GDPR Compliance

Nathan Digital has always believed that the data entrusted to us by our clients is not ours to exploit. The EU General Data Protection Regulation (GDPR) formalizes this belief into law — and we welcome it.

We comply with GDPR not just for clients in the European Economic Area, but as a global baseline standard for all our operations across 50+ countries.

The General Data Protection Regulation (EU) 2016/679 is the world's most comprehensive data protection law. It governs how organizations collect, process, store, and transfer the personal data of individuals in the European Economic Area (EEA).

2.aKey principles

• Lawfulness, fairness, and transparency
• Purpose limitation — data collected for specific, explicit purposes only
• Data minimization — only the data necessary for the purpose
• Accuracy — data kept up to date
• Storage limitation — not kept longer than necessary
• Integrity and confidentiality — secured against unauthorized access
• Accountability — the data controller is responsible for compliance

Nathan Digital acts in two capacities:

As a Data Controller: When we collect and use personal data about website visitors, prospective clients, and contacts (e.g., for marketing, CRM, support).

As a Data Processor: When we process personal data on behalf of our enterprise clients — specifically employee data within our HRMS platform. In this role, we act strictly on the instructions of the controller (our client) and have no independent right to use that data.

We rely on the following lawful bases under Article 6 GDPR:

• Contractual necessity — processing required to deliver the services you have contracted for
• Legitimate interests — improving our services, fraud prevention, security
• Consent — marketing communications and non-essential cookies (which you can withdraw at any time)
• Legal obligation — where we are required by law to process data

If you are in the EEA (or where we extend these rights globally), you have the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Correct inaccurate or incomplete data
• Erasure ("right to be forgotten"): Request deletion of your data where no legal basis remains
• Restriction: Ask us to limit processing while a dispute is resolved
• Portability: Receive your data in a structured, machine-readable format
• Object: Object to processing based on legitimate interests or for direct marketing
• Withdraw consent: At any time, where consent is the legal basis

To exercise any of these rights, contact us at privacy@nathandigital.com. We will respond within 30 days.

Nathan Digital operates across 50+ countries. When personal data is transferred outside the EEA, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable (e.g., transfers to countries recognized as providing equivalent protection)
• Binding Corporate Agreements within our group

You can request a copy of our transfer mechanisms by emailing legal@nathandigital.com.

Enterprise clients who require a formal Data Processing Addendum (DPA) to document our obligations as a data processor can request one at legal@nathandigital.com.

Our DPA incorporates the EU Standard Contractual Clauses and covers:

• Subject matter and duration of processing
• Nature and purpose of the processing
• Types of personal data and categories of data subjects
• Sub-processor management
• Security obligations
• Breach notification (within 72 hours of becoming aware)
• Data subject request handling

We engage a limited number of trusted sub-processors to deliver our services (e.g., cloud infrastructure providers, email delivery services). All sub-processors are contractually bound to GDPR-equivalent data protection standards.

A list of our current sub-processors is available on request. We will notify enterprise clients of any planned changes to sub-processors with at least 14 days' notice.

In the event of a personal data breach, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware, where the breach is likely to result in a risk to individuals' rights and freedoms
• Notify affected data controllers (our clients) promptly so they can fulfil their own notification obligations
• Notify affected individuals directly where the breach is likely to result in a high risk to their rights

We maintain an internal incident response policy and conduct regular drills.

Nathan Digital has appointed a Data Protection Officer (DPO) responsible for overseeing our GDPR compliance programme.

Contact our DPO: Email: privacy@nathandigital.com Nathan Digital — Dubai, United Arab Emirates