PRIVACY POLICY

"Extra Co Group" ("Extra Co Group", "we", "us", or "our") is a trading and marketing name used to present a unified brand identity for a group of independently licensed companies under common ownership. It is not itself a separate registered legal entity. This Privacy Policy explains how the licensed entities operating this website (extraco.ae) collect, use, and safeguard your personal data when you interact with our services in the United Arab Emirates.

The services offered through this website are provided by independently licensed UAE companies operating under the Extra Co Group brand, namely Extra Co Fibreglass and Prefab Houses LLC and Extra Co Industries LLC. Each company is separately registered, issues its own contracts, invoices, and official business documents under its own trade name, and remains solely responsible for its own legal, financial, and regulatory obligations. References to "Extra Co Group" on this website are for branding purposes only and do not imply that the Group itself is a legal entity capable of entering into contracts.

This policy is designed to comply with the UAE Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data (PDPL) and its Executive Regulations, and other applicable regional regulations. We process data with the highest standards of integrity and security.

We may collect personal identifiers (name, email, phone number), professional information (company, job title), recruitment data (CVs, employment history, and qualifications where you apply for a role with us), technical data (IP address, browser type, device information), and usage data (how you use our website, including cookies and analytics).

Your data is processed to provide engineering services, respond to enquiries, process job applications, send technical brochures and marketing communications (with your consent), improve website performance, and comply with legal obligations in the UAE. We only process personal data where we have a valid lawful basis to do so under the PDPL, including: your consent; the necessity of processing to perform a contract with you or to take steps at your request prior to entering into a contract; compliance with a legal obligation to which we are subject; or our legitimate interests, provided such interests are not overridden by your fundamental rights and freedoms.

The Company retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or for such longer period as may be required under the applicable laws and regulations of the United Arab Emirates. Once the applicable retention period expires, personal data is securely deleted or anonymized. Our indicative retention periods are as follows:

• Contact enquiries: 24 months from the date of the last interaction.
• Project enquiries: 36 months from the date of the last interaction.
• Unsuccessful job applicants' CVs and recruitment records: 12 months from the date of application.
• Successful employees' personnel files: for the duration of the employment relationship and thereafter for the period required under applicable UAE laws and regulations.

We may share personal data with service providers, affiliated companies, or entities that provide technical or operational services, to the extent necessary to fulfil legitimate purposes and in compliance with the UAE Federal Decree-Law No. 45 of 2021 and its Executive Regulations. This may include:

• Hosting service providers.
• Email service providers.
• Analytics companies.
• Recruitment service providers.
• Companies affiliated with, or operating under, the Extra Co Group brand.

Some of our service providers, including hosting providers, analytics tools (such as Google Analytics), and email service providers, may be located outside the United Arab Emirates. Where this is the case, personal data may be processed or stored outside the UAE in accordance with the legal safeguards stipulated under the UAE Personal Data Protection Law and its Executive Regulations.

Our website uses cookies and similar technologies to operate the site and improve your experience. We use the following categories of cookies:

• Essential Cookies: necessary for the operation and core functionality of the website.
• Analytics Cookies: used to measure website performance and collect statistics.
• Marketing Cookies: used for marketing and advertising purposes.
• Preference Cookies: used to save and remember your preferences and settings.

When you first visit our website, you will be asked to accept or decline the use of non-essential cookies via our cookie banner. You can change your preference at any time by clearing your browser's stored site data or by contacting us at info@extraco.ae.

We implement enterprise-grade technical and organizational measures, including encryption and secure servers, to protect your data from unauthorized access, loss, or alteration.

Under the UAE PDPL, you have the right to:

• Access your personal data.
• Request rectification of inaccurate or incomplete data.
• Request erasure of your data (right to be forgotten).
• Restrict or object to the processing of your data.
• Withdraw your consent at any time.
• Object to processing based on automated decision-making.
• Lodge a complaint with the UAE Data Office, the competent authority for data protection in the UAE, if you believe your personal data has been processed in violation of applicable law.

The Company does not currently make decisions that significantly affect individuals based on automated processing of personal data without human intervention. Should automated processing technologies be introduced in the future, this Privacy Policy will be updated accordingly and data subjects will be granted their relevant rights in relation to such processing.

Where our processing of your personal data is based on your consent, you may withdraw that consent at any time by contacting us at info@extraco.ae. Withdrawing your consent will not affect the lawfulness of any processing carried out prior to such withdrawal, and may affect our ability to continue providing certain services to you.

You may request the deletion of your personal data by contacting our dedicated data protection contact at info@extraco.ae. To protect your data against unauthorized disclosure or deletion, we may require reasonable information or supporting documentation to verify your identity before processing your request. This same process applies to requests for access to, correction of, or restriction of processing of your personal data.

• We will generally grant a deletion request where the personal data is no longer necessary for the purpose for which it was collected, where you withdraw your consent and there is no other lawful basis for processing, where your personal data has been processed unlawfully, or where deletion is required to comply with applicable law.
• We may refuse a deletion request, in whole or in part, where retention is necessary, including for compliance with a legal or regulatory obligation, to establish, exercise, or defend legal claims, to comply with accounting, tax, or other statutory record-keeping requirements, for the performance or enforcement of a contractual obligation, or under any other exception permitted under the PDPL or other applicable laws.

We will notify you of the outcome of your request. Where a request is refused, in whole or in part, we will provide the reasons for the refusal, unless otherwise prohibited by applicable law.

The Company has assessed its data processing activities against the criteria set out in Article 10 of the PDPL and its Executive Regulations and has determined that the appointment of a dedicated Data Protection Officer is not currently required. We have nonetheless designated a data protection contact point to handle privacy-related enquiries and requests. For any questions regarding this Privacy Policy, to exercise any of your rights described above, or to submit a data deletion, access, correction, restriction, or consent withdrawal request, please contact the relevant licensed entity — Extra Co Fibreglass and Prefab Houses LLC or Extra Co Industries LLC — at info@extraco.ae, or visit our headquarters in Al Sajaa Industrial Area, Sharjah, UAE. Should the Company become required to appoint a Data Protection Officer due to the nature or volume of its data processing activities, this Privacy Policy will be updated with the Officer's identity and contact details.