OKKO Capital Marketplace: Privacy Policy

• OKKO Capital ("OKKO") runs an online marketplace for business and investment listings in the UAE. OKKO is not a broker, advisor or party to any deal. No funds pass through the Platform.
• We collect what you give us: account details, your listings, your responses and chat messages, consulting enquiries, a newsletter email, Telegram connections and the AI tools you connect to your account.
• Some of it is shown to others on purpose. Published listings are visible to everyone. The contact details on your listing are shown to logged-in users. When you respond to a listing, its owner receives your name and your email address.
• OKKO staff do not read chat as part of their work. The exceptions are listed in section 3.4: a reported message, a request from an authority that the law obliges us to answer, and technical work on the systems under a duty of confidentiality.
• We use service providers to run the Platform: hosting, file storage, email delivery, analytics, error monitoring, sign-in with Google or Apple, and Telegram. Some of them process data outside the UAE.
• Optional analytics (PostHog) uses cookies only after you press Accept in the cookie banner. Essential cookies, basic traffic counting and error monitoring run regardless of that choice.
• You can download your data, delete your account and unsubscribe from the newsletter yourself. See section 8.
• To ask anything about your data, or to complain, write to sales@okkocap.com. You can also complain to the UAE Data Office (section 8).

• OKKO, we, us: OKKO Capital, the operator of the Platform.
• Platform: the OKKO Capital website, its API, the OKKO Telegram bots and channel, and the AI connection ("Connect OKKO") that lets an AI tool act on your account.
• You: any person who visits or uses the Platform, with or without an account.
• Listing: a business for sale or an investment opportunity that a user publishes on the Platform.
• Response: the message and short answers a logged-in user sends to a Listing's owner through the Platform.
• Chat: the conversation the Platform opens between a Listing's owner and a person who responded.
• Administrator: an OKKO staff account. A full administrator is an Administrator with the highest access level.
• Personal data: any information about an identified person or a person who can be identified, directly or indirectly.

One account can be seller, buyer and investor at the same time. These are things you can do, not fixed roles.

The Platform is operated by OKKO Capital. For the purposes of the PDPL, OKKO is the controller of the personal data described in this policy, except where section 3 says that another user or a third-party service decides how the data is used.

Our full legal details (legal form, licence and registered address) will be added to this section when this policy is next updated.

Contact for anything in this policy: sales@okkocap.com.
Person responsible for data protection at OKKO: the Data Protection Contact, reached at the same address.

This policy explains what personal data the Platform collects, why, who sees it, how long it is kept, and what you can do about it.

OKKO is a marketplace. Users publish Listings and contact each other. OKKO is not a broker, advisor or party to any transaction, and no funds pass through the Platform. OKKO does not verify Listings, figures, users or anyone's capital and does not guarantee any outcome. This matters for privacy because much of what you enter is shown to other users as you wrote it.

This policy is written against UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL"), where it applies.

Users outside the UAE. Anyone can use the Platform from any country. If a law of the country where you live gives you more rights than this policy and applies to us, those rights apply.

Each part below says what is stored, where it comes from, and who can see it on the Platform. Section 5 lists the service providers that process it for us.

Data you must not upload. Do not upload sensitive personal data (health, religion, ethnic origin, biometric data, criminal records and the like) or identity documents (Emirates ID, passports, visas), yours or anyone else's. Do not upload personal data of other people (for example employees' names and salaries in a financial statement) unless you are allowed to share it and have told them. If you do, you are responsible for it.

3.1 Your account

• Sign-up with email and password: your email address (one account per email), your name and your password. The password is stored as a one-way hash, never in clear text. To finish sign-up you confirm your email with a code we send you. The code is stored as a hash, is valid for 15 minutes and allows 5 attempts.
• Sign-in with Google: we receive your email address, your name and your Google account identifier. We do not receive your Google profile picture.
• Sign-in with Apple: we receive your Apple account identifier and, the first time only, the name and email address Apple shares. If you use Google or Apple only, no password is stored.
• Profile fields you may fill in: phone number (optional, format check only), company name, job title, a short bio, your preferred language and a profile photo.
• Profile photo: the file is stored in public file storage under a permanent web address. Anyone who has that address can open the photo. Deleting the photo in your profile removes the file.
• Account flags: whether your email is confirmed, whether you have finished the onboarding tour, when you last looked at your Responses, and, for staff, whether the account is an Administrator and at which level.
• Password reset and email change: a reset link (valid 1 hour, single use) and an email-change code are stored as hashes. A pending new email address is stored until you confirm it. The old address receives a notice when the email changes.
• Acceptance of the Terms and this policy: when you accept them (at sign-up or when a new version is shown), we store the document, its version, the date and time, your IP address, your browser type and your language. We keep this record as proof of your acceptance, including after you delete your account (it is then no longer linked to your name or email).

