Legal · PDPL Compliant
Privacy Policy
How Capital Tech collects, uses, and protects your personal data under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).
Who We Are
This Privacy Policy explains how [Entity Legal Name] (trading as “Capital Tech”, “we”, “us”, or “our”), a company registered in the United Arab Emirates with registered office at [Registered Address], processes your personal data when you visit [website URL] or contact us about our managed IT, cloud, or consulting services.
We act as the Data Controller for the personal data described below, in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “UAE PDPL”) and its Executive Regulations.
What Data We Collect
| Category | Examples | Source |
|---|---|---|
| Contact data | Name, email, phone, company, job title | You — via contact form, email, phone |
| Enquiry content | Messages, project briefs, attachments you send | You |
| Technical data | IP address, browser type, device type, OS, referring URL | Automatic (server logs) |
| Usage data | Pages visited, time on page, clicks, session duration | Cookies / analytics |
| Communications | Records of calls, emails, and meetings with our team | You and us |
We do not intentionally collect special-category data (health, religion, biometric, etc.) and ask that you do not submit such data through the website.
Why We Process Your Data and Our Lawful Basis
Under Article 5 of the PDPL, we rely on the following lawful bases:
| Purpose | Lawful Basis |
|---|---|
| Responding to your enquiry / quote request | Your consent and pre-contractual steps at your request |
| Delivering proposals, service information, and follow-ups | Legitimate interest in operating our business |
| Website security, fraud prevention, server logs | Legitimate interest in protecting our systems |
| Analytics to improve the website | Your consent (via cookie banner) |
| Complying with UAE law (tax, AML, regulatory requests) | Legal obligation |
Who We Share Your Data With
We do not sell your personal data. We share it only with the following categories of recipients, under written agreements that require them to protect your data:
- Hosting and infrastructure providers (e.g., our website host, email provider)
- Analytics providers (only if you consent to analytics cookies)
- Professional advisers (lawyers, auditors) where strictly necessary
- UAE regulatory authorities when required by law
A current list of categories and named sub-processors is available on request at [privacy email].
International Transfers
Some of our service providers may process data outside the UAE. Where this happens, we ensure that the destination country is on the UAE Data Office’s list of jurisdictions with adequate protection, or we put in place appropriate safeguards (contractual clauses, binding corporate rules, or your explicit consent) in line with Articles 22–23 of the PDPL.
How Long We Keep Your Data
| Data | Retention |
|---|---|
| Enquiry / lead data (no contract follows) | 24 months from last contact |
| Client data (contract entered) | 7 years after contract end (UAE commercial records) |
| Server / security logs | 12 months |
| Marketing data after you unsubscribe | Suppression list only — 5 years |
After these periods, data is securely deleted or anonymised.
Your Rights Under the PDPL
Subject to Article 13 of the PDPL, you have the right to:
Access
View the data we hold about you
Correct
Fix inaccurate or incomplete data
Delete
Remove your data (subject to legal retention)
Restrict
Limit how we process your data
Object
Refuse certain processing activities
Withdraw Consent
Revoke consent at any time
Portability
Receive your data in a portable format
Complain
Escalate to the UAE Data Office
To exercise any right, email [privacy email]. We will respond within 30 days as required by the PDPL.
Cookies
We use cookies and similar technologies as described in our Cookie Notice [link]. You can accept, reject, or customise cookies via the banner shown on your first visit, and change your preferences at any time.
Security
We maintain administrative, technical, and physical safeguards appropriate to the risk — including encryption in transit, access controls, MFA on admin accounts, and regular reviews. No system is perfectly secure; in the event of a personal data breach affecting your rights, we will notify you and the UAE Data Office in line with Articles 9 and 21 of the PDPL.
Children
The website is not directed at children under 18, and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.
Changes to This Policy
We may update this Policy from time to time. When we make material changes, we will:
- Update the Last Updated date above
- Maintain a change log at the bottom of this Policy
- Notify you by email or website banner at least 30 days before the change takes effect, where the change affects you materially
Continued use of the website after the effective date of a change indicates you have read the updated Policy; it does not waive any rights you have under the PDPL.
Contact and Data Protection Officer
Data Controller
[Entity Legal Name]
Address
[Registered Address]
Email (general)
Email (privacy)
[privacy email]
Data Protection Officer
[DPO name / Privacy Lead]
Change Log
- 26 May 2026 — Initial version.