PLATFORM PRIVACY POLICY

 

Beamax Global General Trading LLC, a company duly incorporated and existing under the laws of the United Arab Emirates, with its registered address at Shop No. 10, Bahar 2, Jumeirah Beach Residence, Dubai, United Arab Emirates, holding Trade License No. 1020819 (hereinafter referred to as the “Company”), operates the online platform and website available at https://nlstar.ae/ (the “Platform”).

This Platform Privacy Policy (the “Policy”) describes how the Company, in its capacity as the platform owner and online seller, collects, uses, stores, discloses, and protects personal data of individuals who access or use the Platform.

Certain services accessible through the Platform, including referral, incentive-based, and consultant programs, are operated by independent third parties, including NL Middle East FZE LLC, which act as separate and independent data controllers in respect of personal data processed for such services.

This Policy applies solely to personal data processed by the Company and does not govern the processing of personal data carried out by independent third parties, which is subject to their respective privacy notices.

The Company processes personal data in compliance with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and applicable implementing regulations.

 

SECTION 1. GENERAL PROVISIONS

1.1. Scope

This Policy applies to personal data processed by the Company in relation to individuals who access or use the Platform, including visitors, registered users, and customers purchasing goods offered by the Company for personal, non-commercial purposes (collectively, the “Data Subjects”).

Personal data processed by independent third parties in connection with services accessed through the Platform, including referral or consultant programs, is governed by the respective privacy policies of such third parties.

1.2. Purpose

The purpose of this Policy is to ensure that personal data is processed lawfully, fairly, and transparently, to inform Data Subjects about the Company’s data processing practices, and to set out the rights of Data Subjects and the obligations of the Company under applicable UAE data protection laws.

1.3. Governing Principles

The Company adheres to the following principles when processing personal data:

(a) Lawfulness, Fairness, and Transparency — personal data is processed on lawful grounds and in a transparent manner;

(b) Purpose Limitation — personal data is collected for specified, explicit, and legitimate purposes;

(c) Data Minimization — only data necessary for the stated purposes is processed;

(d) Accuracy — reasonable steps are taken to ensure personal data is accurate and up to date;

(e) Storage Limitation — personal data is retained only for as long as necessary;

(f) Integrity and Confidentiality — appropriate technical and organizational measures are implemented;

(g) Accountability — the Company is responsible for and able to demonstrate compliance with applicable data protection requirements.

 

SECTION 2. DEFINITIONS

(a) Company means Beamax Global General Trading LLC, acting as the owner and operator of the Platform and the seller of goods offered through the Platform.

(b) Consultant means an individual who has entered into a separate consultant or service agreement exclusively with NL Middle East FZE LLC and participates in consultant, referral, or incentive-based programs operated by NL Middle East FZE LLC outside the scope of the Platform operated by Beamax Global General Trading LLC.

(c) Customer means a User who purchases goods offered by the Company exclusively for personal, non-commercial purposes.

(d) Independent Data Controller means a third party that independently determines the purposes and means of processing personal data, including NL Middle East FZE LLC in respect of its referral and consultant programs.

(e) Personal Data means any information relating to an identified or identifiable natural person, as defined under the UAE Personal Data Protection Law.

(f) Platform or Site means the website and related technological infrastructure operated by the Company and used to provide access to online services, including the sale of goods and access to third-party services.

(g) Processing means any operation or set of operations performed on Personal Data, whether by automated or other means, including collection, storage, use, disclosure, or deletion.

(h) Third-Party Service Providers means independent entities whose services may be accessible through the Platform and who process personal data under their own privacy policies.

(i) User means any individual who accesses or uses the Platform, whether registered or unregistered.

 

SECTION 3. CATEGORIES OF PERSONAL DATA

The Company processes only such personal data as is necessary to operate the Platform, sell goods to customers, ensure security, and comply with applicable legal obligations.

3.1. Identification Data. The Company may process basic identification data, including first and last name, username or account identifier, and date of registration on the Platform.

3.2. Contact Data. The Company may process contact details such as email address, telephone number, and delivery address, which are required for account management, order fulfillment, customer support, and communications related to purchases.

