Confidentiality

01

Why this policy exists

Consulting on infrastructure means being shown things a company would not put in public: network topologies, capacity plans, security gaps, commercial terms, roadmaps. Clients hand that over because the work cannot be done otherwise.

This policy sets out how GearTek Trading LLC treats that material, and what we expect of anyone working on our behalf.

02

Who it applies to

It applies to every GearTek employee, contractor, partner and subcontractor, for the whole time they are engaged on our work and after it ends. It covers information received during client engagements, information generated in the course of our own operations, and anything submitted through this website.

03

What we treat as confidential

Client information

Any non-public material shared with us in the course of an engagement — architecture and network detail, configurations, security findings, capacity and cost models, business plans, and intellectual property. Where an engagement calls for a non-disclosure agreement, the terms of that agreement sit on top of this policy and take precedence over it.

Our own information

Methodologies, pricing models, commercial records and staff data, protected with the same care we apply to client material.

Access on a need-to-know basis

Confidential material is made available to the people working on the relevant engagement, not to the wider organisation. Access follows the role and ends with it.

04

Principles we work to

Our handling of personal and confidential data follows the principles that underpin modern data protection law, including the UAE’s federal personal data protection regime and the GDPR where it applies:

• Lawful and transparent. Processed for purposes we can state, and have stated.
• Purpose-limited. Used for the reason it was given, not repurposed later.
• Minimal. No more collected than the work requires.
• Accurate. Corrected when we learn it is wrong.
• Time-limited. Kept while there is a reason to keep it, then disposed of.
• Secure. Protected against unauthorised access, loss and damage by measures proportionate to the sensitivity involved.

05

Security standards for an engagement

The controls that apply to a given piece of work are set at the outset, in proportion to the sensitivity of the material and the client’s own requirements, and are recorded in the engagement documentation rather than assumed.

The standards we work to, and which we will implement where an engagement calls for them, include:

• Encryption of sensitive material in transit and at rest.
• Access control — named accounts, role-based permissions, strong authentication, and multi-factor authentication for privileged access.
• Network protection — segmentation, firewalling, and monitoring appropriate to the environment.
• Physical control of any media or equipment holding client material.
• Disposal of material securely once retention is no longer justified.

Where a client operates to a specific framework or certification, we work within it. If you need a written statement of the controls that will apply to your engagement, ask us before the work starts and we will set it out.

06

Subcontractors and partners

Some engagements draw on specialist partners or cloud providers. Where a third party will handle client material on our behalf, we require them to be bound by confidentiality and data protection obligations no weaker than the ones in this policy, and we remain accountable to the client for the work.

Where a client’s agreement requires prior approval before any third party is involved, we seek it.

07

If something goes wrong

No policy prevents every incident. What matters is what happens next. In the event of a suspected or actual breach affecting confidential or personal data, we:

• Contain it first — stop the exposure, then establish what was affected.
• Tell the people who need to know — the affected client, and any supervisory authority where the applicable law requires notification, within the time that law allows.
• Fix the cause — remediate, and change the practice that let it happen.

We would rather report an incident early and imperfectly than late and neatly.

08

Reviewing this policy

This policy is reviewed periodically, and whenever there is a material change in the law of the jurisdictions we work in, in the services we offer, or in the systems we use. The date of the current version is shown at the top of this page.

09

Contact

To discuss confidentiality arrangements for an engagement, or to raise a concern:

GearTek Trading LLC
Shams Business Center, Sharjah Media City Free Zone
Al Messaned, Sharjah, United Arab Emirates
info@geartektrading.com