1. Data Controller Identification
This Privacy Policy applies to personal data processed by FyrahPrivacy (referred to herein as "FyrahPrivacy", "we", "us", or "our"), operating out of Dubai Silicon Oasis, Dubai, United Arab Emirates.
Under Federal Decree-Law No. 45 of 2021, FyrahPrivacy acts as the Data Controller with respect to the personal data collected through our website (fyrahprivacy.com), our interactive compliance assessment scorecard, customer scheduling tools, downloadable resources, and commercial advisory communications.
Official Data Protection Contact:
Attention: Sayyid Muhammed, Lead Privacy Architect & DPO
Direct Email: privacy@fyrahprivacy.com
Operating Base: Dubai Silicon Oasis, Dubai, United Arab Emirates
2. Categories of Personal Data We Process
In accordance with statutory data minimization principles under Article 5 of the UAE PDPL, we limit personal data collection strictly to what is adequate, relevant, and necessary for the operational purposes specified below:
- Contact & Corporate Identification Data: Full name, professional work email address, company name, website URL, job title, and commercial contact telephone numbers submitted via our contact, partner, or blueprint lead generation forms.
- Operational Assessment & Governance Data: Self-reported data governance parameters, hosting architectures, SaaS vendor rosters, and compliance operational metrics submitted through the UAE PDPL Readiness Diagnostic Tool.
- Appointment & Consultation Data: Selected consultation calendar dates, time zones, meeting agendas, and video conference coordinates collected via our scheduling integrations (Google Meet / Calendly).
- Technical Telemetry & System Logs: Minimal server logs, IP addresses (anonymized where technically feasible), browser types, and timestamp metrics collected solely to maintain website security, prevent DDoS activity, and ensure service reliability.
Statutory Note: We do not collect or process sensitive personal data (e.g., biometric, genetic, health, or judicial records) through our public web platform.
3. Legal Bases & Processing Purposes (Articles 4, 5 & 6)
In accordance with Articles 4, 5, and 6 of the UAE PDPL, every processing activity conducted by FyrahPrivacy is justified by an explicit statutory ground:
| Processing Purpose | Categories of Data | Lawful Basis (Decree-Law 45/2021) |
|---|---|---|
| Delivering requested compliance assessment scorecards & blueprints | Name, work email, company name, industry, diagnostic inputs | Article 6: Explicit Consent |
| Scheduling and conducting 20-minute operational scoping calls | Name, work email, meeting topic, calendar slot | Article 4(2): Pre-Contractual Steps at the request of the Data Subject |
| Executing fixed-fee compliance sprints & delivering RoPAs/DPAs | Corporate contact info, operational tech stack data, billing details | Article 4(2): Performance of Contract |
| Channel partner onboarding & referral commission management | Partner contact details, firm name, collaboration model | Article 4(2): Performance of Contract |
| Fulfilling statutory accounting, tax, and regulatory record-keeping duties | Invoices, executed service agreements, payment logs | Article 4(3): Legal & Statutory Obligation |
| Maintaining web application security and blocking malicious attacks | Server logs, IP address, user-agent string | Technical Necessity & System Integrity |
4. Cookies & Tracking Technologies (Zero-Cookie Architecture)
In strict alignment with our Privacy-by-Design principles, FyrahPrivacy operates a zero-cookie, tracker-free digital architecture. We do not deploy third-party advertising cookies, cross-site profiling pixels, canvas fingerprinting scripts, or persistent tracking technologies on your device.
When you submit a contact inquiry, request a blueprint download, or exercise statutory rights, data is processed directly via secure HTTPS endpoints without dropping persistent marketing cookies. Third-party integrations—such as scheduling discovery sessions via our external Calendly portal—operate under their respective platform privacy and cookie policies upon redirect.
5. Cross-Border Transfers & Third-Party Processors (Articles 22 & 23)
To host our static website, deliver digital blueprints, process inquiries, and manage project scheduling, FyrahPrivacy engages vetted enterprise cloud infrastructure. Certain data is stored on servers located outside the UAE:
- Web Hosting & Edge Delivery: Hostinger International & Cloudflare (Secure edge routing and server hosting).
- Inquiry & Form Infrastructure: Formspree / Secure Cloud Endpoints (Hosted in secure data centers providing robust data protection standards).
- Video Scoping & Calendar Scheduling: Google Workspace / Google Meet / Calendly (Enterprise cloud infrastructure).
Under Articles 22 and 23 of the UAE PDPL, all international data transfers are protected through executed Data Processing Agreements (DPAs) and Standard Contractual Clauses guaranteeing technical security measures equivalent to UAE federal statutory standards.
6. Data Retention & Deletion Schedules
Personal data is retained only for the duration necessary to satisfy the commercial and statutory purpose for which it was obtained:
- Inquiries & Assessment Submissions: Retained for 12 months following last interaction, after which records are permanently erased or anonymized for aggregated industry benchmarking.
- Client Sprint & Project Files: Retained for 3 years following sprint completion to assist with client enterprise vendor audits, after which working files are securely purged unless an active DPO retainer is in place.
- Accounting & Invoicing Records: Retained for 5 years in compliance with UAE commercial and corporate tax record-keeping requirements under Federal Tax Authority (FTA) regulations.
7. Your Statutory Rights (Articles 13–18)
Under Federal Decree-Law No. 45 of 2021, you possess enforceable statutory rights regarding your personal records:
- Right of Access & Information (Article 13): You may request confirmation of whether we process your personal data and obtain a structured copy of your records.
- Right to Data Portability (Article 14): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
- Right to Correction or Erasure (Article 15): You have the right to request the correction of inaccurate or incomplete records, or the deletion of your personal data where lawful grounds no longer apply.
- Right to Restriction of Processing (Article 16): You may request that we suspend processing during disputes over data accuracy or lawful grounds.
- Right to Stop Processing (Article 17): You may object to and require us to stop processing your personal data for direct marketing, statistical purposes, or unauthorized secondary uses.
- Right to Object to Automated Processing (Article 18): You have the right to object to decisions based solely on automated processing or profiling.
How to Exercise Your Statutory Rights
To request access, rectification, data portability, or erasure of your records, submit an authenticated request through our dedicated intake portal:
Access UAE PDPL Rights Portal →Alternatively, email our privacy office at privacy@fyrahprivacy.com. We verify identity and resolve all qualifying requests within thirty (30) calendar days at zero charge.
8. Technical & Organizational Security Controls (Articles 7, 8 & 9)
FyrahPrivacy enforces strict technical safeguards to protect personal data against unauthorized disclosure, accidental loss, or unlawful destruction. Measures include TLS 1.3 encryption for all data in transit, strict multi-factor authentication (MFA) across all administrative accounts, zero-trust role-based access, and an operational Security Incident & Data Breach Response Protocol aligned with Article 9 of Federal Decree-Law No. 45 of 2021.
9. Inquiries & UAE Data Office Recourse (Article 24)
If you have questions regarding this Privacy Policy or believe that your personal data has been handled inconsistently with UAE law, please contact our Lead Privacy Architect at privacy@fyrahprivacy.com.
Under Article 24 of the UAE PDPL, you also possess the statutory right to lodge a formal complaint with the UAE Data Office if you believe that an unresolved violation of Federal Decree-Law No. 45 of 2021 has occurred.