Privacy Policy

Effective June 29, 2026

1. Introduction

Welcome to Qorden. This Privacy Policy explains how Qorden collects, uses, stores, shares, transfers, protects, and otherwise processes personal data when individuals access, use, purchase, subscribe to, administer, or interact with Qorden’s websites, applications, software platforms, APIs, artificial intelligence technologies, communication services, customer portals, support channels, and related products and services (collectively, the “Services”).

The Services are provided by Qorden AI LTD. | Registered Office: Unit GA-00-SZ-L1-RT-208 Level 1, Gate Avenue South Zone Dubai International Financial Centre (DIFC) Dubai, United Arab Emirates 

“Qorden”, “we”, “our”, or “us”).

Qorden develops and operates advanced artificial intelligence technologies that facilitate multilingual communication, speech recognition, speech-to-speech translation, transcription, meeting intelligence, speech analytics, conversational AI, video dubbing, content localization, and other communication technologies designed to enable seamless collaboration across languages, regions, and industries.

We recognize that privacy, confidentiality, security, transparency, accountability, and responsible innovation are fundamental to maintaining the trust of our customers, users, partners, and stakeholders. Accordingly, Qorden is committed to processing personal data fairly, lawfully, transparently, and securely while complying with applicable privacy, data protection, cybersecurity, artificial intelligence, consumer protection, and regulatory requirements.

This Privacy Policy explains the categories of personal data we collect, the purposes for which such information is processed, the legal bases that support our processing activities, how information may be shared or transferred, the safeguards implemented to protect personal data, and the rights available to individuals under applicable laws.

Qorden may process personal data in a variety of circumstances, including when individuals visit our websites, create accounts, subscribe to services, participate in meetings, utilize translation or transcription services, engage with customer support, access APIs, participate in webinars or events, or otherwise interact with our technology platforms.

As a global technology organization, Qorden may process information across multiple jurisdictions and through carefully selected infrastructure providers, service providers, affiliates, and authorized personnel. Whenever personal data is transferred, accessed, or processed, Qorden implements appropriate technical, organizational, contractual, and security safeguards designed to ensure compliance with applicable laws and to protect the confidentiality, integrity, and availability of personal data.

By accessing or using the Services, individuals acknowledge that they have read and understood this Privacy Policy and agree to the processing of personal data as described herein, subject to any rights available under applicable law.

2. About Qorden

Qorden is an artificial intelligence company focused on enabling multilingual communication, intelligent collaboration, and advanced speech technologies for organizations and individuals around the world.

The company develops and operates software platforms, AI services, communication tools, and enterprise technologies that utilize machine learning, natural language processing, speech recognition, speech synthesis, translation engines, large language models, and other artificial intelligence technologies to deliver innovative communication solutions.

Qorden’s solutions are designed to help organizations overcome language barriers, improve collaboration, enhance customer engagement, automate communication workflows, and derive meaningful insights from voice, text, and communication data.

The Services offered by Qorden may include:

• Real-time speech-to-speech translation;
• Real-time transcription services;
• Live multilingual captions;
• Meeting intelligence and analytics;
• Speech analytics and quality monitoring;
• Conversational AI and virtual assistants;
• Customer interaction analytics;
• AI-generated summaries and action items;
• Video dubbing and localization technologies;
• Content translation and language services;
• Enterprise communication and collaboration platforms.

Qorden operates internationally through its Irish and United Arab Emirates entities.

Qorden AI LTD. | Registered Office: Unit GA-00-SZ-L1-RT-208 Level 1, Gate Avenue South Zone Dubai International Financial Centre (DIFC) Dubai, United Arab Emirates

As part of delivering global services, Qorden may maintain operational, technical, support, compliance, customer success, research, development, administrative, and security functions in multiple jurisdictions. Such activities may be performed by employees, contractors, affiliates, or authorized service providers operating under contractual obligations that require compliance with applicable privacy, confidentiality, and information security requirements.

Qorden is committed to responsible innovation and seeks to design, develop, deploy, and operate its technologies in a manner that respects privacy, promotes transparency, reduces risk, and supports ethical and accountable use of artificial intelligence. This commitment extends across the entire lifecycle of our products and services, including design, development, deployment, operation, monitoring, maintenance, and continuous improvement.

