Privacy Notice

This Privacy Notice explains how Lorexa (Lorexa, we, us or our) collects, uses, stores, shares and protects personal data when you visit our website, create or use an account, submit or review commodity opportunities, participate in verification, communicate through the Platform, request or receive an introduction, or otherwise interact with our services.

Lorexa operates a private commodity deal network for structured buy requirements, sell offers, participant verification and controlled introductions. Privacy and access control form part of the Platform workflow: private member and contact data is not intended to be displayed in the public marketplace, and direct contact is opened only through an approved introduction or another authorised process.

1. Scope of this Notice

This Notice applies to personal data processed through Lorexa's website, member portal, marketplace, verification and onboarding processes, private introduction workflows, support channels and related business communications (collectively, the Platform). It also applies where we receive personal data from a company, mandate, representative, counterparty, verification provider or other third party in connection with the Platform.

The Platform is intended for business and professional use. It is not designed for personal, family or household commodity transactions.

2. Data Protection Framework

Lorexa is established in Dubai, United Arab Emirates. We process personal data in accordance with applicable UAE data protection requirements, including Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data (UAE PDPL), together with other mandatory laws that apply to particular processing activities. Where another mandatory data protection law applies to a specific individual or processing activity, we will also comply with that law to the extent required.

3. Personal Data We Collect

The categories of personal data we may collect depend on how you use the Platform and the nature of your role or transaction.

3.1 Account and profile information

• Full name, business email address, telephone number, job title, company name and business address.
• Username, account identifiers, password-related security information and account preferences.
• Participant role, such as buyer, seller, mandate, representative, intermediary or other authorised participant.
• Commodity interests, countries or markets of interest and other professional profile information.

3.2 Identity, company and verification information

• Government-issued identification details and copies where required for verification.
• Date of birth, nationality, residency or similar identifying information where relevant to KYC or sanctions screening.
• Company registration records, licences, registered address, directors, shareholders, beneficial ownership information and corporate documents.
• Evidence of authority, mandate, representation or signing capacity.
• Information generated through sanctions, politically exposed person, adverse media, fraud or other compliance screening, where lawful and appropriate.

3.3 Opportunity and transaction information

• Buy requirements, sell offers, commodity type, quantity, specification, origin, destination, location, delivery terms, commercial terms and transaction status.
• Documents or information supporting supply, demand, authority, title, product availability, financing capability or transaction structure.
• Information about counterparties, representatives, introductions, meetings and deal progress.
• Correspondence, messages, notes and records of communications made through or in connection with Lorexa.

3.4 Financial and payment information

• Billing details, invoices, payment status, bank-related information and records necessary to administer fees or commissions.
• Source-of-funds, source-of-wealth or financial capacity information where reasonably required for compliance, transaction verification or risk management.

3.5 Technical and usage information

• IP address, browser type, device information, operating system, login records, timestamps and security logs.
• Pages viewed, actions taken, search or filter activity, referral information and other Platform usage data.
• Cookie identifiers and similar technical information described in Section 11.

4. How We Collect Personal Data

• Directly from you when you register, complete your profile, submit documents, publish an opportunity, request an introduction, communicate with us or use the Platform.
• From the company or person you represent, including employers, principals, mandates, authorised representatives or transaction counterparties.
• From verification, KYC, sanctions, fraud-prevention or identity-service providers.
• From public registers, corporate registries, government databases, sanctions lists and other lawful public sources.
• Automatically through website and Platform technologies when you access or use our services.

5. Why We Use Personal Data

We process personal data only for legitimate and defined purposes and on a lawful basis permitted by applicable law. Depending on the circumstances, processing may be based on your consent, the steps necessary to provide requested services or perform contractual arrangements, compliance with legal or regulatory obligations, the establishment or defence of legal rights, protection of public or third-party interests, or another basis permitted by applicable law.

