Effective Date: 19 Aug 2026
At Gulf Testing Solutions Enterprise LLC (“GTS”), we recognize that privacy and the responsible handling of personal data are fundamental to maintaining trust with our customers, suppliers, business partners, job applicants and all individuals who interact with us.
This Privacy Notice (this “Notice”) explains how we collect, use, disclose, retain and protect personal data when you visit our website at www.gulftestinglab.com (the “Website”), communicate with us, apply for employment opportunities, register as a vendor or supplier, or otherwise interact with our businesses. This Notice is issued in accordance with the Personal Data Protection Law promulgated by Royal Decree No. 6/2022 (the “PDPL”) and its Executive Regulation issued by Ministerial Decision No. 34/2024 (the “Executive Regulation”). The terms “personal data”, “processing”, “controller” and “processor” have the meanings given to them in the PDPL and the Executive Regulation.
We are committed to managing personal data responsibly, transparently and securely. We seek to ensure that personal data is processed fairly, collected only for legitimate purposes, protected appropriately and handled in accordance with the PDPL, the Executive Regulation, the decisions issued by the Ministry of Transport, Communications and Information Technology (the “Ministry”) and other applicable privacy and data protection requirements.
This Notice is designed to help you understand:
Please read this Notice carefully. This Notice is made available to you, in accordance with Article 21 of the Executive Regulation, so that you can view it before your personal data is processed. Where you give your explicit consent through any form, checkbox, submission or other mechanism made available by us, or otherwise in writing or by electronic means, that consent extends to the collection, use, disclosure, retention, sharing and transfer of your personal data for all of the purposes described in this Notice, and remains in effect until you withdraw it. We may also process personal data on any other basis permitted under the PDPL.
Gulf Testing Solutions Enterprise LLC is a multi-disciplinary Laboratory and Surveying & Technical Services provider. Since inception, GTS has combined technical precision with industry expertise to deliver essential testing, inspection, surveying and mapping services that support construction, oil and gas, mining, infrastructure, and other sectors vital to national development.
The Website is operated and maintained by Gulf Testing Solutions Enterprise LLC. For the purposes of the PDPL, GTS is the controller of personal data collected through the Website, including personal data submitted through the “Contact Us”, enquiries and careers forms.
This Privacy Notice applies to:
Privacy is an integral part of GTS’s commitment to responsible business practices, good governance and the protection of information. We believe individuals should understand how their personal data is used. We recognize that individuals expect their personal data to be handled responsibly and that maintaining their trust requires appropriate governance, transparency and accountability.
Privacy responsibilities are assigned within GTS’s governance framework to support consistent implementation of privacy requirements across our operations.
To support this commitment, we seek to:
We seek to incorporate privacy considerations into our business processes, systems and technology decisions. By considering privacy at an early stage, we aim to identify and address potential risks and implement appropriate safeguards.
Where appropriate, privacy considerations are incorporated into:
We regularly review our privacy practices to reflect changes in our business activities, technology, regulatory expectations and international privacy standards. Privacy is considered as part of our broader approach to information governance, cybersecurity and responsible business practices.
In the Sultanate of Oman, we are committed to complying with the PDPL, the Executive Regulation and the controls, procedures and decisions issued by the Ministry, being the authority responsible for supervising the application of the PDPL. We are also committed to complying with other privacy and data protection laws and regulations applicable to our operations in the jurisdictions in which we conduct business.
Where our operations, service providers or counterparties are located in other jurisdictions, different privacy requirements may apply depending on the nature of the interaction, the location of individuals and the services being provided.
We monitor developments in privacy legislation and seek to maintain practices, processes and controls that support responsible information management and alignment with recognized international privacy standards.
In accordance with Article 20 of the PDPL and Articles 34 to 36 of the Executive Regulation, we have appointed a Personal Data Protection Officer (the “DPO”) for GTS. The DPO monitors our compliance with the PDPL and the Executive Regulation, advises on our obligations thereunder, and is the point of contact for personal data subjects and for the Ministry on all matters relating to the processing of personal data.