3. Applicability and scope

This Privacy Policy applies to all personal data processed by Qorden in connection with the operation, administration, delivery, support, maintenance, and improvement of the Services.

The Policy applies to individuals who visit our websites, register for accounts, subscribe to services, participate in meetings or communications processed through the Services, contact our support teams, attend events, interact with marketing communications, utilize APIs, or otherwise engage with Qorden products and technologies.

This Privacy Policy applies regardless of whether personal data is collected directly from individuals, obtained through enterprise customers, received through authorized integrations, generated through system usage, or provided by trusted third parties acting on behalf of customers or users.

The Policy applies to information processed through:

• Websites and web applications;
• Mobile applications;
• Desktop applications;
• Cloud-hosted software platforms;
• APIs and integrations;
• Customer administration portals;
• Artificial intelligence services;
• Translation and transcription services;
• Speech analytics platforms;
• Customer support systems;
• Marketing and communication channels;
• Professional services engagements;
• Training and educational services.

This Privacy Policy applies to both business-to-business (B2B) and business-to-consumer (B2C) environments unless a separate privacy notice, customer agreement, or contractual arrangement expressly provides otherwise.

In certain circumstances, Qorden may process personal data solely on behalf of enterprise customers. Where this occurs, the customer generally acts as the Data Controller and Qorden acts as the Data Processor. In such situations, the customer’s own privacy notices, policies, and contractual instructions may govern aspects of the processing activity in addition to the provisions described within this Privacy Policy.

This Privacy Policy does not apply to third-party websites, products, applications, or services that may be linked to, integrated with, or accessible through the Services. Qorden is not responsible for the privacy practices, content, security practices, or operations of third parties, and users are encouraged to review the privacy notices of those organizations before providing personal information.

Where applicable law imposes additional requirements or grants additional rights that are not expressly described within this Privacy Policy, Qorden will process personal data in accordance with such legal obligations and rights.

4. Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set forth below unless the context requires otherwise.

“Personal Data” means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified directly or indirectly through reference to identifiers such as a name, identification number, location data, online identifier, device identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that individual.

“Processing” means any operation or set of operations performed on personal data, whether by automated means or otherwise, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, transmission, dissemination, alignment, combination, restriction, erasure, or destruction.

“Data Controller” means the natural or legal person, public authority, agency, or other body that alone or jointly determines the purposes and means of processing personal data.

“Data Processor” means a natural or legal person, public authority, agency, or other body that processes personal data on behalf of a Data Controller.

“Customer Data” means information uploaded, transmitted, generated, stored, shared, or otherwise made available by customers or users through the Services.

“User” means any individual who accesses, uses, administers, interacts with, or participates in the Services.

“AI Systems” means machine learning models, speech recognition engines, language models, translation engines, speech synthesis systems, analytics engines, conversational AI technologies, and other artificial intelligence technologies utilized within the Services.

“Subprocessor” means any third-party service provider engaged by Qorden to process personal data on its behalf in connection with the provision of the Services.

“Applicable Data Protection Laws” means all laws, regulations, and legal requirements governing the collection, use, storage, transfer, disclosure, protection, and processing of personal data, including where applicable the GDPR, UK GDPR, Irish Data Protection Act 2018, DIFC Data Protection Law No. 5 of 2020, and other applicable privacy laws.

“Services” means all products, applications, websites, software platforms, APIs, communication technologies, artificial intelligence services, support services, and related offerings provided by Qorden.

These definitions are intended to support consistency, clarity, and transparency throughout this Privacy Policy and shall be interpreted broadly where necessary to achieve the objectives of applicable privacy and data protection legislation.

5. Data controller and data processor roles

Qorden’s role in relation to personal data depends upon the nature of the Services being provided and the relationship between Qorden, its customers, and end users.

In certain circumstances, Qorden acts as a Data Controller because it determines the purposes for which personal data is collected and the manner in which that information is processed. Examples include the administration of customer accounts, operation of the Qorden website, management of subscriptions, marketing communications, recruitment activities, vendor management, and the administration of customer relationships.