3.3. Account and Transaction Data. The Company processes information related to user accounts and purchases, including order history, payment status, delivery information, and customer service interactions. Payment card details are processed by authorized payment service providers and are not stored by the Company.

3.4. Technical and Usage Data. When Data Subjects access or use the Platform, the Company may automatically collect certain technical data, such as IP address, device type, browser type, operating system, access timestamps, and interaction logs. This data is used to ensure platform security, prevent fraud, and improve functionality.

3.5. Communication Data. The Company may process records of communications between Data Subjects and customer support, including emails, messages submitted through contact forms, and support tickets, for the purpose of resolving inquiries and maintaining service quality.

3.6. Marketing Preferences. Where applicable, the Company may process information regarding marketing preferences, including consent to receive newsletters or promotional communications related to the Company’s goods. Data Subjects may withdraw such consent at any time.

3.7. Exclusions. The Company does not collect or process sensitive personal data, biometric data, health data, passport copies, Tax Identification Numbers, or AML/KYC-related information in the course of operating the Platform or selling goods.

Any personal data processed in connection with referral, incentive-based, or consultant programs is handled by independent third parties acting as separate data controllers and is governed by their respective privacy policies.

 

SECTION 4. Legal Bases and Purposes of Processing

The Company processes personal data only where a lawful basis exists under applicable UAE data protection laws and solely for specific, explicit, and legitimate purposes related to the operation of the Platform and the sale of goods.

4.1. Performance of a Contract. The Company processes personal data where such processing is necessary for the performance of a contract to which the Data Subject is a party, or in order to take steps at the request of the Data Subject prior to entering into a contract. This includes:

• registering user accounts on the Platform;
• processing and fulfilling orders for goods;
• managing payments and refunds through authorized payment service providers;
• delivering purchased goods;
• providing customer support related to orders and accounts.

4.2. Compliance with Legal Obligations. The Company may process personal data to the extent necessary to comply with applicable legal and regulatory obligations under UAE law, including:

• maintaining accounting and transaction records;
• complying with consumer protection requirements;
• responding to lawful requests from competent authorities.

4.3. Legitimate Interests. The Company may process personal data where such processing is necessary for its legitimate interests, provided that such interests do not override the rights and freedoms of the Data Subjects. Legitimate interests include:

• ensuring the security and integrity of the Platform;
• preventing fraud, misuse, or unauthorized access;
• maintaining and improving the functionality and performance of the Platform;
• internal reporting and operational analytics based on aggregated or pseudonymized data.

4.4. Consent. Where required by law, or where no other lawful basis applies, the Company processes personal data based on the Data Subject’s explicit and informed consent. This includes:

• sending marketing communications related to the Company’s goods;
• notifying users about promotions, discounts, or special offers.

Data Subjects may withdraw their consent at any time without affecting the lawfulness of processing carried out prior to such withdrawal.

4.5. Exclusion of Third-Party Programs. The Company does not process personal data for the purposes of calculating, administering, or paying referral rewards, incentives, or consultant compensation. Any such processing is carried out by independent third parties acting as separate data controllers, including NL Middle East FZE LLC, which independently determines the purposes and means of such processing in accordance with its own privacy policy.

 

Section 5. Disclosure and Transfer of Personal Data

5.1. Internal Access. Personal data processed by the Company may be accessed by authorized employees and contractors solely on a need-to-know basis and strictly within the scope of their assigned duties. The Company applies role-based access controls and regularly reviews access rights to prevent unauthorized or excessive access to personal data.

5.2. Disclosure to Third Parties. The Company may disclose personal data to third parties only where such disclosure is necessary for the operation of the Platform, the fulfillment of contractual obligations, or compliance with applicable legal requirements.

5.2.1. Service Providers. The Company may share personal data with trusted third-party service providers acting on the Company’s instructions, including but not limited to:

• payment service providers and financial institutions;
• hosting, cloud infrastructure, and data storage providers;
• IT support, security, and analytics service providers;
• logistics, delivery, and customer support providers.

