Privacy policy
This policy explains what personal data CollectiveSpend collects through the METIS tail spend platform and this website, why we collect it, and what you can do about it.
Who we are
CollectiveSpend Technology FZE is the data controller for the personal data described here. We are registered in Dubai, United Arab Emirates. You can reach us at hello@collectivespend.com.
Tail spend and the METIS platform are ours; procurement consultancy is delivered by our sister company, CollectiveSpend Consultancy LLC. The two companies are separate legal entities and each controls its own website and customer data.
What we collect
| Data | Why | Basis |
|---|---|---|
| Name, work email, company, phone | When you submit an enquiry or request a consultation, so we can reply and prepare for the conversation. | Your consent, and our legitimate interest in responding to enquiries. |
| Content of your enquiry | To understand what you need and route it to the right person. | Your consent. |
| Server logs (IP address, browser, pages requested, timestamps) | Kept by our hosting provider to run the site securely and diagnose faults. | Our legitimate interest in operating a secure service. |
| Analytics, if you consent | Aggregate measurement of how the site is used, so we can improve it. Google Analytics, Google Ads, Microsoft Clarity and HubSpot. | Your consent, which you can withdraw at any time. |
| Enquiries you send us | Your name, email, phone, company and message, so we can reply. Stored in HubSpot, our customer relationship system. | Our legitimate interest in answering the question you asked us. |
| Platform data, for customers | Business contact details of your users, approvers and supplier contacts, processed to run the service. We act as processor on your instructions. | Our contract with you, under the Data Processing Addendum. |
We do not sell personal data, and we do not use it to build advertising profiles.
Cookies
Cookies are small files a site stores in your browser. We keep this deliberately minimal.
- Essential. We store your cookie choice itself, so we do not ask again on every page. This is kept in your browser's local storage and is never sent to us.
- Analytics and measurement. Only set if you choose "Accept all". Choosing
"Essential only" loads none of these scripts at all, rather than loading them in a restricted mode,
so you can confirm it yourself in your browser's network tab. With consent we use:
- Google Analytics 4 and Google Ads. Which pages are visited, how people arrive, and whether an advert led to an enquiry. Run by Google.
- Microsoft Clarity. Aggregated heatmaps and session replays showing where people click and scroll, so we can tell which parts of a page are working. Our contact forms are explicitly marked so that anything you type into them is never captured in a replay.
- HubSpot. Our customer relationship system. If you send us an enquiry, this links the pages you read to that enquiry so we can reply with context.
- Forms. When you submit a form, the details you type are sent to HubSpot, which stores them and notifies us by email. This happens whatever your cookie choice, because it is how we answer you. We use those details to reply to your enquiry.
You can change your choice at any time using the Cookie settings link in the footer, or by clearing site data in your browser. Blocking cookies in your browser settings will not stop the site from working.
Who we share it with
We share personal data only with service providers who help us run the business, and only as far as they need it:
- Hosting and infrastructure. Our platform runs on Amazon Web Services, with data residency in the Gulf region for GCC clients.
- Email and business software. Microsoft 365, for correspondence and scheduling.
- Professional advisers and authorities, where we are legally required to disclose.
Some of these providers operate outside the UAE. Where personal data is transferred abroad, we rely on the provider's standard contractual protections and on their own security commitments.
How long we keep it
Enquiry correspondence is kept for up to 24 months after our last contact with you, unless you become a client, in which case it is retained for the life of the relationship plus the period required by UAE commercial and tax law. Server logs are kept for a short operational window, typically no more than 90 days.
Sub-processors
We use sub-processors, including cloud hosting, AI model and payment partners, to deliver the service. Each is bound by data protection obligations no less protective than our own, we stay responsible for their performance, and we keep a current list available on request. Customers get reasonable prior notice of an intended change and may object on reasonable data protection grounds.
Security incidents
If a personal data breach affects customer personal data, we notify the affected customer without undue delay and in any event within 72 hours of becoming aware of it, with the information reasonably available so they can meet their own notification obligations.
Your rights
You can ask us to give you a copy of the personal data we hold about you, correct it if it is wrong, delete it, restrict how we use it, or object to our use of it. You can also withdraw consent at any time, which does not affect anything we did before you withdrew it.
To exercise any of these, email hello@collectivespend.com. We will respond within 30 days. If you are in the UAE and are not satisfied with our response, you may complain to the UAE Data Office.
We comply with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and, where it applies, the EU and UK General Data Protection Regulation. Where we act as processor for a customer, we act on their documented instructions and requests are routed to them as controller.
Security
We use encryption in transit and at rest, single sign-on with role-based access, and per-tenant database separation for platform data. SOC 2 certification is in progress; we will say so here when it is awarded, and not before.
Children
This is a business-to-business service. It is not directed at children and we do not knowingly collect personal data from anyone under 18.
Changes
If we change this policy we will update the date at the top. Material changes will be flagged on the site itself.
Contact
CollectiveSpend Technology FZE
Dubai, United Arab Emirates
hello@collectivespend.com