In other circumstances, particularly where enterprise customers use the Services to process information relating to their employees, customers, contractors, or business contacts, Qorden acts as a Data Processor. In these situations, the customer determines the purposes and means of processing while Qorden processes personal data solely in accordance with the customer’s documented instructions and applicable contractual obligations.

Where Qorden acts as a Data Processor, customers remain responsible for ensuring that they have an appropriate legal basis for processing personal data and for providing any notices, disclosures, or consents required by applicable law.

Qorden may also support customers through Data Processing Agreements (“DPAs”), Standard Contractual Clauses, security documentation, compliance questionnaires, and other mechanisms intended to facilitate compliance with applicable privacy requirements.

In limited circumstances, Qorden and a customer may act as independent controllers or joint controllers in relation to specific processing activities. Where this occurs, responsibilities will generally be governed by the applicable contractual arrangements between the parties.

Regardless of whether Qorden acts as a Controller or Processor, Qorden implements technical, organizational, and contractual safeguards designed to protect personal data and support compliance with applicable legal requirements.

6. Categories of personal data we collect

The categories of personal data processed by Qorden vary depending upon the Services utilized, the relationship between Qorden and the individual, the customer’s configuration of the Services, and the context in which information is collected.

Qorden may collect and process identity information, including names, usernames, employee identifiers, job titles, company affiliations, profile photographs, and other information used to identify users and administrators within the Services.

Qorden may collect contact information such as business email addresses, telephone numbers, physical addresses, billing addresses, and other communication details required to establish and maintain customer relationships.

Account-related information may include authentication credentials, account preferences, user permissions, subscription details, licensing information, support records, and activity history associated with the use of the Services.

When users participate in meetings, calls, conferences, webinars, training sessions, or other communications processed through the Services, Qorden may process communications data. Such information may include voice recordings, audio streams, video streams, meeting transcripts, captions, translations, summaries, chat messages, shared content, participant information, and collaboration records.

Qorden may collect technical and operational information automatically through the use of the Services. This may include IP addresses, browser information, operating system information, application versions, device identifiers, network information, session information, diagnostic logs, performance metrics, and security events.

Financial and transaction-related information may also be processed, including billing records, payment status information, subscription histories, tax information, invoices, and related commercial records. Payment card information is typically processed directly by authorized payment providers and is generally not stored by Qorden.

Qorden seeks to limit the collection of personal data to that which is relevant, necessary, and proportionate to the purposes described within this Privacy Policy.

7. Sources of personal data

Qorden obtains personal data from a variety of sources depending upon how individuals interact with the Services.

Information may be collected directly from individuals when they create accounts, subscribe to services, register for events, submit inquiries, request demonstrations, contact support teams, participate in surveys, or otherwise communicate with Qorden.

Enterprise customers may provide information relating to employees, contractors, customers, meeting participants, agents, or other authorized users who access or interact with the Services. In such cases, the customer is generally responsible for ensuring that appropriate notices and legal bases are in place.

Qorden may also receive information through integrations with third-party systems, including identity providers, collaboration platforms, communication platforms, customer relationship management systems, contact center technologies, and business productivity tools.

Certain information is automatically generated through the operation of the Services. This includes system logs, security logs, device information, usage statistics, performance metrics, diagnostic information, and other technical records necessary for operating, securing, and improving the Services.

In some cases, Qorden may receive information from publicly available sources, business partners, service providers, event organizers, or referral programs where such collection is permitted by law.

Qorden takes reasonable steps to ensure that personal data obtained from third parties is collected and processed in accordance with applicable legal requirements.

8. Purposes of processing

Qorden processes personal data for a variety of legitimate business, operational, security, contractual, and regulatory purposes.

The primary purpose of processing is to provide and operate the Services. This includes enabling multilingual communication, delivering speech-to-speech translation, generating transcriptions, producing captions, facilitating collaboration, generating meeting summaries, supporting speech analytics, and providing AI-powered functionality.

Personal data is also processed to create and manage customer accounts, authenticate users, administer subscriptions, provide customer support, respond to inquiries, deliver service notifications, and maintain customer relationships.

