COOKIE POLICY
1. Introduction
SB Global Technologies L.LC-FZ (Formation #2646361) A company duly incorporated in UAE, with its registered office at Maydan Grandstand 6th floor Maydan road, Nad Al Sheba Dubai UAE ("we", "us", or "our") operates an online B2B listing marketplace (the "Platform") that enables sellers The Platform enables users to publish, browse, search, and communicate in relation to listings and opportunities concerning medical equipment, equipment services, logistics and customs solutions, business solutions, and businesses offered for sale. The Platform facilitates connections and information exchange between users but does not process payments, handle transactions, act as a broker, agent, distributor, escrow provider, or take custody of any goods, funds, or assets. We do not process clinical health data, patient records, or any data regulated under Federal Law No. 2 of 2019 on the Use of ICT in Health Fields.
This Cookie Policy explains what cookies and similar technologies we use on the Platform, why we use them, what personal data they collect about you as a user, and how you can control them. It is issued in compliance with:
- Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ( "UAE PDPL") and its Executive Regulations (Cabinet Decision No. 83 of 2022 and Cabinet Decision No. 111 of 2023);
- Federal Decree-Law No. 14 of 2023 on Trading through Modern Technology ("E-Commerce Law"), which applies UAE data protection obligations to platforms registered in the UAE.
The personal data we collect through cookies relates to how professional users interact with the Platform. It does not include health data, patient information, or clinical records of any kind. Accordingly, the Health ICT Law (Federal Law No. 2/2019) does not govern our cookie practices, though it may govern the activities of healthcare facility users operating on the Platform in their own right.
Where cookies process personal data, your explicit affirmative consent is required before they are placed, except for strictly necessary cookies. Continued browsing or inactivity does not constitute consent under the UAE PDPL.
2. What Are Cookies
Cookies are small text files stored on your device (computer, tablet, or mobile phone) when you visit our Platform. We also use similar technologies including session tokens, local storage objects, and web beacons. All such technologies are referred to collectively as "cookies" in this Policy.
Where a cookie collects data that can identify you directly or indirectly — such as a device identifier, IP address, or browsing behaviour tied to your account - that data constitutes personal data under Article 1 of the UAE PDPL and is subject to its full protections.
3. Legal Basis for Using Cookies
Under Article 6 of the UAE PDPL, consent must be freely given, specific, informed, unambiguous, and obtained through a clear affirmative act. The UAE PDPL does not recognise "legitimate interest" as a standalone lawful basis in the same manner as the EU GDPR; we do not rely on that basis. Our lawful bases are as follows:
Lawful Basis | Application | Cookie Types Covered |
Explicit Consent | All non-essential cookies. Obtained via the Cookie Preference Centre before any such cookie is set. | Analytics, Advertising, Preference |
Contractual Necessity | Cookies required to provide the Platform service you have requested, including login sessions and listing management. | Strictly Necessary |
Legal Obligation | Cookies used to meet obligations under UAE law, including fraud detection and security logging. | Security / Fraud Prevention |
4. Categories of Cookies We Use
Category | Purpose | Consent Required? |
Strictly Necessary | Essential for the Platform to function. Enables seller login, listing management sessions, buyer browsing sessions, and security controls. Cannot be disabled. | No |
Preference / Functionality | Remembers your settings across visits, such as language, display preferences, and saved search filters. | Yes |
Analytics | Collects data on how users interact with the Platform (pages visited, time on page, navigation paths) to help us improve performance and usability. We use Google Analytics with IP anonymisation enabled. | Yes |
Advertising | Used to show relevant advertisements about the Platform to users who have previously visited. At present these tools are planned but not yet active. This section will be updated when activated. | Yes |
The Platform uses advertising, analytics, remarketing, and targeting tools provided by Meta, Google, and other advertising partners. These technologies may use cookies, pixels, SDKs, device identifiers, and similar tracking technologies to analyze user behavior, measure advertising performance, personalize content, and deliver targeted advertisements across websites, applications, and social media platforms.
