UAE Personal Data Protection Law (PDPL) Policy

Effective date: 9 November 2026
Last updated: 9 November 2026

Dubai SoloMove (the “Company”, “we”, “us” or “our”) is committed to handling personal data responsibly and protecting the privacy of customers, prospective customers, website visitors and people whose information is provided to us in connection with a move. This policy explains our approach to personal data under the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “UAE PDPL”), to the extent that law applies to the relevant processing.

This page supplements our Privacy Policy. It should be read together with that policy, our Terms and Conditions and our Refund Policy. It is not a request for blanket consent and does not replace a separate consent where the law requires one.

1. Who is responsible for the data?

Trading name: Dubai SoloMove
Registered legal entity: [Insert full registered legal company name]
Trade licence number: [Insert trade licence number]
Registered business address: [Insert registered business address]
Privacy contact: citywebhosting@gmail.com
Telephone / WhatsApp: [Add business telephone]

For the purposes of the UAE PDPL, the Company will generally act as the Controller when it determines why and how personal data is used for its own website, enquiries, quotations, bookings, moving services, payments and customer support. Where we handle personal data for a business customer strictly on that customer’s instructions, we may act as a Processor for that activity. The role applicable to a particular activity depends on the facts and the agreement in place.

2. Scope and applicable law

This policy is intended for personal data processing activities to which the UAE federal PDPL applies. The law may apply to electronic and other processing carried out by UAE-based Controllers or Processors and, in the circumstances stated in the law, to organisations outside the UAE that process personal data of individuals in the UAE.

The UAE PDPL contains exclusions for certain categories, including government data and entities, personal data held by security and judicial authorities, certain health data and personal banking or credit data regulated by other laws, and entities in UAE free zones that have their own personal data protection legislation. If the Company is established in, or a particular activity is governed by, a free zone with its own data protection regime (including DIFC or ADGM where applicable), the relevant regime may apply instead of or alongside other applicable requirements. This policy must be reviewed for the Company’s actual licence, establishment and activities.

3. Personal data we may collect

Depending on the service requested, we may collect only the information reasonably necessary for the relevant purpose, including:

• Contact and account details: name, telephone number, email address, account login details and preferred method of contact.
• Moving information: collection and delivery addresses, property or building details, floor and lift access, parking and permit arrangements, preferred dates, inventory descriptions, room or property size and service instructions.
• Photographs and videos: images of furniture, boxes, appliances, access routes or premises that you choose to provide for a quotation, survey, packing plan, handling assessment or service record.
• Booking and transaction details: quotations, orders, invoices, payment status, transaction references, refund records and service history. Card payments may be handled by a payment provider; we do not intend to store complete card security codes.
• Communications and support records: enquiry forms, emails, calls, WhatsApp messages, complaints, feedback and related correspondence.
• Technical information: device, browser, IP address, access logs, security events and cookie or analytics information where the relevant technologies are used and permitted.
• Verification or access information: limited identification, vehicle or permit details where reasonably necessary for a lawful building-access, security or service requirement.

We do not ask customers to provide sensitive personal data for an ordinary moving quotation. Please do not send passports, identity documents, financial credentials, health information or other sensitive information unless we explain why it is necessary and provide an appropriate secure method. If sensitive data is genuinely required for a specific lawful purpose, it will be handled with the safeguards and legal basis required by applicable law.

4. How we receive personal data

We may receive information directly from you through website forms, account registration, quotation requests, telephone, email, WhatsApp, surveys, photographs, payments and booking forms. We may also receive necessary information from a person authorised to arrange a move for you, a business customer, a building or property representative, a payment provider or another service partner involved in the requested service, where lawful.

If you give us information about another person, such as a representative, tenant, building contact or recipient, you must have authority to provide it and should make that person aware that their information is being shared for the relevant moving or service arrangement.

