Privacy Policy

1.1 Who we are

Zana Trading and Consulting FZ-LLC (“Zana”, “we”, “us”) is the data controller responsible for personal data collected through this website.

Legal name

Zana Trading and Consulting FZ-LLC

Legal form

Free Zone Limited Liability Company (FZ-LLC)

Licensing authority

Ras Al Khaimah Economic Zone Authority (RAKEZ), United Arab Emirates

Trade licences

E-Commerce Licence 45003769 · General Trading Licence 7007075 · Project Management Consultancy Licence 47012270

Registered and physical address

FOB51512, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates

Telephone

+971 4 276 0552 · +971 58 575 6240

Email

info@zanaconsult.com

For any question about this policy or about how we handle personal data, write to info@zanaconsult.com marking your message for the attention of the person responsible for data protection.

We have not appointed a Data Protection Officer. Article 10 of the PDPL requires one where processing involves high risk through new technologies, systematic and comprehensive assessment of sensitive data including profiling, or large volumes of sensitive data. The processing described in this policy — an enquiry form and standard server logs — falls into none of those categories. We keep this assessment under review.

1.2 What this policy covers

This policy explains what personal data we collect through this website, why we collect it, how long we keep it, who we share it with, and the rights available to you under the UAE Personal Data Protection Law (Federal Decree-Law 45/2021).

1.3 What we collect

Information you give us. When you submit the enquiry form we collect your full name, company name, business email address, the area of interest you select, and the content of your message.

All fields on the enquiry form are required. Without them we cannot identify you, understand what you are asking for or reply. Providing this data is voluntary: if you prefer not to use the form, you can contact us by email or telephone at the details in section 1.1.

Where your enquiry goes. The enquiry form is delivered by Web3Forms, a form-delivery service operated by Web3Forms (backendless.dev). It receives everything you type into the form and processes it solely in order to pass it to our mailbox. It acts as our processor for that purpose.

Information collected automatically. Our hosting provider records standard server logs, including IP address, browser type, pages requested and the time of the request. These logs are used to keep the site secure and available.

We do not use advertising cookies, tracking pixels or third-party analytics on this website. We do not collect special categories of personal data, and we do not knowingly collect data from anyone under 18.

1.4 Why we use it and on what basis

We process personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“PDPL”). Under the PDPL, processing is based on your consent unless one of the specific cases set out in Article 4 of the PDPL applies.

Where processing is based on your consent, you may withdraw that consent at any time as described in section 1.8. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

We do not rely on “legitimate interests” as a basis for processing, as that concept does not form part of the PDPL.

We do not use your data for automated decision-making or profiling, and we do not sell it.

1.5 Who we share it with

We share personal data only where necessary, and only with:

• Service providers who operate our website infrastructure and email, bound to process data solely on our instructions. These are Cloudflare, which hosts and serves this website, and Web3Forms, which delivers enquiries submitted through the form to our mailbox
• Professional advisers — legal, tax and accounting — where a matter requires their involvement
• Authorities, where disclosure is required by applicable law or a valid regulatory request
• Corporate transactions — where we sell, transfer or reorganise all or part of our business, personal data may be disclosed to the counterparty and its advisers, subject to confidentiality obligations

Each recipient acts either as our processor, bound by data protection terms requiring it to process personal data only on our instructions, keep it confidential and apply appropriate security measures, or in its own capacity where the law requires. Details of the countries in which these recipients are located are set out in section 1.6.

We do not disclose personal data to any other third party except as described in this policy, as required by the laws of the United Arab Emirates, or with your consent.

1.6 International transfers

This website is served from the globally distributed edge network of Cloudflare, and enquiries submitted through the form are handled by Web3Forms before reaching our mailbox. Both operate from infrastructure outside the United Arab Emirates. Personal data collected through this website is therefore transferred to, and stored in, jurisdictions outside the United Arab Emirates.

