This Law Enforcement Playbook governs how Vendolista, as operator of the MawadOnline marketplace, responds to requests, notices, and actions involving law enforcement and regulatory authorities while processing personal data.

1. Data roles

Vendolista acts as a data controller for personal data processed in connection with platform operations, compliance, fraud prevention, dispute handling, and enforcement actions. Vendors and Buyers remain independent parties and are not agents of Vendolista for data processing purposes.

2. Law enforcement disclosures

Vendolista may collect, use, preserve, and disclose personal data, transaction data, device data, content, communications, and system logs when Vendolista determines such action is necessary or appropriate to:

1. Comply with applicable UAE laws, court orders, subpoenas, or binding requests from competent authorities.

2. Respond to lawful requests from law enforcement or regulatory bodies.

3. Detect, investigate, prevent, or address fraud, counterfeit goods, money laundering, sanctions breaches, or other illegal activity.

4. Enforce the Platform’s Terms, Policies, and marketplace rules.

3. Scope of disclosed data

Disclosures may include account identifiers, contact details, transaction records, payment references, delivery confirmations, uploaded content, audit trails, IP addresses, device identifiers, communications conducted through the Platform, and any other data reasonably required for the stated enforcement purpose.

4. No notice obligation

Where legally permitted, Vendolista may disclose data to authorities without prior notice to Vendors or Buyers. Vendolista has no obligation to challenge, delay, or notify users of lawful enforcement requests unless mandatory law requires otherwise.

5. Data minimization and retention

Vendolista limits disclosures to data reasonably necessary for the relevant enforcement purpose. Data is retained for periods determined by legal obligations, risk management, compliance needs, and evidentiary requirements.

6. Cross-border considerations

Where disclosures involve cross-border transfers, Vendolista applies safeguards required under applicable UAE data protection law.

7. No expansion of platform role

Nothing in this playbook makes Vendolista a seller, service provider, payment service provider, or logistics provider. Enforcement cooperation does not create any agency or fiduciary duty beyond lawful compliance.

This section aligns with the Platform Identity, Role, Enforcement Posture, and Data Position documents.