Privacy Policy — UAE (English)

PRIVACY POLICY

Last updated: 2 April 2026

1. DATA CONTROLLER IDENTITY

This Privacy Policy is prepared by Crafbyte ("Company", "We", "Us") acting as a Data Controller pursuant to the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL").

Crafbyte is an international web design and digital agency.

Contact: legal@crafbyte.com | Web: crafbyte.com

2. PERSONAL DATA WE COLLECT

We may collect and process the following categories of personal data:

Category Examples
Identity data Name, surname
Contact data Email address, phone number, postal address
Usage data IP address, browser type, pages visited, visit duration
Commercial data Company name, tax ID, billing information
Communication data Messages, enquiries, project correspondence

We do not collect sensitive personal data (health, biometric, religious, or political data).

3. PURPOSES OF PROCESSING

Your personal data is processed for the following purposes:

  • Provision of services and project management
  • Formation and performance of contracts
  • Client relationship management and communication
  • Invoicing and accounting
  • Compliance with legal obligations
  • Website security and improvement
  • Marketing and promotional communications (with your consent)

4. LEGAL BASIS FOR PROCESSING

Pursuant to the PDPL:

  • Contractual necessity: data required to fulfil a service agreement
  • Legal obligation: tax and accounting regulatory requirements
  • Legitimate interest: website security and technical operations
  • Consent: marketing communications and optional data collection

5. SHARING AND TRANSFER OF PERSONAL DATA

5.1. Domestic Disclosures

Your data may be shared with: - Service providers (hosting, payment processing, analytics) - Legal advisors and accountants - Competent public authorities when required by law

5.2. International Transfers

As an international company, Crafbyte may transfer your data outside the UAE. Such transfers are carried out: - To countries providing an adequate level of data protection recognised by the UAE, or - With appropriate safeguards (such as standard contractual clauses), or - With your explicit consent.

6. DATA RETENTION

Data Type Retention Period
Contract and invoice data 10 years (UAE Commercial Companies Law)
Client correspondence 3 years
Website usage data 2 years
Marketing consent records Until consent is withdrawn

Upon expiry of the retention period, data is securely deleted, destroyed, or anonymised.

7. SECURITY MEASURES

Crafbyte implements appropriate technical and organisational measures to protect your personal data, including:

  • SSL/TLS encryption
  • Access controls and authorisation
  • Regular security testing
  • Staff confidentiality training

Data breach notification: In the event of a serious breach, we will notify the UAE Data Office and affected individuals as required by the PDPL.

8. YOUR RIGHTS UNDER THE PDPL

You have the following rights regarding your personal data:

  1. Access: request a copy of your personal data
  2. Rectification: request correction of inaccurate data
  3. Erasure: request deletion under applicable conditions
  4. Portability: receive your data in a machine-readable format
  5. Objection: opt out of profiling and direct marketing
  6. Withdrawal of consent: withdraw consent at any time, without affecting prior processing

To exercise your rights, contact us at: legal@crafbyte.com
We will respond within 30 days.

9. COOKIES

Our website uses cookies:

Cookie Type Purpose Consent Required
Strictly necessary Site functionality No
Analytics Traffic analysis (e.g. Google Analytics) Yes
Marketing Targeted advertising Yes

You may disable cookies via your browser settings.

10. UPDATES TO THIS POLICY

This Policy may be updated from time to time. Changes take effect upon publication on our website. For significant changes, we may notify you by email.

11. SUPERVISORY AUTHORITY

You may lodge a complaint with the UAE Data Office:

Website: uaedataoffice.ae

12. NOTE ON FREE ZONE APPLICABILITY

If Crafbyte operates through a DIFC entity, the applicable data protection law is the DIFC Data Protection Law 2020. If operating through ADGM, the applicable law is the ADGM Data Protection Regulations 2021. In those cases, the relevant authority is the respective free zone's data protection commissioner.