You may contact the DPO regarding any matter concerning the processing of your personal data:
We manage personal data according to recognized privacy principles. These principles guide how we collect, use, share and protect personal data.
We process personal data in a lawful, fair and transparent manner and, where required by the PDPL, only on the basis of your explicit consent or another basis permitted under the PDPL. We provide clear information about our processing activities, including what personal data we collect, why we collect it, how it is used, the levels of disclosure and how you may exercise your rights.
We collect and use personal data for the purposes described in this Notice and for related or compatible purposes, and we do not use it for purposes that are incompatible with those purposes unless such use is permitted or required by law.
We seek to collect personal data that is relevant to, and appropriate for, the purposes for which it is processed.
We take reasonable steps to ensure that personal data is accurate and, where necessary, kept up to date.
We retain personal data for as long as it is required for the purposes for which it was collected or for other legitimate business, legal, regulatory or record-keeping purposes.
We protect personal data through appropriate security measures and restrict access to those who need it for legitimate purposes. We apply appropriate technical, organizational and administrative safeguards designed to protect personal data against misuse, loss, unauthorized access or disclosure.
We maintain responsibility for complying with these privacy principles and implement appropriate governance, oversight and controls to support the responsible management of personal data.
The type of personal data we collect depends on how you interact with us, the services or information you request and the nature of our relationship with you. We may collect any personal data that is relevant to our relationship with you or to the purposes described in this Notice, and the categories listed below are illustrative and not exhaustive.
You may provide personal data when you:
This information may include, without limitation:
Where you apply for employment opportunities with us, we may collect information including, without limitation:
Where organizations register or interact with us as suppliers, contractors or business partners, we may collect, without limitation:
When you visit the Website, we may automatically collect certain technical information, including, without limitation:
This information helps us maintain, secure and improve the Website and our digital services. We may combine technical information with other personal data we hold and use it to understand usage, derive insights and improve our services.
The Website is not designed for the collection of the special categories of personal data referred to in Article 5 of the PDPL.
Where we collect or process special categories of personal data, we do so in accordance with the PDPL. If such data is provided to us voluntarily without having been requested, we may retain and process it subject to the same safeguards, or delete it.
We collect personal data through a variety of sources depending on the nature of our relationship with you.
We collect personal data that you choose to provide when you communicate or interact with us, including through the Website, email, telephone, meetings, recruitment processes, supplier registration activities and other business interactions.
When you access the Website or our digital services, certain technical data may be collected through cookies, analytics technologies (including Google Analytics), server logs, security monitoring tools and similar technologies, in accordance with Section 12 (Cookies and Digital Technologies) of this Notice. This data helps us operate, maintain, improve and secure our digital services.
Where appropriate, we may obtain personal data from third parties, including recruitment agencies, professional references, business partners, supplier registration platforms, publicly available sources, government or regulatory authorities, our affiliates and related entities and any other lawful source. We expect such personal data to have been collected and shared in accordance with the PDPL and other applicable law.
We may also create or generate personal data in the course of our relationship with you, including records of communications, enquiries, contracts, supplier evaluations, recruitment assessments, compliance activities and other business records.
We use personal data only on the basis of your explicit consent or where processing is otherwise permitted under the PDPL, and in each case for the purposes described in this Notice.
The purposes for which we use personal data include, without limitation, the following.
We use personal data to:
Where individuals apply for employment opportunities, we use personal data to:
We use vendor and supplier information to:
We may use personal data for:
We use technical data to:
We may use personal data where necessary to:
We may also use personal data for other purposes that are related to, or compatible with, the purposes described in this Notice, that are within the scope of your consent, that are notified to you, or that are otherwise permitted or required under the PDPL or other applicable law.
We send advertising, marketing and other materials with commercial purposes only in accordance with the PDPL and the Executive Regulation. In particular:
You may opt out at any time by using the opt-out mechanism provided in the relevant communication or by contacting the DPO info@gulftestinglab.com. Marketing consent given through the Website or otherwise covers communications from GTS regarding its products, services, projects and events, unless the consent states otherwise.
We rely on the following bases:
Our primary basis for processing personal data is your explicit consent, obtained in accordance with the relevant provisions of the PDPL and the Executive Regulation. Consent must be given by a person with full legal capacity, in a clear manner and without coercion, and may be provided in writing, electronically or through the consent mechanisms made available on the Website. Your consent may be given by any affirmative act made available by us, including ticking a consent box, selecting “Accept” or an equivalent option on the cookie consent tool, submitting a form to which a consent statement is attached, or proceeding with a request after a consent statement has been presented to you; each such act constitutes your explicit consent given electronically for the purposes of the PDPL. By accessing or continuing to use the Website, you accept this Notice as the notice governing the processing of your personal data, and you will be invited through the mechanisms described above to provide your consent before your personal data is processed. We maintain records evidencing the consents obtained from you, including consents given through the Website forms, cookie consents and marketing consents. Unless it expressly states otherwise, a consent given through any of our channels covers all of the purposes, disclosures and transfers described in this Notice, including processing by our affiliates and related entities, and remains valid until withdrawn.
Where processing relies on consent, you may withdraw your consent at any time, although withdrawal will not affect processing carried out before consent was withdrawn.
In accordance with the PDPL, explicit consent is not required where, among the other cases listed in that Article, the processing is:
We may process personal data where necessary to comply with legal or regulatory obligations, including obligations relating to:
Where the processing of personal data is subject to the laws of a jurisdiction other than the Sultanate of Oman, we may also rely on any lawful ground recognized under those laws. For processing subject to the PDPL, we rely on consent and on the other grounds recognized by the PDPL.
In accordance with Article 21 of the PDPL, we maintain the confidentiality of personal data and do not disclose it except with your prior consent or as otherwise permitted under the PDPL. We share personal data only where necessary for the purposes described in this Notice, legal compliance or the operation of our activities.
We may share personal data with our affiliates and related entities for our business operations and other legitimate purposes, within the scope of your consent (which, unless it states otherwise, extends to sharing with our affiliates and related entities) or as otherwise permitted under the PDPL, including for purposes such as:
Access to personal data is limited to individuals who require it for legitimate business purposes.
We may engage selected third-party service providers that process personal data on our behalf.
These may include providers of:
Our current principal service providers include our website hosting provider, whose servers are located outside the Sultanate of Oman.
Service providers are required to maintain appropriate confidentiality, security and data protection standards. Before engaging service providers, we consider factors such as the nature of the services, the categories of personal data involved, information security practices, confidentiality obligations, compliance requirements and appropriate contractual protections.
In accordance with Article 3 of the Executive Regulation, processors process personal data on our behalf and act as our representatives within the scope of the services they provide. They are required to process personal data only on our documented instructions, maintain appropriate technical and organizational security measures, protect its confidentiality and comply with the PDPL and applicable contractual requirements. They are not permitted to use personal data for their own independent purposes unless such use is separately authorized or required by law.
We may share personal data with professional advisers, including:
Such sharing occurs where necessary to obtain advice, meet obligations or protect our legitimate interests.
We may disclose personal data where required or permitted by law, including to:
If GTS undergoes a merger, acquisition, restructuring, sale or other corporate transaction, personal data may be shared with relevant parties involved in that process, subject to appropriate confidentiality and legal protections and compliance with the PDPL.
Our operations, service providers and technology platforms may involve the processing of personal data across different countries. In particular, the Website is hosted with a third-party hosting provider, and enquiries and submissions made through the Website may accordingly be stored in the servers of that hosting provider outside the Sultanate of Oman.
We transfer personal data outside the Sultanate of Oman only in accordance with Article 23 of the PDPL and Articles 37 to 40 of the Executive Regulation, as described below.
Personal data may be transferred, stored or accessed outside the country where it was originally collected, including where:
Before transferring personal data outside the Sultanate of Oman, we:
Your consent given under this Notice includes your consent to the transfers described in this Section, including the storage of Website submissions on cloud servers outside the Sultanate of Oman, unless you expressly indicate otherwise.
In addition, depending on the jurisdictions involved and applicable legal requirements, we apply supplementary safeguards, which may include:
We remain committed to protecting personal data throughout the information lifecycle, regardless of where it is processed. We do not transfer personal data that has been processed in violation of the PDPL, and we do not transfer personal data where the transfer is likely to cause harm to you.
We retain personal data for as long as reasonably necessary for the purposes for which it was collected, for related or compatible purposes, or to meet applicable legal, regulatory, contractual or business requirements. Retention periods may vary depending on:
Examples include:
When personal data is no longer required, we take appropriate steps to securely delete, destroy or anonymize it in accordance with our information management practices and applicable requirements.
Where personal data is subject to retention requirements, we maintain appropriate controls to ensure it is retained only for the required period and is protected throughout its lifecycle.
In accordance with Article 27 of the Executive Regulation, we retain the documents of processing operations on the basis of specific and legitimate reasons, define retention periods appropriate to the purpose of the processing and maintain technical protection systems to retain such documents securely.
The Website uses cookies and similar technologies (including Google Analytics) to support functionality, security, performance, user experience and marketing.
A cookie is a small text file stored on your device when you visit a website. Cookies allow websites to recognize your device and remember certain information about your interaction with the website.
These cookies are necessary for the operation, functionality and security of the Website. They may support functions such as:
These cookies generally cannot be disabled because the website may not function properly without them.
These cookies help us understand how visitors use the Website. We use Google Analytics for this purpose. They may provide information such as:
This information helps us improve the Website and user experience.
These cookies allow websites to remember preferences and settings, such as:
These cookies may be used to support marketing activities, measure campaign effectiveness and provide more relevant content based on interactions with the Website.
We deploy analytics and performance, functional and marketing and advertising cookies only after obtaining your explicit consent through the cookie consent tool on the Website, in accordance with the PDPL. You may withdraw your consent at any time through the cookie settings on the Website or by adjusting your browser settings, without affecting the lawfulness of processing carried out before the withdrawal.
Most internet browsers allow users to manage cookie settings. Depending on the browser and device settings, you may be able to:
Please note that restricting or disabling cookies may affect certain website functions or features.
Protecting personal data is an important part of our corporate responsibility.
We maintain appropriate technical, organizational and administrative safeguards designed to protect personal data against unauthorized access, accidental loss, misuse, alteration, disclosure or destruction.
Our security practices are designed to support confidentiality, integrity and availability of information throughout its lifecycle.
Depending on the nature of the information and processing activities, our safeguards may include:
We regularly review our security measures to address changing risks and technological developments.
In accordance with the Executive Regulation, we establish, use and activate electronic systems designed to prevent unauthorized access to, or breach, alteration or misuse of, personal data; we maintain mechanisms for recovering personal data in the event of a physical or technical incident; and we conduct regular testing of the effectiveness of the technical procedures we implement.
While we take appropriate measures to protect personal data, no method of electronic transmission, processing or storage can be guaranteed to be completely secure. We therefore cannot guarantee absolute security, but we remain committed to maintaining appropriate safeguards and continuously improving our security practices.
As technology continues to evolve, we may use digital tools, automated technologies, analytics and artificial intelligence-enabled solutions to support our business activities, analyse information, derive insights, improve efficiency and enhance our operations.
Where such technologies involve the processing of personal data, we seek to apply appropriate safeguards, including consideration of:
Where individual review or decision-making is required, we apply appropriate human oversight. Our approach to emerging technologies will continue to evolve as technology, regulatory expectations and best practices develop.
We maintain processes designed to identify, assess, manage and respond to actual or suspected personal data breaches and incidents.
For the purposes of the PDPL, a personal data breach means unlawful access to personal data leading to its unauthorized destruction, alteration, disclosure, access or processing. A personal data incident may include situations where personal data is:
Where an incident occurs, we may take steps including:
In accordance with Article 19 of the PDPL and Articles 30 to 33 of the Executive Regulation:
We are committed to responding to privacy and security incidents responsibly and taking appropriate action to protect personal data.
We respect your rights regarding your personal data and are committed to supporting individuals in understanding and exercising those rights.
Under Article 11 of the PDPL and the Executive Regulation, you have the rights described below in relation to your personal data. Individuals in jurisdictions outside the Sultanate of Oman may have additional rights under their local laws.
These rights include:
You may request confirmation of whether we process your personal data and request a copy of your processed personal data, provided in a legible and clear electronic or paper format, in accordance with Article 19 of the Executive Regulation. The copy provided will not include personal data that could identify another individual.
You may request that inaccurate, incomplete or outdated personal data be amended or updated, and you may request the withholding of your personal data.
You may request deletion of your personal data where:
We may decline a deletion request where retention is necessary to comply with a legal obligation imposed on us by any law, judgment or court decision, where the processing is necessary for national archiving and documentation, or where there is an existing dispute between us and you.
When you submit a request to exercise any of your rights, you may also request the cessation of the processing of your personal data until your request has been addressed, in accordance with Article 16 of the Executive Regulation.
You may request the transfer of your personal data to another controller, in accordance with Article 11 of the PDPL and Article 20 of the Executive Regulation.
Where we rely on your consent to process personal data, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
You have the right to be notified of any breach or violation of your personal data and of the actions taken in that regard, as described in Section 15 of this Notice.
If you believe that the processing of your personal data does not comply with the PDPL or the Executive Regulation, we encourage you to contact the DPO at info@gulftestinglab.com so that we may address your concern. You also have the right to submit a complaint or report to the competent department of the Ministry within (30) thirty days of becoming aware of the violation, in accordance with Article 12 of the PDPL and Article 41 of the Executive Regulation.
If you wish to exercise any privacy rights or have questions about how we process your personal data, you may contact the Data Protection Officer using the contact details provided in this Notice.
When submitting a request, we may ask for information necessary to verify your identity and ensure that personal data is disclosed only to the appropriate individual.
Requests to exercise your rights are made free of charge. We will respond to your request within a maximum period of (45) forty-five days from the date of receiving it, in accordance with Article 16 of the Executive Regulation. We may reject a request, in whole or in part, where it is unjustifiably repetitive or where fulfilling it would require extraordinary effort; in all cases, we will inform you of the reasons for any refusal within the period referred to above.
When responding to requests, we may need to consider:
If we are unable to fulfil a request, we will explain the reason where permitted by applicable law.
The Website may contain links to, or integrate with, websites, applications or online services operated by third parties. These links may be provided for convenience, information or to support certain website functionality.
Third-party websites operate independently from us and may have their own privacy notices, terms and conditions and security practices. We do not control how third parties collect, use or protect personal data through their websites or services.
We are not responsible for:
We encourage you to review the privacy notices of third-party websites before providing personal data on such platforms. Where the Website uses embedded content or third-party technologies, such as analytics tools, maps, videos or other services, those providers may process information in accordance with their own privacy practices.
The Website and our business activities are primarily intended for business users, customers, suppliers, prospective employees and professional stakeholders.
We do not knowingly seek to collect personal data from children or intentionally direct the Website or our products or services toward children.
In accordance with Article 6 of the PDPL and Articles 11 to 15 of the Executive Regulation, we process the personal data of a child only on the basis of the explicit consent of the child’s guardian, unless the processing is in the child’s best interest. Where a child’s personal data is processed, we provide means by which the guardian may access, update and amend that data, and we do not disclose or share a child’s personal data with third parties without the guardian’s express consent. If we become aware that we have collected personal data from a child without the required consent, we will take appropriate steps to review and, where required, delete that data.
If you believe that a child has provided personal data to us, please contact us using the details provided in this Notice.
We may update this Privacy Notice from time to time to reflect changes in:
When we make changes, we will update the Effective Date at the beginning of this Notice and publish the updated version on the Website. The updated Notice applies from its publication, and your continued interaction with us within the scope of your existing consents will be governed by the updated Notice.
Where changes require fresh consent under the PDPL, we will seek that consent; otherwise, no further action is required from you.
We encourage you to review this Notice periodically to remain informed about how we protect and use personal data.
If you have questions about this Privacy Notice, wish to exercise your privacy rights, or require further information about our handling of personal data, please contact us.
We are committed to handling privacy enquiries responsibly, transparently and in accordance with the PDPL and other applicable requirements.
