PRIVACY POLICYLast Updated: January 11, 20251. INTRODUCTIONWelcome to NEW LIGHT CONSULTING L.L.C ("Company," "we," "us," or "our"). Protecting your privacy and safeguarding your personal data is of paramount importance to us. At NEW LIGHT CONSULTING L.L.C, we approach data protection not only as a legal requirement but as a core element of the trust we build with our users. This Privacy Policy outlines the meticulous measures we take to ensure your data is handled responsibly and transparently, in full compliance with UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection, Russian Federal Law No. 152-FZ "On Personal Data," and other applicable international data protection regulations.
By accessing or using our website, mobile applications, products, or services ("Services"), you confirm that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, please cease using our Services and contact us for further clarification or support.
This Privacy Policy reflects our commitment to transparency, accountability, and user empowerment. Our proactive approach to privacy ensures that you understand your rights and the comprehensive measures we implement to protect them. This document is part of our mission to foster long-lasting trust and collaboration with our users.
When processing your personal data, we adhere to the following key principles: legality and fairness, ensuring that data is processed only on lawful grounds and in an honest manner; transparency, providing complete information about how your data is used; data minimization, collecting only what is genuinely necessary for the stated purposes; purpose limitation, using data exclusively for the purposes you have been informed about; accuracy, maintaining the relevance and reliability of the data; storage limitation, keeping it no longer than necessary; integrity and confidentiality, ensuring robust protection of your data; and accountability, taking responsibility for complying with all these principles.
1.1 Key Principles of Data Processing
When processing your personal data, we adhere to the following key principles: legality and fairness, ensuring data processing is conducted only on lawful grounds and in an honest manner; transparency, providing full information on how your data is used; data minimization, collecting only what is genuinely necessary for the stated purposes; purpose limitation, using data solely for the purposes you have been informed about; accuracy, maintaining the relevance and reliability of the data; storage limitation, retaining data no longer than necessary; integrity and confidentiality, ensuring robust protection of data; and accountability, taking full responsibility for compliance with all the listed principles.
1.2 Scope of the Policy
This Privacy Policy applies to all personal data that we collect and process through our website, mobile applications, customer communications (email, phone, chat), social media, messaging services, and offline interactions. Additionally, data processing may include information received from third parties with your consent. All personal data operations are carried out using certified platforms, including Tilda, GetCourse, SaleBot, Kommo, TimeWeb.Cloud, and other systems that ensure high security standards and regulatory compliance.
In accordance with Russian law requirements, data of Russian Federation citizens is recorded, organized, stored, and processed using servers located within the Russian Federation, including those provided by TimeWeb.Cloud. For data processed outside Russia, servers in the United Arab Emirates and Ireland are used in compliance with international security standards.
2. DEFINITIONS2.1 Automated Data Processing
Processing personal data using computing technologies to perform operations without direct human intervention.
2.2 Blocking of Personal Data
Temporary suspension of data processing activities (except for cases required for data clarification).
2.3 Website
A collection of graphical, informational materials, and software hosted on the internet, accessible via the URL: https://newlightconsult.com.
2.4 Personal Data Information System
A database of personal data combined with technical tools and technologies used for processing.
2.5 Anonymization
Actions that render personal data unidentifiable without additional information.
2.6 Processing of Personal Data
Any operation or set of operations performed on personal data, including collection, recording, organization, storage, retrieval, use, disclosure, or destruction, using automated or manual methods.
2.7 Operator
The entity that determines the purposes and means of processing personal data and is responsible for implementing this Privacy Policy.
2.8 Personal Data
Any information that directly or indirectly relates to an identifiable individual.
2.9 Cookies
Small text files stored on a user’s device to recognize their browser and remember preferences during their visit to the website.
3. DATA WE COLLECTTo tailor and enhance the experience of our Services, we collect a variety of personal data. Our collection practices balance operational needs with your privacy expectations. The following sections detail the categories of data we collect and how they contribute to our Services.
3.1 Personal Identification Information
The Operator, represented by NEW LIGHT CONSULTING L.L.C., collects and processes personal data such as full name, email address, and phone number in strict compliance with legal regulations. This information is necessary to maintain effective communication and provide personalized services. Additionally, we may collect data about your professional activities, including your job title and company information, to better understand your profile. If necessary, identification documents such as a passport or national ID may also be collected. This data is used strictly within the scope of our obligations.