Qorden processes information to maintain the security, availability, and integrity of its platforms. This includes monitoring systems, detecting suspicious activities, preventing unauthorized access, investigating incidents, managing vulnerabilities, enforcing policies, and protecting customers, users, and infrastructure.

Qorden may process personal data to improve products and services. Such activities may include analyzing system performance, identifying usability issues, evaluating feature effectiveness, improving translation quality, enhancing speech recognition accuracy, developing new functionality, and conducting internal research and development activities.

Information may also be processed to comply with legal obligations, regulatory requirements, contractual commitments, court orders, governmental requests, tax obligations, and industry standards.

Where permitted by law, Qorden may use personal data to communicate information regarding products, services, updates, events, webinars, research publications, and other business-related information that may be of interest to customers and users.

Qorden endeavors to ensure that all processing activities are proportionate, necessary, and aligned with clearly defined business and legal objectives.

9. Legal bases for processing

Qorden processes personal data only where a lawful basis exists under applicable data protection laws.

One of the primary legal bases relied upon by Qorden is contractual necessity. Personal data may be processed where such processing is necessary to enter into, perform, administer, or enforce a contract with an individual or customer. This includes providing access to the Services, administering accounts, delivering support, managing subscriptions, and fulfilling contractual obligations.

Qorden may also process personal data on the basis of legitimate interests. These interests include operating and improving the Services, securing systems, preventing fraud, protecting intellectual property, conducting business operations, supporting customer relationships, and ensuring the continued reliability of the Services. Where legitimate interests are relied upon, Qorden seeks to balance its interests against the rights and freedoms of affected individuals.

Certain processing activities may be based on consent. Examples include marketing communications, optional cookies, participation in promotional activities, voice cloning services, or other activities where consent is required by law. Individuals may withdraw consent at any time, although withdrawal will not affect the lawfulness of processing conducted before such withdrawal.

Qorden may process personal data where necessary to comply with legal obligations. Such obligations may arise under tax laws, financial reporting requirements, data protection regulations, court orders, regulatory investigations, and other legal requirements applicable to Qorden’s operations.

In limited circumstances, processing may be necessary to protect vital interests, exercise legal rights, defend legal claims, or support matters of substantial public interest where recognized by applicable law.

10. Special category data, biometric data, and sensitive information

Certain Qorden Services involve the processing of audio, speech, and communication content. Depending upon how the Services are used, this information may contain personal data that is considered sensitive or subject to enhanced protection under applicable law.

Voice recordings may contain information relating to an individual’s identity, language, nationality, health information, accessibility needs, personal opinions, professional discussions, or other information disclosed during communications. In some jurisdictions, certain voice characteristics may also be considered biometric information where they are processed for identification purposes.

Qorden does not intentionally collect sensitive personal data unless such processing is necessary to provide the Services, required by customers, voluntarily provided by users, or otherwise permitted by law. Where processing of special category data is required, Qorden implements additional safeguards designed to protect such information.

Access to sensitive information is restricted to authorized personnel with a legitimate business need. Additional security controls, monitoring measures, encryption technologies, and contractual safeguards may be applied where appropriate.

Qorden does not use voice recordings or speech data for surveillance purposes, behavioral profiling, or identity verification activities unless expressly disclosed, contractually authorized, and legally permissible.

Enterprise customers utilizing recording, transcription, translation, speech analytics, or related Services remain responsible for ensuring that they have obtained any necessary consents, notices, permissions, or legal bases required under applicable laws governing communications and recordings.

Qorden encourages customers and users to avoid unnecessarily disclosing sensitive personal information unless such disclosure is required for legitimate business purposes and supported by an appropriate legal basis.

11. Artificial intelligence processing and transparency

Artificial intelligence technologies form a core component of the Services provided by Qorden. These technologies are designed to assist users in communication, translation, transcription, analytics, collaboration, content generation, and related activities.

Qorden utilizes a combination of proprietary technologies, third-party artificial intelligence services, machine learning models, natural language processing systems, speech recognition engines, speech synthesis technologies, translation engines, large language models, and analytical systems to provide the functionality available through the Services.

Depending on the specific service utilized, artificial intelligence systems may process spoken language, written text, meeting content, communication metadata, customer-provided information, user instructions, and other information necessary to generate requested outputs.