5. Purposes for which we use personal data

We may process personal data for specific moving-business purposes, including to:

• respond to enquiries and prepare quotations;
• assess the volume, nature and access requirements of a move;
• create and administer customer accounts and bookings;
• plan and provide packing, wrapping, loading, transportation, delivery, furniture handling and agreed storage services;
• coordinate authorised employees, drivers, moving teams, building access and delivery recipients;
• process payments, invoices, refunds and accounting records;
• provide customer support, handle complaints and assess loss or damage claims;
• protect the safety, security and property of customers, staff and the Company;
• prevent fraud, misuse, unauthorised access and security incidents;
• comply with applicable laws, lawful directions and record-keeping obligations; and
• establish, exercise or defend legal claims and resolve disputes.

Photographs or videos provided for estimating or carrying out a move are used for those service purposes. We will not use identifiable customer or home photographs, testimonials or personal belongings in public marketing unless we have obtained the appropriate separate permission or another lawful basis applies.

6. Legal grounds for processing

We do not treat consent as the only possible legal ground for every activity. Depending on the circumstances and the UAE PDPL, processing may be necessary to take steps at your request before entering into a contract, perform a contract with you, comply with a specific legal obligation, protect your interests, protect public interest where applicable, or establish, exercise or defend legal claims. Other grounds may apply only where the conditions in the law are met.

Where our processing relies on consent, we will seek a clear, specific and informed affirmative action, keep evidence of that consent where required, and provide a practical way to withdraw it. Withdrawal will not make earlier processing unlawful and will not prevent processing that may continue on another lawful basis.

Agreeing to the Terms and Conditions, Privacy Policy or this PDPL Policy is not, by itself, consent to optional marketing messages. Marketing permissions, where required, will be requested separately.

7. Data protection principles

We aim to handle personal data in a fair, transparent and lawful manner; collect it for clear purposes; limit collection to what is reasonably necessary; take reasonable steps to keep it accurate and up to date; protect it against unauthorised access, loss, alteration or disclosure; and retain it only for as long as the relevant purpose or applicable legal requirement requires. Where appropriate, we will erase or anonymise information when it is no longer needed.

8. Sharing personal data

We do not sell personal data. Where necessary for the purposes described above, we may share relevant information with:

• our authorised employees, customer support staff, packers, drivers, supervisors and moving teams;
• approved subcontractors, transport operators, storage providers and specialist handlers engaged for the requested service;
• building management, property representatives or security personnel where information is needed to arrange permits, access, lift bookings or delivery;
• website hosts, CRM providers, cloud storage, IT support, communications platforms and other technology providers;
• payment gateways, banks and payment service providers to complete or reconcile transactions;
• insurers, claims handlers, accountants, auditors, legal advisers and other professional advisers where relevant; and
• courts, regulators, law-enforcement bodies and government authorities where disclosure is required or permitted by law.

We seek to limit information shared to what is relevant and necessary, and to use service providers that provide appropriate privacy and security commitments. Where a third party processes data for us, we will use appropriate contractual instructions and safeguards as required by applicable law.

9. Transfers outside the UAE

Some technology, hosting, cloud, payment, communications or business-support providers may store or process personal data outside the UAE. Where personal data is transferred outside the UAE, we will use a transfer route permitted by the UAE PDPL, which may include an approved adequate-protection destination, an applicable agreement or safeguard, explicit consent where legally valid, or another statutory exception or permitted basis. We will consider the nature of the information, the recipient, the purpose and the safeguards required for the particular transfer.

You may contact us using the details below to ask for general information about relevant recipients, transfer destinations and safeguards, subject to security, confidentiality and legal restrictions.

10. Retention of personal data

We retain personal data only for as long as it is reasonably required for the purpose for which it was collected, including the duration of an enquiry or customer relationship, completion of a move, handling of a complaint or claim, accounting and tax record requirements, security and fraud prevention, and the establishment or defence of legal claims. The actual period depends on the record type and applicable legal requirements. When information is no longer required, we will take appropriate steps to delete, destroy or anonymise it, unless a legal requirement or permitted exception requires continued retention.

11. Security and personal data incidents

We aim to apply technical and organisational safeguards appropriate to the nature and risks of the information, which may include access restrictions, account controls, secure transmission, backups, staff confidentiality obligations, provider due diligence and security monitoring. Access should be limited to people who need the information for their assigned duties.

