you have the following rights as an individual which you can exercise in relation to the

Personal Data we hold about you.

Right What does this mean?

The right to object to

Processing

You have the right to object to certain types of Processing, including Processing for

direct marketing (i.e. if you no longer want to be contacted with potential

opportunities).

The right to be informed You have the right to be provided with clear, transparent and easily understandable

information about how we use your information and your rights. This is why we are

providing you with the information in this Policy.

The right of access You have the right to obtain access to your information (if we are processing it), and

certain other information (similar to that provided in this Policy). This is so you are

aware and can check that we’re using your information in accordance with DP

Regulations.

The right to rectification You are entitled to have your information corrected if it is inaccurate or incomplete.

The right to erasure This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to

request the deletion or removal of your information where there’s no compelling

reason for us to keep using it. This is not a general right to erasure; there are

exceptions.

The right to restrict

processing

You have rights to ‘block’ or suppress further use of your information. When

processing is restricted, we can still store your information, but may not use it further.

We keep lists of people who have asked for no further use of their information to be

‘blocked’ to make sure the restriction is respected in future.

The right to data

portability

You have rights to obtain and reuse your personal information for your own purposes

across different services. For example, if you decide to switch to a new provider, this

enables you to move, copy or transfer your information easily between our IT systems

and theirs safely and securely, without affecting its usability.

The right to lodge a

complaint

You have the right to lodge a complaint about the way we handle or process your

personal information with ADGM Office of Data Protection.

The right to withdraw

consent

If you have given your consent to anything we do with your personal information, you

have the right to withdraw your consent at any time (although if you do so, it does not

mean that anything we have done with your personal information with your consent

up to that point is unlawful). This includes your right to withdraw consent to us using

your personal information for marketing purposes

If you wish to exercise any of the rights set out above, please contact [email protected]

Note: your right of access can be exercised in accordance with DP Regulations and other applicable laws. There are

circumstances where we may not be able to comply with your request, such as where we have a legal duty to retain

Personal Data.

9. Data retention

We Process Personal Data for such periods as is necessary for the purposes set out in this Policy, unless a longer period

for the retention of Personal Data is required by ADGM Laws.

We may retain your Personal Data for a longer period in the event of a complaint or if we reasonably believe there is

a prospect of litigation in respect to our relationship with you.

Personal Data Processed based on consent will be retained for the period specified in the consent, or where not

specified, until you withdraw your consent.

10. Opt-out of marketing communications

If you do not wish to receive future marketing or other commercial messages from us, simply follow the unsubscribe

instructions contained within the subscription message you receive. Note, however, that you may continue to receive

certain communications from us that are necessary for the Service, such as renewal notifications, technical notices

and updates, security alerts, and support and administrative service bulletins.

11. Third party links

Our Services may contain links to third-party websites and applications. Any access to and use of such linked websites

and applications is not governed by this Policy, but is instead governed by the privacy policies of those third-party

websites and applications. We are not responsible for the information practices of such third party websites and

applications. We encourage you to review the privacy policies of any third-party websites or applications that you

choose to visit.

12. Changes to our Privacy Policy

We may amend this Policy from time to time to meet changes in the regulatory environment, business needs, or to

satisfy the needs of our customers and service providers. Any changes we make to this Policy will be posted on our

website and date stamped so that you are always aware of the latest update. You should check this page from time to

time to ensure you are happy with any changes.

13. Glossary

ADGM Abu Dhabi Global Market

Abu Dhabi Global Market Laws

Any laws, regulations, bylaws, decisions, orders or instructions related to Abu

or ADGM Laws

Dhabi Global Market and issued by the Board of Directors of Abu Dhabi

Global Market or any of Abu Dhabi Global Market Authorities

Affiliated Entities Any holding company, subsidiary or entity affiliated with the relevant party

and any entity that is a subsidiary of any such holding company, subsidiary,

or entity in whom the relevant party holds an ownership interest of fifty

percent (50%) or more.

Controller Is defined in the DP Regulations. At the date of and in the context of this

determines the purposes and means of the Processing of Personal Data.

Data Subject Is defined in the DP Regulations. At the date of this Privacy Policy, it means

an identified or identifiable living natural person.

DP Regulations Means the ADGM’s Data Protection Regulations 2021, as amended from time

to time.

Personal Data Process or Processing Service(s) Special Categories of Personal

Data

The Sandy Times, we, us, or our Terms of Use You or Your Is defined in the DP Regulations. At the date of this Privacy Policy, it means

information relating to a Data Subject as per Section 1 of this Privacy Policy.

Is defined in the DP Regulations. At the date of this Privacy Policy, it broadly

means any operation or set of operations which is performed on Personal Data

or on sets of Personal Data, such as collection, recording, storage, use,

disclosure or destruction.

Means interaction with the website www.sandytimes.ae and STR by The

Sandy Times mobile applications – computer programs on mobile devices on

Android and iOS planforms, including, mobile site, marketing campaigns,

subscriptions, emails, newsletter, and other online activities, offerings,

provided by us.

Is defined in the DP Regulations. At the date of this Privacy Policy, it means

(a) Personal Data revealing racial or ethnic origin, political opinions, religious

or philosophical beliefs; (b) Genetic Data, Biometric Data for the purpose of

uniquely identifying a natural person, Data Concerning Health or data

concerning a natural person's sex life or sexual orientation; and (c) Personal

Data relating to criminal convictions and offences or related security

measures.

Means (whether capitalized or not) Sandy Media Ltd, registered under the

laws of Abu Dhabi Global Market with registration number 14805, operating

under tradename “The Sandy Times”.

Means all rules, restrictions, limitations, terms and/or conditions that apply to

the Services, whether listed in the Terms of Use, the Privacy Policy, or posted

at various points in the Service, or otherwise communicated to users of the

Services.

Means (whether capitalized or not) all those who access, visit and/or use the

Service, whether acting as an individual or on behalf of an entity, including

you and all persons, entities, or digital engines of any kind that harvest, crawl,

index, scrape, spider, or mine digital content by an automated or manual

process or otherwise.