Where required under applicable law, non-essential advertising and targeting technologies are activated only after obtaining the user’s consent through the Cookie Preference Centre.
5. Specific Cookies in Use
The table below lists the cookies currently deployed on our Platform. This table is updated following each cookie audit, which we conduct at minimum every six months and after any material change to the Platform.
Cookie Name | Provider | Duration | Purpose | Category |
_session_id | Medsahra | Session | Maintains authenticated user session (User login) | Strictly Necessary |
_csrf_token | Medsahra | Session | Cross-site request forgery protection | Strictly Necessary |
cookie_consent | Medsahra | 12 months | Records user cookie preferences and consent timestamp | Strictly Necessary |
lang_pref | Medsahra | 12 months | Stores user language and display preference | Preference |
search_filters | Medsahra | Session | Remembers active listing search filters within a session | Preference |
_ga | 24 months | Distinguishes users for Google Analytics reporting (IP anonymised) | Analytics | |
_gid | 24 hours | Distinguishes users for Google Analytics reporting | Analytics | |
_gat | 1 minute | Throttles Google Analytics request rate | Analytics | |
[Ad cookie name] | [Ad Provider] | [Duration] | [Purpose — populate when advertising tools are activated] | Advertising |
6. Platform Infrastructure and Cross-Border Data Transfers
6.1 Hosting on Amazon Web Services (AWS)
Our Platform is hosted on Amazon Web Services (AWS). The AWS region in which your personal data is stored is: Frankfurt, Germany
AWS acts as a data processor on our behalf. We rely on AWS's Data Processing Addendum and standard contractual clauses as the transfer mechanism for any personal data processed outside the UAE. AWS's data protection commitments are documented at: https://aws.amazon.com/compliance/data-privacy/
6.2 Third-Party Cookie Providers — Transfer Table
The following table sets out each third-party cookie provider, the country in which they process data, and the transfer mechanism we rely upon under Article 22 of the UAE PDPL:
Provider | Service | Processing Location | Transfer Mechanism |
Amazon Web Services (AWS) | Platform hosting and data storage | Frankfurt Germany | AWS Data Processing Addendum incorporating standard contractual clauses |
Google LLC | Google Analytics (with IP anonymisation enabled) | United States (primarily) | Google Analytics Data Processing Terms incorporating standard contractual clauses. IP anonymisation is enabled to minimise personal data transmitted. |
Meta | Advertising / retargeting | United States | Meta Data Processing Terms and applicable cross-border transfer mechanisms incorporated into Meta’s Business Tools Terms. |
Where no adequacy decision has been issued by the UAE Data Office for the destination country, we rely on the contractual safeguards described above. We will update this table as new tools are activated or transfer mechanisms change.
7. Consent: Collection, Logging, and Withdrawal
7.1 How We Obtain Consent
When you first visit the Platform, a Cookie Consent Banner is displayed before any non-essential cookies are set. You must actively select your preferences and confirm — pre-ticked boxes, continued scrolling, or inactivity do not constitute consent under Article 6 of the UAE PDPL. You may accept all, reject all, or choose by category.
7.2 Consent Records and Audit Log
In accordance with Article 6 of the UAE PDPL — which requires us to be able to prove consent — we maintain a documented consent log for every user. Each record captures:
- A unique Consent ID
- Date, time, and timestamp of consent
- Version of this Cookie Policy displayed at the time
- Cookie categories accepted or declined
- Pseudonymised device or session identifier
- Method by which consent was given
Consent records are retained for a minimum of five years and will be made available to the UAE Data Office upon request.
7.3 Withdrawing Consent
You may withdraw or modify your consent at any time by clicking "Cookie Settings" in the footer of the Platform. Upon withdrawal: (a) no new non-essential cookies will be placed; and (b) non-essential cookies already on your device will be deleted within [specify your technical timeframe — e.g., immediately / within 24 hours]. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Access to the Platform will not be made conditional on accepting non-essential cookies.
