Privacy Policy

1. Who is responsible for your data

First Layer Technology CO. L.L.C S.O.C is the data controller for personal data collected through this website and in the course of providing our services. We are licensed in Dubai under Trade Licence No. 1624077 and based at Office 2105-D-075, The Citadel Tower, Business Bay, Dubai, UAE.

This policy explains what we collect, why, who we share it with, and what rights you have. It is written to comply with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and its implementing regulations.

2. What we collect

When you contact us or request an audit: your name, business name, email address, phone number, website address, and anything you choose to tell us about your business.

When you become a client: your trade licence details, registered address, billing address, authorised contact person, and the access credentials you provide for your domain, hosting and other accounts.

When you pay: your billing name, business name, billing address, phone number and email. Card details are entered directly into our payment processor’s secure page.

When you visit this website: standard technical information such as IP address, browser type, pages viewed and referring page.

On behalf of our clients: where we build and host a website for you, we process the enquiry and contact data submitted by your own visitors. For that data, you are the controller and we act on your instructions.

3. Card and payment data

We never see, handle, or store your full card number. Payments are processed by Stripe, a PCI-DSS Level 1 certified payment provider. Card details are entered on Stripe’s own secure page and stored by Stripe, not by us.

What we can see in our payment dashboard is limited to the last four digits, the card brand, the expiry date, and whether a payment succeeded or failed. That is all we need to manage your subscription and answer billing questions.

Stripe processes your data as an independent controller for its own compliance and fraud-prevention purposes. Stripe’s own privacy policy is available at stripe.com/ae/privacy.

4. Why we use your data

• To respond to your enquiry and prepare a proposal
• To deliver the services set out in your agreement
• To issue invoices, take payment and manage your subscription
• To provide support and send you performance reports
• To notify you about your account — failed payments, expiring cards, renewal rates and changes to these terms
• To keep the accounting and tax records we are required by UAE law to keep
• To improve this website and understand how it is used

We use the contact details you give us — email, telephone and WhatsApp — to reach you about your enquiry, your project and your account.

We process your data on the lawful bases available under Federal Decree-Law No. 45 of 2021: performance of a contract with you, compliance with our legal obligations, our legitimate business interests, and — where required — your consent.

We do not sell your personal data, and we do not share it for anyone else’s marketing.

5. Marketing communications

We may contact business owners by email about our services. Every such message identifies us clearly and includes a way to tell us to stop.

If you ask us to stop contacting you, we will — and we keep a minimal record of that request precisely so that we do not contact you again by mistake. Account and billing notifications are not marketing and continue for as long as you are a client.

6. Who we share data with

We share personal data only with service providers who need it to help us deliver our services, and only to the extent necessary:

• Stripe — payment processing, invoicing and subscription billing
• Our hosting providers — to host your website and ours
• Our email provider — to send and receive business correspondence
• Google — where we manage your Google Business Profile or analytics on your instructions
• Our internal project and client management tools — to track work and correspondence

We may also disclose data where required by law, by a court, or by a competent authority in the United Arab Emirates, and to professional advisers where necessary to establish or defend legal claims.

We may engage subcontractors to perform parts of the services. We remain fully responsible for their performance and for their compliance with confidentiality.

7. Transfers outside the UAE

Some of the providers above operate servers outside the United Arab Emirates. Where personal data is transferred abroad, we do so only where the receiving jurisdiction provides an adequate level of protection, or under contractual safeguards that meet the requirements of Federal Decree-Law No. 45 of 2021.

8. How long we keep it

• Enquiries that do not become clients: up to 24 months, then deleted
• Client records and correspondence: for the duration of the agreement and 3 years afterwards, matching the confidentiality period in our terms
• Invoices, payment records and accounting data: for the period required by UAE tax and commercial law — currently seven (7) years from the end of the relevant tax period under the UAE Corporate Tax regime
• Website analytics: up to 14 months from a visitor’s most recent activity
• Access credentials you provide: deleted or revoked within 30 days of termination

9. Security

We apply appropriate technical and organisational measures to protect personal data, including encryption in transit (SSL/TLS), access controls, multi-factor authentication on the accounts that hold client data, and routine backups.

No system is completely secure. If a personal data breach occurs that is likely to prejudice the privacy, confidentiality or security of your data, we will notify the competent supervisory authority in the United Arab Emirates and the affected individuals, as required by law and without undue delay.

10. Your rights

Under Federal Decree-Law No. 45 of 2021 you have the right to:

• Be informed about how your data is processed
• Request access to the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your data, subject to our legal retention obligations
• Request restriction of processing in certain circumstances
• Object to processing based on our legitimate interests
• Require us to stop processing your data for marketing purposes or statistical surveys
• Object to decisions made solely by automated processing that significantly affect you
• Receive your data in a structured, machine-readable format and have it transferred to another provider, where processing is based on your consent, a contract, or automated means
• Withdraw your consent at any time, where processing is based on consent

To exercise any of these, email support@firstlayer.ae. We respond within thirty (30) days. There is no charge, unless a request is manifestly excessive or repetitive.

If you are not satisfied with our response, you may complain to the competent supervisory authority in the United Arab Emirates.

11. Cookies

This website uses cookies that are strictly necessary for it to function, including cookies that maintain your session and protect the security of the site. These are always active and cannot be switched off.

We also use Google Analytics 4 to understand how visitors use the site, such as which pages are viewed and how visitors arrive. These analytics cookies are set only after you accept them. If you choose “Necessary only,” no analytics cookies are set and no analytics data is sent.

You can change your choice at any time using the Cookie settings link in the footer. You can also block or delete cookies through your browser settings, although blocking strictly necessary cookies may stop parts of the site from working.

12. Children

Our services are provided to businesses. We do not knowingly collect personal data from anyone under the age of 18. If you believe we hold such data, contact us and we will delete it.

13. Changes to this policy

We may update this policy. The version in force is the one published on this page, and the effective date appears at the top. We will notify active clients in writing of any material change.

This policy is published in English and Arabic. In the event of any conflict between the two texts, the Arabic text shall prevail before the Courts of Dubai in accordance with the applicable laws of the United Arab Emirates.