Privacy Policy

Scope and data controller

This notice applies when you use ersaa.ae, submit the contact form, or contact us through a channel linked from the website. Ersaa Building, Abu Dhabi, United Arab Emirates, determines why and how this personal data is processed and acts as the data controller. We follow UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) and other applicable UAE requirements.

Personal data we collect

We collect data you choose to provide and limited technical data needed to operate the contact form:

• +Your name, phone number, email address, optional service interest, and message
• +Any project details or later correspondence you choose to share
• +Your IP address and request time, held temporarily to prevent contact-form abuse
• +Your English or Arabic language preference, saved only in your browser's local storage

Please do not submit Emirates ID details, payment information, health data, or other sensitive personal data through the general contact form.

Why we process it

We process personal data only for specific, relevant purposes:

• +To respond to your request and discuss a consultation, scope, or quotation, with your consent and where needed to take steps you request before a contract
• +To operate, secure, troubleshoot, and prevent misuse of the website and contact form
• +To keep necessary business records, meet UAE legal obligations, and establish or defend legal rights

We do not use contact-form data for unrelated advertising, sell contact lists, or make decisions about you using automated profiling.

Who receives personal data

Access is limited to authorised Ersaa Building personnel who need the information to respond. We also use service providers that support website hosting, security, and encrypted email or SMTP delivery. They may process data only to provide those services and under appropriate confidentiality and data-protection controls.

We may disclose information when required by UAE law, a competent authority, or to protect legal rights. We do not sell or trade personal data. WhatsApp, Instagram, and other external services process data under their own privacy terms when you choose to visit them.

International transfers

We operate from the UAE. Some hosting, communications, or technical-provider infrastructure may process personal data outside the UAE. Where that occurs, we require a lawful transfer route and appropriate safeguards under Articles 22 and 23 of the UAE PDPL, such as an adequate protection framework or binding contractual protections.

How long we keep it

Contact-form IP rate-limit records are automatically removed after approximately 24 hours. General inquiry emails are normally kept for up to 24 months after the last interaction, then deleted or anonymised. If an inquiry becomes a quotation, project, dispute, or legally required record, relevant information may be retained longer for the applicable contract, accounting, warranty, or legal period.

Your language preference stays in your browser until you change it or clear local site data.

Security and data incidents

We use proportionate technical and organisational measures, including encrypted transport, access controls, data minimisation, protected email delivery, and short-lived rate-limit records. No internet system can be guaranteed completely secure. If a personal-data incident creates the risk described by applicable UAE law, we will investigate and notify the competent authority and affected individuals as required.

Your privacy rights

Subject to applicable UAE law and any valid exceptions, you may:

• +Ask what personal data we process and receive access to relevant information
• +Ask us to correct, complete, erase, restrict, or stop processing your personal data
• +Withdraw consent at any time, without affecting processing already carried out lawfully
• +Request transfer of your personal data where technically feasible
• +Object to automated decisions or profiling; we do not currently use either for website inquiries
• +Raise a concern with us or complain to the competent UAE data-protection authority

Email info@ersaa.ae to make a request. We may ask for limited information to verify your identity and will respond in line with applicable law. Some records may need to be retained where erasure would conflict with a legal obligation or the establishment or defence of legal claims.

Cookies, local storage, and external links

This website currently uses no advertising or analytics cookies. It uses local storage only to remember your selected language, and that preference is not sent to us. Our Cookie & Storage Notice provides the current details. External links open services controlled by other organisations, whose terms and privacy practices apply after you leave this website.

Contact and complaints

For questions, consent withdrawal, a privacy-rights request, or a complaint about how we handle personal data, contact us using the details below: