WONE Global Privacy Policy

1. Data Controller & Contact Information

This Privacy Notice governs personal data collected by WONE Global Ltd ("WONE", "we", "us", or "our"), a company registered in the United Kingdom with its principal secretariat at:

Where you engage an independent admitted law firm, accounting practice, or advisory partner through WONE, that practice acts as an independent data controller for matters undertaken under a separate client engagement agreement.

2. Lawful Bases for Processing

Under the UK General Data Protection Regulation (UK GDPR), the EU GDPR, the UAE Federal Decree-Law No. 45 of 2021, and the India Digital Personal Data Protection Act (DPDP Act 2023), WONE processes personal data under the following lawful grounds:

• Contract Performance: Processing necessary to deliver subscription services, authenticate user accounts, generate bespoke executive decision files, and administer partner listings.
• Consent: Explicit, affirmative consent provided when submitting inquiry forms, partner expressions of interest, event registrations, or opting into analytical cookies.
• Legitimate Interests: Operating a secure service for businesses and Partners, preventing fraud and unauthorized scraping, routing corporate requirements to appropriate practice leads, and maintaining institutional governance standards.
• Legal & Regulatory Compliance: Fulfilling international statutory requirements, cross-border sanctions screening, tax reporting, and cooperating with supervisory authorities.

3. Categories of Information We Collect

We collect information you directly provide to us and data generated automatically during your use of WONE:

• Identity & Contact Data: Full name, professional business email, direct telephone/WhatsApp number (in E.164 international format), corporate title, and company/firm affiliation.
• Inquiry & Requirement Data: Cross-border project scope, target jurisdictions, transaction timing, and specific service requirements submitted via Bring a requirement or Contact Desks.
• Decision & Query Sessions: Business questions and evaluation parameters submitted to Ask WONE or the Executive Brief generator.
• Partner Application Data: Detailed practice specialisms, jurisdictional bar/licensing admissions, firm headcount, and professional bios submitted via the Expression of Interest (EOI) process.
• Event & Roundtables: Registration credentials and session preferences for the Global Business Circuit™ and international assemblies.
• Technical & Telemetry Data: IP address, browser type and version, operating system, session tokens, referring URL, and interaction logs.

4. How We Use Your Information

Your information is processed strictly for legitimate corporate and advisory purposes:

• To route cross-border requirements to the WONE Global Partner or Associate firm in the relevant jurisdiction. Your requirement is shared with a named firm only after we have told you who it is and you have agreed to the sharing;
• To compile and render structured Executive Decision Briefs and cross-market comparisons;
• To maintain secure client workspaces (My WONE) and authenticated document management;
• To screen submissions against applicable international economic sanctions and regulatory watchlists;
• To communicate formal confirmations, transactional receipts, and governance updates.

WONE does not sell, rent, or monetize your personal information to third-party advertisers or data brokers.

5. Artificial Intelligence & Decision Support Disclosure

WONE utilizes modern server-side artificial intelligence models to assist in structuring complex regulatory taxonomies, synthesizing legal statutory data, and accelerating cross-border decision analysis. We maintain strict safeguards:

• No Model Training on Client Data: Confidential business questions and client mandate details submitted to Ask WONE are never used to train, retrain, or fine-tune public foundation AI models.
• Stateless Enterprise Processing: AI analysis executes through secure, enterprise-tier API instances with zero-retention agreements or transient session isolation.
• Client Privacy by Design: API keys and model configurations are maintained strictly within our secure cloud infrastructure and are never exposed in client browser code.
• Human Partner Verification: All machine-assisted outputs are labeled as draft decision support and must be validated by licensed local partners before legal or financial execution.

6. International Data Transfers & Sub-Processors

Because WONE coordinates cross-border requirements across 60 markets, your information may be transferred to and stored in jurisdictions outside your country of residence, including the United Kingdom, the European Economic Area, the United Arab Emirates, Singapore, and India.

Where personal data is transferred across borders, we implement approved statutory transfer mechanisms, including the UK International Data Transfer Agreement (IDTA), the European Commission’s Standard Contractual Clauses (SCCs), and jurisdictional adequacy findings. All service sub-processors (hosting infrastructure, transactional email dispatch, enterprise security) are bound by rigorous Data Processing Agreements (DPAs).

7. Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• General Inquiries & Unconverted Requirements: Retained for 18 months from the date of last communication, after which records are securely purged or anonymized.
• Authenticated User Accounts & My WONE Data: Retained for the duration of the active subscription plus 7 years to comply with statutory accounting, tax, and anti-fraud regulations.
• Form Drafts: Saved locally within your browser session or held in transient session storage protected by cryptographic resume tokens for up to 30 days.

8. Your Statutory Rights

Depending on your location, you hold statutory rights regarding your personal data:

• Access: Request confirmation and copies of personal data held about you.
• Rectification: Request correction of inaccurate, incomplete, or outdated data.
• Erasure: Request the deletion of your personal data where retention is no longer justified by law or contract.
• Restriction & Objection: Object to processing based on legitimate interests or request suspension of processing.
• Data Portability: Request machine-readable export of data provided under contract or consent.
• Withdrawal of Consent: Revoke consent at any time without affecting the lawfulness of processing before revocation.

To exercise any of these rights, email privacy@woneglobal.org. We respond to all verified requests within 30 days.

9. Cookies & Telemetry Analytics

WONE utilizes strictly necessary cookies for user authentication, security verification (CSRF tokens), and session management. Analytics cookies (including Google Site Kit / Analytics) are used in aggregate to monitor traffic health and interface performance.

You can configure your browser to block or alert you about cookies; however, disabling strictly necessary cookies may restrict access to authenticated areas such as My WONE and Executive Brief generation.

10. Grievance Officer & India DPDP Notice

In accordance with the Information Technology Act 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, and the Digital Personal Data Protection Act 2023 of India, our designated Grievance Officer for India matters is: