Privacy
Policy

This Privacy Policy (the "Policy") applies to all websites, products, and services provided by Persora LLC ("Persora", "we", "us"). By using our services, you acknowledge the terms set out below.

We provide strategic and management consulting primarily to corporate clients. In the course of our work, we process business correspondence, financial and operational data of clients, as well as personal data of representatives of counterparties.

Definitions

• Personal data — any information that directly or indirectly identifies an individual.
• Processing — any operation on personal data: collection, recording, structuring, storage, adaptation, retrieval, use, disclosure, erasure.
• Data subject — an individual whose personal data is processed by Persora.

We divide data into three categories based on the source and purpose of processing. This allows us to apply a tailored protection regime and retention period to each.

We do not collect special categories of personal data (racial or ethnic origin, political opinions, health data, biometrics) unless explicitly required by the engagement and covered by separate consent.

Every processing activity relies on one or more legal grounds recognised by applicable law (including GDPR, CCPA, and US federal regulations).

• Contract performance — delivery of consulting services, invoicing, reporting.
• Legitimate interest — infrastructure security, fraud prevention, service improvement.
• Consent — marketing communications, analytical cookies.
• Legal obligation — tax, accounting, and anti-money-laundering compliance.

Marketing communications

We send insights and invitations to private events only to recipients who have given explicit consent. Every message contains an unsubscribe link — we honour opt-out requests within 72 hours.

Persora does not sell personal data to third parties. Disclosure is permitted only in a limited set of circumstances:

• processors acting on our behalf under a confidentiality agreement (cloud providers, payment systems, IT vendors);
• state authorities — solely in response to a substantiated request within applicable law;
• successors — in the event of a reorganisation, merger, or asset sale, with prior notice to data subjects.

All our principal processors are located in the US and EU. An up-to-date list of vendors is available on request at info@persora.ae.

We apply a layered protection model aligned with ISO/IEC 27001 and SOC 2 Type II.

• Encryption at rest (AES-256) and in transit (TLS 1.3).
• Two-factor authentication for every employee account.
• Principle of least privilege with regular access reviews.
• Backups in geographically distributed data centres.
• Security event logging retained for at least 12 months.

Retention follows the purpose of processing: client project data is kept for 7 years after contract closure (GAAP requirement), marketing consent until withdrawal, technical logs for 12 months.

You may contact us at any time regarding your personal data. We handle substantiated requests within 30 calendar days.

• Access — receive a copy of the data we process.
• Rectification — correct inaccurate or outdated information.
• Erasure — request deletion when no legal basis for retention exists.
• Restriction — pause processing while a request is being verified.
• Portability — receive your data in a structured, machine-readable format.
• Objection — opt out of processing for direct marketing purposes.

To exercise any of these rights, send a request to info@persora.ae with the subject line "Data Subject Request" and identity verification. We may ask for additional information where needed.

Our websites use three types of cookies. You can accept all, only the necessary ones, or configure categories individually.

Preferences can be changed at any time through the consent banner, which reappears whenever saved settings are modified.

We update the Policy as our services evolve and applicable law changes. Material updates are announced by email at least 14 days before they take effect.

Previous versions of the document are kept in our archive and can be provided on request.

For any questions about this Policy, the processing of your data, or the exercise of your rights, please contact our Privacy Officer.

If you believe that the processing of your data violates applicable law, you also have the right to lodge a complaint with the supervisory authority of your jurisdiction.