Effective date: November 5, 2026

Asyad Group S.A.O.C. ("Asyad", "we", "us", "our"), as the entity operating the applicable website, application, platform or online service (as the controller of the personal data processed through such website, application, platform or service), is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share, and protect personal data of visitors to our websites and users of our online services, and the rights available to you. It is issued under, and should be read together with, our Personal Data Protection Policy.

This Privacy Policy is governed by and construed in accordance with the Oman Personal Data Protection Law and its Executive Regulations, as amended from time to time (the "PDPL").

1. Who is the Controller

Asyad Group is the controller of the personal data processed through Asyad websites and online services. If you have any question about this Policy or how we handle your personal data, you can contact our Data Protection Officer (DPO) at:

Name: Data Protection Officer
Email: PDP@asyad.om
Address: Bowsher, Muscat, Sultanate of Oman

2. Personal Data We Collect

Depending on how you use the websites and the online services, we may collect the following categories of personal data:

• Identification and contact data — name, email address, phone number, country, job title, organization.
• Account and authentication data — username, password (hashed), security questions, login records.
• Communication data — content of enquiries, messages, feedback, and support requests you submit.
• Career and recruitment data — CV, education, employment history, and other information you provide when applying for a role.
• Commercial data — information you provide as a customer, supplier, contractor, or partner.
• Technical and usage data — IP address, device and browser information, operating system, referrer URL, pages visited, time spent, and interactions with the website.
• Cookies and similar technologies — see Section 7 below.

We do not seek to collect sensitive personal data through websites and online services. If sensitive personal data is required for a specific service, we will obtain your express written consent and, where required by the PDPL, the prior approval of the Ministry of Transport, Communications and Information Technology (MTCIT).

Where personal data is required in order to provide a service, process a request, enter into or perform a contract, or comply with a legal obligation, failure to provide the requested information may prevent us from providing the relevant service or proceeding with the applicable transaction.

3. How We Use Your Personal Data and the Lawful Basis

We process your personal data for the following purposes, on the lawful basis shown:

• To operate, maintain, and secure Asyad websites and online services — based on our legal obligations and on the necessity of processing to provide the websites and online services you use, in each case as permitted under the PDPL.
• To respond to your enquiries, requests, and complaints — based on your consent or, where your enquiry relates to a contract to which you are a party, the execution of that contract.
• To process job applications and manage recruitment — based on your consent.
• To manage customer, supplier, and contractor relationships — based on the execution of a contract to which you are a party, compliance with our legal obligations (including Know Your Customer (KYC) checks where required by law), or your consent.
• To send marketing communications about Asyad services — only with your prior explicit written consent, which you may withdraw at any time.
• To comply with legal, regulatory, audit, and reporting obligations — based on compliance with a legal obligation.
• To analyze and improve websites and online services — based on your consent for non-essential cookies and, for strictly necessary analytics, on the legal obligations applicable to operating and securing the websites and online services.

4. How We Share Your Personal Data

We share personal data only where necessary and under appropriate safeguards. Recipients may include:

• Asyad Group business units and subsidiaries, on a need-to-know basis;
• service providers and processors who act on our documented instructions under a written Data Processing Agreement (for example, hosting, IT, analytics, communications, recruitment);
• professional advisers (legal, audit, tax);
• regulators, courts, law-enforcement authorities, and other competent bodies, where required by law or to protect our rights; and
• parties to a corporate transaction (such as a reorganization, merger, or sale), subject to confidentiality.

We do not sell personal data and do not permit third parties to use personal data for their own independent marketing purposes unless expressly authorized by the data subject or otherwise permitted by applicable law.

5. Cross-Border Transfers

Some of our service providers or Asyad entities are located outside the Sultanate of Oman. Where we transfer your personal data outside Oman, we do so only in accordance with the controls and procedures set by the PDPL and, where applicable, the requirements of the Cyber Defense Centre, and only where:

• the destination provides an adequate level of personal data protection;
• you have given express consent to the transfer, having been informed of any associated risks;
• appropriate safeguards are in place (such as contractual data-protection clauses) ensuring your data remains protected; or
• the transfer is made under an international agreement to which Oman is a party, or is otherwise permitted by the PDPL.

