Privacy notice.

1 · Who we are.

This notice is given by the DMDC group of companies (“DMDC”, “we”), of Office 1305, Tower B, Business Central Towers, Dubai Media City, Dubai, United Arab Emirates, acting as controller of the personal data described below. For anything in this notice: info@dmdc.ae.

2 · What we collect, and on what basis.

Through the Private Brief we collect exactly four things: your name, your email address, your mobile number, and what you choose to tell us about your project. If you contact us directly, we hold that correspondence. That is the complete list — we do not purchase data about you, enrich your record from third parties, or ask this site for anything you have not chosen to give it.

We process this data on the bases recognised by Federal Decree-Law No. 45 of 2021 (the “PDPL”): your consent, given when you send the brief, and the necessity of processing to take steps at your request toward a contract. We ask for no more than those purposes need.

Separately from that, and never joined to it, we measure how the site itself is used: which pages are read, in what order, which link or search brought a reader here, and roughly where in the world the visit came from. This is done with Google Analytics and Microsoft Clarity. They count visits and pages — not people — and Clarity replays how a page was used: pointer, clicks, scrolling. Neither receives what you type into a field; Clarity masks it before it leaves your browser. Between them they set four cookies — named, with their lifetimes, on the cookies page — so that a returning visit is not counted twice. You may block or delete them in your browser at any time, and doing so changes nothing about how the site works for you.

Both tools are loaded from their own addresses and contacted directly by your browser while you read. The basis for this measurement is our legitimate interest in knowing whether our own pages are useful — which the PDPL recognises where it does not prejudice your rights, and which is why the measurement carries no name, is never joined to a brief, and can be refused in your browser.

We do this to learn which of our guides are useful and where a page loses people. Nothing collected this way is linked to a brief, a name or an address; we do not use it to build a profile of you, to target advertising, or to follow you to other websites.

A narrower measurement covers our own advertising, added 1 September 2026. If a Google advertisement brought you here, this site sets a cookie of its own, dmdc_gclid, holding only the click reference, for up to ninety days. And Meta’s pixel, on the same terms as the measurement above, sets _fbp so that we can tell which of our own advertisements on its platforms led to a visit. Neither is used to build a profile of you, to target advertising to you elsewhere, or to sell or share what it records; we run no third-party advertising network on this site. The basis is the same legitimate interest as above — knowing which of our own efforts reach the people we intend to reach — and both may be refused in your browser without changing how the site works for you.

This one is joined to something, where the other measurement is not: if a Google advertisement brings you here and you then choose to write to us on WhatsApp, the click reference travels with that message so we know which advertisement produced the enquiry. What we report back to Google and Meta afterward is only that an enquiry reached a stage — a qualified lead, a meeting held, a quote sent, a contract signed — and its value in AED where one exists. Your name, your number and what you wrote are never sent to either platform.

3 · What we use it for — and never for.

We use your data to respond to your enquiry, to conduct any engagement that follows, and to keep the records UAE law requires of us. We do not sell or share your data for marketing, we do not add you to mailing lists without a separate and explicit consent, and we do not publish client identities or project details without express written approval — a commitment that predates this notice and outlasts any engagement.

4 · Who sees it.

Within the group, only the companies and senior people needed to answer your brief. Outside it, only our professional advisers under duties of confidence, and authorities where UAE law requires disclosure.

Where your data is held. A brief you send takes two steps, and neither of them stays in the UAE. It is first submitted to this website’s host, Webflow, Inc., on infrastructure in the United States — so it leaves the UAE at the moment you press send, not at some later stage. It is then delivered to our mailbox at info@dmdc.ae, which runs on Microsoft 365, in Microsoft’s European region. Both transfers are made only as the PDPL permits, under each processor’s contractual data protection terms, with protections no weaker than this notice. We are a UAE company and we answer to you from the UAE; the systems that carry your message to us are not, and we would rather say so than let the address imply otherwise.

The site and advertising measurement described in section 2 are separate, and are not your data in the sense used above: they are held by Google LLC, Microsoft Corporation and, for the advertising measurement, Meta Platforms, Inc., each as our processor, on infrastructure outside the UAE, under their own contractual data protection terms. None of it carries a name, a contact detail or anything typed into a field. The one exception is the click reference described above, which we join to a WhatsApp enquiry you choose to send — and even then, only a conversion stage and, where one exists, a value in AED is ever sent back to Google or Meta.

5 · How long we keep it.

For as long as your enquiry or engagement is live, and thereafter only for the retention periods UAE law imposes on commercial records — after which it is deleted or irreversibly anonymised.

Site measurement is held separately and for a shorter period: Google deletes its records after fourteen months, Microsoft deletes Clarity’s session replays after thirty days and its aggregated click data after nine months, and we do not archive either elsewhere. The advertising measurement in section 2 is shorter still — dmdc_gclid and Meta’s _fbp last up to ninety days — and the conversion stage we report back to Google and Meta is not linked to your enquiry once it is sent. Aggregate counts, which identify nobody, are kept for as long as they are useful.

6 · Your rights.

Under the PDPL you may ask us what we hold about you, ask for correction or deletion, restrict or object to processing, ask for your data in a portable form, and withdraw consent at any time without affecting prior lawful processing. Write to info@dmdc.ae — it reaches the people who can actually do it. If we fail you, you may complain to the UAE Data Office as the PDPL provides.

7 · Security and changes.

We protect your data with organisational and technical measures proportionate to its sensitivity, restrict access to those who need it, and will notify you and the authorities of any breach as the PDPL requires. If this notice changes, the date above changes with it, and no change reduces your rights retroactively.