Privacy Policy.

This Policy sets out, in detail, how Bygnicon Building Contracting L.L.C. collects, uses, shares, retains and protects personal information, the lawful bases on which we process it, the specific rights you hold in respect of that information, and the procedures for exercising them.

1. About This Policy

Bygnicon Building Contracting L.L.C. (“we”, “us”, “our”, or “the Company”) is committed to protecting the privacy and security of personal information. This Privacy Policy explains how Bygnicon Building Contracting L.L.C. collects, uses, discloses, retains and protects personal information about visitors to our website, prospective clients, clients, and individuals who otherwise interact with us in the course of our business.

This Policy applies to:

• The website at m2fitout.com and its sub-pages;
• Communications with Bygnicon Building Contracting L.L.C. through email, our enquiry form, or other channels;
• Engagement-related processing where Bygnicon Building Contracting L.L.C. acts as a data controller in respect of contact and relationship data in connection with construction, fit-out, engineering and design services provided to commercial, residential and governmental clients.

This Policy does not govern processing activities performed by Bygnicon Building Contracting L.L.C. as a data processor on behalf of clients under specific engagement agreements; those activities are governed by the relevant construction contract and any associated data processing terms.

2. Information We Collect

Information you provide directly

• Contact information (name, email address, company name, telephone number, job title);
• The content of communications you send us, including project briefs, site information, drawings, specifications and photographs you choose to submit;
• Information you provide during client onboarding, contractor pre-qualification, or supplier registration.

Information collected automatically

• IP address;
• Browser type, language, and device information;
• Pages visited, time spent on pages, and referring URLs;
• Cookie and similar tracking-technology data (see our Cookie Policy).

Information from third parties

We do not routinely collect personal information about you from third parties. Where this occurs (for example, where a client provides contact details for additional project stakeholders, where a consultant or sub-contractor introduces a counterparty, or where information is obtained through publicly available business directories), we will identify the source on request.

3. How We Use Your Information

We use personal information to:

• Respond to enquiries submitted through the website, by email, or through other channels;
• Provide and administer services under contracts with our clients, including construction, fit-out, engineering and design works;
• Communicate with you about your project, including scope, programme, deliverables, site coordination and invoicing;
• Manage tender, pre-qualification, supplier registration, and procurement processes;
• Operate, maintain, secure, and improve our website;
• Comply with legal, regulatory, and contractual obligations, including those arising under UAE construction, civil defence, municipality and health-and-safety regimes;
• Detect, investigate, and prevent fraud, abuse, or unauthorised access;
• Establish, exercise, or defend legal claims;
• Any other purpose disclosed at the time of collection or with your consent.

4. Legal Bases for Processing

Where we are subject to data protection laws that require a legal basis for processing — including UAE Federal Decree-Law No. 45 of 2021 concerning the Protection of Personal Data and any other applicable data protection law — we rely on the following bases:

• Consent — where you have given us specific consent;
• Performance of a contract — where processing is necessary to perform a contract with you or to take pre-contractual steps;
• Legitimate interests — where processing is necessary for our legitimate interests in operating our construction practice, balanced against your rights and freedoms;
• Legal obligation — where processing is necessary to comply with a legal obligation;
• Establishment, exercise, or defence of legal claims.

5. Sharing Your Information

We may share personal information:

• With service providers, consultants, sub-contractors, and suppliers under written agreements requiring confidentiality and data protection, to the extent necessary to deliver a project;
• With governmental authorities, municipalities, civil defence, master developers, owners’ associations, and other regulators, where required by law, contract, or project approval procedures;
• Where required by law, court order, or regulatory authority;
• In connection with the exercise or defence of legal claims;
• In connection with corporate transactions (merger, acquisition, asset sale, reorganisation);
• With your consent.

We do not sell personal information to third parties, and we do not engage in advertising-based business models that depend on data sharing.

6. International Transfers

Bygnicon Building Contracting L.L.C. is headquartered in Dubai, United Arab Emirates, and our construction operations are principally carried out within the UAE. Personal information that we collect is primarily processed within the UAE.

