Privacy Notice

ICAN is established in the UAE and applies Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data (the “UAE PDPL”) as its primary corporate privacy baseline where applicable.

Additional privacy laws may apply to particular processing depending on the circumstances — for example the EU GDPR or UK GDPR, where their territorial-scope tests are met.

The fact that a person lives in the EU, or that data is hosted in the EU, does not by itself mean every ICAN processing activity is governed by the GDPR.

Account and contact data. Name, business email, personal or business email where supplied, phone number, organisation, role, user permissions and account identifiers.

Expert profile data. City, country of residence, citizenship where relevant, CV, work history, years of experience, expertise, industries, languages, certifications, indicative rates and earliest availability.

Contracting and identity data. When there is a genuine contracting need: passport or other approved identity-document data, principal address, agreement information and, where required, a photograph used for identity and contract administration.

Engagement and commercial data. Opportunities, engagement assignments, rates, fees, invoices, payment information, session records where applicable, expenses, deliverables and project administration.

Signature and acceptance evidence. Typed name, the exact attestation or acceptance text, document version, document hash and integrity information, timestamp, IP address, browser user-agent and other audit evidence associated with the signing event.

Security and technical data. Login and authentication events, IP address, device and browser information, security alerts, access logs and activity needed to protect the portal.

Communications. Messages, support requests and other correspondence with ICAN.

Optional marketing material. Only where you affirmatively agree: professional designation, short professional description, biography, photograph, quotation or testimonial.

We use personal data to create and administer portal accounts; maintain and assess ICAN’s expert network; identify and contact experts for suitable opportunities where permitted; take steps relating to potential engagements and administer signed engagements; verify identity when contracting; and generate, sign, retain and evidence agreements.

We also use it to share an expert profile with a relevant client where that is part of the opportunity process and permitted; administer services, projects, sessions, deliverables, expenses, invoices and payments; protect client and ICAN confidential information; secure the portal, prevent misuse and investigate suspected fraud or security incidents; comply with legal, regulatory, tax, accounting and audit obligations; establish, exercise or defend legal claims; and improve the operation and reliability of ICAN’s systems using appropriately limited operational data.

Professional or promotional material is used for proposals or marketing only where the required affirmative permission has been obtained.

Contract and pre-contract steps. We process information reasonably necessary to take requested steps toward an engagement, enter into an MCA or other agreement, and perform and administer that relationship.

Legal obligations and legal claims. We retain and use information where necessary to meet applicable legal, tax, accounting, compliance and recordkeeping duties, or to establish, exercise or defend legal claims.

Consent or affirmative permission. Used where appropriate — including retaining a Stage 1 expert profile in ICAN’s general network where there is no specific active opportunity, proposal and capability use, and public promotional use of biography, photograph or testimonial. Where processing is based on consent you may withdraw it for future processing; withdrawal does not make earlier lawful processing unlawful, and does not require deletion of records ICAN must keep on another lawful basis.

Legitimate interests where applicable. Where the law applying to the specific processing permits it, ICAN may rely on legitimate interests such as platform security, fraud prevention, business administration and protecting legal rights, after considering the effect on the individual.

Where ICAN asks you to opt into its general expert network, the exact permission shown at collection is:

“I agree that ICAN may keep and use my profile, CV, rate expectations and availability to assess me for and contact me about suitable consulting opportunities. I can withdraw this permission at any time. If I do not enter into an engagement, ICAN will delete or ask me to refresh this information after 24 months of inactivity.”

The box is off by default.

ICAN’s normal process is not to request a passport at profile stage. We request a passport or other approved identity document only when there is a genuine reason to contract or verify identity.

At the upload step we display: ICAN collects your passport copy only once an MCA is ready for signature, to verify identity, administer and evidence the contractual relationship, meet applicable compliance requirements, and prevent or defend against fraud or disputes. It is not used for marketing. It is stored in ICAN’s restricted-access EU-hosted environment and retained only for the period stated in this Privacy Notice.

Passport access is restricted. A general ability to view an expert profile does not give a user permission to view the passport.