Who sees it. You see everything above in your profile and account tabs. Other users see your name and photo in Chat. A Listing owner you respond to sees your name in their account and your name and email address in the email we send them (see 3.3). Administrators can see a list of all users with name, email and staff level. No public profile page shows your phone, company, job title or bio.

3.2 Your Listings

• Listing content: everything you type in the publish wizard: title, summary, description, type, sector, city (Dubai, Abu Dhabi or Sharjah), figures in AED (price or investment range, revenue, profit and similar), and dates.
• Your contact details for the Listing: phone, email, WhatsApp and Telegram, stored separately from the Listing body.
• Files: photos, videos, documents and a logo. You choose whether a document is private. Public files are stored in public file storage under permanent web addresses. Private files are stored in private storage and are opened only through links that expire after 5 minutes. A file's displayed name is, by default, the original name of the file you uploaded, so do not put personal data in file names you do not want shown.
• Moderation notes: a comment from an Administrator when a Listing is returned or edited, a pending edit waiting for a check, and the reason you give when you mark a Listing closed.
• Statistics: aggregate view and click counts for your Listing (see 3.11).

Who sees it. While the "guests see listings" setting is on (the default), anyone, including visitors without an account, search engines and the OKKO Telegram channel, can see the whole published Listing except your contact details and private files. If OKKO switches that setting off, visitors without an account see only the type, sector, city, status and dates. Logged-in users always see the full Listing.

Your contact details are shown to every logged-in user who is not you, and to anyone who has linked a Telegram account through the Listings bot (section 3.7). Anyone can open an account, and OKKO does not check who users are, so treat these details as visible to the public.

Private files are visible to you and to Administrators only. Administrators can see your Listing together with your name, email and phone. The public Listing data carries your account's random identifier, not your name or email.

After a Listing is withdrawn or removed. Withdrawing, pausing or removal changes the Listing's status. Public files stay at their web addresses, so anyone who saved an address can still open them.

3.3 Responses you send

When you respond to a Listing you choose who you are (private buyer, private investor, strategic buyer, fund or family office, broker or representative), a budget band in AED, a decision timeline, and you write a message (on the website, 10 to 4,000 characters).

Who sees it. The Listing owner sees your choices and message in their account, with your name. The owner also receives an email with the Listing title, your name, your email address, your choices and your message. Once the owner has your email address, OKKO cannot control how the owner uses it. Responding also opens a Chat between you and the owner. You can respond to the same Listing more than once. Administrators have no page that lists Responses. Responses cannot be deleted by you today.

A Listing that its owner has marked closed no longer accepts Responses.

3.4 Chat, files and reports

• Messages: text of up to 4,000 characters, who sent it, when, and when the other person read it.
• Files: JPEG, PNG, WebP or PDF files, checked by content. Limits: 10 MB per file, 5 files or 25 MB per message, 100 files or 200 MB per day. We store the file under a random key in private storage, its original name (cleaned), type, size and image dimensions.
• Reports: if you report a message, we store the reason (spam, scam or fraud, inappropriate, other), your note of up to 500 characters, who reported it, the status, and the Administrator's decision note.

Who sees it. Only the two participants can open a Chat and its files in the Platform; files open through links that expire after 5 minutes. OKKO staff do not read, monitor or check Chat as part of their work. The exceptions are:

1. Email preview. When you send a message, the other person receives an email with your name, the Listing title, the first 100 characters of your message and the number of files attached. That email goes through our email provider (section 5). So a Chat is not visible only to the two of you in the strict sense.
2. Reports. When a message is reported, a full administrator can open the reported message, its files and up to five messages before and after it, and sees the name and email of both the reporter and the reported person. Every opening is written to the audit log. The administrator decides: dismiss the report, remove the message, warn the sender, suspend the sender, or remove the message and suspend the sender. A removed message is kept as evidence, hidden from both people. The sender and the reporter receive a notice of the outcome. Other staff, such as moderators, cannot read message content.
3. Legal requests. OKKO discloses Chat content to an authority only where the law requires it.
4. Technical work. Staff who maintain the systems can technically reach stored data. They access it only when needed to keep the Platform working.

