Privacy Policy
This policy explains what personal data Alfalab collects through this website and in the course of business, why, how long we keep it and the rights you have.
Who is responsible for your data
Alfalab Marketing & Web Development is the controller of personal data collected through alfalabmarketing.com and in the course of our business. In this policy, 'Alfalab', 'we' and 'us' mean Alfalab Marketing & Web Development.
We process personal data in line with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and the other laws of the United Arab Emirates that apply to us.
For privacy questions or to exercise your rights, contact us through our contact page.
What we collect
- Enquiry and proposal forms
- Your name, company, email address, phone number, the service you are interested in, your project description, budget range and timing, and any files you upload.
- Call bookings
- Your name, email address, chosen time slot, time zone and the answers you give to preparation questions.
- Direct messages
- Content of emails, WhatsApp messages and calls you send us, with the phone number or address they came from.
- Client and contract records
- Contact details of client staff, contracts, invoices, payment records and project communications.
- Technical data
- IP address, browser type, device type, pages requested and timestamps, recorded in server and security logs.
- Analytics data
- Pages viewed, referring source, approximate location and interactions, collected only if you consent to analytics cookies. See our cookie policy.
Please do not send us sensitive personal data, such as health, biometric or financial account details, through the website. If a project requires us to handle such data, we will agree how in writing first.
Why we use it and on what basis
| Purpose | Data used | Basis for processing |
|---|---|---|
| Replying to your enquiry and preparing a proposal | Form, booking and message data | Steps you have asked us to take before entering a contract, or your consent |
| Delivering a project and managing the client relationship | Client and contract records, communications | Performance of our contract with you or your employer |
| Invoicing, accounting and tax records | Client and contract records | Compliance with legal obligations, including UAE VAT record-keeping |
| Keeping the website secure and working | Technical data | Necessary to provide the website you request and to protect our systems and users |
| Understanding how the website is used | Analytics data | Your consent, which you can withdraw at any time |
| Sending updates or marketing messages | Name, email, phone number | Your consent, given separately; you can opt out in any message |
Where we rely on consent, it must be specific, clear and unambiguous, and you can withdraw it as easily as you gave it. Withdrawing consent does not affect processing that happened before. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Where we use software to sort or summarise incoming enquiries, a person reviews the enquiry before we reply or decide anything about it.
Data in systems we build for clients
When we build or support a website, CRM integration, automation or application for a client, the client usually decides what personal data that system processes and is its controller. We act on the client's documented instructions as a processor, under a data processing agreement. If you are a customer of one of our clients, please contact that business directly about your data; we will help them respond.
Transfers outside the UAE
Some of our service providers, and some of our team, may process personal data outside the UAE. The PDPL permits cross-border transfers to countries with adequate data protection, and in other cases subject to conditions such as contractual safeguards or your consent. We transfer data only on a basis the applicable law allows, and we require the recipient to protect it to the standard this policy describes.
How long we keep it
We keep personal data only as long as we need it for the purpose we collected it for, then delete it or anonymise it so it can no longer identify you. In practice, that means:
| Data | How long we keep it |
|---|---|
| Enquiries that do not become projects | As long as needed to respond and follow up on the enquiry |
| Client and contract records | For the duration of the relationship, and afterwards as long as needed to meet our contractual obligations or deal with any claim |
| Invoices and accounting records | For the period required by UAE VAT and commercial record-keeping laws |
| Server and security logs | As long as needed to keep the website secure and investigate incidents |
| Analytics data | As long as needed to understand how the website is used, in aggregated or pseudonymised form where possible |
| Marketing consent records | As long as needed to show that you consented or withdrew consent |
Your rights
Subject to the conditions and exceptions in the applicable law, you can ask us to:
- Tell you what personal data we hold about you, why, who we share it with and how long we keep it.
- Provide your data in a structured, machine-readable form, or transfer it to another controller where technically feasible.
- Correct inaccurate or incomplete data.
- Erase data that is no longer needed or that we process unlawfully.
- Restrict processing while an objection or correction is resolved.
- Stop processing for direct marketing, or where processing is not necessary for the purposes it was collected for.
- Object to decisions made solely by automated processing that significantly affect you.
- Withdraw consent at any time.
Send requests through our contact page. We may need to verify your identity before acting, and we will respond within the period the applicable law requires. If you are not satisfied with our response, you can complain to the UAE Data Office.
How we protect it
We use technical and organisational measures appropriate to the risk to protect personal data, including encrypted connections to this website, access limited to the people who need it, and service providers with recognised security practices. No system is completely secure. If a breach affects your personal data and puts your privacy at risk, we will notify you and the relevant authority as the applicable law requires.
Children, links and changes to this policy
This website is intended for businesses and is not directed at children. We do not knowingly collect children's personal data.
Links to other websites are not covered by this policy. Read the privacy notice of each site you visit.
We will update this policy when our processing changes. The version published on this page is the one that applies.