Such service providers process personal data solely for the purposes specified by the Company and are contractually bound to implement appropriate technical and organizational security measures.

5.2.2. Independent Third-Party Service Providers. Certain services accessible through the Platform, including referral, incentive-based, or consultant-related programs, are operated by independent third parties. Where Users choose to participate in such services, relevant personal data may be transferred to the respective third-party service provider acting as an independent data controller, including NL Middle East FZE LLC, in accordance with the applicable privacy notices of such third parties.

The Company does not determine the purposes or means of processing personal data carried out by independent third-party controllers and is not responsible for such processing.

5.2.3. Legal and Regulatory Disclosure. The Company may disclose personal data where required to do so by applicable laws, court orders, or requests from competent regulatory or governmental authorities in the United Arab Emirates. Any such disclosure shall be limited to the extent legally required and proportionate to the purpose of the request.

5.3. International Data Transfers. Personal data processed by the Company may be transferred to recipients located outside the United Arab Emirates where such transfer is necessary for the operation of the Platform, including for cloud hosting, payment processing, customer support, or IT infrastructure.

The Company ensures that international transfers of personal data are carried out in compliance with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and are subject to appropriate safeguards, including:

• contractual data protection obligations imposed on recipients;
• technical security measures such as encryption and access controls;
• assessment of the recipient’s ability to provide an adequate level of data protection.

5.4. Onward Transfers. Third parties receiving personal data from the Company are not permitted to transfer such data further unless equivalent data protection safeguards are in place and such transfer is permitted under applicable law.

 

Section 6. Cookies and Tracking Technologies

The Platform uses cookies and similar tracking technologies to ensure its proper operation, enhance user experience, and support essential platform functionalities.

Detailed information about the types of cookies used, their purposes, applicable third-party cookies, and available user controls is provided in the Company’s separate Cookie Policy, which forms an integral part of this Privacy Policy and is available on the Platform.

Certain cookies or tracking technologies may be placed by independent third-party service providers operating services accessible through the Platform. The processing of personal data by such third parties is governed by their respective privacy notices.

 

Section 7. Data Subject Rights

7.1. General. Data Subjects have the rights set out below in relation to personal data processed by the Company in its capacity as the operator of the Platform and the seller of goods offered through the Platform, in accordance with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).

Where personal data is processed by independent third-party service providers acting as separate data controllers, including referral or consultant program operators, the exercise of data subject rights shall be governed by the privacy policies of such third parties.

7.2. Right of Access. Data Subjects have the right to request confirmation as to whether the Company processes their personal data and, where applicable, to obtain access to such data and information regarding the purposes of processing, categories of data, and recipients.

7.3. Right to Rectification. Data Subjects have the right to request the correction of inaccurate or incomplete personal data processed by the Company. The Company may take reasonable steps to verify the accuracy of the data before making any corrections.

7.4. Right to Erasure. Data Subjects may request the deletion of their personal data processed by the Company where:

• the data is no longer necessary for the purposes for which it was collected;
• processing is based solely on consent and such consent has been withdrawn;
• the data has been unlawfully processed.

This right does not apply where the processing of personal data is required to comply with legal obligations, to perform a contract, or to establish, exercise, or defend legal claims.

7.5. Right to Restriction of Processing. Data Subjects may request the restriction of processing of their personal data by the Company where the accuracy of the data is contested, the processing is unlawful, or the data is required for legal claims.

7.6. Right to Object. Data Subjects have the right to object to the processing of their personal data by the Company where such processing is based on the Company’s legitimate interests or carried out for direct marketing purposes. Where an objection relates to direct marketing, the Company shall cease such processing without undue delay.

7.7. Right to Withdraw Consent. Where processing is based on the Data Subject’s consent, the Data Subject may withdraw such consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to withdrawal.

7.8. Right to Data Portability. Where applicable under UAE law, Data Subjects may request to receive personal data they have provided to the Company in a structured, commonly used, and machine-readable format, provided that such processing is based on consent or contractual necessity and is carried out by automated means.