Chat messages and files cannot be deleted by users. They are kept as a record of what was said between the two parties. If either person deletes their account, the messages stay as the other person's record, without the deleted person's name.

A Chat becomes read-only when the Listing is no longer published or paused, and opens again if the Listing goes live again.

3.5 Consulting enquiries

The consulting form on the Services page collects: which audience you belong to, your name, your preferred contact channel (WhatsApp, Telegram, email or phone) and its value, your answers to short questions (sector, revenue or deal or capital band, time horizon, investor type, deal format), an optional note of up to 1,000 characters, and your language. The enquiry is not linked to a user account, even if you are logged in. An AI tool connected to your account can also send one on your behalf (section 3.8).

Who sees it. Full administrators only. Each enquiry is also emailed to the consulting addresses OKKO sets. OKKO's consulting team contacts you through the channel you chose, from OKKO's work accounts.

How we use your contact details. We use them only to answer your request and, if you become a client, to provide the consulting service. We do not use them for other marketing unless you agree to it separately.

Contact details on Listings. OKKO does not use the contact details that owners show on their Listings to offer OKKO's own services, unless the owner has agreed to that. OKKO may contact an owner about their own Listing (for example a correction or a question about it), by the account email where possible.

The consulting service is a separate paid service, described in the Terms. It is not part of publishing or browsing Listings.

3.6 Newsletter and emails

If you enter your email in the newsletter form, we store the email address, your language, where you signed up (the website, an AI tool or the email preferences page), the dates of your request and of your confirmation, and the IP address and browser of those two requests, as proof of your consent. We send you an email asking you to confirm. We send the newsletter only after you confirm. Every newsletter has a one-click unsubscribe link, and you can manage your emails on the email preferences page without logging in. When you unsubscribe, the address stays on our list marked as unsubscribed, with the date, so that we do not email you again, and we add a one-way hash of the address to a list of addresses that get no marketing email. If you delete your account, we remove the newsletter row and keep only the hash. The newsletter email address is not linked to an account.

An AI tool connected to an account can also submit an email address for the newsletter. The address still has to be confirmed by the link in the email.

Emails about your account (codes, password reset, security notices) are always sent while you have an account. Emails about your own activity (new Responses, new messages, moderation notices) are sent by default and you can switch each kind off on the email preferences page.

3.7 Telegram

OKKO runs Telegram bots and a public Telegram channel. Everything here is optional and happens only if you use them.

• News subscription (user bot): pressing Start stores nothing. When you subscribe, we store your Telegram chat identifier, your chosen language and the date. When you unsubscribe, we record the date but keep the chat identifier and language.
• Linking your Telegram to your OKKO account: you ask for a one-time code in your profile (valid 10 minutes, stored as a hash) and send it to the bot. We then store your Telegram user identifier, the link date and which bot. Linking lets the bot show you Listings as a logged-in user would see them, including owner contact details, inside Telegram. It grants nothing else. Unlinking deletes the record; the unlink is written to the audit log.
• What we never store from Telegram: your Telegram name, username, phone number or the text of your messages to the bot.
• Administrators link their Telegram the same way to receive AI news drafts and read-only counts. Their Telegram identifiers can appear in the audit log.
• The public channel: OKKO may post published news to its public channel.

Who sees it. You see your own link in your profile. Full administrators see all linked accounts with the user's name and email. Telegram itself receives the chat identifiers, the news text, the Listing cards and the public cover images we send (section 5).

3.8 AI tools and API keys

You can let an AI tool (for example an assistant such as Claude or ChatGPT) act on your account through "Connect OKKO", or create a personal API key.

