Privacy Policy

1. About Us

Al Wafaa Group ("we", "us", "our") is a UAE-based IT and digital transformation company registered and operating in Dubai, United Arab Emirates. Our registered office is at Mezzanine Floor, Attrium Building, 28th Street, Abu Hail, Deira, Dubai, UAE.

We are the Data Controller of personal data collected through this website (www.alwafaagroup.com) and through our service delivery operations.

For any privacy-related enquiries, contact our Data Protection Officer at: privacy@alwafaagroup.com or info@alwafaagroup.com.

2. Data We Collect

We collect the following categories of personal data:

2.1 Data You Provide Directly

• Full name
• Email address
• Phone number and WhatsApp number
• Company name and business website
• Industry and service requirements
• Messages and enquiry content submitted via forms
• Payment and billing information (processed securely via third-party payment providers)

2.2 Data Collected Automatically

• IP address and approximate geographic location
• Browser type, version, and operating system
• Pages visited, time spent, and navigation behaviour
• Referral source (how you found our website)
• Device type and screen resolution
• Cookie identifiers and session data

2.3 Data from Third Parties

• Information from Google Analytics and Google Ads regarding your interactions with our advertising
• Social media profile data when you interact with us on Facebook, Instagram, LinkedIn, or WhatsApp
• Business contact information from publicly available professional directories

3. How We Use Your Data

We process your personal data for the following purposes and on the following legal bases:

4. Data Sharing and Disclosure

We do not sell your personal data. We may share your data with the following categories of recipients:

• Service providers: Cloud hosting providers (AWS, Vercel), email delivery services (Resend), analytics platforms (Google Analytics, Vercel Analytics), and CRM tools — all bound by data processing agreements
• Payment processors: Secure third-party payment gateways for billing purposes
• Professional advisors: Legal, accounting, and audit firms under confidentiality obligations
• Government and regulatory authorities: When required by UAE law, court order, or lawful request from UAE regulatory bodies including the UAE Data Office, TRA, or law enforcement agencies
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity

5. International Data Transfers

Some of our service providers (including cloud hosting and analytics tools) may process your data outside the UAE. Where this occurs, we ensure appropriate safeguards are in place in accordance with Article 22 of the UAE PDPL, including contractual clauses that provide equivalent data protection standards. Our primary data processing infrastructure is located within UAE or in jurisdictions recognised by the UAE Data Office as providing adequate protection.

6. Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including:

• Client project data: 7 years from project completion (in compliance with UAE commercial law)
• Enquiry and lead data: 2 years from last interaction
• Marketing consent records: Until consent is withdrawn plus 1 year
• Financial and billing records: 5 years (as required by UAE tax and commercial laws)
• Website analytics data: 26 months

7. Your Rights Under UAE PDPL

Under the UAE Federal Decree-Law No. 45 of 2021, you have the following rights regarding your personal data:

• Right to access: Request a copy of the personal data we hold about you
• Right to correction: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data (subject to legal retention requirements)
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at privacy@alwafaagroup.com. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the UAE Data Office at uaedataoffice.ae.

8. Cookies and Tracking

We use cookies and similar tracking technologies on our website. For full details of the cookies we use and how to manage your preferences, please see our Cookie Policy.

9. Children's Privacy

Our website and services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us immediately at privacy@alwafaagroup.com and we will delete it promptly.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include SSL/TLS encryption, access controls, regular security assessments, and staff training. However, no method of internet transmission is 100% secure, and we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable UAE law. We will notify you of material changes by posting the updated policy on this page with a revised effective date. We encourage you to review this policy periodically.

12. Contact Us