What we collect, why we collect it, and how it is handled.
Last updated
This policy explains what personal data MaffeiTech Information Technology L.L.C. collects, why we collect it, who we share it with, and what you can require us to do about it.
We are a technology company licensed by the Department of Economy and Tourism in Dubai, United Arab Emirates. We build software — websites, mobile and web applications, and the systems behind them — for our clients, and we operate our own products. Our registered address is Business Bay, Dubai, United Arab Emirates.
For personal data described in this policy, MaffeiTech is the controller: we decide what is collected and why. Where we handle personal data inside a system we built or run for a client, we act as a processor on that client's instructions — see *When we handle data for a client* below.
Questions, or any request under this policy, go to legal@maffeitech.com.
We are established in the United Arab Emirates and licensed on the Dubai mainland, so our processing is governed by Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Companies in certain financial free zones fall under separate regimes; we do not, and this policy does not hedge across them.
The Executive Regulations under that law have not yet been issued, which means several timeframes the law leaves to them are not yet fixed. Rather than stay silent, we have committed below to the deadlines we will hold ourselves to — for responding to you, and for reporting a breach.
Where you are located somewhere with its own data protection law and that law applies to our processing of your data, we will honour the rights it gives you as well. If you think a right you hold in your own country is not reflected here, write to us and we will deal with it on its merits rather than on the wording of this page.
Visitors to this website — anyone who reads maffeitech.com.
People who contact us — by email, phone, or through a form if we add one.
Clients and prospective clients, and the people who work for them.
Job applicants who write to us about a role.
It does not cover the end users of a product we built for a client. That client's own privacy policy governs their data, and we handle it only as their processor.
Information you give us. When you email, call, or send us a brief, we receive whatever you choose to include: your name, email address, telephone number, the company you work for, and the content of your message. If you apply for a role, we receive your CV and anything else you send with it.
Information we collect automatically. When you visit this website, our hosting provider and our analytics receive technical information: your IP address, the type of browser and device you are using, the pages you view, the page that referred you, and the approximate region your connection resolves to. This is ordinary server and analytics data — it is not used to identify you personally, but in some jurisdictions an IP address is personal data, so we treat it as such.
Information from advertising and analytics tools. Where we run advertising campaigns, the platforms we advertise on may set cookies or similar identifiers in your browser so they can measure whether an advertisement led to a visit. What those tools are, what they set, and how to refuse them is set out in our Cookie Policy.
A record of your cookie choice. When you accept or refuse cookies we keep a record of what you chose, when, and which version of the categories you were shown — because the law requires us to be able to demonstrate that consent was given, and a choice stored only in your browser proves nothing. The record includes your browser type and the page you were on. It does not include your IP address: that is put through a one-way cryptographic function with a secret key, so we can check whether a given address consented without ever holding a list of addresses that visited.
We do not collect payment card details through this website. We invoice clients directly and do not operate a checkout here.
We do not knowingly collect sensitive personal data — health, biometric, genetic, racial or ethnic origin, religious or political belief, or criminal record — through this website, and we ask that you do not send it to us unsolicited.
Under Article 4 of the Personal Data Protection Law, processing requires your consent unless one of the specific exceptions in that article applies. Unlike some other regimes, UAE federal law does not recognise a general “legitimate interests” basis, so we do not rely on one.
To reply to you. If you contact us, we use your details to answer. This is necessary to take steps at your request before entering into a contract.
To provide our services. Where you are a client, we process the contact details of the people we work with in order to perform the contract between us.
To run and secure this website. Keeping the site available and protected is necessary to deliver the service you asked for when you requested the page, and to meet our own obligations to safeguard data.
To understand how the site is used. Analytics runs on your consent, given through our cookie controls, and not otherwise.
To advertise. Advertising and conversion measurement run on your consent, given through our cookie controls, and not otherwise.
To consider you for a role. Recruitment is processing at your request ahead of a possible employment contract.
To meet legal obligations. Some records — invoices in particular — we are required to keep, whatever else we would prefer to do.
Where our basis is consent, you can withdraw it at any time and we will stop. Withdrawing consent does not make what we did before it was withdrawn unlawful.
We do not sell personal data. We have never sold personal data and have no plans to.
We share it only in these circumstances:
Service providers who work for us — hosting, email, analytics, and the advertising platforms we use. They act on our instructions and may not use what they receive for their own purposes, other than to the extent an advertising platform acts as a controller in its own right, which its own policy governs.
Professional advisers — lawyers, accountants and auditors, where they need it to advise us.