7.9. Automated Processing. The Company does not use automated decision-making processes that produce legal effects or similarly significant effects on Data Subjects in relation to the operation of the Platform or the sale of goods. Any automated processing used by the Company is limited to technical, security, or fraud-prevention purposes.

7.10. Exercise of Rights. To exercise any of the rights set out in this Section, Data Subjects may contact the Company using the contact details provided in this Policy. The Company may request additional information to verify the identity of the Data Subject before responding to a request and shall respond within a reasonable timeframe in accordance with applicable law.

7.11. Complaints. Data Subjects who believe that their personal data has been processed in violation of applicable data protection laws may submit a complaint to the Company. If the response is unsatisfactory, Data Subjects have the right to lodge a complaint with the competent data protection authority in the United Arab Emirates.

 

Section 8. Data Retention

8.1. Retention Principles. The Company retains personal data only for as long as necessary to achieve the purposes for which such data was collected and processed, unless a longer retention period is required or permitted by applicable law.

Retention periods are determined based on the nature of the data, the purpose of processing, and the Company’s legal, accounting, and contractual obligations.

8.2. Retention of Platform and Transaction Data. Personal data relating to the use of the Platform, customer accounts, orders, payments, deliveries, and customer support interactions is retained for the duration of the contractual relationship and thereafter for the period required to comply with applicable legal, tax, and accounting obligations under UAE law.

8.3. Marketing and Communication Data. Personal data processed for marketing or communication purposes is retained until the Data Subject withdraws consent or objects to such processing, unless retention is otherwise required by law.

8.4. Data Processed by Independent Third Parties. Personal data transferred to independent third-party service providers acting as separate data controllers, including operators of referral or consultant programs, is retained in accordance with the retention policies of such third parties and is governed by their respective privacy notices.

8.5. Deletion and Anonymization. Upon expiration of the applicable retention period or where personal data is no longer necessary for the purposes for which it was collected, the Company securely deletes or irreversibly anonymizes such data, unless further retention is required by law.

8.6. Secure Disposal. The Company applies appropriate technical and organizational measures to ensure the secure disposal of personal data, including access-controlled deletion, data wiping, and other industry-standard data destruction methods.

8.7. Retention Schedule. The Company maintains internal data retention schedules that specify retention periods for different categories of personal data processed by the Company in accordance with applicable legal and regulatory requirements.

 

Section 9. Security Measures

9.1. Technical and Organizational Measures. The Company implements appropriate technical and organizational measures designed to protect personal data processed by the Company against unauthorized or unlawful access, loss, alteration, disclosure, or destruction. Such measures are implemented taking into account the nature of the data, the purposes of processing, and the risks involved.

These measures may include, where appropriate:

• access controls and authentication mechanisms;
• encryption of data in transit and at rest;
• network security measures and firewalls;
• regular system monitoring and vulnerability management.

9.2. Access Management. Access to personal data is restricted to authorized personnel and contractors who require such access for the performance of their duties. The Company applies the principle of least privilege and periodically reviews access rights to reduce the risk of unauthorized access.

9.3. Employee Awareness and Training. Employees and contractors with access to personal data receive appropriate training regarding data protection, confidentiality obligations, and information security practices and are required to comply with the Company’s internal policies and procedures.

9.4. Incident Response. The Company maintains procedures to detect, assess, and respond to actual or suspected personal data breaches affecting personal data processed by the Company. Such procedures are designed to enable timely containment, mitigation, and remediation of security incidents.

9.5. Data Breach Notification. Where a personal data breach affecting personal data processed by the Company is likely to result in a risk to the rights and freedoms of Data Subjects, the Company shall take appropriate steps in accordance with applicable UAE data protection laws, including notifying the competent authority and affected Data Subjects where required by law.

9.6. Third-Party Security. Where personal data is shared with third-party service providers acting on behalf of the Company, the Company requires such providers to implement appropriate security measures consistent with applicable data protection requirements.

The Company is not responsible for the security practices of independent third-party data controllers operating services accessible through the Platform, including referral or consultant programs, which are governed by their respective privacy policies.

 

Section 10. Roles and Responsibilities

10.1. Data Protection Responsibility. The Company is responsible for ensuring that personal data processed by it in connection with the operation of the Platform and the sale of goods is handled in accordance with applicable UAE data protection laws.