• Create, administer and secure user accounts and memberships.
• Review applications and determine eligibility for access to the private network.
• Perform identity, company, authority, beneficial ownership, sanctions and other verification checks.
• Review, structure, moderate, publish or restrict commodity opportunities.
• Match relevant buy and sell opportunities and determine whether an introduction is appropriate.
• Facilitate approved introductions and private communications between counterparties.
• Administer fees, commissions, invoices and transaction reporting where applicable.
• Prevent fraud, circumvention, misuse, unauthorised access, suspicious activity and other Platform abuse.
• Meet legal, regulatory, compliance, sanctions, anti-money laundering, anti-bribery, tax or law-enforcement requirements where applicable.
• Maintain records, manage disputes and establish, exercise or defend legal rights.
• Operate, maintain, analyse and improve the Platform, its security and user experience.
• Send service communications, account notices, verification requests, opportunity-related updates and other operational messages.
• Send marketing or network communications where permitted by law and subject to your available choices.

6. Verification, KYC and Compliance Screening

Lorexa may request information and documents to verify identity, corporate status, beneficial ownership, authority or commercial credibility and to manage sanctions, fraud and other compliance risks. Verification is a network access and risk-control process. It does not constitute a guarantee of identity, solvency, authority, title, product availability, financial capacity or transaction performance.

We may use specialist service providers or lawful databases to support these checks. Screening results may produce risk indicators or alerts that are reviewed as part of our onboarding, access-control or transaction-review process.

7. Controlled Introductions and Disclosure to Counterparties

Lorexa is designed so that private member and contact details are not automatically disclosed in the public marketplace. When Lorexa approves an introduction, we may disclose information reasonably necessary to connect the relevant parties, such as names, companies, roles, business contact details and relevant opportunity information.

Before an introduction, we may share limited or anonymised information where possible to allow a party to assess commercial relevance without unnecessarily revealing the identity or private contact details of another participant.

Once counterparties are introduced, each counterparty may process the information it receives for its own independent business purposes. Lorexa does not control how an independent counterparty processes personal data after lawful disclosure, and each party is responsible for complying with its own data protection obligations.

8. Who We May Share Personal Data With

We do not sell personal data. We may disclose personal data only where reasonably necessary for the purposes described in this Notice, including to:

• Approved buyers, sellers, mandates, representatives or other counterparties as part of a controlled introduction.
• Identity, KYC, sanctions, adverse-media, fraud-prevention and compliance service providers.
• Cloud hosting, cybersecurity, software, communications, analytics, document-management and other technology providers supporting the Platform.
• Payment, accounting, invoicing or banking service providers where relevant to fees or transactions.
• Professional advisers, including legal counsel, accountants, auditors, insurers and consultants, where they require access for legitimate professional purposes.
• Government, regulatory, judicial, law-enforcement, tax or other competent authorities where disclosure is required or permitted by law.
• Potential investors, acquirers, financing parties or successors in connection with a genuine corporate transaction, subject to appropriate confidentiality and data-protection safeguards.

9. International Transfers

Lorexa operates an international commodity network. Personal data may therefore be accessed, stored or processed in countries outside the UAE, including where counterparties or service providers are located abroad. Where a cross-border transfer is subject to the UAE PDPL or another applicable data protection law, we will use the transfer mechanism, contractual protection or other safeguard required by that law.

The level of data protection in another country may differ from the UAE. We take reasonable steps to ensure that personal data transferred internationally remains subject to appropriate confidentiality, security and use restrictions.

10. Data Security

Lorexa applies technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, misuse or destruction. Measures may include access controls, authentication requirements, role-based permissions, logging, encryption or secure transmission where appropriate, network security, backups, monitoring and internal confidentiality controls.

No website or electronic system can be guaranteed to be completely secure. Users are responsible for protecting their login credentials and must notify Lorexa promptly if they suspect unauthorised access to their account.

Where required by applicable law, Lorexa will assess personal data breaches and make notifications to the relevant authority or affected individuals in accordance with legal requirements.

11. Cookies and Similar Technologies

The Platform may use cookies, local storage, session identifiers and similar technologies to operate account sessions, remember preferences, maintain security, measure performance and understand how the Platform is used.

• Strictly necessary technologies support core functionality, authentication, fraud prevention and security.
• Preference technologies remember settings or choices that improve usability.
• Analytics technologies help us understand Platform performance and usage patterns.
• Marketing technologies, if used, will be managed in accordance with applicable consent or opt-out requirements.

