Privacy Policy

For the purposes of this Policy, the data controller responsible for personal data processed in connection with the Site and related business development activities is Gulf Stone for Trading, with its principal correspondence address at P.O. Box 112, P.C. 111, Bousher, Muscat, Sultanate of Oman.

For privacy requests, questions about this Policy, or to exercise applicable rights, contact us at [email protected], by telephone at +968 9113 9979, or via our contact page. We may require reasonable verification of identity before fulfilling certain requests.

This Policy applies to personal data we process about visitors and users of the Site, prospective and existing clients, suppliers, carriers, and commercial counterparties, professional advisers, and individuals who communicate with us (including in connection with administrative services, logistics, equipment, IT, or auto spare parts). It does not govern employee or applicant data to the extent covered by separate internal policies, or data processed solely on behalf of clients as a processor under a written agreement (in which case the client's privacy notice will typically apply).

We process personal data only where permitted by law. Depending on the context, this may include:

• Performance of a contract or pre-contractual steps — to respond to inquiries, prepare proposals, onboard clients, and deliver administrative, logistics, or trading-related services under agreed terms.
• Legitimate interests — to operate and secure the Site; manage relationships; improve services; conduct internal analytics; prevent fraud, misuse, or security incidents; defend legal claims; and pursue lawful commercial objectives, where such interests are not overridden by your rights.
• Legal and regulatory obligations — including record-keeping, tax, customs, trade compliance, anti-money laundering or sanctions screening where applicable, and responses to lawful requests from authorities.
• Consent — where required for certain cookies, electronic marketing, or other processing for which consent is the appropriate basis. You may withdraw consent at any time where processing is consent-based, without affecting prior lawful processing.

Because Gulf Stone provides services across administrative services, logistics, and equipment, IT, and auto spare parts trade, we may process personal data of representatives of corporate clients, counterparties, and service providers involved in:

• Coordinating financial administration or technology and risk-management support engagements;
• Arranging freight forwarding, customs processes, warehousing, inventory visibility, and transportation management;
• Facilitating sourcing, procurement, shipping, and supplier intelligence in connection with IT, communications equipment, machinery, and auto spare parts transactions.

Such processing is generally limited to what is necessary for contract performance, compliance, and legitimate business operations. We do not use the Site to conclude binding commodity trades without separate written agreements and know-your-counterparty procedures where required.

We may use cookies, local storage, pixels, and similar technologies to maintain session state, remember preferences, measure Site traffic, and assess campaign effectiveness. Where required by law, we will seek consent before using non-essential cookies. You can control cookies through your browser settings; disabling certain cookies may limit Site functionality.

We do not sell personal data. We may disclose personal data to:

• Service providers who host the Site, provide IT security, analytics, customer relationship tools, or communications infrastructure, subject to confidentiality and processing terms.
• Professional advisers such as lawyers, accountants, or auditors, where necessary.
• Commercial partners involved in a specific engagement (e.g., logistics subcontractors or inspection agents) where disclosure is required to perform services you request.
• Authorities or courts when required by applicable law, regulation, legal process, or governmental request.
• Successors in connection with a merger, acquisition, restructuring, or asset sale, subject to appropriate safeguards and notice where required.

Gulf Stone and its providers may process personal data in the Sultanate of Oman, other Gulf Cooperation Council states, and additional countries where we or our vendors operate (including jurisdictions with different data protection standards). Where transfers are subject to legal requirements, we implement appropriate safeguards such as contractual clauses, adequacy decisions, or other mechanisms recognized under applicable law.

We retain personal data for as long as necessary to fulfill the purposes described in this Policy, including satisfying legal, accounting, customs, trade-compliance, or reporting requirements. Retention periods vary by data category and context; for example, marketing data may be retained until you unsubscribe, while contract and transaction records may be kept for longer periods prescribed by law or legitimate business need. When retention expires, we delete or anonymize data where feasible.

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction, commensurate with the nature of the data and processing risks. No electronic transmission or storage is completely secure; we encourage you to use secure channels when sending sensitive information and to notify us promptly of any suspected compromise.

Subject to applicable law and exceptions, you may have rights to:

• Request access to personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request deletion or restriction of processing in certain circumstances;
• Object to processing based on legitimate interests;
• Receive a copy of personal data you provided in a structured, machine-readable format where technically feasible (data portability);
• Withdraw consent where processing is consent-based, without affecting prior lawful processing;
• Lodge a complaint with a competent supervisory or regulatory authority where you believe processing violates applicable law.

To exercise these rights, contact us using the details in Sections 1 and 26. We will respond within timelines required by applicable law. We may deny requests where legally permitted (for example, where processing is necessary for compliance or legal claims).

The Site and our B2B services are not directed at individuals under the age of 18 (or the higher age of majority in your jurisdiction). We do not knowingly collect personal data from children. If you believe we have collected such data, please contact us and we will take appropriate steps to delete it.

We do not use the Site to make solely automated decisions that produce legal or similarly significant effects on individuals. If that changes in the future, we will update this Policy and provide required information.

Where we process personal data in or in respect of the Sultanate of Oman, we aim to comply with the Personal Data Protection Law issued pursuant to Royal Decree No. 6/2022 and its implementing regulations, as amended or replaced from time to time ("Oman PDPL"). This includes principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability in line with regulatory guidance issued by the competent Omani authority.

Where we process personal data of individuals located in other countries—including other Gulf Cooperation Council member states, the European Economic Area, or the United Kingdom—we additionally take into account applicable local data protection statutes, sectoral rules (for example financial-services oversight where relevant to an engagement), and contractual commitments agreed with clients or counterparties.