Examples of AI-powered functionality may include:

• Speech-to-text transcription;
• Real-time translation;
• Speech-to-speech communication;
• AI-generated summaries;
• Action item extraction;
• Conversation analysis;
• Sentiment analysis;
• Knowledge retrieval;
• Speech analytics;
• Language identification;
• Accent adaptation;
• Video dubbing;
• Automated quality monitoring;
• AI-powered assistance features.

Qorden is committed to providing transparency regarding the use of artificial intelligence within its Services. Users should understand that AI systems operate by identifying patterns, making predictions, generating outputs, and processing information through statistical and computational methods.

While Qorden continuously works to improve the accuracy and reliability of its AI systems, artificial intelligence outputs may occasionally contain inaccuracies, omissions, mistranslations, incomplete information, or unintended results. AI-generated outputs should therefore be reviewed by appropriately qualified individuals before being relied upon for legal, financial, regulatory, employment, medical, compliance, or other high-impact decisions.

Qorden does not guarantee that AI-generated outputs will always be accurate, complete, or suitable for any particular purpose.

12. Real-time translation, transcription, and speech processing

Certain Services involve the real-time processing of voice, audio, video, text, and communication content in order to facilitate multilingual communication and collaboration.

When users participate in meetings, calls, conferences, webinars, or other communications processed through the Services, Qorden may analyze spoken language to generate transcriptions, captions, translations, summaries, analytics, and related outputs.

Processing activities may include:

• Capturing audio streams;
• Speech recognition;
• Language detection;
• Translation processing;
• Speech synthesis;
• Speaker segmentation;
• Transcription generation;
• Caption generation;
• Meeting intelligence processing;
• Quality analysis.

Such processing is performed solely for the purposes of providing the requested Services, improving user experience, supporting customer requirements, and maintaining service functionality.

Customers utilizing recording, transcription, translation, or analytics features remain responsible for ensuring that all required notices, disclosures, permissions, and legal bases are obtained before communications are recorded or processed.

Qorden does not monitor customer communications for independent business purposes and processes communication content only as necessary to provide the Services and comply with legal obligations.

13. Automated decision-making and human oversight

Qorden believes that meaningful human oversight remains an important component of responsible artificial intelligence deployment.

As a general principle, Qorden does not make decisions that produce legal effects or similarly significant effects on individuals solely through fully automated processing without appropriate safeguards.

Where AI-generated outputs are provided through the Services, such outputs are intended to support human decision-making rather than replace human judgment.

Customers and users remain responsible for reviewing AI-generated outputs before relying upon them in business, legal, financial, employment, compliance, healthcare, or regulatory contexts.

Qorden maintains governance processes designed to support transparency, accountability, monitoring, and oversight of AI-enabled systems. These measures may include testing procedures, quality assurance reviews, model performance monitoring, risk assessments, human review mechanisms, and continuous improvement activities.

Where applicable law grants individuals rights relating to automated decision-making, Qorden will facilitate the exercise of those rights in accordance with legal requirements.

14. Data sharing and disclosure

Qorden may share personal data with carefully selected third parties where necessary to provide the Services, operate its business, comply with legal obligations, or protect legitimate interests.

Personal data may be disclosed to:

• Cloud infrastructure providers;
• Hosting providers;
• Payment processors;
• Customer support providers;
• Identity and authentication providers;
• Security service providers;
• Analytics providers;
• Professional advisors;
• Auditors;
• Legal counsel;
• Regulatory authorities;
• Government agencies where required by law.

All third parties processing personal data on behalf of Qorden are subject to contractual obligations designed to protect personal data and ensure compliance with applicable privacy requirements.

Qorden does not sell personal data.

Qorden does not rent personal data.

Qorden does not disclose personal data to third parties for independent marketing purposes without an appropriate legal basis.

15. Subprocessors and service providers

To provide secure, reliable, and scalable services, Qorden may engage subprocessors and service providers that assist with hosting, infrastructure, communications, security, analytics, billing, support, monitoring, and related operational functions.

