Privacy Policy

Federal Decree-Law No. 45 of 2021 applies to Webzenia in full. Article 2(1)(b) reaches every controller or processor residing in the State that processes the data of data subjects inside and outside the State, and Webzenia Marketing FZ-LLC resides in the State. The reach does not depend on a targeting or monitoring test.

A free zone licence does not put Webzenia outside that law. Article 2(2)(g) removes from the law only companies and establishments located in free zones that have special legislation of their own on personal data protection. The Ras Al Khaimah Economic Zone has enacted none, so the federal law governs Webzenia's processing without qualification. Any statement that a free zone company sits outside the UAE data protection law is wrong for this entity.

Two UAE free zones do run regimes of their own: the Dubai International Financial Centre under DIFC Law No. 5 of 2020, and Abu Dhabi Global Market under the ADGM Data Protection Regulations 2021. Each has its own commissioner, its own adequacy position and its own enforcement. Webzenia is registered in neither, so neither regime governs this website and this policy does not cite them.

One point of detail decides what this policy is able to promise. Article 28 required the Council of Ministers to issue Executive Regulations under the law, and they have not been issued. The obligations in the statute bind now. The numbers that were delegated to those regulations, among them a breach-notification period, a response window and a penalty schedule, do not exist in binding form. This policy therefore states the duty and never a deadline UAE law has not set.

Webzenia collects the data it needs to answer you, run the website and deliver the work, and no more. Article 5(1) of Federal Decree-Law No. 45 of 2021 requires processing to be fair, transparent and lawful, collection to be for a specific and clear purpose, and the data to be adequate and limited to what the purpose needs. Webzenia does not ask for payment card numbers, health data or biometric data through the website. Anything of that kind sent unprompted is deleted once the request behind it is closed.

Webzenia processes personal data for the purposes in the table below and for nothing unrelated to them. Article 4 of Federal Decree-Law No. 45 of 2021 prohibits processing personal data without the consent of its owner, then sets out eleven cases that sit outside the prohibition. Two of them carry most of Webzenia's processing: limb 9, processing necessary to perform a contract to which you are a party or to take measures at your request before one, and limb 10, processing necessary to meet an obligation under another law in force.

UAE law has no legitimate-interests basis. The list in Article 4 is closed and none of its eleven limbs covers analytics, advertising or audience measurement. Those run on your consent or they do not run at all, which is why the cookie choice on this site is a real one and not a notice.

Consent under UAE law carries conditions and Webzenia meets them. Article 6(1) of Federal Decree-Law No. 45 of 2021 requires the controller to be able to prove consent where processing rests on it, requires the consent itself to be prepared in a clear, simple, unambiguous and easily accessible manner in writing or electronically, and requires it to include the data subject's right to withdraw it easily.

Article 6(2) lets you withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it, and for some services it means Webzenia can no longer do the thing the consent covered. To change a cookie choice, use the controls on the Cookie Policy page. To stop marketing, use the unsubscribe control in any message or write to privacy@webzenia.com. Webzenia keeps a record of the consent you gave and the date you gave it, because Article 6(1) puts the burden of proving consent on Webzenia rather than on you.

Webzenia uses cookies to keep the website working and, once you accept them, to measure traffic and attribute campaigns. Analytics, marketing and personalisation cookies stay off until you turn them on.

A cookie that identifies you is personal data. Article 1 of Federal Decree-Law No. 45 of 2021 counts an electronic identifier and geographical location among the elements by which a person is identified, so the Article 4 consent rule reaches every non-essential cookie on this site. The full inventory, naming each cookie, who sets it, what it does and how long it lasts, is on the Cookie Policy page together with the controls that change your choice. Webzenia honours a browser Do Not Track signal by not loading non-essential tracking.

Webzenia does not sell personal data and does not trade contact lists. Data is shared only with the categories below, each under a contract that binds the recipient to process it on Webzenia's instructions and to apply the measures Federal Decree-Law No. 45 of 2021 requires.

• Processors: hosting, content delivery, analytics, email delivery, scheduling, CRM and payment providers that process data for Webzenia. Article 8 places duties directly on a processor, including the processing record required by Article 8(7), and Webzenia's contracts require the same.
• Professional advisers: accountants, auditors and lawyers, engaged when the work needs them and bound by confidentiality.
• Authorities: where a law, a regulator, a court order or another lawful request requires disclosure, or where Article 4(3) applies because a legal claim or a judicial or security procedure is involved.
• A corporate transaction: on a merger, acquisition, financing or sale of assets, personal data transfers as part of that transaction and remains subject to this policy.

Some of the systems Webzenia uses store or process data outside the United Arab Emirates. Federal Decree-Law No. 45 of 2021 allows that on two routes, and this section says which route Webzenia relies on.

Article 22 permits a transfer to a state or province approved by the regulator, either because it has personal data legislation covering the significant provisions with a judicial or regulatory authority able to impose measures, or because the UAE has joined a bilateral or multilateral agreement with it on personal data protection. No approved list has been published, so Webzenia names no destination as adequate and does not use this route.

