Haqeeba1. Data Controller
Haqeeba Tech Limited , a company incorporated in the Dubai International Financial Centre (“DIFC”), DIFC, Dubai, UAE.
For data protection inquiries, contact our Data Protection Officer: contact@haqeeba.org
We are regulated by the DIFC Commissioner of Data Protection under the DIFC Data Protection Law No. 5 of 2020 (“DP Law 2020”).
2. Scope & Applicable Law
This Policy applies to all processing of Personal Data by Haqeeba Limited in connection with our Services. It is governed by:
- DIFC Data Protection Law No. 5 of 2020 (DP Law 2020)
- DIFC Data Protection Regulations (DP Regulations)
- DIFC Law No. 1 of 2020 (Companies Law) where applicable
Where we process data outside the DIFC, we ensure compliance with DP Law 2020 transfer requirements.
3. Personal Data We Collect
3.1 Account & Identity Data (DP Law 2020 Art. 1)
Name, email, job title, company, phone, authentication credentials, SSO identifiers.
3.2 Special Category Data (DP Law 2020 Art. 10)
We do not intentionally collect special category data (health, biometric, political, religious). If you submit such data via support channels, we treat it with enhanced protections.
3.3 ERP & Financial Data — Processor Role (DP Law 2020 Art. 28)
When you connect an ERP system, we process your financial records, transactions, vendor data, and organisational hierarchies solely as a Data Processor on your documented instructions. We do not use this data to train models or for any purpose beyond providing the Service.
3.4 Usage & Analytics Data
API requests, feature usage, error logs, performance metrics, UI interactions, session data.
3.5 Communications Data
Support tickets, emails, chat transcripts, call recordings (with consent), survey responses.
3.6 Marketing Data
Website visits, content downloads, event registrations, email engagement (with consent where required).
4. Purposes & Legal Basis (DP Law 2020 Arts. 5–6)
| Purpose | Data Categories | Legal Basis |
|---|---|---|
| Provide & operate the Service | Account, Usage, ERP | Contract performance (Art. 6(1)(b)) |
| Authenticate & secure access | Account, Usage | Legitimate interest (Art. 6(1)(f)) |
| Billing & invoicing | Account | Contract performance (Art. 6(1)(b)) |
| Support & troubleshooting | Account, Usage, Communications | Contract performance (Art. 6(1)(b)) |
| Product improvement (aggregated/anonymised) | Usage | Legitimate interest (Art. 6(1)(f)) |
| Marketing (opt-in) | Marketing | Consent (Art. 6(1)(a)) |
| Legal & regulatory compliance | All | Legal obligation (Art. 6(1)(c)) |
5. Sharing & Disclosure
5.1 Sub-processors (DP Law 2020 Art. 28)
We engage sub-processors for hosting, analytics, communications, and payments. We notify 30 days before adding new sub-processors. All sub-processors are bound by written contracts meeting DP Law 2020 Art. 28 requirements.
5.2 DIFC Authority & Regulatory Disclosure
We disclose data to the DIFC Commissioner of Data Protection, DIFC Courts, or other competent authorities only when legally compelled. We notify you unless prohibited by law.
5.3 Business Transfers
In a merger, acquisition, or sale of assets, your data transfers with the business. We notify you of any change in Data Controller.
5.4 No Sale of Data
We do not sell Personal Data. ERP/financial data is never shared with third parties for their own purposes.
6. International Transfers (DP Law 2020 Part 4)
Our primary infrastructure is in the DIFC and UAE. Where sub-processors are outside the DIFC, we ensure adequate safeguards per DP Law 2020 Art. 23–26:
- DIFC Standard Contractual Clauses (approved by Commissioner)
- Adequacy decisions (where applicable)
- Binding Corporate Rules (where implemented)
- Supplementary measures: encryption, access controls, pseudonymisation
Enterprise customers may restrict processing to specific jurisdictions — contact sales for details.
7. Retention (DP Law 2020 Art. 7)
| Data Category | Retention Period | Basis |
|---|---|---|
| Account data | Duration of contract + 2 years | Contract + limitation period |
| Usage/analytics (identified) | 13 months | Legitimate interest |
| Usage/analytics (aggregated/anonymised) | Indefinite | Not Personal Data |
| ERP/financial data | Per your instructions; deleted on termination | Processor role |
| Support communications | 3 years after closure | Legal obligation / defence of claims |
| Marketing data | Until withdrawal of consent | Consent |
| Billing records | 7 years | UAE Federal Tax Law / DIFC requirements |
8. Your Rights (DP Law 2020 Part 3)
You may exercise the following rights at any time by emailing contact@haqeeba.org:
- Right of Access (Art. 13) — Confirmation & copy of your Personal Data
- Right to Rectification (Art. 14) — Correction of inaccurate data
- Right to Erasure (Art. 15) — Deletion (subject to legal obligations)
- Right to Restriction (Art. 16) — Limit processing
- Right to Data Portability (Art. 17) — Structured, machine-readable copy
- Right to Object (Art. 18) — Object to legitimate-interest processing
- Right to Withdraw Consent (Art. 9) — For consent-based processing
- Right to Complain (Art. 33) — Lodge complaint with DIFC Commissioner of Data Protection
We respond within 30 days (extendable by 30 days for complexity). No fee unless manifestly unfounded/excessive.
9. Security (DP Law 2020 Art. 21)
We implement technical and organisational measures per our security program: AES-256 encryption, TLS 1.3, mTLS for ERP, SOC 2 Type II, ISO 27001, annual penetration testing, 24/7 monitoring. We maintain a Personal Data Breach Register and notify the Commissioner within 72 hours per Art. 30.
10. Cookies & Tracking
See our Cookie Policy for details on essential, analytics, and marketing cookies, and how to manage preferences.
11. Children (DP Law 2020 Art. 9)
Our Service is not directed to individuals under 18. We do not knowingly collect Personal Data from children. If you believe we have, contact us immediately for deletion.
12. Changes
We may update this policy. Material changes: 30 days’ notice via email and in-app banner. Continued use after the effective date constitutes acceptance.
13. Contact
Data Protection Officer: contact@haqeeba.org
Supervisory Authority: DIFC Commissioner of Data Protection