Where required, you can manage non-essential cookie choices through the relevant cookie controls or browser settings. Blocking certain cookies may affect Platform functionality.

12. Service and Marketing Communications

We may send operational communications necessary to administer your account, verification, opportunities, introductions, security and contractual relationship. These messages are not marketing and may be necessary for continued use of the Platform.

We may also send business development, network or marketing communications where permitted by law. You may opt out of direct marketing at any time using the unsubscribe method provided in the message or by contacting us. An opt-out will not prevent us from sending necessary service or compliance communications.

13. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and for any additional period required or permitted by applicable law. Retention periods vary depending on the type of data, the nature of the account or transaction, legal and regulatory requirements, fraud prevention, dispute management, contractual obligations and the need to establish or defend legal rights.

Some verification, compliance, transaction, invoice, contractual and security records may need to be retained after an account is closed or an opportunity is completed. When personal data is no longer required, we will delete, anonymise or securely dispose of it in accordance with our retention practices and legal obligations.

14. Your Data Protection Rights

Subject to applicable law and any lawful exceptions, you may have rights in relation to your personal data, including the right to:

• Obtain information about the personal data we process and the purposes of processing.
• Request access to or a copy of personal data relating to you.
• Request transfer of personal data in a structured and machine-readable format where the legal conditions for portability apply and the transfer is technically feasible.
• Request correction of inaccurate personal data or completion of incomplete data.
• Request erasure of personal data where the legal conditions for erasure are met.
• Request restriction of processing in circumstances recognised by applicable law.
• Object to or request the stopping of processing for direct marketing and certain other purposes recognised by law.
• Object to certain decisions based solely on automated processing, including profiling, where those decisions have legal or similarly significant effects and no lawful exception applies.
• Withdraw consent where processing is based on consent. Withdrawal does not affect processing that was lawful before consent was withdrawn.
• Raise a complaint with Lorexa and, where applicable, with the competent data protection authority.

We may need to verify your identity before acting on a rights request. Rights are not absolute, and we may lawfully refuse, limit or defer a request where an exemption or competing legal obligation applies. If we cannot fulfil a request, we will explain the reason where required by law.

15. Automated Screening and Profiling

Lorexa may use automated tools to support security, verification, sanctions screening, fraud detection, opportunity matching or risk identification. These tools may flag information for review, but Lorexa does not intend to make decisions producing legal or similarly significant effects solely by automated means unless this is permitted by law and appropriate safeguards are in place.

16. Personal Data About Other People

If you provide personal data relating to another person, such as a director, beneficial owner, employee, representative, mandate, counterparty or contact, you must have appropriate authority or another lawful basis to provide that information to Lorexa. Where required, you are responsible for ensuring that the individual is informed about the disclosure and this Privacy Notice.

17. Minors

The Platform is intended for business users and is not directed to children. Users must be at least 18 years old unless Lorexa expressly approves another legally valid arrangement. We do not knowingly seek to collect personal data from children through the Platform.

18. Third-Party Websites and Services

The Platform may contain links to third-party websites, communications tools, document services, payment services or other external systems. Those third parties may process personal data under their own privacy notices and terms. Lorexa is not responsible for the privacy practices of independent third parties.

19. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes to the Platform, our processing activities, technology, legal requirements or business practices. The current version will be published on the Platform with an updated effective or last-updated date. Material changes may also be communicated through the Platform, by email or through another appropriate method.

20. Contacting Lorexa and Making a Privacy Request

Privacy requests, questions or complaints may be submitted to Lorexa using the contact or support channel made available on the Platform or through your member account. Written requests may also be sent to the Platform Operator at:

Please provide enough information for us to identify you and understand your request. We may ask for additional information where reasonably necessary to verify identity, authority or the scope of the request.

If you believe that Lorexa has not handled your personal data in accordance with applicable law, you may also have the right to submit a complaint to the competent UAE data protection authority or another supervisory authority with jurisdiction over the relevant processing.

By using the Platform, you acknowledge that you have read this Privacy Notice and understand how Lorexa processes personal data in connection with its private commodity deal network.

End of Privacy Notice