Legal
Privacy Policy
Effective date: 10 September 2026
1. Who is responsible for your data
Lypso Software FZCO (registered office: IFZA Business Park, Dubai Digital Park, Dubai Silicon Oasis, PO Box 342001, Dubai, United Arab Emirates; licence no. 92217, Dubai Integrated Economic Zones Authority (IFZA)) is the controller of the personal data described in this policy ("Lypso Software", "we", "us").
Questions and requests about personal data: [email protected].
2. Scope
This policy covers personal data we process:
- when you visit this website (the "Site");
- when you contact us by email, telephone or post;
- when you or your organisation enter into, or explore, a business relationship with us (for example as a customer, supplier, payment partner or regulator).
Personal data processed inside our software products on behalf of business customers is governed by the relevant Customer Agreement and data processing terms, under which the customer is the controller and we act as processor. This policy does not replace those terms.
3. What we collect and why
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Contact details | Name, business email, telephone, company, role | Responding to enquiries, managing the relationship | Legitimate interests; performance of a contract |
| Correspondence | Emails, letters, meeting notes | Handling requests, complaints and support | Legitimate interests; legal obligation |
| Due-diligence records | Identity and company documents provided by customers or partners | Know-your-customer checks, fraud prevention, sanctions screening | Legal obligation; legitimate interests |
| Contract and billing data | Agreements, invoices, payment references | Performing and invoicing contracts, accounting | Performance of a contract; legal obligation |
| Technical data | IP address, browser type, pages requested, timestamps | Security, abuse prevention and operation of the Site | Legitimate interests |
We do not run advertising or behavioural tracking on the Site. We do not sell personal data.
4. How we obtain data
Directly from you (for example when you email us), from the organisation you represent, from public registers and verification providers when we carry out due diligence, and automatically from your browser when you visit the Site.
5. Who we share data with
- Service providers that host our infrastructure, deliver email, or provide security services, acting on our documented instructions. The Site is hosted and protected by Cloudflare, Inc.
- Professional advisers: auditors, accountants, lawyers and compliance consultants, under duties of confidentiality.
- Banks and payment partners, to the extent needed to receive and make payments and to satisfy their compliance requirements.
- Authorities and regulators, where the law requires it or where a request is lawful and proportionate.
We do not share personal data with third parties for their own marketing.
6. International transfers
We are established in the United Arab Emirates. Our service providers may process data in other countries, including the European Economic Area and the United States. Where data protection law requires it, we put in place appropriate safeguards for such transfers, such as standard contractual clauses.
7. How long we keep data
- Enquiries and correspondence: up to 3 years after the last contact.
- Contract, billing and accounting records: at least 5 years after the end of the relationship, or longer where required by tax, accounting or anti-money-laundering rules.
- Due-diligence records: for the period required by applicable anti-money-laundering and know-your-customer regulations.
- Technical logs: typically no longer than 12 months.
8. Security
We protect personal data with encryption in transit and at rest, access controls on a need-to-know basis, logging, and regular review of our providers. No system is completely secure; if we become aware of a personal data breach that is likely to affect you, we will notify you and any competent authority as the law requires.
9. Your rights
Depending on where you are, you may have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent where processing is based on consent. You may also lodge a complaint with a supervisory authority.
We apply the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where it applies to our activities, the EU General Data Protection Regulation and equivalent laws. To exercise a right, write to [email protected]. We may ask you to verify your identity, and we respond within the time limits set by the applicable law.
10. Children
The Site and our products are for businesses. We do not knowingly collect personal data from anyone under 18. If you believe we hold such data, contact us and we will delete it.
11. Cookies
See our Cookie Policy.
12. Changes
We may update this policy. The effective date at the top of the page shows when it was last changed. Material changes will be highlighted on the Site.
13. Contact
Lypso Software FZCO IFZA Business Park, Dubai Digital Park, Dubai Silicon Oasis, PO Box 342001, Dubai, United Arab Emirates Email: [email protected]