No list of jurisdictions recognised as providing an adequate level of protection for the purposes of Article 22 of the PDPL has yet been issued. We therefore rely on the following mechanisms under Article 23 of the PDPL:

• Contractual safeguards. Where a provider receives personal data outside the United Arab Emirates, we rely on data protection terms binding that provider, whether forming part of the terms on which its service is supplied or agreed separately with us. We select providers whose terms impose appropriate and enforceable obligations, including confidentiality, security measures, restrictions on onward transfer and assistance with requests from data subjects, and we keep those arrangements under review.
• Your consent. Where a transfer cannot be covered by contractual safeguards, we will transfer personal data outside the United Arab Emirates only with your express consent, having informed you of the risks.

We transfer only the personal data necessary for the purposes described in section 1.4. You may request further information about these transfers and about the safeguards we apply by writing to info@zanaconsult.com.

1.7 How long we keep it

We keep personal data only for as long as it is needed for the purposes described in section 1.4.

Enquiries that do not lead to a business relationship are kept while the enquiry is live and for a reasonable period afterwards, and are then deleted. Records connected to a contract, invoice or transaction are kept for the period required by applicable UAE commercial, tax and anti-money-laundering rules. Server logs are kept for a short period for security and availability purposes and are then deleted.

Where personal data no longer serves any of those purposes, it is deleted within a reasonable period.

1.8 Your rights

Subject to the conditions and exceptions set out in the PDPL, you have the right to:

• Access and information — obtain confirmation of, and information about, the personal data we process about you, the purposes of processing, the parties with whom it is shared, the controls applied to its storage, and the procedures for its rectification or erasure (Article 13 PDPL)
• Data portability — receive the personal data you have provided to us in a structured, machine-readable format, where processing is based on your consent or is necessary for the performance of a contract (Article 14 PDPL)
• Rectification or erasure — have inaccurate or incomplete personal data corrected, or have your personal data erased (Article 15 PDPL)
• Restriction of processing — require us to restrict processing where the accuracy of the data is contested, where processing is contrary to the agreed purposes, or where processing has been carried out in breach of the PDPL (Article 16 PDPL)
• Cessation of processing — require us to stop processing your personal data where processing is not necessary for the purposes for which it was collected, including processing for direct marketing purposes (Article 17 PDPL)
• Object to automated processing — object to decisions produced by automated processing that have legal consequences for you or seriously affect you (Article 18 PDPL). We do not currently carry out any such processing.
• Withdraw consent — withdraw your consent at any time where processing is based on consent (Article 6 PDPL). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, write to info@zanaconsult.com. We will acknowledge your request without undue delay and respond within a reasonable period, or within any period required by law. Where a request is complex or where we receive several requests from you, responding may take longer and we will tell you if it does. We may need to verify your identity before acting, and we may decline a request where the PDPL permits us to do so, in which case we will tell you why.

If you are not satisfied with our response, you may lodge a complaint with the federal authority competent for personal data protection in the United Arab Emirates.

1.9 Security

We apply organisational and technical measures appropriate to the risk, including encrypted transport (HTTPS), restricted access to enquiry data and reliance on providers whose terms carry security obligations. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

Personal data breaches. Where a breach of personal data occurs that would prejudice your privacy, confidentiality or security, we will notify the competent federal authority in accordance with Article 9 of the PDPL, without undue delay after becoming aware of it, and we will notify you where the breach is likely to cause you serious harm. Our notification will describe the nature of the breach, the categories and approximate number of records affected, the likely consequences, the measures taken or proposed to address it, and a contact point for further information. We will record each breach and the action taken in response.

1.10 Cookies

This website uses only cookies strictly necessary for the site to function. It does not set analytics, advertising or profiling cookies. If this changes, we will update this policy and, where required, request your consent first.

1.11 Changes

We may update this policy from time to time. The version published on this page is always the current one, and the date it was last updated is shown at the foot of the page.

Where a change materially affects how we process your personal data, we will take reasonable steps to notify you before the change takes effect and, where the PDPL requires it, obtain your consent.