Information for website visitors and contact persons
1. Subject and area of application
This privacy policy explains the processing of personal data in connection with https://www.AlexBodi.com and processing inquiries to the website operator. Personal data is information relating to an identified or identifiable natural person. This includes, for example, contact details, the contents of a message and technical identifiers to the extent that they can be assigned to a person.
SCANDIC ASSETS FZCO is responsible for the processing described in this statement. The General Data Protection Regulation of the European Union, Regulation (EU) 2016/679 – hereinafter “GDPR” – applies to the extent that the requirements of its article 3 are met. For a company outside the EU, what is particularly important is the offer of goods or services to people in the Union or the observation of their behavior there. The protection of the GDPR does not depend solely on EU nationality.
This declaration is not a declaration of consent. Your access and acknowledgment do not automatically allow further processing. If individual additional services are offered, such as a newsletter, customer account, identity verification or AI-supported interaction, the associated specific additional information must be available in a timely manner. The mere description of an optional process does not mean that it will occur on every visit.
2. Person responsible and contact
SCANDIC ASSETS FZCO
Dubai Silicon Oasis DDP Building A1/A2
342001 Dubai / UAE
United Arab Emirates
Business License Number: 050-3124863
Phone: +971 56 929 86 90
E-mail: [email protected]
Website: https://www.AlexBodi.com
Please direct data protection inquiries to [email protected], if possible with the subject “data protection”. You can also contact us in writing to the address provided. The naming of this contact point does not mean that a formally appointed data protection officer exists.
Representative in the European Union according to Article 27 GDPR:
SCANDIC ASSETS FZCO
Contact the data protection officer:
SCANDIC ASSETS FZCO
3. Principles of processing
We base the processing on lawfulness, transparency, purpose limitation, data minimization, accuracy and an appropriate limitation of the storage period. Only people and service providers who need the data for the respective task and are obliged to do so are granted access. Pseudonymized data remains personal data if it can be assigned using available means.
A new use for a different purpose requires the necessary legal review and information. Any necessary consent will be obtained separately. Mere group or brand affiliation with other companies does not create a blanket permission to share personal data with them.
4. Legal basis and legitimate interests
Contract and pre-contractual measures - Article 6 Paragraph 1 Letter b GDPR: This basis applies if data is required for a contract with you or for the initiation of a contract at your request. If you receive a message as an employee of a business partner, your personal contract is not automatically affected; then the legitimate interest in business communication can be particularly important.
Legitimate interests – Article 6 Paragraph 1 Letter f GDPR: This includes the secure provision of the website, the defense against specific attacks and attempts at abuse, the appropriate processing of general and business inquiries as well as the assertion or defense of legal claims. The processing requires its necessity and a consideration of your rights and interests.
Consent - Article 6 Paragraph 1 Letter a GDPR: Voluntary, informed and specific consent may be required, for example, for unnecessary tracking or certain additional functions. You can revoke your consent at any time in the future. The revocation does not affect the lawfulness of the processing that has taken place up to that point.
Legal obligation - Article 6 Paragraph 1 Letter c in conjunction with Paragraph 3 GDPR: This basis is only used where there is an actually relevant obligation under Union law or a Member State and the processing is necessary to fulfill it. A foreign obligation or a service provider contract does not in itself constitute this legal basis. The specific relevant standard must be specified in a corresponding process.
For health data and other special categories of data, an additional exception is required according to Article 9 Paragraph 2 GDPR. The special requirements of Article 10 GDPR apply to data on criminal convictions and crimes. A blanket reference to “compliance” does not replace these requirements.
5. Website access, server logs and hosting
When you access the website, connection data is technically transmitted to the systems involved. This includes, in particular, the IP address, time of retrieval, requested address or file, transfer status as well as the browser and operating system information transmitted by the browser. A source page is only processed if it is actually communicated by the browser. The specific scope of stored logs depends on the server configuration.
The purposes are the delivery of the requested content, the technical error analysis, the stability of the operation and the prevention of abusive access. Unless a more specific basis is relevant, the necessary processing is carried out based on our legitimate interest in a functional and secure website in accordance with Article 6 paragraph 1 letter f GDPR. Necessary logging does not result in permission for comprehensive marketing profiling.