Depending on the purpose, data may be shared with authorised ICAN personnel who need access for their role; relevant client organisations, for example when an expert is being considered for or is delivering an engagement; service providers that operate infrastructure or support functions for ICAN and are subject to appropriate contractual and security duties; professional advisers, auditors, insurers or authorities where reasonably necessary and lawful; and other recipients where you direct or authorise the disclosure.

We do not sell personal data to advertisers.

ICAN is established and operated in the UAE.

The portal database and private document storage are hosted in the European Union, in Frankfurt, Germany, using Supabase infrastructure.

Authorised ICAN personnel may access data from the UAE and other authorised operating locations. Relevant clients and service providers may also receive or access information from their locations when necessary for the permitted purpose.

ICAN uses contractual, security and other safeguards appropriate to the applicable law. If GDPR or UK GDPR applies to a transfer, ICAN and the relevant exporting organisation will use an applicable transfer mechanism where required.

For personal data ICAN processes as a processor on a client’s instructions, the service providers involved are listed in the subprocessor register.

ICAN does not keep personal data indefinitely merely because it may be useful. Our schedule is:

Stage 1 expert profile, no MCA and no engagement — 24 months from the last substantive activity or profile refresh, unless you renew the permission, there is an active opportunity, or another lawful retention reason applies.

Passport where an MCA was signed but never deployed — the image is deleted 24 months after the MCA terminates or expires, unless a legal hold, active dispute or regulatory duty applies. Minimal identity-verification metadata may be kept with the legal record where justified.

Passport after deployment — the full image is deleted 24 months after the later of MCA termination or expiry, the last engagement end date, or final payment, unless a documented legal, client or regulatory requirement applies.

Signed MCA and signature evidence — 7 years after the later of MCA termination or expiry, the last engagement end date, or final payment.

Tax and accounting records — at least 7 years following the end of the relevant tax period, or longer where the law requires.

Security and access logs — normally 24 months, unless linked to a security incident, dispute, investigation or legal hold.

A deletion timer is suspended only for data reasonably relevant to a documented legal hold, which is released when no longer needed.

Subject to applicable law and relevant exceptions, you may have rights to receive information about how your personal data is processed; access personal data held about you; correct inaccurate or incomplete data; request deletion; restrict or object to certain processing; object to direct marketing; withdraw consent where consent is the basis; receive or transfer data in a structured, machine-readable form where a portability right applies; and complain to the competent data-protection authority where that right is available.

To exercise a right, contact privacy@icanmena.com. ICAN may verify your identity before responding.

Where ICAN holds your data only as a processor on a client’s instructions, we will direct your request to that client or forward it to them, unless the law requires otherwise.

If you withdraw from the network and ICAN has no delivery, billing, contract, security, dispute or statutory record requiring retention, ICAN may hard-delete the profile and documents.

If you have history that must remain attributable, ICAN removes non-required live-profile data but retains only the minimum information needed for the applicable contract, tax, accounting, security or legal record, until the retention period expires.

ICAN will not retain your name indefinitely solely so old analytics remain readable. After the applicable record period, personal identifiers are deleted or irreversibly anonymised where continued aggregate analytics are useful.

ICAN does not treat an MCA signature as blanket permission to use an expert in marketing.

Proposal and capability use, and public promotional use, are separate opt-ins.

You may withdraw optional marketing permission for future use by contacting ICAN, and we will stop new use after withdrawal. Material already lawfully distributed to third parties may not always be capable of full retrieval.

ICAN uses access controls, restricted private storage, logging and other technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration or disclosure.

No system can be guaranteed completely secure. Users must also protect their credentials and promptly report suspected account compromise.

The portal and expert network are intended for adults and are not directed to persons under 18.

ICAN will not introduce solely automated decision-making that produces legal or similarly significant effects on individuals without assessing the applicable legal requirements and providing any notice or safeguards required by law.

ICAN may update this Notice. Material changes will be brought to users’ attention through the portal or another appropriate channel. We will request fresh consent only where a consent-based purpose requires new or expanded permission — we do not treat general acceptance of this Notice as consent to every processing purpose.

Privacy questions and rights requests: privacy@icanmena.com. Other legal matters: legal@icanmena.com.

I C A N Management Consultancy LLC · Commercial Licence 915665 · 504 Al Nasr Plaza, Oud Metha, Dubai, United Arab Emirates.