Privacy Policy — Osool

Last updated: 29 July 2026

1. Introduction

Osool (the "Platform", the "Service", "we") is operated by Maxima Group, located at Office 404, City 4 Building, Al Garhoud, 53 St., Dubai, United Arab Emirates. The Platform is wholly owned by Maxima Group, and all related intellectual property — including its name, logo, design, source code and databases — belongs to the company.

We respect your privacy and are committed to protecting your personal data in accordance with UAE Federal Decree-Law No. (45) of 2021 on the Protection of Personal Data and its Executive Regulations, without prejudice to any other applicable federal or local legislation.

This policy explains how we collect, use and protect your data when you use the Platform. By using Osool, you acknowledge that you have read and understood this policy.

2. Our role in processing

Osool is a B2B platform for managing investments, partners, real-estate projects and financial records. We therefore distinguish two cases:

• Your own account data (user/subscriber): we act as the controller, and this policy governs it in full.
• Third-party data you enter into your workspace (partners, clients, grant recipients, supervisors, suppliers): you are the controller and we act as processor on your behalf. You are responsible for having a lawful basis to enter and process that data and for informing the individuals concerned. We process it only on your instructions and within the limits of our agreement with you.

3. Data we collect

a. Data you provide directly when creating and using your account

• Name, email address, profile picture (optional)
• Country, preferred and enabled currencies, interface language
• Company identity data shown on your printed documents: trade name, logo, address, phone number

b. Operational data you enter into your workspace

• Partner records and profiles (name, email, phone, notes) and partnership shares
• Investment data: purchases, sales and valuation snapshots
• Financial data: finance entries, expenses and recurring expenses, contributions, distributions, settlements, payments, debts and repayments, wallet
• Vouchers and documents you upload
• Real-estate project data: projects, floors, apartments and their instalments
• Fit-out data: clients, supervisors, packages, jobs, quote items, milestones, payments, costs, change orders and snags
• Grants and grant recipients
• Personal finance data, if you use that module

c. Data collected automatically

• Session and authentication data (session token, creation and expiry timestamps)
• IP address and browser/device identifier (User-Agent)
• Sign-in data from external identity providers, if you use them
• Usage data and technical logs required for operation, security and troubleshooting

d. What we do not collect

• We neither request nor store full bank card numbers. Any payments are handled by licensed payment providers.
• We do not collect your precise geolocation.
• The financial values you enter are accounting records inside your workspace; they are not a direct link to your bank accounts.

4. Legal basis and purposes of processing

We process your data on one of the following bases under the Data Protection Law:

• Performance of a contract: to deliver the subscribed services and operate your account
• Your explicit consent: for marketing communications and any optional processing
• Legitimate interests: to secure the Platform, prevent fraud and misuse, and improve the Service
• Legal obligation: to comply with accounting, tax and regulatory requirements

We use your data to:

• Create your account and manage access and permissions within your workspace
• Operate the Platform's modules: investments, partners, debts, expenses, wallet, vouchers, projects, fit-out, grants
• Generate reports, statements and printed documents carrying your company identity
• Convert and display amounts in the currencies you select
• Send operational notifications and alerts about your account
• Secure the Platform, diagnose faults and improve performance
• Comply with legal obligations

5. Data sharing

We may share your data with:

• Users within your workspace: data is visible to authorised members according to the role-based access control (RBAC) you define
• Service providers: cloud hosting, file storage, email delivery, payment processing, analytics and error tracking — all contractually bound to protect the data and process it only on our instructions
• Professional advisers: accountants, lawyers and auditors, where and to the extent necessary
• Competent government and judicial authorities: where there is a legal obligation or court order
• In a corporate transaction: in a merger, acquisition or transfer of assets, data transfers with the recipient bound to the same level of protection, and we notify you in advance

6. Data security

We apply technical and organisational measures to protect your data, including:

• Encryption in transit (TLS) and at rest
• Role-based access control (RBAC) and isolation of each workspace's data
• Password hashing and secure session management
• Regular backups and audit logs
• Periodic security review of code and infrastructure

No electronic system can be guaranteed absolutely secure. You are responsible for keeping your credentials confidential and for reviewing the permissions of those you grant access to your workspace.

7. International data transfers

Some of your data may be stored or processed on servers outside the UAE by cloud service providers. In such cases we comply with Articles (22) and (23) of the Data Protection Law, and transfer data only to jurisdictions offering an adequate level of protection as recognised by the UAE Data Office, or under appropriate contractual safeguards (standard contractual clauses).

8. Data retention

We retain your data for as long as your account or subscription is active. After termination or account deletion:

• We allow you a window to retrieve and export your data
• We retain the legally required minimum (such as financial and accounting records for tax and regulatory purposes) for the period prescribed by applicable law
• We delete or anonymise the remainder so it can no longer be linked to an identified person

9. Your rights

Under the UAE Data Protection Law you have the right to:

• Access your data and obtain a copy of it
• Rectify inaccurate data and complete incomplete data
• Erase your data (the "right to erasure"), subject to our legal retention obligations
• Restrict or object to processing
• Port your data to another controller in a structured, commonly used format
• Withdraw your consent at any time, without affecting the lawfulness of prior processing
• Object to decisions based on automated processing

To exercise any right, contact us at privacy@maximagroup.ae. We respond within the period prescribed by law. You also have the right to lodge a complaint with the UAE Data Office.

10. Account deletion

You may request deletion of your account and workspace through the account settings in the Platform, or by writing to privacy@maximagroup.ae. We action the request within the statutory period after verifying your identity and settling any outstanding financial obligations, subject to the retention periods in clause (8).

11. Cookies

We use cookies that are strictly necessary to operate the Platform and to store your session and preferences (language, currency). We may use analytics cookies to measure performance and improve the Service, and we enable them only with your consent where the law requires it. You can control cookies through your browser settings; disabling necessary cookies may prevent the Platform from functioning.

12. Children's privacy

Osool is a business platform not directed at persons under 18, and we do not knowingly collect their data. If we learn that we have collected a minor's data without a lawful basis, we delete it immediately.

13. Changes to this policy

We may update this policy from time to time. We will notify you of any material changes through the Platform or by email a reasonable time before they take effect, and your continued use of the Platform after the effective date constitutes acceptance.

14. Governing law

This policy is governed by the laws of the United Arab Emirates, and the courts of the Emirate of Dubai have jurisdiction over any dispute arising from it.

15. Contact

• Owned and operated by: Maxima Group
• Privacy contact: privacy@maximagroup.ae
• General: info@maximagroup.ae
• Phone: +971 4 282 3360
• Address: Office 404, City 4 Building, Al Garhoud, 53 St., Dubai, United Arab Emirates
• Website: maximagroup.ae