Privacy and Data Protection Policy

The platform is operated by the company identified at the top of this page (the “Operator”, “we”).

We are the controller of your account, billing and communication data.

For your company's employee data and records that you enter in the platform, your company is the controller and we act as the processor, handling the data on its behalf, on its instructions and only to provide the service.

Account data: name, email address, phone number, role within the company, and sign-in history.

Company data: legal name, trade licence number, address, subscription and invoice details.

Employee data entered by your company: name, job title, nationality, hiring and contract dates, wages and allowances, expiry dates of residency, work permit, health insurance, Emirates ID and passport, and records of violations, investigations, penalties and settlements.

Content you write or upload: questions to the AI assistant, tickets, attachments and evidence, and draft documents.

Limited technical data: network address, browser type and access times, for security and audit purposes.

The platform is not designed to store identity numbers, passport numbers or bank account numbers; only document expiry dates are kept. Please do not type those numbers into free-text fields or tickets.

We do not collect payment card data. Payment is completed entirely with the licensed payment provider and card details never pass through our servers.

To provide the service and perform our contract with you: creating the account, running the compliance, calculation and document tools, and Labor Relations & Legislation Advisor review when you request it.

Billing, payment, and compliance with tax and accounting rules.

Security, fraud prevention and audit logs, which is a legitimate interest of ours and of our customers.

Operational communication: sign-in details, alerts, notifications and periodic reports.

Limited improvement of the service using aggregated statistics that do not identify individuals.

Where the law requires your consent we ask for it explicitly, and you may withdraw it at any time without affecting earlier processing.

We do not sell personal data and we do not use customer data for advertising.

Ask Tawafuq uses an AI model hosted by an external provider to answer questions, draft documents and search for legal updates.

We send the model only the fields needed for the answer. A privacy filter automatically masks patterns resembling Emirates ID numbers, passport numbers, bank accounts and payment cards before anything is sent. This is a precaution and does not replace not typing those numbers in the first place.

Under the provider's commercial terms in force when this policy was written, customer content is not used to train its models, and we review this periodically.

AI output supports decisions and is not final legal advice; you can ask for a Labor Relations & Legislation Advisor's review.

We do not take solely automated decisions that have legal effects on individuals. Disciplinary and termination decisions are taken by the employer after human review, and individuals may object to automated processing as the law provides.

We keep account data and content for as long as you subscribe.

After the subscription ends you have 30 days to export your data; it is then deleted or anonymised unless the law requires it to be kept.

We keep invoices and financial records for the period required by tax and accounting rules (at least five years for tax records).

Security audit logs are kept for a reasonable period for security and evidence purposes.

Records created by your company (such as penalties and settlements) are your company's records; how long your company must keep them is set by its own legal obligations.

As the law provides, you may access your personal data and get a copy, correct or complete it, request its deletion, restrict its processing, port it, object to processing and to automated processing, and withdraw your consent.

If your data was entered by the company you work for, the request goes first to your employer as the controller, and we help it respond.

To exercise your rights write to the email address shown at the top of this page. We reply within a reasonable time and no later than 30 days. We may ask you to prove your identity first.

You may complain to the UAE Data Office (the data protection authority) if you believe your rights were not respected.

Each company's data is isolated from every other company at the database level with row-level security policies, so one company cannot see another's data.

Role-based permissions and two-step verification for administrative accounts.

Encrypted connections, and private file storage opened only through short-lived signed links.

Sensitive service keys live on the server only and never reach the browser.

Audit logs for sensitive actions, and signature verification of payment notifications.

If a data breach likely to harm your privacy occurs, we notify the competent authority and affected people without undue delay as the law requires.

No system is completely secure; please use a strong password and do not share your account.

We use only the cookies necessary to run your session, keep you signed in and remember the interface language. We use no advertising or third-party tracking cookies.

The service is for employers and their staff. We do not knowingly collect data from anyone under 18.

We may update this policy and will notify accounts of material changes a reasonable time before they take effect. The date of the last update is shown at the top of the page.

For any privacy question, write to the email address at the top of this page.