Where any cross-border transfer of personal information becomes necessary — for example, where a client, consultant, or supplier is established outside the UAE — we implement appropriate safeguards consistent with applicable data protection laws, including:

• Compliance with the cross-border data transfer provisions of UAE Federal Decree-Law No. 45 of 2021;
• Contractual confidentiality and data-protection undertakings with the receiving party;
• Other lawful transfer mechanisms permitted under applicable law.

7. Cookies and Tracking Technologies

We use cookies and similar technologies on this website to provide essential functionality and, with your consent, to enable analytics, personalisation, and other features. For full detail, please refer to our Cookie Policy.

8. Data Security

We maintain technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using current Transport Layer Security standards;
• Access controls limiting personal information to authorised personnel on a need-to-know basis;
• Regular review of security practices and infrastructure;
• Documented incident response procedures;
• Confidentiality obligations applicable to all personnel, sub-contractors and suppliers.

No system can guarantee complete security. We commit to notify affected individuals and relevant authorities of any personal information breach in accordance with applicable law.

9. Data Retention

We retain personal information only for as long as necessary:

• Enquiry information — typically 24 months from the date of last meaningful contact;
• Client and project records — duration of the project plus the applicable retention period required by law and the relevant contract (typically up to 10 years following project completion, reflecting decennial liability and statutory limitation periods applicable to construction works);
• Procurement, supplier and pre-qualification records — for the period necessary to administer the relationship and to satisfy tax, audit and legal requirements;
• Website analytics information — as specified in our Cookie Policy.

On expiry of the applicable retention period, personal information is securely deleted or anonymised.

10. Your Rights

Subject to applicable law, you may have the following rights:

• Access to your personal information;
• Correction of inaccurate or incomplete information;
• Deletion, subject to legal limitations;
• Restriction of processing in certain circumstances;
• Portability in a structured, machine-readable format;
• Objection to processing based on legitimate interests, including direct marketing;
• Withdraw consent at any time where processing is consent-based;
• Lodge a complaint with a competent supervisory authority.

To exercise these rights, contact us at admin@m2fitout.com. We will respond within the timeframes required by applicable law.

11. Specific Regional Rights

United Arab Emirates (Federal Decree-Law No. 45 of 2021): Data subjects in the UAE have rights of access, correction, deletion, restriction of processing, objection to automated decision-making, and the right to lodge complaints with the UAE Data Office.

Where a project or engagement involves the Dubai International Financial Centre and the personal information is processed in that context, the Data Protection Law No. 5 of 2020 of the DIFC may additionally apply, and data subjects have a right to lodge complaints with the DIFC Commissioner of Data Protection.

Where data subjects are located outside the UAE, additional data-protection laws of their country of residence may apply, and we will give those laws such effect as is required.

12. Children's Privacy

This website is not directed at children. Bygnicon Building Contracting L.L.C. does not knowingly collect personal information from individuals under the age of eighteen. If you become aware that personal information of a minor has been provided to us, please contact us so we may delete it.

13. Automated Decision-Making

Bygnicon Building Contracting L.L.C. does not use your personal information for any form of automated decision-making or profiling that produces legal or similarly significant effects on you.

14. Third-Party Links

Our website may contain links to third-party websites (for example, regulators, master developers, owners’ associations, or industry bodies). We are not responsible for their privacy practices. Please review the privacy policies of any third-party websites you visit.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will revise the “Last Updated” date at the top. Where changes are material, we will provide additional notice by appropriate means.

16. Contact Us

Questions, comments, or requests about this Privacy Policy may be directed to:

17. Complaints

You have the right to complain to a competent supervisory authority. The relevant authorities include:

• The UAE Data Office (in respect of processing subject to Federal Decree-Law No. 45 of 2021);
• The DIFC Commissioner of Data Protection (in respect of processing carried out within the DIFC under DIFC Law No. 5 of 2020).

We encourage you to contact us first so that we may address your concerns directly.

This Privacy Policy is published in English. Where a translation is provided for convenience, the English version prevails in the event of any inconsistency. Nothing in this Privacy Policy creates rights or obligations beyond those provided under applicable law.