Personal Data Protection Policy

Purpose and scope

FORMĚS is committed to protecting the privacy and confidentiality of personal data that it collects and processes. This policy is intended to reflect the Oman Personal Data Protection Law issued by Royal Decree 6/2022, as amended by Royal Decree 68/2026, and the Executive Regulation issued by Ministerial Decision 34/2024, together with other requirements that apply to the particular processing activity.

Collection and use of personal data

FORMĚS may collect and process personal data such as names, contact information, employment details and other information relevant to providing services and conducting business.

Personal data may be used to provide services and fulfil contractual obligations, communicate with clients, employees, suppliers and other relevant parties, comply with legal or regulatory requirements, and improve services and client experience.

FORMĚS seeks to collect and process data that is necessary for the relevant purpose. Where processing relies on explicit consent, FORMĚS must be able to evidence that consent. Where the law permits processing without explicit consent, FORMĚS relies on the applicable statutory condition and keeps appropriate evidence of the processing basis.

Explicit consent and transparency

Where explicit consent is required, the consent request is intended to be written clearly and understandably and to identify FORMĚS as controller, identify the processor where relevant, provide a mechanism to contact the Personal Data Protection Officer, and explain the purpose and nature of the processing.

Consent for one purpose is not treated as consent for a materially different purpose. In particular, submitting a technical, procurement or career-interest form does not itself authorize commercial marketing.

Personal Data Protection Officer

FORMĚS provides a personal-data-protection contact mechanism through data.privacy@formessolutions.com. The Personal Data Protection Officer supports privacy governance, data-subject requests and coordination with the competent Ministry as required.

Data security and confidentiality

FORMĚS describes technical and organizational measures intended to safeguard personal data against unauthorized access, loss, destruction or alteration. Measures may include access controls, secure storage, encryption where appropriate and security assessment.

Employees and third-party service providers handling personal data are expected to observe applicable confidentiality and data-handling obligations.

Data sharing and transfers

FORMĚS may use trusted third-party service providers to support its services. Where such providers process personal data on behalf of FORMĚS, they are expected to process it for the relevant purpose and in accordance with applicable requirements.

Where personal data is transferred outside Oman, FORMĚS applies the transfer conditions, risk assessment, safeguards, approvals and/or explicit consent required for the particular transfer under applicable law. Cross-border processing is not treated as automatically permitted merely because a service provider uses international infrastructure.

Retention and erasure

Personal data is intended to be erased when the purpose for its processing ends. FORMĚS may retain data where an existing dispute requires retention or where a legal obligation, judgment, order or decision requires continued retention. Retention controls are applied according to the processing context and record category.

Automated processing

Where automated processing is used, FORMĚS and its processors are expected to implement measures that protect privacy and confidentiality and avoid harm to the data subject. Where the applicable right is engaged, a data subject may object to a decision resulting from automated processing and request human review.

Data-subject rights

Subject to applicable law and the circumstances of the processing, individuals may have rights including:

• Access to personal data and rectification of inaccurate information
• Requesting erasure where the relevant legal requirements are satisfied
• Withdrawal of consent where processing relies on consent
• Data portability where the right applies and is technically feasible
• Objecting to an applicable automated-processing decision and obtaining human review
• Submitting a complaint to the Ministry where a violation or unlawful processing is alleged

Personal-data breach response

Where a personal-data breach threatens the rights of affected data subjects, the controller is required to notify the competent Ministry within 72 hours of becoming aware of the breach. Where the breach causes serious harm or high risk to an affected data subject, notification to that individual is also required within the applicable 72-hour period. FORMĚS maintains incident escalation and assessment procedures intended to support these obligations.

Commercial marketing

FORMĚS does not treat consent to a business enquiry, procurement request or career-interest submission as consent to commercial marketing. Explicit consent is required before personal data is used to send commercial advertising or marketing material where required by applicable law.

Compliance and updates

FORMĚS may review and update this policy to maintain its relevance to business practices and applicable data-protection requirements.

Contact and complaints

Questions, concerns, withdrawal requests or data-subject requests can be directed to the FORMĚS Personal Data Protection Officer at data.privacy@formessolutions.com. Data subjects and interested parties may also use the complaint procedures provided by the Ministry of Transport, Communications and Information Technology where they believe the Law, Executive Regulation or related decisions have been violated.