Privacy Policy (PDPL-Ready)

PRIVACY POLICY (PDPL)

Legal entity name​ (Trade Licence No. Trade licence number​)

This policy is issued under Federal Decree-Law No. 45/2021 on the Protection of Personal Data ("PDPL") and its executive regulations. Full compliance is required by 1 January 2027 under the transitional deadline; this policy documents the legal basis for processing (consent is the default basis), the data subjects' rights, breach notification to the UAE Data Office, DPIAs where required, and restrictions on cross-border transfer.

1. DATA WE COLLECT 1.1. Categories of data collected​

2. WHY WE COLLECT IT 2.1. Purposes of processing​ 2.2. Legal basis: Legal basisConsentContract performanceLegal obligationLegitimate interest.

3. RETENTION 3.1. Retention period​

4. THIRD PARTIES AND PROCESSORS 4.1. Third parties and processors​

5. CROSS-BORDER TRANSFER 5.1. Cross-border transfer​

6. DATA PROTECTION CONTACT 6.1. Data protection contact​. A dedicated Data Protection Officer is mandatory only for large-scale processing of sensitive data, systematic monitoring, or high-risk profiling — a smaller business needs only a contact person.

7. YOUR RIGHTS 7.1. Data subject rights and request channel​

8. SCOPE 8.1. This policy is written for UAE mainland entities under the PDPL. DIFC and ADGM apply their own data protection laws, not the PDPL — confirm which regime applies before use.

Version date: Policy version date