Article 23 supplies the routes that operate where adequate protection is not available, and Webzenia uses three of them. Article 23(a) is a contract with the receiving company that obliges it to adopt the measures, controls and requirements of Federal Decree-Law No. 45 of 2021, and every processor holding Webzenia data outside the UAE is on such a contract. Article 23(b) is your explicit consent, which is the basis for the analytics and advertising vendors you switch on yourself, and which applies provided the transfer does not contradict the public or security interest of the State. Article 23(d) covers a transfer necessary to sign or implement a contract, which is the position when a project runs on a client's own tooling hosted abroad.

The safeguards in this policy travel with the data whichever route applies. Article 13(1) entitles you to be told about the cross-border safeguards under Articles 22 and 23 that attach to your data, so write to privacy@webzenia.com and Webzenia will tell you which route a particular system sits on.

Article 20 of Federal Decree-Law No. 45 of 2021 requires technical and organisational measures at the highest standard of information security, and names encryption and pseudonymisation among them. Webzenia encrypts data in transit over HTTPS, restricts access on a need-to-know basis, pseudonymises analytics identifiers where the tool supports it, contracts each processor before data reaches it, and reviews the arrangement on a fixed cycle.

No transmission or storage method is completely secure. Where a personal data breach occurs that would prejudice the privacy, confidentiality and security of the data, Article 9(1) requires Webzenia to notify the regulator at the time it becomes aware of the breach, with the particulars the article lists: its nature, form and causes, the approximate number of records affected, the contact details of any data protection officer, the expected effects, the corrective measures taken or proposed, and the documents evidencing both. Article 9(2) requires notice to you where the breach would prejudice your data. Article 9(3) requires a processor to notify Webzenia as soon as it becomes aware.

The statute fixes no number of hours, because Article 9 delegates the period to Executive Regulations that have not been issued. Webzenia therefore commits to notifying without delay from the moment it becomes aware, which is the statute's own standard, and refuses to print a deadline UAE law has not set.

Article 5(1) of Federal Decree-Law No. 45 of 2021 forbids keeping personal data after the purpose it was collected for has been exhausted, unless the identity of the data subject has been concealed by anonymisation. Webzenia works to that rule, and the table below is how it applies in practice.

Federal Decree-Law No. 45 of 2021 gives you the rights below. Each row names its article so you can read the text for yourself on the UAE legislation portal rather than take this page's word for it.

An access request costs nothing. Article 13(1) gives the right by submitting a request to the controller without any consideration, so Webzenia charges no fee for one. Webzenia asks you to verify your identity before it acts on a request, and answers as fast as the request allows. Federal Decree-Law No. 45 of 2021 sets no response window for a controller and this policy invents none: the only 30-day period in the statute is in Article 25, and it governs an objection to a decision of the regulator, not a request made to Webzenia.

Article 13(3) lets a controller refuse a request in four situations: the request is unrelated to the information the article lists or is excessively repetitive; it conflicts with judicial procedures or investigations; it would negatively affect the controller's information-security efforts; or it affects the privacy of other people. Where Webzenia relies on one of them, it tells you which one and why.

When a client sent Webzenia your data

Where Webzenia holds your data as a Processor on a client's instructions, that client is the Controller and decides how the data is used. Send your request to that client. Webzenia supports it under Article 8 and under the contract between them, and will tell you who the client is where it is permitted to.

Webzenia contacts you for marketing only where you asked for it. Article 4 of Federal Decree-Law No. 45 of 2021 requires consent before contact data is processed for marketing, Article 6 requires that consent to be provable and easily withdrawable, and Article 17(1) lets you stop processing intended for direct marketing, including the profiling behind it, at any time and without giving a reason.

Telemarketing has its own instrument and it reaches a free zone company squarely. Cabinet Resolution No. 56 of 2024 applies to all companies licensed in the State, including those located in free zones, that market products or services through telemarketing, and its definition covers marketing text messages and marketing messages through social media applications as well as calls. Article 4(1) requires prior approval from the competent authority for the activity, Article 4(3) requires the numbers used to be registered under the company's own commercial licence, Article 4(7) requires the consumer to be told at the start of a call that it is being recorded, and Article 5(3) confines marketing phone calls to the hours between 9:00 am and 6:00 pm.

Marketing text messages carry a prescribed sender identity in the UAE. Article 8.8 of the TDRA Regulatory Policy on Unsolicited Electronic Communications requires the sender name on a marketing text message to include the code AD- followed by the sender's name, and TDRA publishes the short code 7726 so a recipient can block one sender or all promotional messages.

A second statute protects data given for an order. Article 4(5) of Federal Law No. 15 of 2020 on Consumer Protection states the protection of consumer privacy and data security, and not using them for promotion and marketing, as a right the consumer holds. Data you give Webzenia to place an order or run a project is not used to market anything to you.