We will not transfer your personal data where it has been processed in violation of the law or where the transfer would cause you harm. Where other personal data protection laws apply, we additionally rely on a recognized transfer mechanism under those laws (such as an adequacy decision or standard contractual clauses) and, where required, complete a transfer impact assessment.

6. Retention

We delete your personal data once the purpose for which it was collected has been fulfilled. We retain it beyond that point only where there is an ongoing dispute between you and us, or where retention is required by a specific legal obligation. Once no such ground applies, the data is securely erased or anonymized. Retention periods may vary depending on the nature of the personal data, the purpose of processing, and applicable legal or regulatory requirements. Further information on retention periods is available on request.

7. Cookies, Similar Technologies and Automated Processing

Our website uses cookies and similar technologies to operate the site, remember your preferences, measure usage, and (with your consent) deliver tailored content. You can manage non-essential cookies through our cookie banner and your browser settings. Strictly necessary cookies cannot be disabled without affecting the functioning of the website.

Automated processing

Where we use automated processing — that is, processing carried out by an electronic program or system operating entirely without human involvement or with only limited human supervision — we apply appropriate safeguards to protect your personal data. You may object to any decision resulting from automated processing and require that the decision be reviewed by a person with appropriate authority, who may confirm, vary, or set it aside; we will inform you of the outcome.

8. Your Rights

Subject to the PDPL, you have the right to:

• be informed about how your personal data is processed;
• access your personal data and obtain information about its processing;
• rectify, update, or complete inaccurate or incomplete data;
• have your personal data blocked (restricted) in defined circumstances;
• erase your personal data, subject to legal grounds for retention;
• withdraw consent at any time, without affecting the lawfulness of earlier processing;
• data portability, where technically feasible;
• object to processing, including processing for direct marketing;
• object to any decision resulting from automated processing and require that it be reviewed with human involvement;
• be notified of any breach affecting your personal data; and
• lodge a complaint with the Ministry of Transport, Communications and Information Technology (MTCIT).

To exercise any right, contact the DPO using the details in Section 1. We will respond within 45 days of receipt as required by the PDPL Executive Regulations. Requests are handled free of charge. We may refuse a request only where it is unjustifiably repetitive or requires extraordinary effort, or on other grounds permitted by the PDPL (for example, where we must retain the data under a legal obligation or because of an ongoing dispute with you); any refusal will be justified and communicated to you within 45 days.

9. Children

This website and the related online services are not intended for or directed at minors. We do not knowingly collect personal data of minors except where permitted by law and after obtaining any required consents or approvals. Where we knowingly process the personal data of a minor, we obtain the express consent of the minor’s guardian, and we apply additional safeguards.

10. Security

We implement appropriate technical and organizational measures to protect your personal data, including access control on a least-privilege basis, encryption in transit and at rest, pseudonymization where appropriate, logging and monitoring, secure disposal, and periodic testing.

11. Personal Data Breaches

If a personal data breach is likely to cause serious harm to you, we will notify you without undue delay and inform you of the actions taken, in line with our Personal Data Protection Policy and the PDPL.

12. Changes to this Policy

We may update this Policy from time to time to reflect changes in our processing activities, technology, or legal requirements. The current version, with its effective date, is always available on this website. Material changes will be brought to your attention where required. Where a change involves processing your personal data for a new purpose, we will obtain your explicit consent where required by the PDPL.

13. How to Contact Us or Complain

For any question, request, or complaint about your personal data, contact our DPO at PDP@asyad.om. You also have the right to lodge a complaint directly with the Ministry of Transport, Communications and Information Technology (MTCIT) of the Sultanate of Oman.

When submitting a personal data request, please include "Personal Data Request" in the subject line and provide sufficient information to enable us to verify your identity and process your request.