Authorities — where we are required by law, court order, or a lawful request from a competent authority in the United Arab Emirates or elsewhere.
A buyer — if the business or part of it is sold or reorganised, under the same terms as this policy.
Some of the providers we rely on hold data outside the UAE. Article 22 of the Personal Data Protection Law permits transfers to states recognised as providing adequate protection, but no such recognitions have been issued to date, so we do not rely on that route.
Instead we rely on Article 23, which permits a transfer where it is made under a contract obliging the receiving party to apply the protections this law requires, where you have given express consent, or where the transfer is necessary to perform a contract with you or in your interest. In practice our transfers rest on contractual commitments with our providers, together with your consent where the processing is consent-based.
If you want to know which ground applies to a particular transfer, or to see the safeguards behind it, ask us at legal@maffeitech.com and we will tell you.
Enquiries that do not become work — up to 24 months from your last contact with us, then deleted.
Client records — for the duration of our engagement and for 5 years afterwards, which reflects the periods we are required to retain commercial and tax records in the UAE.
Job applications — 12 months after the decision, so we can come back to you if something suitable opens. Tell us to delete it sooner and we will.
Server and security logs — normally no more than 12 months.
Cookie consent records — kept while the choice is in force and for 24 months after it is replaced, which is what makes them useful as proof that consent was given.
Analytics data — retained for the period set in the tool, which is described in our Cookie Policy.
Where we are required by law to keep something for longer, we keep it for that period and no longer.
We apply technical and organisational measures appropriate to the risk: access is restricted to the people who need it, connections to our systems are encrypted in transit, credentials are managed rather than shared, and access to client systems is logged.
No system is perfectly secure and we will not pretend otherwise. If a breach occurs that would prejudice the privacy, confidentiality or security of your data, we will notify the supervisory authority and tell you directly. The law defers the exact deadline to regulations that have not yet been issued, so we commit to acting without undue delay and in any event within 72 hours of becoming aware — and to telling you what happened, what it affects, and what we are doing about it.
Under the Personal Data Protection Law you may:
Ask what we hold about you, and receive a copy of it.
Have it corrected if it is inaccurate or incomplete.
Have it deleted, where we no longer have a reason to keep it and no legal obligation to retain it.
Restrict what we do with it, for example while a dispute about its accuracy is resolved.
Object to direct marketing at any time and without giving a reason, including any profiling connected to it; object to use of your data for statistical surveys; and object to any processing that does not meet the requirements of the law.
Receive it in a portable form, and have it transmitted to another controller where that is technically feasible.
Withdraw consent you previously gave, at any time.
Object to a decision made about you purely by automated means where it produces a legal or similarly significant effect, and require that a person reviews it. We do not currently make such decisions.
Exercising any of these costs nothing. Write to legal@maffeitech.com. The Personal Data Protection Law leaves the response deadline to regulations that have not yet been issued, so we commit to responding within 30 days, and to telling you if a request is genuinely complex enough to need longer.
We may need to verify who you are before we act — not to obstruct you, but because handing your data to someone else would be the very failure this policy exists to prevent.
If you are unhappy with how we have handled your data, tell us first at legal@maffeitech.com — most problems are quicker to fix directly.
You also have a statutory right to complain to the competent federal authority for personal data protection in the United Arab Emirates. That function sat with the UAE Data Office and, following a restructuring announced in June 2026, now sits within the federal authority responsible for artificial intelligence and data. If you would like the current contact route, ask us and we will give you what we have. You may also complain to a supervisory authority in your own country where one has jurisdiction. Complaining to us first is not a precondition.
Much of our work involves building or running systems that hold other organisations' data. In that work we are a processor, not a controller: we act on our client's documented instructions, we do not decide what is collected or why, and we do not use what we see for our own purposes.
Our commitments in that role — confidentiality, security, sub-processors, breach notification, and what happens to the data when the engagement ends — are set out in the agreement with each client, and where required in a separate data processing agreement. If you are an end user of a product we built for someone else, that organisation is the controller and its privacy policy applies; we will pass any request you send us on to them.
This website is aimed at businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, tell us and we will delete it.
We update this policy when what we do changes, or when the law does. The date at the top of the page is when it last changed. Where a change materially affects your rights or how we use your data, we will do more than change the date — we will say so plainly on the site, and tell clients with an active engagement directly.
MaffeiTech Information Technology L.L.C.
Business Bay, Dubai, United Arab Emirates
Privacy and data protection: legal@maffeitech.com
General enquiries: info@maffeitech.com