Legal

Privacy Policy

What personal data we hold, why we hold it, how long we keep it, and how to ask for it or have it deleted.

1. Who this covers

This policy applies to visitors to this website and to the people we deal with in the course of our licensed activities: prospective and current clients, their staff, suppliers, and business contacts. It is written to meet the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and, where we deal with people in the European Economic Area or the United Kingdom, the GDPR and UK GDPR.

2. Data this website collects

None. This is a single static page. It sets no cookies, uses no analytics, has no accounts, no login, no tracking pixels and no forms that store anything. We verified this at the time of writing by inspecting the running site: zero cookies, zero local storage, zero analytics scripts.

Like any website, our hosting provider (Cloudflare) processes your IP address and browser details in order to deliver the page to you and to protect the site from abuse. Cloudflare's handling of that data is described in Cloudflare's privacy policy. We do not receive server logs from Cloudflare containing your personal data.

3. Third parties this website contacts

To display the page, your browser fetches a small number of files from other companies. Each of those companies receives your IP address and standard browser information as part of the request. None of them set cookies from this site, and we do not send them anything about you beyond the request itself.

• cdnjs (Cloudflare) – serves the GSAP animation library. Purpose: motion on the page.
• jsDelivr – serves the Lenis smooth-scroll library. Purpose: scrolling behaviour.
• Unsplash – serves the photographs. Purpose: images on the service cards.
• Pexels – serves the short background videos. Purpose: video on the service cards.

Fonts are served from this website itself, not from a third party. Our Cookie Policy repeats this list and explains why there is no consent banner.

4. When you contact us

The only way to contact us through this website is by email or telephone, using the links on the page. When you do, we receive whatever you choose to send: typically your name, your email address or number, your company, and the substance of your enquiry.

We use that information to reply to you and, if you ask us to, to prepare a proposal. We keep enquiry correspondence for 12 months after our last exchange, then delete it unless you have become a client (see section 5).

We do not add enquirers to any mailing list. We do not send marketing email. If that ever changes, we will ask for your explicit, separate consent first, and every such message will carry an unsubscribe link.

5. When you become a client

Every engagement starts with a written scope. From that point we hold the personal data needed to do the work and to meet our own legal obligations:

• Identity and contact details of the people we deal with at your company.
• Know-your-customer documents where the free zone authority, a bank or a counterparty requires them: for example a copy of a trade licence, a passport or Emirates ID of an authorised signatory.
• Commercial and financial records of the engagement: proposals, contracts, invoices, payment records and correspondence.
• Work product which may incidentally contain personal data – see section 6.

6. Notes by line of business

We are licensed for eight activities. Most involve ordinary business contact data only. Three deserve specific mention.

People & HR work

HR work can involve your employees' personal data: names, roles, pay, performance, absence and similar. In that work we act as a processor on your instructions; you remain the controller of your staff's data. We process it only for the purpose you set out in the scope, keep it only for the duration of the engagement plus any hand-over period, and return or delete it at the end. Where the data includes health or other sensitive categories, we will agree specific handling terms with you in writing before we begin.

E-Commerce

If we build or run an online store for you, the store's customers are your customers and their data is yours. We will put a written data-processing agreement in place and will not use that data for any purpose of our own.

Medical, Surgical Equipment & Instruments Trading

Trading in medical equipment does not involve patient data. It does involve regulatory records – import and export documentation, product registrations, supplier and buyer details – which we keep for the periods those regulations require.

7. Why we are allowed to process it

• Performing a contract with you, or taking steps you ask for before entering one.
• Legal obligation – licensing, anti-money-laundering, customs and tax record-keeping in the UAE.
• Legitimate interests – running our business, responding to enquiries, keeping records of our dealings, and protecting our legal position. We balance these against your interests and rights.
• Consent – only where nothing above applies, for example if we ever ask to send you marketing. You can withdraw consent at any time.

8. How long we keep it

• Enquiries that do not become engagements: 12 months from last contact.
• Client contracts, invoices and financial records: 5 years from the end of the financial year in which the engagement ended, as UAE commercial and tax law requires. [To confirm with counsel: some regulators require longer for specific activities.]
• KYC documents: 5 years from the end of the relationship, as UAE anti-money-laundering rules require.
• Data we process on your behalf (HR, e-commerce): the life of the engagement plus an agreed hand-over period, then returned or deleted.

9. Who we share it with

We do not sell personal data and we do not share it for anyone else's marketing. We share it only:

• with the Free Zones Authority of Ajman and other UAE authorities where the law or our licence requires;
• with banks, customs brokers, freight forwarders and counterparties where an engagement or a trade transaction needs it;
• with professional advisers – lawyers, accountants, auditors – under duties of confidence;
• with service providers who host our email and documents, under contracts that restrict them to our instructions.

10. Where it is stored

Our correspondence and records are held in the United Arab Emirates and on cloud services that may store data in other countries. Where data about people in the EEA or UK leaves those areas, we rely on standard contractual clauses or an equivalent lawful mechanism. [To confirm with counsel once the company's email and document hosting is finalised.]

11. Your rights

Under the PDPL, and under the GDPR where it applies, you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is wrong or incomplete;
• delete data we no longer need, or that you withdraw consent for;
• restrict or object to particular processing;
• receive data you gave us in a portable format;
• withdraw consent where consent is the basis.

The simplest way to exercise any of these is the Data Access & Deletion Request page, or email bibinjohnsysitco@gmail.com. We will confirm your identity, then respond within 30 days. There is no charge unless a request is manifestly unfounded or excessive.

If you are unhappy with our response you may complain to the UAE Data Office or, if you are in the EEA or UK, to your local supervisory authority.

12. Security

We keep records on password-protected, encrypted devices and services, limit access to the people who need it, and keep KYC documents separately from general correspondence. No system is perfectly secure; if a breach ever affects your data we will tell you and the relevant authority as the law requires.

13. Children

Our services are for businesses. We do not knowingly collect data from anyone under 18. If you believe we have, contact us and we will delete it.

14. Changes to this policy

We will post any change here with a new version number and date. Material changes affecting existing clients will be notified by email.