Privacy Policy

The PDPL requires personal data to be processed on a lawful basis. We rely on the following.

• Consent — for marketing communications, non-essential cookies and any optional processing. Consent is requested in clear terms, recorded, and may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
• Performance of a contract — to provide the services you have purchased, operate your account, provide support and issue invoices.
• Compliance with a legal obligation — to meet UAE tax, accounting, anti-money-laundering, telecommunications and record-keeping requirements.
• Protection of our legitimate interests — for network and information security, fraud prevention, service improvement and the establishment or defence of legal claims, where those interests are not overridden by your interests or fundamental rights.
• Protection of vital interests or public interest — in the limited circumstances permitted by the PDPL.

• Responding to enquiries, preparing quotations and providing pre-sales technical advice.
• Provisioning, operating, monitoring and supporting the services you have purchased.
• Managing your account, authenticating users and administering role-based access.
• Issuing invoices, collecting payment and meeting UAE VAT and accounting obligations.
• Detecting, investigating and preventing security incidents, abuse, fraud and unlawful use of our platform.
• Notifying you of service incidents, planned maintenance, security advisories and material changes to terms — these are operational messages, not marketing, and you cannot opt out of them while you hold an account.
• Sending marketing about our services, where you have consented, with an unsubscribe link in every message.
• Improving our services through aggregated analysis that does not identify any individual.
• Complying with lawful requests from UAE regulators, courts and law enforcement.

We do not sell personal data. We do not share personal data with third parties for their own independent marketing purposes.

We do not make decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing. Automated rules are used for operational purposes such as fraud scoring, abuse detection and rate limiting, and a human reviews any outcome that would result in suspension of a customer account. You have the right under the PDPL to object to processing carried out solely by automated means and to request human intervention.

We disclose personal data only where necessary, and only to the following categories of recipient:

• Group companies providing shared engineering, support and administrative functions under binding internal agreements.
• Technology partners where required to provision or support a product you have purchased — principally Microsoft (for CSP licence provisioning and tenant administration), Amazon Web Services, HPE and NVIDIA.
• Infrastructure and hosting providers operating the data centre facilities and cloud regions in which the services run.
• Professional advisers — auditors, lawyers, accountants and insurers, bound by professional confidentiality.
• Payment and banking providers for the processing of payments and reconciliation.
• Public authorities where disclosure is required by UAE law, court order or a lawful regulatory request.
• A successor entity in connection with a merger, acquisition or transfer of business, subject to equivalent protection being applied.

Every processor engaged by us is bound by a written agreement imposing confidentiality, security measures at least equivalent to our own, restrictions on onward transfer, and obligations to assist with data subject requests and breach notification. A current list of sub-processors used in the provision of customer services is available on request to info@cloudtechtiq.ae.

Our default position is that personal data processed in the provision of UAE services remains within the United Arab Emirates. Where a transfer outside the UAE is necessary, the PDPL permits it only in defined circumstances, and we rely on one of the following:

• transfer to a state or territory that the competent UAE authority has determined provides an adequate level of protection;
• a contract or agreement obliging the recipient to apply the standards required by the PDPL, including onward transfer restrictions and audit rights;
• your explicit consent, given after you have been informed of the nature of the transfer and the protections applied; or
• another basis expressly permitted by the PDPL, such as necessity for the performance of a contract or for the establishment or defence of a legal claim.

Where you are a customer, the specific transfer position for your services — including which sub-processors are located outside the UAE and on what basis — is recorded in the Data Processing Agreement. We will not begin a new category of cross-border transfer of your customer data without notifying you first.

We keep personal data only for as long as necessary for the purpose it was collected for, and then delete it or irreversibly anonymise it. Our standard periods are:

• Website enquiries that do not proceed — 24 months from last contact.
• Customer account and contract records — for the duration of the relationship and 5 years after termination, to meet UAE commercial and tax record-keeping requirements.
• Invoices, tax records and accounting data — 5 years from the end of the relevant tax period, or longer where a specific UAE requirement applies to the record type.
• Support tickets and correspondence — 3 years from closure.
• Security and access logs — 12 months, unless retained longer for an active investigation.
• Marketing consent records — for the duration of the consent and 3 years after withdrawal, as evidence that consent was validly obtained.
• Customer content in the services — per your instructions and the Data Processing Agreement; deleted within 30 days of account termination unless you request otherwise in writing.

Where a legal claim, regulatory investigation or lawful hold applies, we retain the relevant data until the matter is concluded.

We operate an information security management system certified to ISO/IEC 27001:2022, and we maintain a SOC 2 Type II report available to customers under non-disclosure agreement. Technical and organisational measures include:

• encryption in transit using TLS 1.2 or above, and encryption at rest using AES-256;
• role-based access control on the principle of least privilege, with multi-factor authentication mandatory for all administrative access;
• network segmentation, firewalling and intrusion detection;
• centralised logging and monitoring with alerting on anomalous administrative activity;
• a documented vulnerability management and patching cycle, with penetration testing performed at least annually;
• background screening of personnel with access to production systems, and confidentiality undertakings for all staff;
• backup and disaster recovery procedures that are tested, not merely scheduled; and
• a documented incident response plan rehearsed on a regular basis.

No system is completely secure. We do not represent that our services are immune from compromise, and you remain responsible for the security of credentials issued to your users and for the configuration choices you make within your environment.

Subject to the conditions and exemptions set out in the PDPL, you have the right to:

• be informed about how your personal data is processed;
• access the personal data we hold about you and receive information about the processing;
• request portability of personal data you provided to us, in a structured, commonly used, machine-readable format;
• request rectification of inaccurate or incomplete personal data;
• request erasure of your personal data where the conditions for erasure are met;
• restrict processing in the circumstances permitted by the PDPL;
• object to processing, including processing for direct marketing and processing carried out solely by automated means; and
• withdraw consent at any time where processing is based on consent.

How to exercise a right

Our services are directed at businesses and are not intended for individuals under the age of 18. We do not knowingly collect personal data from children through this website. If you believe a child has provided personal data to us, contact us and we will delete it.

Our use of cookies and similar technologies, the categories used, their duration and how to manage your preferences are described in the Cookie Policy. Non-essential cookies are set only after you have given consent, and you may change or withdraw that consent at any time.

We may update this policy to reflect changes in our services, our processing activities or applicable law. The version in force is the one published on this page, with the date shown at the top. Where a change materially affects how we process your personal data, we will notify you by email or through the console before it takes effect.