7.4 Browser and Third-Party Controls
You may also manage cookies through your browser settings or via:
- Google Analytics Opt-Out: https://tools.google.com/dlpage/gaoptout
- Google Ads Settings: https://adssettings.google.com
- Your Online Choices (EDAA): https://www.youronlinechoices.com
8. Third-Party Processors and Data Processing Agreements
- The Platform currently uses advertising, analytics, remarketing, and targeting technologies provided by Meta and other advertising partners. These technologies may use cookies, pixels, SDKs, device identifiers, and similar tracking tools to analyze user behavior, measure advertising performance, personalize content, and deliver targeted advertisements across websites, applications, and social media platforms.
- Where required under applicable law, the Platform obtains users’ consent before activating non-essential advertising or targeting technologies.
Privacy documentation for current providers:
9. Analytics and Profiling
We use Google Analytics to understand how users navigate the Platform — for example, which listing categories are most visited, how users search, and where drop-off occurs. This helps us improve the Platform's usability and listing experience for both sellers and buyers.
Google Analytics is configured with IP anonymisation enabled, which means your full IP address is truncated before it is stored or processed by Google. The data collected is used in aggregate and pseudonymised form. We do not use analytics data to build individual behavioural profiles for commercial targeting at this stage.
We confirm that cookies used on the Platform do not collect or infer sensitive personal data as defined under the UAE PDPL (such as health status, religious beliefs, biometric data, or political opinions). Browsing behaviour on a medical equipment listing platform represents commercial procurement activity and does not constitute health data about the user.
10. Your Rights Under the UAE PDPL
As a data subject under the UAE PDPL, you have the following rights in relation to personal data collected through cookies. We will respond to all verified requests within 30 calendar days. Where a request is complex, we will notify you of an extension (up to a further 30 days) within the initial period. We will not charge a fee, and we will not require you to create an account to submit a request.
Right to be Informed: To receive clear information about our cookie practices — this Policy fulfils that obligation.
Right of Access: To request a copy of personal data we hold about you collected via cookies, including your consent log record.
Right to Rectification: To request correction of inaccurate personal data collected via cookies.
Right to Erasure: To request deletion of personal data collected via cookies, subject to any overriding legal retention obligation.
Right to Data Portability: To receive your personal data in a structured, machine-readable format.
Right to Withdraw Consent: To withdraw consent to non-essential cookies at any time via the Cookie Preference Centre, without detriment.
Right to Object to Direct Marketing: To object to processing for direct marketing or advertising purposes. We must honour this immediately without requiring justification.
Right to Restrict Processing: To request restriction of processing in certain circumstances, including while another request is pending.
Right to File a Complaint: To lodge a complaint with us at (legal@medsahra.com) and/or the UAE Data Office at https://www.uaedataoffice.gov.ae if you believe your rights have been violated.
11. Data Retention
Session cookies are deleted when you close your browser. Persistent cookies remain on your device for the duration specified in Section 5, or until you delete them manually.
Personal data collected through cookies is retained only as long as necessary for the stated purpose. Consent records are retained for five years to demonstrate compliance with Article 6 of the UAE PDPL. Security and fraud-prevention logs are retained for the period required by applicable UAE law. Analytics data held by Google is subject to Google's own retention settings, which we have configured to 5 Years
12. Data Breach Notification
In the event of a personal data breach involving cookie-collected data, we will comply with our notification obligations under the UAE PDPL and Cabinet Decision No. 111/2023, including:
- Notifying the UAE Data Office within the prescribed timeframe;
- Where the breach poses a high risk to affected users, notifying them without undue delay;
- Maintaining an internal breach register documenting the breach, data categories affected, and remedial action taken.
If you believe your personal data has been compromised, please contact our legal department immediately using the details in Section 10.
13. Children
Our Platform is a professional B2B marketplace and is not directed at individuals under the age of 18. We do not knowingly collect personal data from children via cookies. If we become aware that such data has been collected, we will delete it promptly.
14. Updates to This Policy and Version History
We may update this Policy to reflect changes in the cookies we use, applicable UAE law, or our Platform's technical infrastructure. Material changes will be communicated via a prominent notice on the Platform at least 14 days before taking effect. All prior versions are archived and available on request.