Hosting/infrastructure service provider:
SCANDIC ASSETS FZCO
Other infrastructure, such as CDN, DNS security service or web application firewall:
DARK TRACE / SCANDIC ASSETS FZCO
Regular deletion period for the stored access logs: Each time on 31. December of the current year. In the event of a specific security incident, necessary data can be stored separately for the documented duration of the investigation and, if necessary, legal prosecution. This does not involve blanket, unlimited storage.
6. Contact by email, telephone and, if necessary, form
If you contact us, we process the information you provide, in particular your name, email address or telephone number, message content, attachments and the metadata necessary for communication. In principle, you decide for yourself what information you provide. Mandatory fields in a form that may be offered must be recognizable as such and remain limited to the required information.
The processing serves to answer your query, its internal allocation, the possible desired business initiation and the traceable processing. Depending on the process, we base it on Article 6 Paragraph 1 Letter b or f GDPR. Without accessible contact information or without the information necessary to address your concern, we may not be able to provide a meaningful response. You do not have to make a business request to visit a general website.
Inquiries do not become a newsletter subscription simply by sending them. Telephone conversations may not be recorded or transcribed using AI based solely on this statement. Such additional processing requires a separate, legally viable basis and prior information.
Email/communication service providers and form providers:
SCANDIC ASSETS FZCO
Once processing has been completed, data will be deleted unless it is required for an ongoing communication process, legal storage or specifically justified legal claims. Deadline for normal completed requests: Every day on 31. December of the current year. Business documents and documents that are subject to retention are treated separately.
7. Business initiation and business partner contacts
For cooperation, media, supplier or other business inquiries, company name, function, professional contact details, subject of a planned collaboration, negotiation documents and correspondence may also be processed. Contact person data is required to carry out the business relationship and to coordinate with the company represented.
Recipients within our organization are the responsible people. External consultants or potential project partners only receive personal information to the extent that it is necessary for the specific process communicated, legally covered and transparent. Confidential correspondence will not be published or used as an advertising reference solely because of contact.
To the extent that information comes from public company registers, from permissible business partner information or from another contact person, the information requirements of Article 14 GDPR also apply. Information on the source, data categories and specific purpose must be added if necessary.
8. KYC, KYB and AML – agreed cooperation with CRIF Germany
Collaboration with CRIF Germany is contractually agreed for corresponding business transaction-related audits. The public provider identification of crif.de names CRIF GmbH, Victor-Gollancz-Straße 5, 76137 Karlsruhe, Germany. Which CRIF company takes on the specific audit assignment and in which data protection role it acts must be stated in the respective contract and the associated information.
KYC (Know Your Customer) includes the identification and, if necessary, verification of customers or acting persons. KYB (Know Your Business) concerns company data, representation relationships and, if applicable, ownership and control structures. AML (Anti-Money Laundering) refers to measures to prevent money laundering; Related audits may take into account terrorist financing and sanctions risks, where relevant.
Such an examination can only be considered if it is necessary for the specific business transaction and is legally permissible. Simply visiting a website or making a non-binding general inquiry does not automatically justify requesting ID. Not every visitor and not every contact person is checked solely because of the existing CRIF cooperation.
Depending on the permissible audit order, the following may be required: identity and address data, date of birth, function and power of representation, company and register information, information on beneficial owners and a limited audit result. Copies of ID cards, biometric procedures, complete financial profiles, sanctions or PEP comparisons are not generally legitimized by this exemplary description. You need a specifically described need, a suitable procedure and the appropriate legal basis.
In the case of legally required audits, the regulation that actually applies to SCANDIC ASSETS FZCO must be stated. For voluntary integrity checks, article 6 paragraph 1 letter f GDPR can only be considered after a documented necessity and interest check. Agreeing to website terms and conditions is not a substitute for background checks that are not required by law or contract.
To be additionally provided before carrying out the respective test: specific CRIF contractual company and role; test product; data categories; Sources including, where appropriate, public registers; Purpose; exact legal basis; recipients and countries; storage period; possible consequences of non-provision; Dealing with deviating results and automated evaluation is carried out by the technical team at SCANDIC ASSETS FZCO, Dubai, UAE.