3.2 Technical and Usage Data
For the smooth functioning and security of our online platforms, we collect technical data, including IP addresses, browser types, and device information. Our system also captures details about your interactions, such as pages you visit, session durations, and referral sources. This data enables us to continually improve the efficiency and user-friendliness of our digital platforms. These insights are integral to identifying potential technical issues and crafting solutions that enhance your user experience.
3.3 Transactional and Financial Data
To facilitate secure and transparent transactions, we collect payment details, including Payment Card information through our Third Party Data Processors, billing information, and a record of services purchased or subscribed to. This financial data is treated with the highest level of confidentiality and processed solely for the purpose of fulfilling your requests. Our secure payment systems adhere to industry standards to ensure your financial information is always protected.
It is important to note that we never store the full details of your payment cards, as all payment processing is carried out through certified providers compliant with the PCI DSS standard. Our payment partners use advanced encryption methods to ensure data security, and transaction history is stored in an anonymized format. Additionally, we regularly conduct security audits of our payment processes to maintain a high level of protection.
All payment transactions are processed through licensed payment systems, each of which has its own privacy policy and complies with international security standards.
3.4 Marketing and Communication Data
We respect your preferences and collect only the data necessary to deliver personalized marketing materials, newsletters, and event invitations. Feedback gathered through surveys or forms helps us refine our offerings and better address your needs. By analyzing this data, we aim to create targeted campaigns that resonate with your interests, ensuring meaningful and relevant communications.
4. PURPOSES AND LEGAL BASES FOR PROCESSING DATAEvery instance of data processing at NEW LIGHT CONSULTING L.L.C is tied to a clear and lawful purpose. These purposes include but are not limited to providing services, enhancing user experiences, communicating updates, and meeting legal obligations. We prioritize transparency by detailing the legal grounds underpinning each processing activity:
4.1 Service Provision and Enhancement
As part of providing our services, we process data to create and manage your account, authenticate and verify users, process your orders and transactions, provide customer support, resolve technical issues, improve the functionality of our services, and personalize the user experience.
4.2 Marketing and Communications
For marketing and communications, we respect your preferences and use your data to deliver promotional offers and event invitations only when you have explicitly opted in. Feedback from surveys and campaigns allows us to tailor our outreach to your specific interests.
4.3 Compliance and Legal Obligations
This includes processing data to comply with the legal requirements of the UAE and Russia, respond to requests from government authorities, protect our legal rights and interests, prevent unlawful activities, ensure the security of transactions, and maintain necessary documentation.
4.4 Security and Risk Management
Data processing also supports our efforts to detect and mitigate security risks. This includes monitoring system vulnerabilities, preventing unauthorized access, and maintaining robust digital safeguards.
5. HOW WE SHARE YOUR DATAThe sharing of personal data occurs under controlled and documented circumstances to ensure compliance with UAE and Russian laws and safeguard your privacy. Third-party service providers assist us in delivering core functionalities, including payment processing, cloud storage, and event management. These providers are bound by contracts to uphold confidentiality and adhere to data protection standards. Upon the termination of their services, any data shared with them is returned or securely deleted, further strengthening our protective measures.
In situations involving legal obligations, data may be shared with government agencies, courts, or law enforcement entities. Such disclosures are carried out in strict accordance with legal requirements to ensure transparency and fairness. By adhering to clear processes, we ensure that your rights are respected during such interactions.
Collaborations with business partners for co-branded events or offerings occur only with your explicit consent. Regular audits ensure that these partners comply with the same high standards of data protection that we uphold. Our approach to data sharing is marked by diligence and integrity, ensuring that your data remains secure.
5.1 Categories of Data Recipients
We may share your data with various categories of recipients to ensure the functionality of our services and fulfill our obligations. Service providers such as payment systems and banks, hosting providers, analytics systems, email marketing services, delivery services, and customer support services assist us in processing payments, providing technical infrastructure, analyzing data, and delivering products and services.
Our partners, including advertising platforms, marketing agencies, consultants, auditors, and software providers, access data solely for the purpose of delivering specialized services. Additionally, we may share data with government authorities, such as regulatory bodies in the UAE and Russia, law enforcement agencies, and tax authorities, as required to comply with legal obligations or protect our legitimate interests.
5.2 Guarantees for Data Sharing
When transferring data, we ensure the highest level of protection for your personal data. This includes entering into confidentiality agreements with recipients, verifying the security measures they apply, and limiting the amount of data shared to the minimum necessary for specific tasks. We also monitor the use of the shared data and provide you with the ability to withdraw your consent for data sharing. These measures guarantee the security of your data and its use strictly in compliance with applicable laws.
