When the GDPR applies to us
Litiqo is based in the United Arab Emirates. The GDPR applies to our processing where we offer services to, or monitor the behaviour of, people in the European Economic Area or the United Kingdom. Where it applies, this page describes how we handle it.
Controller and processor
We are the controller for data collected through this website, for enquiries, for the newsletter and for our direct relationship with customer contacts.
We are a processor for the data a customer puts into a Litiqo platform, such as patient, client, tenant or employee records. That customer is the controller and decides the purpose; we act on their documented instructions.
Data processing agreement
A data processing agreement covering the Article 28 requirements is available to customers who need one. Ask us and it will be provided as part of your service agreement rather than negotiated at the end.
Sub-processors
We use a limited set of sub-processors for hosting, infrastructure and communications. Each is engaged under contract with equivalent obligations. A current list is available to customers on request, and customers are notified of a material change.
International transfers
Where personal data is transferred out of the EEA or the UK, we rely on appropriate safeguards, including standard contractual clauses where applicable. Where a customer requires data residency in a particular region, that can be configured, and it is agreed before deployment rather than afterwards.
Data subject rights
Individuals may exercise rights of access, rectification, erasure, restriction, objection and portability.
- If we hold your data as a controller, write to privacy@litiqo.com.
- If we hold your data as a processor for one of our business customers, contact that business. If you contact us instead, we will tell you who the controller is and forward your request to them.
We aim to respond within one month, and we will tell you if a request will take longer and why.
Breach notification
Where we are the controller, we will notify the relevant supervisory authority within 72 hours of becoming aware of a reportable breach, and notify affected individuals where required. Where we are the processor, we will notify the controlling customer without undue delay so they can meet their own obligations.
Security measures
Technical and organisational measures are described on our security page.
Representative and complaints
If you are in the EEA or the UK and wish to raise a concern, write to us first at privacy@litiqo.com. You also have the right to complain to your local supervisory authority.
Contact
Questions about this document can be sent to legal@litiqo.com or through the contact form.
Entity: Medixcart FZC LLC, United Arab Emirates. Effective: 11 September 2026.
Question about this document?
Legal and compliance enquiries go to legal@litiqo.com, or use the contact form and mark it as legal.