Privacy Policy | 971 Global F.Z.E

In short: this website does not set cookies, does not run an advertising or analytics tracker, and does not host a sign up form. Most of the personal data we hold reaches us because someone wrote to us by email.

1. Who controls your data

The data controller is 971 Global F.Z.E, a Free Zone Establishment registered with the Free Zones Authority, Government of Ajman, under License No. 43239, at F1-227-OaaS - 03-C, Al Jurf Building - F1 Block, Ajman Free Zone, Ajman, United Arab Emirates.

The company is the controller. No individual is named as a separate contact point. Privacy questions reach the company at hello@971global.com.

2. What we collect

Information you send us

The contact links on this website open your own email program. When you write to us, we receive your name, your email address, and whatever you choose to include in the message, including any attachment. If a contact form is added to this website in future, this policy is updated before it goes live.

Correspondence and engagement records

Where a discussion becomes an engagement, we hold the business contact details of the people we work with, the proposal and scope of work, correspondence relating to delivery, and the billing records that go with it.

Server logs

Our hosting provider records standard technical information for each request to this website, including the IP address, the time of the request, the page requested, the referring page, and the browser user agent string. These logs support security and availability, and they are not used to build a profile of a visitor.

Payment information

Card details are handled by our payment provider and are not collected or stored by us. What we hold is the record of the transaction, such as the amount, the date, the invoice it relates to, and the last digits of the card where the provider shows them.

3. Why we use it, and on what basis

To answer an inquiry and prepare a proposal. The basis is the steps taken at your request before entering a contract.
To deliver an engagement, issue invoices, and take payment. The basis is performance of a contract.
To keep accounting and commercial records. The basis is compliance with a legal obligation in the United Arab Emirates.
To keep the website available and secure, and to investigate misuse. The basis is our legitimate interest in protecting the service, balanced against the limited nature of the data held.
To send occasional operational updates to an existing client about work in progress. The basis is our legitimate interest in running the engagement. We do not run marketing mailing lists from this website.

We do not sell personal data, and we do not share it with third parties for their own marketing.

4. Cookies and analytics

This website sets no cookies of its own. There is no analytics product, no advertising pixel, no session tracker, and no behavioral profiling on this site. Nothing is written to local storage by our own code.

One third party resource is loaded on each page. The web font used across the site is served by Google Fonts from fonts.googleapis.com and fonts.gstatic.com. Loading the font sends your IP address and browser user agent to Google as part of the ordinary request for the file. Google states that it does not set cookies for this service. Further information is published in the Google Privacy Policy.

If we ever add analytics to this site, this section is updated to name the tool and describe what it collects before it is switched on.

5. Third parties that process data for us

Hosting and content delivery. Cloudflare, which serves this website and holds the server logs described above.
Web fonts. Google Fonts, as described in section 4.
Email. Our email service provider, which stores and transmits correspondence sent to our addresses.
Payments. Our payment provider, which processes card payments and holds the card data we never see.
Accounting and banking. Our accountant and our bank, for invoicing, settlement, and statutory records.

These parties act on our instructions for the purposes described, or as independent controllers where their own regulatory duties require it, such as a bank or a payment provider. We do not add processors casually, and we review what each one needs.

6. International transfers

The company is established in the United Arab Emirates and its records are held there. Some of the providers listed above operate infrastructure outside the United Arab Emirates, including in the European Union and the United States, so personal data may be processed outside the country.

Where a transfer of that kind takes place, we look for providers that offer recognized safeguards, which in practice means contractual data protection terms, standard contractual clauses where they apply, and a documented security posture. Where the receiving country does not offer an adequate level of protection, the transfer rests on contractual safeguards or on the consent of the individual concerned.

7. How long we keep it

Inquiries that do not become an engagement. Up to 24 months from the last message, then deleted.
Engagement records, contracts, and correspondence. The duration of the engagement and five years after it ends.
Accounting and tax records, including invoices. At least five years from the end of the financial year they relate to, in line with record keeping requirements in the United Arab Emirates.
Server logs. Retained by the hosting provider for a short operational period, typically not more than 30 days.

Where a record is subject to a legal hold or an ongoing dispute, it is kept until the matter is resolved.

8. Security

The website is served over HTTPS. Access to our email, billing, and engagement records is limited to the people who need it, protected by strong authentication, and reviewed when roles change. Devices used for company work carry disk encryption and screen locks. Deliverables and client material are stored in access controlled systems rather than on shared drives. Where a client provides credentials for their own systems, we ask for time limited and least privilege access, and we ask for it to be revoked at the end of the engagement.

No system is completely secure. Where a breach affects personal data and presents a risk to the people concerned, we notify the relevant authority and the affected individuals in line with applicable law.

9. Your rights

Individuals whose personal data we hold have the following rights, subject to the conditions and exceptions of the applicable law:

To be told what data we hold and to receive a copy of it.
To have inaccurate or incomplete data corrected.
To ask for data to be deleted, where we have no continuing legal or contractual reason to keep it.
To object to processing that rests on our legitimate interests, and to ask that it be restricted while the objection is considered.
To receive data you provided to us in a structured, commonly used format, or to have it sent to another controller where that is technically feasible.
To withdraw consent at any time, where processing rests on consent, without affecting what was done before the withdrawal.
To complain to the competent supervisory authority.

10. How to exercise them

A request is best sent to hello@971global.com with the subject line "Privacy request" and enough detail to identify the records concerned. We may ask a question or two to confirm identity before acting, which protects the data of the person making the request.

Requests are acknowledged within 5 business days and answered within 30 days. Where a request is complex, we say so within that period and explain the expected timing. There is no charge for a request, unless one is clearly unfounded or repetitive.

11. United Arab Emirates data protection law

Our handling of personal data is designed to be consistent with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and with the implementing decisions issued under it. Where the law of a free zone or a sector specific regulation also applies to a particular engagement, we follow the stricter requirement.

12. Visitors in the European Union and the United Kingdom

Visitors and clients in the European Union and the United Kingdom are handled consistently with the principles of the General Data Protection Regulation and the UK GDPR, including lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity, and accountability. The rights listed in section 9 are made available to them on the same basis, regardless of whether the company is directly subject to those regulations for a given activity.

13. Children

This website and our services are directed at businesses, and they are not intended for children. We do not knowingly collect personal data relating to a person under 18 years of age. Where we learn that we hold data of that kind without an appropriate legal basis, it is deleted.

14. Changes to this policy

This policy is reviewed periodically and updated when our practices or our providers change. The date at the top of the page records the current version. Where a change materially affects how personal data is handled, we note it on this page, and we write to active clients where the change affects their engagement.

15. Privacy contact

Privacy questions, requests, and complaints are received at hello@971global.com, or in writing to 971 Global F.Z.E, F1-227-OaaS - 03-C, Al Jurf Building - F1 Block, Ajman Free Zone, Ajman, United Arab Emirates.

Billing and payment questions are handled separately at pay@971global.com.