Subprocessors may process personal data only for purposes authorized by Qorden and subject to contractual obligations that require:

• Confidentiality;
• Information security controls;
• Data protection compliance;
• Incident reporting;
• Access restrictions;
• Audit cooperation;
• Appropriate transfer safeguards.

Qorden conducts reasonable due diligence before engaging subprocessors and periodically reviews the security and compliance posture of service providers that process personal data.

A current list or categories of subprocessors may be made available upon request or through customer agreements where applicable.

16. International data transfers

Qorden operates globally and may transfer Personal Data across national borders where necessary to provide the Services, maintain its infrastructure, and support its customers.

Personal Data may be processed within:

• United Arab Emirates;
• Other countries where Qorden, its affiliates, cloud service providers, subprocessors, or authorized service providers operate.

Where Personal Data is transferred outside the United Arab Emirates, Qorden implements appropriate contractual, technical, and organizational safeguards to ensure that Personal Data continues to receive a level of protection consistent with applicable UAE data protection laws and regulatory requirements.

Such safeguards may include:

• Data Processing Agreements;
• Contractual obligations with service providers and subprocessors;
• Appropriate technical and organizational security measures;
• Encryption and secure transmission of Personal Data;
• Access controls and information security measures aligned with recognized industry standards.

Qorden periodically reviews its international data transfer practices and updates its safeguards as necessary to comply with applicable laws, regulatory requirements, and evolving best practices.

17. Information security and technical safeguards

Protecting personal data is a fundamental component of Qorden’s operational and governance framework.

Qorden maintains administrative, technical, physical, and organizational safeguards designed to protect personal data against accidental loss, unauthorized access, disclosure, alteration, misuse, or destruction.

Examples of security measures include:

• Encryption in transit;
• Encryption at rest where appropriate;
• Role-based access controls;
• Multi-factor authentication;
• Security monitoring;
• Network segmentation;
• Vulnerability management;
• Penetration testing;
• Security awareness training;
• Incident response procedures;
• Vendor risk assessments;
• Secure software development practices.

Access to personal data is limited to authorized personnel whose responsibilities require such access.

Although no security system can guarantee absolute protection, Qorden continually reviews and improves its security practices to address evolving threats and industry expectations.

18. Data retention

Qorden retains personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, enforce agreements, protect legal rights, and maintain business records.

Retention periods vary depending upon the nature of the information, the services utilized, contractual commitments, customer instructions, regulatory obligations, and operational requirements.

Examples may include:

• Account information;
• Billing records;
• Security logs;
• Support records;
• Customer communications;
• Meeting metadata;
• Audio recordings;
• AI-generated outputs.

Where customers control retention settings, Qorden generally follows customer-configured retention periods subject to legal and contractual obligations.

Upon expiration of applicable retention periods, personal data may be securely deleted, anonymized, aggregated, or otherwise rendered incapable of identifying individuals.

19. Data subject rights

Depending upon applicable law, individuals may have certain rights regarding their personal data.

Such rights may include:

• Right of access;
• Right to rectification;
• Right to erasure;
• Right to restriction of processing;
• Right to data portability;
• Right to object;
• Right to withdraw consent;
• Rights relating to automated decision-making;
• Right to lodge complaints with supervisory authorities.

Qorden is committed to responding to privacy rights requests in accordance with applicable legal requirements and regulatory timelines.

Where Qorden acts solely as a Data Processor, requests may be referred to the relevant customer for handling under the customer’s instructions.

Qorden may request information necessary to verify an individual’s identity before fulfilling a request.

20. Exercising your rights and complaints

Individuals wishing to exercise privacy rights, submit complaints, request information, or raise concerns regarding the processing of personal data may contact Qorden using the contact details provided in this Privacy Policy.

Privacy requests should include sufficient information to enable Qorden to identify the requester, understand the nature of the request, and verify identity where necessary.

Qorden will review all requests fairly, objectively, and in accordance with applicable legal requirements.

Where an individual believes that Qorden has not adequately addressed a privacy concern, the individual may have the right to lodge a complaint with a competent supervisory authority, including the Irish Data Protection Commission, the DIFC Commissioner of Data Protection, or another authority having jurisdiction over the matter.

Qorden is committed to working constructively with individuals and regulators to resolve privacy concerns and continuously improve its privacy and data protection practices.