Depending on the service, CRIF can act as a processor or as an independent controller. The contract name alone does not determine this. When processing orders, Article 28 GDPR must be observed; When jointly determining the essential purposes and means, Article 26 GDPR must be checked. CRIF's own data protection information can be found at https://www.crif.de/datenschutz/; these do not replace our information obligations.
9. Automated decisions and human review
An exclusively automated decision with legal effect or similarly significant impairment may not be based on the general use of these website conditions or on a general security notice. For such use, the requirements and protective measures of Article 22 GDPR must be checked separately.
In the case of identity, sanction or other risk-related hits, the possibility of identical names, incorrect initial data and outdated information must be taken into account in particular. To the extent that human review is required, it must actually be carried out by a responsible person with discretion and must not be a mere confirmation of a system proposal.
Specific status of automated decisions within the operator's area of responsibility:
The actual status after periodic system checks in terms of logic in an understandable form. The scope and intended effects were determined by SCANDIC ASSETS FZCO.
10. Technical monitoring by Darktrace
The technical monitoring of the integrated applications is supported by security solutions from Darktrace. Depending on the product and configuration used, this may include analyzing network, application, device, access or security event data. A comprehensive content analysis of all communication is not hereby generally claimed or permitted.
The purposes are to identify attack patterns, investigate anomalies, protect confidentiality, integrity and availability, and process security incidents. The legal basis, to the extent relevant and necessary, is Article 6 paragraph 1 letter f GDPR. Article 32 GDPR describes security requirements, but does not replace checking the legal basis for the specific processing.
Actual Darktrace contractual company, product, scope of integration and data categories: SCANDIC ASSETS FZCO. Storage location, remote access options and deletion periods are handled by SCANDIC ASSETS FZCO in Bahrain (Al-Manāma).
Security protocols may not be misused for advertising, general performance monitoring of employees, or unnecessary behavioral profiling without an additional legal basis. A security system does not guarantee complete freedom from errors or attacks. Further provider information is available at https://www.darktrace.com/legal/privacy-policy.
11. Media monitoring and legal advice
The media monitoring of the website is carried out by Prof. Dr. Stefan Haupt, Reinbeckstraße 21, D-12459 Berlin, Federal Republic of Germany, https://www.haupt-rechtsanwaelte.de. In order to examine specific publications, complaints or legal questions, the necessary personal data can be transmitted as part of the mandate.
The legal basis here is in particular Article 6 Paragraph 1 Letter f GDPR with the legitimate interest in lawful communication and the protection of legal interests. If special categories of data are required to assert, exercise or defend legal claims, Article 9 paragraph 2 letter f GDPR must also be checked. This does not involve a blanket forwarding of all visitor data or all correspondence.
In terms of data protection law, independent legal advice must be distinguished from technical order processing that is bound to instructions. The relevant professional confidentiality obligations also apply to legal work. A data transfer does not make the lawyer the general operator of the website.
12. Product testing and Slow Medicine Research Institute
The contractually agreed product testing is carried out for the products commissioned in collaboration with Slow Medicine Research Institute, HP Prof. Dr. rer. nat. Dieter Lazik, Olympic Trail 7, 14471 Potsdam, Germany.
In the case of a purely factual product test, no personal data from website visitors need to be passed on. If contact details of business partners or information about a product complaint are required for a specific testing process, the scope of data must be limited to what is necessary. If possible, product and quality data should be provided without personal reference.
Health data, information on side effects or data from studies and tests are subject to separate requirements. Such processing, including any disclosure to the auditor, requires specific information and a viable basis in accordance with Article 6 and, if applicable, Article 9 GDPR. An appeal to research purposes or article 9 paragraph 2 letter j GDPR is not sufficient without the necessary legal requirements.
Submitting a general inquiry does not constitute participation in a study or consent to medical research. For personal examinations that are actually carried out, independent documents, clear responsibilities and, if necessary, further technical legal requirements are required in advance.
13. Cookies, similar technologies and external content
Cookies, local storage, session storage, device identifiers, pixels and similar processes can store or read information on a device. In the scope of application of § 25 TDDDG, consent is generally required for this, unless a legal exception applies. Whether additional personal data is processed must be assessed separately according to the GDPR.
Non-essential analytics, marketing and similar services may not be activated solely because you continue to use the website or close a banner. A selection must be purpose-related and voluntary. Rejection and later revocation must not be made unreasonably difficult. Specific services, storage periods and revocation options must be stated in the cookie declaration or in the effective cookie settings.