6. CROSS-BORDER DATA TRANSFERSGiven the global nature of our operations and the predominant use of our services by clients from Russia, personal data may be transferred between jurisdictions, including Russia and the UAE, where our servers and main business operations are located. We take all necessary measures to ensure the security of such data and its processing in compliance with Russian and international legislation.
6.1 Features of Cross-Border Data Transfers
For cross-border data transfers, we inform users about such transfers through this Privacy Policy and the user agreement. Our servers are located in Russia and the UAE, ensuring physical protection of the data and compliance with local legal requirements. We verify that the level of data protection complies with the legislative requirements of Russia and the UAE, as well as international standards. To provide additional protection, standard contractual clauses are used in agreements with third parties. When necessary, encryption, anonymization, and other technological measures are applied to prevent unauthorized access. We strictly adhere to the requirements of Federal Law No. 152-FZ "On Personal Data" of the Russian Federation and Federal Decree-Law No. 45 of 2021 on Personal Data Protection of the UAE.
6.2 Acceptance of Cross-Border Data Transfer Conditions
By using our Services, you agree to the terms of cross-border data transfers, which are necessary to ensure the functionality of our platforms and the provision of our services. We place significant emphasis on protecting your information during transfers between our servers in Russia and the UAE.
6.3 Security and Confidentiality Guarantees
Data transfers between servers in the UAE and Russia are carried out with strict security measures, such as data encryption in transit and access authentication. We guarantee that data is used solely for the purposes specified and only to the extent necessary to achieve those purposes. Monitoring and regular audits ensure compliance with security and confidentiality standards.
7. DATA RETENTION PERIODSData is stored only for the time necessary to fulfill the purposes of processing. For example, transactional data is retained for seven years to meet legal and audit requirements. Marketing preferences are retained only as long as you continue to provide your consent. Periodic reviews are conducted to identify and securely delete data that is no longer needed, in accordance with the principle of data minimization.
7.1 Retention Periods for Different Data Categories
Account data is stored until the account is deleted or a request for deletion is received. Financial data and transaction history are retained for seven years in compliance with legal requirements. Data used for marketing purposes is stored until the user withdraws consent. Information related to customer support inquiries is retained for three years following the last interaction. Technical logs are stored for one year. Cookie retention periods vary by type, ranging from session cookies (deleted upon browser closure) to persistent cookies (stored for up to two years).
7.2 Data Deletion Process
We use a comprehensive approach to ensure data security during deletion. All data is securely deleted using specialized methods that prevent recovery. Upon completion of the deletion process, we confirm the successful operation. If data has been shared with third parties, we notify them of the need to delete the corresponding information from their systems.
7.3 Specific Requirements for Russian Users' Data Storage
For the collection of personal data belonging to Russian citizens, including through the internet, the recording, systematization, accumulation, storage, updating (modification), and retrieval are carried out using databases located on the territory of the Russian Federation. This requirement is fulfilled in compliance with Russian personal data legislation.
8. YOUR RIGHTS8.1 Detailed Overview of Your Rights
The right to access your data includes the ability to obtain confirmation of data processing, receive a copy of your data, and access information about the purposes and methods of processing.
The right to correct your data allows you to rectify inaccurate information, supplement incomplete data, and update outdated information in our systems.
The right to delete your data enables you to request the removal of your data when it is no longer necessary for processing, withdraw your consent to processing, or request the deletion of unlawfully processed data.
The right to restrict processing allows you to temporarily suspend the processing of your data, preserve it without usage, and limit access to it.
The right to data portability ensures you can receive your data in a structured format, transfer it to another operator, or request direct data transfer between operators.
The right to object to processing includes the ability to opt out of marketing communications, automated decision-making, and demand a review of automatically made decisions.
8.2 Exercising Your Rights
To exercise your rights, you can use the personal account functionality on our website, send a request to info@newlightconsult.com, contact customer support, or send a written request to our legal address. We process all received requests within five business days and provide a detailed response on the measures taken.
8.3 Limitations
In some cases, we may be restricted from fulfilling your request. This may occur if the request conflicts with legal requirements, affects the rights of others, is technically unfeasible, or requires disproportionate effort. In such cases, we will provide a detailed explanation of the reasons for refusal.
8.4 Consent to Personal Data Processing
For users from Russia, consent to personal data processing can be provided in written form, as an electronic document signed with a simple electronic signature, or through implied actions on our website.
8.5 Withdrawal of Consent to Processing
Upon receiving a withdrawal of consent for personal data processing, we cease processing within 30 days of receiving the withdrawal. During the same period, the data is destroyed, and we issue a notification of the cessation of processing and data destruction.