• Connected AI tools: we store the tool's name and return addresses, the permission you granted (one permission, "mcp", which covers every action in the tool list), when you granted it and when it was last used. The consent page shows you the tool's name and host before you agree. Tokens are stored as hashes. A connected tool can, as you: create, edit, submit and close your Listings, upload files, read your profile (name, email, phone, company, job title, bio, photo), read your Listings and Responses, search Listings with the same visibility as the website, send a Response (which emails the owner your name and email and opens a Chat), save Listings, subscribe an email to the newsletter (see 3.6) and send a consulting enquiry. It has no Chat tools.
• What the AI provider receives. Whatever a connected tool reads from your account (including your profile and the contact details of other users' Listings that you are allowed to see) goes to the provider of that tool under your own agreement with it. OKKO does not control that provider.
• Personal API keys: we store a label, the creation date, the last-used date and a hash of the key. A key has no expiry and no narrower permissions. Besides the AI tools above, a key can read and send your Chat messages and files through the API, and read your profile.
• Revoking: you can disconnect an AI tool or revoke a key at any time in Account → API tokens. "Log out everywhere" ends your logins but does not revoke keys or AI tools. A password reset revokes logins, keys and AI tools together.

Who sees it. You see and revoke your own connections. Full administrators see the list of AI tools with how many users are connected, never which users and never any tokens.

AI news drafts. OKKO uses the Anthropic API to draft news articles from public RSS feeds. Only the public headline, excerpt, link and feed label are sent. No user data of any kind is sent to Anthropic. A member of staff edits and approves every draft before publication.

3.9 Payments

No payments are made on the Platform, so no payment data is collected.

3.10 Saved Listings

Listings you save are stored against your account and shown only to you.

3.11 Technical and usage data

• IP address and browser identity: apart from the records named in sections 3.1 (acceptance of these documents) and 3.6 (newsletter consent), never stored in a database column. They are used in memory to limit abuse (100 requests per minute per IP address) and to build the two hashes below. Our hosting providers receive them to deliver the pages (section 5). The hosting provider also tells the Platform which country a request comes from, and we use that only to choose a default display currency; it is not stored.
• Daily visitor count: once a day your browser sends a ping. We store the day and a hash of your IP address, browser identity and a secret salt that is deleted after the day. Rows are deleted after 35 days. Not done for Administrators.
• Listing click counts: when a Listing is opened from the catalog or a link, we store the Listing, the source and an unsalted hash of your IP address and browser identity (and of a visitor cookie, if your browser has one). An unsalted hash of an IP address can be matched back to that address, so we treat these rows as personal data. These rows are not deleted today.
• Exchange rates: rates are fetched by our server. If the server could not provide them, your browser fetches them directly from the rates provider, which then sees your IP address.
• Cookies, storage, analytics and error monitoring: section 6.

3.12 Records about staff and authors

• Audit log: every Administrator action (and some system jobs) is recorded with the Administrator's identifier, the action, what it targeted and notes. The log has no IP address or browser data. Any Administrator can read it.
• News: the author's name is public on a published article.
• Case studies: carry the client's business name, which is public. We publish a case study only with the client's written permission.

We use personal data only with your consent or where the PDPL allows it without consent.

We do not sell your personal data. We do not use your personal data to make automated decisions that have legal effects on you. The OKKO Rating is computed automatically, but it measures only how complete a Listing is, not a person.

Emails about your account are always sent while you have an account. Emails about Responses, messages and moderation can be switched off (section 3.6). None of these is marketing.

We do not share your personal data with anyone except: other users, as described in section 3; the service providers below, which process it for us to run the Platform; and authorities where the law requires. Where a region is not confirmed, we have not yet verified where the provider stores data.

International transfers. Most of these providers operate outside the UAE, as the Region column shows. We send them only the data needed to run the Platform. By accepting this policy you acknowledge that your data is transferred to and stored in these countries.

Backups. Before large clean-ups we take a manual database copy that is kept outside the Platform.

Professional advisers, such as lawyers, auditors and accountants, who are bound by confidentiality, where we need their advice.

Business transfer. If OKKO's business or its assets are transferred (for example in a sale or merger), personal data may pass to the new operator, which will be bound by this policy or will tell you about its own.

6.1 Your choice

The cookie banner has two equal buttons, Reject and Accept. It controls one thing: PostHog product analytics. Essential cookies, Umami traffic counting, the daily visitor ping and Sentry error monitoring run whichever button you press. Your choice is stored for one year. You can change it any time with "Cookie settings" in the footer. Switching to Reject puts PostHog into memory-only mode, resets its identifier and deletes its cookies and storage.

6.2 Cookies we set

None of these cookies is shared with other sites. A okko_vid visitor cookie is read for click counting if present, but the Platform does not set it today.

6.3 Browser storage

The Platform does not use IndexedDB, and its service worker caches nothing.

