Book a demo

Privacy Policy

What data we handle, why we handle it, how long we keep it and who we may share it with — on this website and in our systems.

Last updated: 17 October 2026

1. Who we are

KATTITTA builds compliance and business software for the UAE gold and jewellery trade, including The KYC Hub, E-Invoice, a gold-ready ERP and e-commerce. This policy explains how we handle personal data on this website and in those systems (the “Services”). Words such as “Company” and “Client” have the meanings given in our Terms & Conditions.

2. This website

This website does not ask you to create an account and does not store the details you type into the demo form. When you press the button on the form, your message opens in WhatsApp on your own device, ready for you to send. If you call or message us, we receive your phone number and what you choose to tell us, and we use it only to reply and to arrange a demo.

Our fonts, images and brand film are served from this website, not from third-party advertising or tracking networks. See our Cookie Policy for the small amount of information stored in your browser.

3. Data we handle in the Services

Account and Company data

Names, email addresses, phone numbers, roles, trade licence details, Tax Registration Number (TRN), addresses, compliance officer details and subscription and payment records.

Client KYC data (The KYC Hub)

Information the Company collects from its Clients through KYC requests: company and individual details, shareholders and ultimate beneficial owners, identity documents such as passports and Emirates IDs, declarations, risk assessments, sanctions and PEP screening results, transactions and reports prepared for goAML.

Invoicing data (E-Invoice)

Client and supplier details, items, prices, tax information and the invoices, credit notes and debit notes that are created, sent or received.

Technical data

Logs needed to keep the Services secure and working, such as sign-in times, IP addresses and actions taken in an account.

4. Why we use it

  • To provide the Services the Company has signed up for, and to support it.
  • To let the Company meet its own legal duties, such as customer due diligence, screening, record keeping, goAML reporting and e-invoicing.
  • To process payments and activate subscriptions.
  • To keep the Services secure, prevent misuse and keep audit trails.
  • To meet our own legal obligations.

5. Roles and accuracy

For Client KYC data, the Company decides what to collect and why, and uses the Services to do it. We handle that data to provide the Services to the Company.

Responsibility for data

  1. Clients are responsible for providing accurate data. The Company is responsible for verifying the accuracy of the data.
  2. The Company agrees to provide correct information. Any loss to us due to inaccurate data will be indemnified to us by the Company.
  3. The Company agrees to submit the data to clients through KYC requests.

6. How long we keep data

We keep data only for as long as the rules below allow. Full details are in our Data Retention Policy.

Retention and removal

  1. Premium customers’ attachment data will be stored until the period ends. They will have an option to download it anytime.
  2. Once the premium ends, unless renewed, they will have an option to download the data for 14 days, after which it will be removed.
  3. If not renewed within 14 days, and renewed later, it will be considered as a new account, and all features except premium features will be started as a new customer.
  4. If you are using the system free, the attachments with client KYC requests will expire and be removed from the system in 14 days.

Because data is removed after these periods, the Company should download and keep its own copies of any records it is required by law to retain.

7. Who we share data with

Sharing under legal obligations

  1. We may share the data with any outside agencies under legal obligations.

We may also share data with:

  • The Company’s Clients, where the Company sends them a KYC request or update link.
  • Accredited Service Providers and the Peppol network, to validate, deliver and report e-invoices, including reporting tax data to the UAE Federal Tax Authority.
  • Screening data sources, to check names against sanctions and PEP lists.
  • Service providers who host, secure, email or process payments for us, under contracts that require them to protect the data.

We do not sell personal data.

8. Security

We use measures such as company-level data isolation, access controls, separate keys for separate services, rotating tokens, encrypted connections, soft deletes and activity logs. No system is completely secure, so please tell us at once if you suspect a problem.

9. International transfers

Some of our service providers may process data outside the UAE. Where that happens, we take steps to make sure the data stays protected as required by applicable law.

10. Your rights

Subject to applicable law, including the UAE Personal Data Protection Law, you may ask to access, correct or delete your personal data, to restrict or object to its use, or to receive a copy. If your data was collected by a Company through a KYC request, please contact that Company first; we will help it respond. We may need to keep or share some data where the law requires it.

11. Children

The Services are for businesses and are not directed at children.

12. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows when it last changed.

13. Contact

For privacy questions or requests, call or WhatsApp +971 58 571 7756, or contact us.

Call us WhatsApp