The Company has designated a responsible function or department to oversee data protection compliance, including the handling of data subject requests, implementation of security measures, and coordination of privacy-related matters.

10.2. Employees and Authorized Personnel. Employees and authorized contractors of the Company who have access to personal data are required to:

• process personal data strictly within the scope of their assigned duties;
• comply with applicable data protection, confidentiality, and information security requirements;
• undergo appropriate training related to data protection and information security;
• promptly report any suspected personal data breaches or security incidents.

10.3. Third-Party Processors. Where the Company engages third-party service providers to process personal data on its behalf (including hosting, payment processing, IT support, or analytics services), such providers act as data processors and are required to process personal data solely in accordance with the Company’s instructions and applicable contractual obligations.

The Company ensures that appropriate contractual safeguards are in place with such processors, including obligations relating to confidentiality, data security, and compliance with applicable data protection laws.

10.4. Independent Third-Party Controllers. Certain services accessible through the Platform are operated by independent third parties that act as separate and independent data controllers in respect of personal data processed for their own purposes, including referral, incentive-based, or consultant-related programs.

The Company does not control and is not responsible for the data processing activities of such independent controllers. Data Subjects are encouraged to review the applicable privacy notices of those third parties to understand how their personal data is processed.

10.5. Cooperation with Authorities. The Company cooperates with competent regulatory and governmental authorities in matters relating to personal data protection, where required by applicable law, and responds to lawful requests in a timely and proportionate manner.

 

Section 11. Contact Information & Complaints

11.1. Contact Details. For matters relating to the processing of personal data by the Company in connection with the operation of the Platform or the sale of goods, Data Subjects may contact the Company using the following details:

Beamax Global General Trading LLC

Address: Shop No. 10, Bahar 2, Jumeirah Beach Residence, Dubai, United Arab Emirates

Email: support@nlstar.ae

11.2. Scope of Requests. Requests and inquiries submitted to the Company under this Policy shall be limited to personal data processed by the Company in its capacity as the operator of the Platform and the seller of goods.

Where a request relates to personal data processed by an independent third-party service provider acting as a separate data controller, including referral or consultant program operators, the Data Subject shall contact the relevant third party directly in accordance with its applicable privacy notice.

11.3. Handling of Requests. The Company shall review and respond to requests submitted under this Policy within a reasonable timeframe and in accordance with applicable UAE data protection laws. The Company may request additional information to verify the identity of the Data Subject before responding to a request.

11.4. Complaints. If a Data Subject believes that their personal data processed by the Company has been handled in violation of applicable data protection laws, they may submit a complaint to the Company using the contact details above. The Company will make reasonable efforts to review and address such complaints in a timely manner.

11.5. Regulatory Complaints. Without prejudice to any other rights, Data Subjects have the right to lodge a complaint with the competent data protection authority in the United Arab Emirates in respect of the processing of their personal data by the Company, in accordance with applicable law.

 

Section 12. Changes to the Policy

The Company may update this Platform Privacy Policy from time to time to reflect changes in its data processing practices, applicable laws, or operational requirements.

Any amendments to this Policy shall be published on the Platform and shall become effective as of the date indicated as the “Last updated” date at the beginning of this Policy.

Where required by applicable law, or where the changes materially affect the rights of Data Subjects, the Company will take reasonable steps to notify Data Subjects of such changes in advance through the Platform or other appropriate means.

Continued use of the Platform after the effective date of an updated Policy constitutes acknowledgment of the updated Policy, to the extent permitted by applicable law.

 

ACKNOWLEDGMENT

By accessing or using the Platform, or by otherwise providing personal data to the Company, Data Subjects acknowledge that they have been informed of the processing of their personal data in accordance with this Platform Privacy Policy.

 

Where the processing of personal data is based on the Data Subject’s consent under applicable law, such consent is provided separately and may be withdrawn at any time in accordance with this Policy and applicable legal requirements.

 

Effective Date: 01/01/2025

Last Updated: 01/01/2025