Privacy Notice

1. Introduction

MELEK GUR LLC-FZ (“we”, “us”, “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Notice explains how we collect, use, store, and protect personal data when you interact with melekgur.com and our services, and outlines your rights under applicable data protection law.

As a UAE-registered business, our primary legal framework is UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, as amended, together with its Executive Regulation, Cabinet Decision No. 33 of 2024 (together, the “UAE PDPL”). Where we process personal data of individuals located in the European Union or European Economic Area, we also apply the General Data Protection Regulation (EU) 2016/679 (“GDPR”), as described in Section 15.

“Personal data” means any information that identifies you or can be used to identify you, directly or indirectly.

2. Data Controller

For the purposes of applicable data protection law, the data controller is:

MELEK GUR LLC-FZ
Registered in the United Arab Emirates
Company registration number: 2535358
Email: [email protected]

3. Scope of This Privacy Notice

This Privacy Notice applies to all personal data collected through:

• Our website
• Contact and enquiry forms
• Coaching services
• Email communications
• Marketing communications (where consented)
• Payment processing

4. Personal Data We Collect

Information you provide directly

• Full name
• Email address
• Telephone number (including country code)
• Country of residence
• Job title, role, or company (where provided)
• Reason for contacting us or enquiry details
• General lifestyle, dietary, or wellbeing preferences you choose to share as part of coaching (see Section 8)

Payment-related data

• Payment transaction details (processed securely by third-party payment providers; we do not store full payment card details)

Technical data

• IP address
• Browser type and version
• Device information
• Time zone and approximate location
• Website usage and interaction data

We do not operate a mobile application, group chat, or wearable device integration.

5. How We Collect Personal Data

We collect personal data when you:

• Submit a contact or enquiry form
• Communicate with us by email
• Purchase coaching services
• Opt in to receive marketing communications
• Browse our website (via cookies and similar technologies)

6. Purposes of Processing, Legal Basis, and Retention

Where personal data is no longer required for these purposes, it is securely deleted or anonymised unless a longer retention period is required by law.

7. Marketing Communications

We will only send you marketing communications if:

• You have explicitly consented, or
• We are otherwise permitted to do so under applicable law

Where permitted, and subject to appropriate safeguards, we may also rely on legitimate interests to contact individuals who have previously engaged with us about similar services (“soft opt-in”). You may object to this at any time.

We do not engage in automated profiling or third-party advertising based on behavioural tracking.

You may unsubscribe at any time using the link provided in our communications or by contacting us directly.

8. Wellbeing and Health-Related Information

Our services are coaching-based and do not constitute medical, clinical, or diagnostic care. We do not collect or request clinical health data, medical records, laboratory results, or diagnostic information.

In the course of coaching, you may voluntarily choose to share general information relating to your lifestyle, diet, sleep, stress, or wellbeing goals. Depending on applicable law, some of this information may be treated as sensitive personal data.

Where this applies, we process it only where:

• You have entered into, or are in the process of entering into, a coaching relationship with us; and
• The processing is strictly necessary to provide personalised coaching support; and
• You have given explicit, separate consent for this specific purpose, distinct from your general acceptance of these policies

Explicit consent is obtained through a clear, affirmative action (for example, a dedicated consent checkbox or written confirmation), following a clear explanation of what is collected and why. Records of consent, including the date, method, and scope, are retained for compliance purposes.

You may withdraw this consent at any time. Withdrawal may limit our ability to provide personalised coaching, but does not affect the lawfulness of processing carried out before withdrawal.

This information is not combined with external data sources, used to predict health outcomes, or used for any automated decision-making (see Section 9). It is retained for a maximum of six months after your last active engagement with our services, after which it is securely deleted or anonymised.

9. No Automated Decision-Making or Profiling

We do not engage in:

• Automated decision-making that produces legal or similarly significant effects
• Automated profiling based on wellbeing or sensitive personal data
• Systematic evaluation or categorisation of individuals based on health-related characteristics

All coaching guidance is developed manually, on an individual basis, by Melek Gür or her team.

10. Third-Party Service Providers

We do not sell your personal data.

We share personal data with carefully selected third-party service providers who support our business operations, acting as data processors under our instructions, including:

• Website hosting and infrastructure — [confirm current provider] — see provider privacy policy
• Payment processing: Stripe — https://stripe.com/privacy (Stripe acts as an independent controller for its own compliance and fraud-prevention purposes)

We may also disclose personal data where required by law, to regulatory authorities, or in connection with a corporate transaction such as a merger, acquisition, or asset transfer, subject to confidentiality safeguards.

11. International Data Transfers

Your personal data may be transferred to, and processed in, countries outside the United Arab Emirates and, where relevant, outside the European Economic Area, including the United States, where certain service providers are located.

Where such transfers occur, we rely on appropriate safeguards, which may include:

• Standard contractual clauses recognised under the UAE PDPL, or the EU Standard Contractual Clauses adopted under Article 46 GDPR
• An assessment of the data protection standards of the destination country
• Technical safeguards such as encryption in transit and at rest, and organisational safeguards such as access controls and confidentiality obligations

A copy of the EU Standard Contractual Clauses is available at: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj

12. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or disclosure, including encryption and access controls.

Access to personal data is limited to those who require it for legitimate business purposes.

13. Your Data Protection Rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your data
• Restrict our processing of your data
• Receive your data in a portable format, where technically feasible
• Object to processing based on legitimate interests, including direct marketing
• Withdraw consent at any time, without affecting the lawfulness of prior processing
• Not be subject to a decision based solely on automated processing (see Section 9)

To exercise any of these rights, contact us at [email protected]. We may request additional information to verify your identity before responding, and will do so within the timeframe required by applicable law.

14. Right to Lodge a Complaint

If you are located in the UAE, you may lodge a complaint with the UAE Data Office, the federal authority responsible for personal data protection.

If you are located in the European Union or European Economic Area, you may lodge a complaint with the supervisory authority of your habitual residence, place of work, or place of the alleged infringement. A list of EU/EEA supervisory authorities is available at: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

15. Application of the GDPR

Although MELEK GUR LLC-FZ is established in the United Arab Emirates, the GDPR may apply to our processing of personal data to the extent that it relates to:

• The offering of coaching services to individuals located in the EU/EEA, whether paid or unpaid; and/or
• The monitoring of the behaviour of individuals located in the EU/EEA, insofar as that behaviour takes place within the EU/EEA; and/or
• Marketing or outreach activities intentionally directed at individuals located in the EU/EEA

Where the GDPR applies, we process personal data in accordance with Article 3(2) GDPR and honour the applicable legal bases and data subject rights described in this Notice.

Based on the limited and occasional nature of our EU/EEA-facing processing, we do not currently process special category data at scale and are not required to appoint an EU representative under Article 27(2)(a) GDPR. This position will be reviewed if our EU-facing activities expand.

16. Cookies

Our website uses cookies and similar technologies. Please refer to our separate Cookie Policy for further details, which forms part of this Privacy Notice.

17. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in law, technology, or our practices. The “Last updated” date indicates the most recent revision.

18. Contact

If you have any questions about this Privacy Notice or our data protection practices, please contact:

MELEK GUR LLC-FZ
Email: [email protected]