21. Cookies and similar technologies

Qorden uses cookies, pixels, local storage objects, web beacons, SDKs, and similar technologies to support the operation, security, functionality, and performance of its Services.

Cookies are small text files placed on a user’s device that allow websites and applications to recognize devices, remember preferences, maintain sessions, improve functionality, and collect information regarding how Services are used.

Qorden uses strictly necessary cookies required for authentication, security, session management, fraud prevention, and essential platform functionality. These technologies enable users to access secure areas of the Services, maintain active sessions, and utilize features that would otherwise be unavailable.

Qorden may also utilize performance, analytics, functional, and preference-related technologies that help us understand how users interact with the Services, identify areas for improvement, measure platform performance, and improve overall user experience.

Where required by applicable law, non-essential cookies and tracking technologies will only be deployed following the user’s consent through an appropriate consent management mechanism.

Users may manage cookie preferences through browser settings, consent management tools, or platform-specific privacy settings. Disabling certain technologies may impact the functionality and performance of some Services.

Additional information regarding the use of cookies and tracking technologies may be provided in a separate Cookie Policy published by Qorden.

22. Marketing communications

Qorden may communicate with existing customers, prospective customers, partners, event attendees, and other individuals regarding products, services, updates, events, webinars, educational content, industry developments, and other business-related matters.

Marketing communications may be delivered through email, telephone, messaging platforms, social media channels, webinars, newsletters, or other communication methods permitted by applicable law.

Where required by law, Qorden will obtain appropriate consent before sending marketing communications. In other circumstances, communications may be sent on the basis of legitimate interests, existing customer relationships, or other lawful grounds recognized by applicable law.

Individuals may opt out of marketing communications at any time by following unsubscribe instructions contained within communications or by contacting Qorden directly.

Opting out of marketing communications will not affect service-related communications necessary for account administration, security notifications, contractual performance, support interactions, billing matters, or compliance obligations.

Qorden does not sell marketing lists or disclose personal data to third parties for independent marketing purposes without an appropriate legal basis.

23. Children’s privacy

Qorden’s Services are primarily intended for use by businesses, organizations, professionals, and individuals who are legally capable of entering into binding agreements under applicable law.

Except where specifically indicated, Qorden does not knowingly collect, solicit, or process personal data from children below the age at which parental consent is required under applicable law.

If Qorden becomes aware that personal data relating to a child has been collected without the necessary authorization, consent, or legal basis, Qorden will take reasonable steps to investigate the matter and, where appropriate, delete the information or otherwise restrict processing.

Parents, guardians, educational institutions, or other responsible parties who believe that a child may have provided personal information to Qorden are encouraged to contact Qorden immediately.

Where Qorden introduces educational, accessibility, family-oriented, or youth-focused features, additional safeguards, disclosures, and consent mechanisms may be implemented to comply with applicable child privacy requirements.

24. Incident response and data breach management

Qorden maintains policies, procedures, and operational controls designed to detect, investigate, respond to, and recover from security incidents and potential personal data breaches.

Security incidents may include unauthorized access, disclosure, loss, destruction, alteration, corruption, misuse, or unavailability of personal data or information systems.

Qorden’s incident response framework includes detection mechanisms, escalation procedures, forensic investigation processes, containment measures, remediation activities, communication protocols, and post-incident reviews.

Where a personal data breach occurs, Qorden will assess the nature, scope, severity, and potential impact of the incident and determine whether notification obligations arise under applicable law, contractual commitments, or regulatory requirements.

Where required, Qorden will notify affected customers, supervisory authorities, regulators, or impacted individuals within applicable legal timeframes.

Qorden continuously reviews and improves its incident response capabilities to address evolving threats and maintain resilience against cyber risks.

25. Law enforcement, regulatory, and legal requests

Qorden may receive requests for information from courts, regulators, law enforcement agencies, governmental authorities, supervisory bodies, or other parties asserting legal authority.

Qorden carefully reviews such requests to assess their validity, scope, legal basis, and consistency with applicable laws.

Where legally permitted, Qorden may seek to limit overly broad requests, challenge inappropriate requests, request clarification, or notify affected customers before disclosure.

