Privacy Policy

This Privacy Policy explains how HUB 01 PLATFORM (trade licence 1560291) (HUB01, we) collects, uses, shares and protects personal data, and what rights you have over it. It is written to comply with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its implementing regulations.

HUB01 is the Controller of the personal data described here. Contact us about anything in this policy at privacy@hub01.shop.

1. What we collect

If you have a customer account

• Name, email address, mobile number, and the password you set (stored only as a one-way hash, we never see it).
• Delivery addresses you save, and order history once shopping opens.
• Messages you send to a store, and comments you post during a live broadcast.
• Technical data: IP address, device and browser type, and the pages you visit.

If you register a store

Everything above, plus the identity and business information our payment provider requires before a business can be paid:

• Legal company name, trade licence number and legal form, company address, phone and TRN.
• The name, date of birth, nationality, Emirates ID number, home address, email, phone, job title and ownership share of the person who represents the business.
• Bank account details: IBAN, account holder name and bank name.
• Documents: trade licence, memorandum of association, passport, Emirates ID, company authorisation letter, and proof of bank account ownership.
• The date, time and IP address at which you accepted our terms.

What we do not collect

• Full card numbers. Card details are entered directly with our payment provider and never reach HUB01's systems.
• Biometric data, health data, or data about your religion, politics or trade union membership.
• Personal data of children. HUB01 is not for under-18s and we do not knowingly collect their data.

2. Why we use it, and on what basis

PDPL requires a lawful basis for every use. Ours are:

• To perform our contract with you, creating and running your account, listing your store, processing orders, arranging delivery, paying merchants, and providing support.
• To comply with a legal obligation, identity verification (KYC), anti-money-laundering and sanctions screening, tax and accounting records, and responding to a lawful request from a court, regulator or the police.
• For our legitimate interests, where these do not override your rights, preventing fraud and abuse, keeping the Platform secure, resolving disputes, and understanding how the Platform is used so we can improve it.
• With your consent, for marketing emails and any optional analytics. You can withdraw consent at any time, and withdrawing it does not affect anything done before you did.

We do not use your data to make solely automated decisions that produce a legal effect on you. Verification decisions are reviewed by a person.

3. Who we share it with

We share personal data only with these categories, and only as much as each needs:

• Our payment provider (Stripe). Merchant identity and business data, and the documents listed above, are transmitted to Stripe so it can verify the business and make payouts. Stripe processes this as an independent controller under its own privacy policy.
• Merchants. When you place an order, the seller receives the name, contact details and delivery address needed to fulfil it, and nothing else. Merchants are contractually forbidden from using it for their own marketing.
• Service providers acting on our instructions, hosting, email delivery, error monitoring and customer support tooling, under written contracts that require them to protect it and forbid them from using it for anything else.
• Authorities, where we are legally required to disclose, or where disclosure is necessary to establish or defend a legal claim.
• A buyer of the business, if HUB01 is sold or merges, in which case the data stays subject to this policy or one no less protective.

We do not sell personal data. We never have and we will not.

4. Where it goes

HUB01's data is stored in the UAE where practicable. Some processing happens outside it, in particular, verification data sent to Stripe, whose infrastructure is in the United States and the European Union, and email delivery.

PDPL permits a cross-border transfer where the destination has an adequate level of protection, or where appropriate contractual safeguards are in place, or where the transfer is necessary to perform a contract with you. We rely on those bases and we put contractual safeguards in place with each recipient. Ask us at privacy@hub01.shop for details of the safeguards applying to a specific transfer.

5. How long we keep it

• Account data, while your account is open, then 12 months, so you can reopen it and so we can handle a late dispute.
• Verification documents and KYC records, for the period UAE anti-money-laundering law requires, currently 5 years after the business relationship ends.
• Transaction and tax records, 5 years from the end of the relevant tax period, as required by UAE tax law.
• Live broadcast recordings and chat, 90 days, unless retained longer for an open dispute or investigation.
• Security and access logs, 12 months.

After the applicable period we delete the data or irreversibly anonymise it. Where a legal hold applies, we keep it until the hold lifts.

6. How we protect it

• Traffic is encrypted in transit. Passwords are stored only as salted one-way hashes.
• Verification documents are held on private storage. There is no web address that will open one. A member of our verification team has to sign in to view a document, and each time one is opened we record who opened it, which document, and when.
• Access is limited to staff who need it for their role.
• Uploads are validated by their actual file contents, not by their name or declared type.

No system is perfectly secure. Where a breach is likely to cause you harm, we will notify you and the UAE Data Office as PDPL requires.

7. Your rights

Under PDPL you may:

• Access the personal data we hold about you, and get a copy.
• Correct anything inaccurate or incomplete.
• Delete your data, where we have no overriding legal obligation to keep it.
• Restrict or object to processing based on legitimate interests.
• Receive your data in a structured, machine-readable format, and have it sent to another controller where technically feasible.
• Withdraw consent at any time, where consent was the basis.
• Complain to the UAE Data Office.

Write to privacy@hub01.shop. We respond within 30 days. We may need to verify your identity first. Requests are free unless they are manifestly excessive or repetitive.

8. Cookies and similar technology

HUB01 uses cookies and local storage that are strictly necessary for the Platform to work, keeping you signed in, protecting forms against cross-site request forgery, and remembering your cart. These do not require consent because the service cannot function without them.

We do not use advertising cookies or third-party tracking pixels. If that ever changes, we will ask for your consent first and this policy will say so before it happens.

9. Marketing

We send transactional email, verification decisions, order updates, security notices, because they are part of providing the service, and you cannot opt out of those while you hold an account. Marketing email is sent only with your consent and every one carries a one-click unsubscribe.

10. Changes

We may update this policy. The version and date at the top always identify the current one. Where a change materially affects how we use your data, we will tell account holders by email before it takes effect.

11. Contact

HUB 01 PLATFORM
Dubai, United Arab Emirates
Privacy: privacy@hub01.shop
General: legal@hub01.shop