GENERAL PROVISIONS
The User, acting in accordance with UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection, hereby gives consent to the processing of his/her personal data by the Operator.
The processing of personal data is carried out by the Operator on behalf of NEW LIGHT CONSULTING L.L.C (ARAB BANK BLDG, 184-0, Port Saeed, Dubai), hereinafter referred to as the “Principal”.
The Principal defines the purposes and scope of personal data to be processed, while the Operator ensures their collection, storage, and processing, including cross-border transfers when necessary.
This consent covers the processing of data in compliance with the legislation of the United Arab Emirates and international data protection standards.

PURPOSES OF DATA PROCESSING
Ensuring compliance with applicable personal data protection legislation, including UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.
The processing is carried out by the Operator on behalf of the Principal, who determines the purposes and scope of personal data.
Maintaining accounting and tax records in accordance with the legislation of the United Arab Emirates. Personal data may be used by the Operator to prepare mandatory reports and fulfill obligations toward relevant authorities.
Ensuring the execution and conclusion of civil-law contracts in the interests of the personal data subject. The processing is carried out by the Operator on behalf of the Principal to the extent necessary for such contracts.
Cross-border transfer of personal data to ensure the operation of services. When data transfers to other jurisdictions are required, the Operator undertakes to apply protection measures in accordance with UAE Federal Decree-Law No. 45 of 2021.
Informing the personal data subject about new services, special offers, and promotional activities of the Principal. For such communications, the Operator may use the contact details provided by the personal data subject.

SCOPE OF PERSONAL DATA
This consent applies to the following categories of personal data:

• Surname, first name, patronymic (if provided)
• Contact details (phone number, email address, and other communication means)
• Any other data provided by the personal data subject necessary for the conclusion and execution of contracts with the Principal

PAYMENT DATA PROCESSING
For payment processing, the personal data subject is redirected to a payment service platform operating under its own privacy policy.
The Operator does not store or process payment details except for information required to confirm payment.

DATA PROTECTION MEASURES
The Operator commits to implementing the following measures to protect personal data:

• Use of cryptographic data protection
• Use of secure servers meeting international security standards
• Protection against unauthorized access and malware
• Regular data backups
• Access to data granted only to authorized personnel
• Ensuring physical security of data storage and processing locations

RIGHTS OF THE PERSONAL DATA SUBJECT
The personal data subject has the right to:

• Receive information about their personal data and its processing
• Request correction of incorrect or incomplete data
• Request deletion of their personal data
• Withdraw consent for personal data processing
• Request restriction of personal data processing
• Receive a copy of their personal data
• Appeal the Operator’s actions or inaction to an authorized body or court
• Receive compensation in case of violation of their rights

PROCEDURE FOR EXERCISING RIGHTS
To exercise these rights, the personal data subject may submit a request through their personal account on the Operator’s website or by email at info@newlightconsult.com.
The Operator undertakes to respond within 30 calendar days of receiving the request.

CONSENT VALIDITY AND WITHDRAWAL PROCEDURE
This consent remains valid until the purposes of processing are achieved or until the retention periods established by applicable legislation expire.
The personal data subject may withdraw their consent at any time by submitting a written request to the Principal; such withdrawal must be executed by the Operator within 30 calendar days.

FINAL PROVISIONS
The personal data subject confirms that they give this consent voluntarily and in their own interest, being informed of the terms of processing and transfer of personal data.
This consent is deemed granted upon confirmation through a special form on the Principal’s website or another method determined by the Principal, and its execution is ensured by the Operator.