External videos, maps, social media content, fonts or other resources can transmit data to third parties as soon as they are loaded. Whether prior consent is required depends on the actual function, technical integration and legal basis. A mere text link is to be distinguished from an embedded third-party resource.
Actually integrated third-party content, statistics, marketing and consent services are handled by SCANDIC ASSETS FZCO. No claim about Google Analytics, Meta Pixel, specific consent tools or complete freedom from tracking is made without examining their actual use.
14. Newsletters, accounts and other optional features
A newsletter, customer account, checkout, public comment function or AI chat are not established solely by this declaration. If such a function is provided, its data categories, purposes, basis, mandatory information, providers, transmissions, storage periods and, if applicable, profiling mechanisms must be explained separately and directly with the function.
For email advertising, the relevant competition law requirements must also be observed. Any necessary consent must be verifiable; A confirmation using the double opt-in procedure can serve as proof, but does not create permission for additional, unexplained purposes such as individual opening or click tracking.
AI service providers may not receive contact and conversation content for their own training purposes solely on the basis of a general AI ethics note. The use of a model, the storage of inputs, any evaluation for security purposes and training must be checked separately and made transparent.
15. Categories of possible recipients and responsibilities
Depending on the process actually used, responsible employees, hosting and communication providers, IT security service providers, specifically commissioned verification services, legal advisors and technical product testers may receive data. Data is not passed on simply because a company belongs to a partner network or is described here as a possible recipient.
Authorities, courts or other public bodies only receive information if there is a legal obligation or other valid permission. Requests are examined for jurisdiction, necessity and relevant legal requirements. The confidentiality of legally protected information and permissible restrictions on information obligations remain unaffected.
Processors must be contractually bound in accordance with Article 28 GDPR. For those responsible independently, the respective basis for disclosure and the information obligations of both bodies must be checked. In the case of joint responsibility, the essential contents of the agreement must be made accessible in accordance with Article 26 GDPR.
16. Processing in the UAE and international data transfers
The operator is based in Dubai, United Arab Emirates. Data can therefore be processed as part of the processing by the responsible persons in the UAE. According to the European Commission's published overview of the status of this declaration, there is no adequacy decision for the UAE under Article 45 GDPR.
The direct communication of data by a data subject to a controller in a third country must be distinguished from a transfer by another controller or processor. If a transfer process is subject to Chapter V of the GDPR, a permissible transfer mechanism is required in addition to the general legal basis. Remote access from a third country must also be included in the review.
For transfers without a relevant adequacy decision, suitable guarantees in accordance with Article 46 GDPR come into consideration in particular, provided that the respective instrument actually covers the specific transfer. An examination of the level of protection in the recipient country and additional technical or organizational measures may be necessary. Standard contractual clauses are not a blanket replacement for this review and may only be used for a transaction covered by their scope.
Guarantees agreed for the actual data flows and affected countries/recipients:
Information or, if necessary, a redacted copy of relevant guarantees can be obtained via [email protected] requested as long as the relevant instruments have actually been agreed.
For UK recipients, a relevant adequacy decision may apply to the relevant extent. For US recipients, it is particularly important to check whether a valid certification under the EU-US Data Privacy Framework covers the specific organization and processing; otherwise another acceptable solution is required. These options say nothing about which countries the specific website actually uses.
Exceptions under Article 49 GDPR must be interpreted narrowly and not used as a general permanent replacement for suitable guarantees. A cookie banner, the mere continued use of the website or the naming of a foreign company does not constitute blanket consent to any third-country transfers.
17. Storage, deletion and retention
We do not store personal data longer than is justified by the respective purpose and a specifically relevant retention obligation. Depending on the process, deadlines begin, for example, with the completion of an inquiry, the end of a contractual relationship or the legally defined event. If the purpose no longer applies, data will be deleted or, where possible and appropriate, effectively anonymized.
Retention obligations under German commercial, tax or money laundering law do not apply to the operator simply because the website is in German. Likewise, a KYC check does not automatically establish a specific blanket retention period. Relevant obligations under the law of the UAE and other affected legal systems must be determined separately and may not be presented in an undifferentiated manner as an article 6 paragraph 1 letter c basis for GDPR processing.