Personal data will only be disclosed where Qorden determines that disclosure is legally required, authorized, necessary to protect rights or safety, or otherwise permissible under applicable law.

Nothing in this Privacy Policy shall prevent Qorden from complying with lawful obligations imposed by courts, regulators, governmental authorities, or other competent bodies.

26. Responsible AI and EU AI Act compliance

Qorden is committed to the responsible design, deployment, operation, and governance of artificial intelligence technologies.

Qorden recognizes the importance of transparency, accountability, fairness, human oversight, risk management, privacy protection, security, and ethical considerations in the development and operation of AI systems.

To support these principles, Qorden maintains governance processes that may include:

• AI risk assessments;
• Human oversight measures;
• Security controls;
• Model testing procedures;
• Quality assurance processes;
• Documentation controls;
• Monitoring and review activities;
• Regulatory compliance assessments.

Where applicable, Qorden seeks to align its operations with the requirements of the European Union Artificial Intelligence Act (EU AI Act), GDPR, and other emerging AI governance frameworks.

Users should understand that AI systems are probabilistic technologies and may generate inaccurate, incomplete, biased, outdated, or unexpected outputs. Human review remains essential when utilizing AI-generated outputs for important decisions.

Qorden reserves the right to modify, suspend, or discontinue AI features where necessary to maintain compliance, security, reliability, or legal obligations.

27. Business transfers and corporate transactions

As Qorden continues to grow and evolve, certain business transactions may occur, including mergers, acquisitions, investments, restructurings, asset sales, financings, or similar corporate activities.

In connection with such transactions, personal data may be disclosed to professional advisors, auditors, investors, lenders, potential acquirers, or other authorized parties, subject to appropriate confidentiality obligations and security measures.

Where a transaction results in the transfer of personal data to another organization, Qorden will take reasonable steps to ensure that personal information continues to receive an appropriate level of protection consistent with applicable legal requirements.

28. Changes to this Privacy Policy

Qorden may update or modify this Privacy Policy from time to time to reflect changes in legal requirements, regulatory expectations, technological developments, business operations, security practices, AI capabilities, or service offerings.

When material changes are made, Qorden may provide notice through the Services, website announcements, email communications, customer portals, or other appropriate mechanisms.

The “Last Updated” date appearing at the beginning of this Privacy Policy indicates when the document was most recently revised.

Users are encouraged to review this Privacy Policy periodically to remain informed about Qorden’s privacy and data protection practices.

Continued use of the Services following the effective date of an updated Privacy Policy constitutes acknowledgment of the revised Privacy Policy to the extent permitted by law.

29. Contact information

Questions, requests, concerns, complaints, or inquiries relating to privacy, data protection, artificial intelligence governance, security, or regulatory compliance may be directed to:

Qorden AI LTD. | Registered Office: Unit GA-00-SZ-L1-RT-208 Level 1, Gate Avenue South Zone Dubai International Financial Centre (DIFC) Dubai, United Arab Emirates

Email: privacy@qorden.ai

Website: www.qorden.ai

Headquarters

Qorden AI Ltd.

Dubai International Financial Centre (DIFC)

Dubai, United Arab Emirates

Email: legal@qorden.ai

Qorden is committed to responding to inquiries promptly and in accordance with applicable legal and regulatory requirements.

30. Governing law and jurisdiction

This Privacy Policy shall be governed by and construed in accordance with the applicable laws of the United Arab Emirates, including the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the Dubai International Financial Centre (DIFC) Data Protection Law No. 5 of 2020 where applicable, and any other relevant laws and regulations governing the processing of Personal Data.

Nothing in this Privacy Policy limits or excludes any statutory rights available to individuals under applicable privacy, data protection, consumer protection, or artificial intelligence laws.

Where disputes arise concerning privacy, the processing of Personal Data, or compliance matters, the Parties shall first seek to resolve the dispute through good-faith negotiations. If the dispute cannot be resolved amicably, it shall be resolved in accordance with the dispute resolution provisions set out in the applicable customer agreement, Terms of Service, or other governing contractual documentation, and, where applicable, the competent courts or arbitration tribunal having jurisdiction in the United Arab Emirates.