No website, email service, cloud platform or electronic transmission can be guaranteed to be completely secure. If a personal data incident occurs, we will assess and manage it and make notifications to the competent UAE authority and affected individuals where and as required by applicable law. We will cooperate with relevant authorities and take reasonable steps to reduce adverse effects.

12. Data Protection Officer and high-risk processing

Where the UAE PDPL requires a Data Protection Officer due to the nature, scale or risk of processing, the Company will make the required appointment and provide the officer with the necessary access and support. A Data Protection Impact Assessment will be carried out where required for high-risk processing, including the cases specified by the law. This policy does not represent that a Data Protection Officer has been appointed unless the Company has made and documented that appointment.

Data Protection Officer contact, if appointed: [Insert name or role and monitored contact details. If no appointment is legally required, replace this line with “Privacy requests may be sent to the privacy contact below.”]

13. Your rights under the UAE PDPL

Subject to the law, its exceptions and any applicable sector-specific rules, you may have the right to:

• Receive information: ask what categories of your personal data we process, why we process it, relevant recipients, retention criteria, safeguards for cross-border transfers and how to exercise your rights.
• Request access or a copy: ask for information about your personal data and the processing carried out, subject to applicable limits and protections for other people.
• Request transfer: request an organised, machine-readable copy of data you provided where the legal conditions for portability are met, including relevant automated processing based on consent or contract, and request transfer to another Controller where technically feasible.
• Request correction: ask us to correct inaccurate personal data or complete information that is incomplete.
• Request erasure: ask for deletion where a legal ground for erasure applies. This right is subject to exceptions, including legal retention duties, protection of rights, public interest and other grounds recognised by law.
• Request restriction: ask for processing to be restricted where the conditions in the law are met.
• Object or stop certain processing: object to direct marketing and other processing in the circumstances recognised by the law.
• Object to certain automated decisions: object to decisions based on automated processing in the circumstances recognised by the law and request human review where applicable.
• Withdraw consent: withdraw consent where consent is the legal basis for the relevant processing.

These rights are not absolute. We may need to retain or continue using certain information to comply with law, complete a service, protect another person’s rights, maintain security or establish or defend a legal claim. If we cannot fully comply with a request, we will explain the reason to the extent legally permitted.

14. How to submit a privacy request

Send your request to citywebhosting@gmail.com or contact us at [Add business telephone]. Please use the subject “PDPL Data Rights Request” and, where possible, include your name, registered contact details, customer or booking reference, the right you wish to exercise and enough information for us to locate the relevant records.

We may ask for reasonable proof of identity or authority before disclosing or changing personal data. Please do not email passwords, full payment card details or unnecessary identity documents. We will handle requests within the period and procedure required by applicable law and may contact you if clarification is needed.

15. Complaints

If you have a concern about how we use your personal data, please contact us first so that we can review it. You may also have the right to submit a complaint to the competent UAE Data Office or other competent authority under applicable law. This policy does not restrict any right to approach a regulator or court.

16. Cookies and website technologies

Our website may use essential cookies or similar technologies for login, security, session management and core site functions. Analytics, advertising or other non-essential technologies should be used only with any choice or consent required by applicable law. You can also manage cookies through your browser, although blocking essential cookies may affect website features. The Privacy Policy may provide additional details about the cookies and technology providers actually used on the site.

17. Children and information about other people

Our moving and relocation services are intended to be arranged by adults or authorised representatives. We do not intentionally invite children to create customer accounts. If a parent or authorised guardian provides information about a child because it is genuinely necessary for a service, that information must be limited to what is necessary and handled in accordance with applicable law.

18. Changes to this policy

We may update this policy when our services, systems, data practices or legal requirements change. The current version will be published on our website with the updated date. Material changes will be communicated through an appropriate channel where required by law.

19. Contact us

For questions, requests or complaints relating to personal data, contact:
Dubai SoloMove
Registered legal entity: [Insert full registered legal company name]
Registered address: [Insert registered business address]
Email: citywebhosting@gmail.com
Telephone / WhatsApp: [Add business telephone]
Website: [Insert website URL]

This policy is a business policy template and should be checked against the Company’s actual legal entity, trade licence, hosting and CRM providers, storage locations, retention schedule, security measures and any free-zone or sector-specific rules before it is relied upon as a statement of compliance.