This Policy is not an exhaustive statement of every legal obligation that may apply to a specific transaction; statutory and contractual duties may impose further requirements (for example under customs, maritime, energy-sector, or anti-money-laundering frameworks).

We may send commercial or relationship communications about Gulf Stone's services, market commentary, events, or similar topics where permitted by law. Where consent is required for electronic marketing, we will obtain it separately and clearly. You may opt out of promotional emails at any time using the unsubscribe mechanism provided or by contacting us at [email protected]; operational or transactional messages relating to an existing relationship may continue where necessary.

We may track engagement metrics (for example newsletter opens or link clicks) using standard technologies, subject to this Policy and applicable law.

In connection with equipment, IT, and auto spare parts trade, logistics, and cross-border services, we may conduct or participate in compliance screening (including sanctions, export-control, and trade-embargo checks), credit or counterparty due diligence, and verification of corporate representatives. This may involve processing identification data, ownership information, watch-list matches, and transaction-related details obtained from you or reputable third-party sources.

We may disclose personal data to tax, customs, port, maritime, energy-sector, law-enforcement, or other regulatory bodies when required by applicable law, court order, subpoena, or legitimate regulatory request, or when necessary to protect our rights, safety, or property and that of others.

We maintain procedures designed to detect, respond to, and report personal data security incidents. Where we are required by Oman PDPL or other applicable law to notify a supervisory authority or affected individuals of a breach, we will do so without undue delay in accordance with those requirements. If you become aware of any unauthorized access to or disclosure of personal data relating to Gulf Stone, please notify us immediately at [email protected].

For personal data collected through the Site and for our own business development and client relationship management, Gulf Stone typically acts as a data controller. Where we process personal data strictly on documented instructions from a client—for example when providing outsourced administrative or logistics coordination services—and the client determines the purposes and means of processing, we may act as a data processor. In that case, the client's privacy notice and data processing agreement (if any) will govern in respect of that processing, and we will assist the client with applicable obligations where contractually agreed.

Most of our relationships are with legal entities. We routinely process personal data about directors, officers, authorized signatories, procurement and logistics contacts, compliance officers, and other representatives you designate. We may verify identities and authority using government-issued identification (where permitted), corporate extracts, powers of attorney, and reputable commercial databases.

For anti-money-laundering, sanctions, and counterparty integrity purposes, we may process information about beneficial owners, shareholders, and politically exposed persons where required or reasonably appropriate under applicable law and our risk-based policies. You warrant that any such data you supply has been obtained and shared in compliance with the laws binding your organization and that affected individuals have been informed where required.

Where we support financial administration or technology and risk-management arrangements for clients, processing may include payment contact details, invoicing metadata, limited transaction narratives, system access logs, and ticketing data. We are not a licensed bank, broker-dealer, investment adviser, or insurance undertaking unless separately authorized and disclosed; administrative support does not constitute the provision of regulated financial services unless expressly agreed in writing and permitted by law.

Client-directed processing of payroll, expense, or treasury-adjacent data is governed by the client's instructions and, where applicable, a data processing addendum. We implement access controls and segregation of duties appropriate to the sensitivity of the engagement.

Without limiting the regulatory framework described in Section 14, we endeavor to apply the following core principles drawn from the Oman PDPL framework when processing personal data in or in respect of Oman: lawfulness and fairness (processing has a valid basis); transparency (data subjects are informed through notices like this Policy where practicable); purpose limitation (data is collected for specified, explicit, legitimate purposes and not further processed in a manner incompatible with those purposes); data minimization (only adequate, relevant, and necessary data); accuracy (reasonable steps to keep data correct); storage limitation (retention aligned with purpose and law); integrity and confidentiality (appropriate security); and accountability (documentation and measures to demonstrate compliance).

Specific rights, procedures, and supervisory oversight are as prescribed by Oman PDPL and related decisions of the Ministry of Transport, Communications and Information Technology (or successor authority) from time to time. This summary does not replace the text of the law or official guidance.

This Policy is provided for transparency and compliance purposes only. It does not constitute legal advice on data protection, trade, sanctions, customs, tax, or any other specialty area. Gulf Stone does not warrant that this Policy satisfies every obligation that may apply to your organization or jurisdiction. You should consult qualified counsel and advisers regarding your own compliance programs, cross-border transfers, and sector-specific duties.

Where we process personal data about individuals located in the European Economic Area, the United Kingdom, or Switzerland (and where we qualify as a controller under applicable law), the following supplemental disclosures apply in addition to the rest of this Policy.

We may use third-party infrastructure and software to operate the Site and protect our networks. Categories of recipients may include hosting and content delivery providers, email and form delivery services, web analytics or performance monitoring tools (which may use cookies or similar technologies), security and fraud-prevention services (including web application firewalls and bot management), and backup and disaster-recovery systems. We select vendors with reasonable security practices and, where we act as controller, impose data-processing terms consistent with this Policy and applicable law.

Log files generated by servers and security tools may contain IP addresses, user-agent strings, timestamps, and request paths. We use such data to ensure integrity, investigate incidents, and comply with legal obligations—not for automated profiling of Site visitors for unrelated commercial decisions.

We may amend this Policy to reflect legal, regulatory, or operational changes. The revised version will be posted on this page with an updated "Last updated" date. Material changes may be communicated through additional means where appropriate. Continued use of the Site after changes constitutes acceptance of the updated Policy where permitted by law.

Gulf Stone for Trading — P.O. Box 112, P.C. 111, Bousher, Muscat, Sultanate of Oman. Email: [email protected]. Phone: +968 9113 9979.