It is important to note that the withdrawal of consent does not affect the processing of data necessary to fulfill a contract, comply with legal requirements, or protect our rights and legitimate interests.
9. DATA SECURITYWe implement multi-layered protection measures, including encryption, access controls, and regular vulnerability assessments. Our staff undergo continuous training to stay updated on the latest security protocols, ensuring the safety of your data from potential threats. In the unlikely event of a breach, we will promptly notify affected individuals and provide guidance on mitigating risks.
9.1 Technical Protection Measures
Our security system employs advanced encryption methods for data transmission and storage, multi-factor authentication for system access, regular backups, and strict access controls to information. We use secure data transfer protocols and regularly update security systems to defend against emerging threats.
9.2 Organizational Protection Measures
Our company has implemented an access management system for personal data. Each employee with access to personal data signs a confidentiality agreement. We conduct regular training sessions on information security and audits of data processing procedures. Incident response protocols for information security breaches are developed and operational.
9.3 Data Breach Notification Procedure
In the event of a data breach, we promptly conduct an internal investigation, take measures to resolve the issue, and prevent similar incidents in the future. Affected users and relevant regulatory authorities are notified within 72 hours of identifying the breach if the incident poses risks to the rights and freedoms of individuals.
10. COOKIES AND TRACKING TECHNOLOGIESOur website and online platforms utilize cookies and similar technologies to enhance user experience and improve the functionality of our Services. This section outlines how these technologies are used and your options to manage them in compliance with UAE Federal Decree-Law No. 45 of 2021 and Russian regulations.
Cookies are small data files placed on your device by a website or service. They enable the website to recognize your device and remember information about your visit, such as your preferences and activity. Other tracking technologies, such as web beacons or pixel tags, may also be employed to collect information about user interactions.
We use the following types of cookies:
- Essential Cookies: Necessary for the operation of our Services, such as enabling secure login and facilitating navigation.
- Performance Cookies: Collect information about how users interact with our Services, allowing us to identify and fix issues and optimize the user experience.
- Functional Cookies: Remember user preferences, such as language settings or login details, to personalize your experience.
- Advertising Cookies: Deliver targeted advertisements based on your browsing behavior and track the performance of marketing campaigns.
Our use of cookies aligns with the UAE Federal Decree-Law No. 45 of 2021 and Russian Federal Law No. 152-FZ. Essential cookies are used under the basis of legitimate interest, while performance, functional, and advertising cookies are implemented with your explicit consent, which can be managed through our cookie management tool.
11. CHANGES TO THIS PRIVACY POLICYThis Privacy Policy is a living document that evolves to reflect regulatory changes and advancements in data protection practices. Substantial updates will be communicated via email and highlighted on our website at least 30 days before taking effect. By ensuring timely updates, we strive to maintain
12. CONTACT INFORMATION12.1 General Contact Information
If you have any questions, concerns, or complaints regarding this Privacy Policy or the processing of your data, please feel free to reach out to us. We are committed to responding to your inquiries promptly and transparently.
NEW LIGHT CONSULTING L.L.C. Data Protection
Address: OFF2-04, Port Saeed 184-0, Arab Bank Building, Dubai, UAE
Email: info@newlightconsult.com
Phone: +971-586297066
12.2 Data Protection Inquiries
For all matters related to the processing of personal data, including requests to exercise your rights as a data subject, you may contact our Data Protection Officer using the contact details provided above. We are committed to reviewing all received inquiries and responding within the timeframes prescribed by applicable law.
12.3 Interaction with Supervisory Authorities
If necessary, you may also contact the relevant supervisory authorities responsible for data protection:
In the UAE: UAE Data Office
In Russia: Federal Service for Supervision of Communications, Information Technology, and Mass Media (Roskomnadzor)
13. GOVERNING LAW13.1 Jurisdiction
This Privacy Policy is governed by and construed in accordance with the laws of the United Arab Emirates. For users located in the Russian Federation, the relevant provisions of Russian personal data protection laws shall apply.
13.2 Dispute Resolution
Any disputes arising in connection with this Policy shall be resolved through negotiations. If an agreement cannot be reached through negotiations, disputes will be resolved in accordance with the applicable laws in the competent courts of the UAE or Russia, depending on the jurisdiction and nature of the dispute.
13.3 Priority of Versions
In the event of any discrepancies between different versions of this Policy, the English version shall prevail. However, provisions relating to the processing of personal data of Russian citizens will always be interpreted in accordance with the requirements of Russian legislation.