You can complain about Webzenia to the federal data protection regulator. Article 24 of Federal Decree-Law No. 45 of 2021 gives a data subject the right to file a complaint where they believe the law has been violated. That right does not depend on writing to Webzenia first, although a message to privacy@webzenia.com is the faster route to a fix.

The regulator's identity has changed, which is why this policy names it by function. The UAE Data Office was established by Federal Decree-Law No. 44 of 2021 and is the body the data protection law calls the Bureau. On 14 June 2026 the Cabinet approved the establishment of the Artificial Intelligence and Data Authority, and the UAE Data Office's functions moved into it. The statute has not been amended to follow, so its text still says the Bureau while the functions sit with the new authority.

One 30-day period does exist in the law, and it runs against the regulator rather than against Webzenia. Under Article 25, a stakeholder who objects to a decision or a penalty of the regulator files a written objection with the General Director within 30 days of being notified of it, that objection is decided within 30 days of submission, and the decision cannot be challenged before a court until the objection has been made.

The website is built for business buyers and is not directed at children. Federal Decree-Law No. 26 of 2025 on Child Digital Safety, in force since 1 January 2026, defines a Child as any human being who has not completed the age of 18 Gregorian years, and Article 3(1) applies the law to digital platforms operating within the State or directed at users in it, listing websites first.

Article 7(1) prohibits a digital platform from collecting, processing, publishing or sharing the personal data of a child under 13 unless every one of its conditions is fulfilled and verified: explicit, documented and verifiable parental consent from the child caregiver; a rapid and continuously accessible way to withdraw that consent without complexity; disclosure of the privacy policy and the purpose of collection in terms the child and the caregiver understand; access restricted to authorised persons and to the minimum necessary; and a bar on using the data for commercial purposes, for targeted electronic advertising to the child, or for tracking the child's account beyond the purpose originally authorised.

Webzenia does not knowingly collect the personal data of a child under 13 and runs no targeted advertising at children. Federal Decree-Law No. 45 of 2021 sets no age threshold of its own, so this policy takes its thresholds from the Child Digital Safety law and from the age of majority, which Article 84(2) of Federal Decree-Law No. 25 of 2025 sets at 18 completed Gregorian years. If you believe a child has given Webzenia personal data, write to privacy@webzenia.com and it will be deleted.

Webzenia makes no decision with a legal or similarly significant effect on you by automated processing alone. Advertising and analytics tools group audiences in aggregate; the decisions that shape an engagement are made by people on Webzenia's payroll.

Article 18(1) of Federal Decree-Law No. 45 of 2021 gives you the right to object to a decision produced by automated processing including profiling, particularly a decision with a legal impact on you or one that adversely affects you. Article 18(2) removes that right where the automated processing is agreed in the contract, required by other legislation, or covered by consent you already gave under Article 6. Article 18(4) stands in every case: the controller includes the human element in reviewing an automated decision at the data subject's request. Ask at privacy@webzenia.com and a person reviews it.

Article 7(4) of Federal Decree-Law No. 45 of 2021 obliges the controller to maintain a special record of personal data. Webzenia keeps one. It carries the controller's details and those of any data protection officer, the categories of personal data, the persons authorised to access it, processing times, limitations and scope, the erasure and modification mechanism, the purpose of processing, cross-border movement data, and the technical and organisational measures applied. Article 8(7) imposes a parallel record on a processor. Webzenia produces its record to the regulator on request.

Article 21 requires an assessment of the impact of processing before it begins where modern technologies pose a high risk to the privacy of data subjects, and specifically where the processing involves a systematic and comprehensive assessment of personal aspects by automated processing including profiling with legal consequences or serious impact, or is carried out on a large volume of sensitive personal data. Webzenia runs that assessment before adopting a tool of that kind.

Article 10(1) requires a data protection officer in three cases: processing that would cause a high-level risk to the confidentiality and privacy of personal data as a result of adopting new technologies or the volume of data; processing involving a systematic and comprehensive assessment of sensitive personal data including profiling and automated processing; and processing on a large volume of sensitive personal data. Article 10(4) delegated the criteria for technology and volume to Executive Regulations that have not been issued, so no numeric threshold exists in UAE law. Webzenia states neither an appointment it has not made nor an exemption the law does not grant: it reviews its position against Article 10 whenever its processing changes, and appoints an officer and notifies the regulator under Article 10(3) if the assessment changes.

Webzenia updates this policy when its processing changes or the law does. The "Last updated" date above marks the version in force, and a material change is notified where notification is appropriate. Continued use of the website after an update means you accept the revised policy.

Two future changes are already foreseeable and this policy will carry them when they land. The first is the issue of the Executive Regulations under Article 28 of Federal Decree-Law No. 45 of 2021, which will supply the breach-notification period, the response window and the penalty schedule this page currently leaves out because UAE law does not yet set them. The second is any renaming or restructuring of the federal data regulator, whose functions moved into the Artificial Intelligence and Data Authority on 14 June 2026.