6.4 PostHog (optional analytics)

Before you choose, and after Reject, PostHog runs without cookies or storage and receives only page view and page leave events. After Accept it also records clicks and session replays. In replays all text and all form inputs are masked, and no request headers or bodies are recorded. We never tell PostHog who you are: no user identifier, name or email is sent. Web addresses are reduced to catalog filters; tokens, codes, emails and search terms are removed. PostHog is off for Administrators and on admin pages.

6.5 Umami (traffic statistics)

Umami counts page views on every page, including the maintenance page, without asking for consent. The vendor describes the script as cookieless. We have not checked that claim ourselves.

6.6 Sentry (error monitoring)

When something breaks, the browser, the website server and the API send an error report to Sentry. Reports include technical details of the request. Passwords, tokens and secrets are removed before sending; no user identifier or email is attached; no session replay. Sentry runs regardless of your cookie choice. The browser also sends content-security reports to Sentry.

We keep personal data only as long as it is needed for the purpose it was collected for, or as long as the law requires.

Withdrawing, pausing or an Administrator unpublishing a Listing changes its status; nothing is deleted. You can delete individual files from your Listing, and your profile photo, yourself.

Under the PDPL you have the right to:

• be informed about how your data is used (this policy) and who receives it;
• receive a copy of the data you gave us, in a structured, machine-readable form, and have it sent to someone else where technically possible;
• correct data that is wrong or incomplete;
• have data erased when it is no longer needed for its purpose, when you withdraw consent and no other basis applies, or when it was processed unlawfully;
• restrict processing, for example while a correction you asked for is being checked;
• object to processing, including at any time to direct marketing;
• not be subject to a decision based solely on automated processing that has legal effects on you;
• withdraw consent at any time, without affecting what was done before;
• complain to the UAE Data Office.

What you can do yourself

• See your profile and account data in the account tabs, or through an AI tool's "get my profile".
• Download a copy of your data from your account (once a day).
• Delete your account from your account settings. You confirm your identity, and the deletion takes effect after a waiting period (7 days unless we change it), during which you can cancel. Then your name, email, phone, photo, company, job title and bio are removed, your Listings and their files are removed, and your Telegram links, API keys, AI tool connections and newsletter address are removed. The chat messages, chat files and Responses you sent stay as the other person's record, shown as "Deleted account".
• Correct your name, phone, company, job title and bio; change your email (with a code to the new address) and your password; delete your profile photo.
• Withdraw, pause or close a Listing; delete single files from it.
• Switch off emails about Responses, messages and moderation, and unsubscribe from the newsletter (email preferences page).
• Change your cookie choice (footer, "Cookie settings").
• Unsubscribe from Telegram news in the bot; unlink your Telegram account in your profile.
• Disconnect an AI tool, revoke an API key, log out everywhere.

What you ask for by writing to sales@okkocap.com

• Anything above that you cannot do yourself, and any other question or complaint about your data.
• Removal of a Response or a Chat message you sent. These are kept as a record for the other person, so we decide case by case.

We may ask you to confirm your identity before we act, so that we do not give your data to someone else. We reply from the same address within 30 days.

• Passwords are stored as one-way hashes. Codes, reset links, API keys and AI tool tokens are stored as hashes.
• Login cookies cannot be read by scripts and are sent only over HTTPS in production.
• Private files and Chat files live in private storage and open only through links that expire after 5 minutes, after a check that you are allowed to see them.
• Only the two participants can open a Chat in the Platform. Staff access is limited as described in section 3.4 and is logged where the Platform supports it.
• Administrator actions are written to an audit log.
• Uploaded files are checked by content for type (image or PDF). They are not scanned for viruses. Open files from people you do not know with care.

No system is completely secure, and we cannot promise that unauthorised access will never happen. If a breach of personal data could harm your privacy or the security of your data, we will notify the UAE Data Office and you, as the PDPL requires.

The Platform is for people doing business. You must have the legal capacity to agree to our Terms, or act with your legal representative's consent. We do not knowingly collect data from children. If you believe a child has given us data, write to sales@okkocap.com and we will remove it.

We may change this policy. The date and version at the top show the current version. When we publish a new version, we show it to signed-in users and ask them to accept it the next time they use the Platform.

The English version of this policy is the official text. Translations into Arabic and Russian may follow. If the versions differ, the English version prevails, to the extent the law allows.

sales@okkocap.com

OKKO Capital