In the case of a specific dispute, documents required for legal defense can be retained until final clarification or for a relevant statute of limitations. Access and use must be limited to the respective reason for storage. Backups and archive systems must be included in the deletion concept; A restore may not permanently reverse deletions that have already been effectively implemented.
Mandatory deadline overview to be supplemented: server logs; security events/dark trace; general inquiries; business correspondence; KYC/KYB/AML credentials; if applicable, proof of consent; product complaints; Backups. The start of the deadline and the deletion period are each 01. January of a current year and the 31. December of a current year.
18. Your rights
Under the applicable conditions, you have the right to information about your personal data and to a copy in accordance with Article 15 GDPR. You can request the correction of incorrect data and the completion of incomplete data in accordance with Article 16 GDPR.
According to Article 17 GDPR, you can request deletion, especially if data is no longer needed, relevant consent is revoked or the processing is unlawful. Legal exceptions, such as required storage or the defense of legal claims, remain to be examined. According to Article 18 GDPR, you can request a restriction of processing under the conditions stated there.
According to Article 20 GDPR, there is a right to data portability for the data you provide, provided that the processing is based on consent or contract and is carried out automatically. This does not automatically include all internal reviews, trade secrets or information about other people.
You can revoke your consent at any time with future effect. Revocation is possible via the respective consent mechanism or via our contact point. For cookies, the settings provided must be used; A lack of a mechanism is not a reason to ignore a revocation declared otherwise.
Objection according to Article 21 GDPR: You can object to processing based on Article 6 paragraph 1 letters e or f GDPR on grounds of your particular situation; This also applies to profiling based on this. We will then no longer process the data unless we can demonstrate compelling legitimate reasons that outweigh your interests, rights and freedoms, or the processing serves legal claims.
Direct advertising: You can object to the processing of your data for direct advertising purposes at any time without any specific justification. This also applies to associated profiling. After such an objection, the data may not be further processed for these purposes.
To the extent that Article 22 GDPR is relevant, the protective rights provided therein exist, in particular, if necessary, human intervention, expression of one's own point of view and contesting a decision. The exact form depends on the legal basis of the respective decision.
19. Exercise of rights and complaints
Address your request [email protected] or to the responsible authorities mentioned in section 2. We do not routinely require an unredacted copy of your ID. If there are reasonable doubts about identity, we may request additional, appropriate information necessary for confirmation.
You will generally receive information about the measures taken in response to your application within one month of receipt. Under the conditions of Article 12 Paragraph 3 GDPR, the deadline can be extended by a further two months; You must be informed about this and the reasons within the first month. Inquiries are generally processed free of charge. The narrow legal exceptions in the case of obviously unfounded or excessive applications remain unaffected.
According to Article 77 GDPR, you can complain to a competent data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged violation. A prior complaint to the operator is not a requirement. The jurisdiction of a specific German authority is not derived solely from the address of a consultant in Berlin or Potsdam.
The European Data Protection Board maintains an overview of the European data protection supervisory authorities. In addition, legal remedies and, if necessary, other rights under applicable law remain in effect.
20. Security and Incidents
Appropriate security measures are based on the type, scope, circumstances and purposes of the processing as well as the risk to data subjects. Depending on the system, this includes access restrictions, secure configuration, encryption of appropriate communication channels, logging of security-relevant processes, updates and controlled responses to incidents.
The description is not a guarantee of complete security. In particular, integrating Darktrace does not replace legally compliant configuration, personnel responsibility or checking of other service providers. If violations of the protection of personal data are discovered, the reporting and notification obligations under Articles 33 and 34 GDPR must be checked in accordance with their respective requirements.
21. Minors and Sensitive Information
Please do not submit any unnecessary information about children, health, religious or political beliefs, or criminal allegations. For offers that are actually aimed at children, the relevant information, consent and protection requirements must be implemented separately. Article 8 GDPR does not mean that every website visit automatically requires a minimum age of 16 years.
22. Updates
This statement will be adjusted if the actual processing operations or the relevant legal requirements change. An update does not grant retroactive consent and does not automatically expand existing purposes. In the event of significant changes, affected persons will be informed in an appropriate manner; Any new consent required will be obtained before the processing in question.
Status: 01. October 2026.