Consura's Privacy Policy

1. Introduction
Welcome to the privacy policy of Consura Legal Consultancy FZ LLE (Consura, we, us, or our). Consura is a UAE-registered legal consultancy operating within the Fujairah Creative Zone. As the Controller of the personal data we collect through this website, we are committed to complying with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). The PDPL establishes the UAE Data Bureau (Office) under Federal Decree-Law No. 44 of 2021, which oversees the implementation of the PDPL.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data in accordance with the PDPL. Please note that free-zone entities with their own data laws, such as those under the DIFC or ADGM, are exempt from the federal PDPL. However, as a consultancy operating exclusively under the federal framework, our practices fully adhere to the PDPL requirements.

For further information, or if you wish to exercise your rights under the PDPL, you may contact our appointed Data Protection Officer (DPO):
Marthinus Vermeulen (Managing Partner)
Contact Email: enquiry@consura.ae
Subject Line: "Data Request"

2. Scope of This Privacy Policy
This Privacy Policy applies to personal data we process when you interact with our website, submit enquiries, request legal consultancy services, or otherwise engage with us. It includes personal data collected directly from you and through automated processes, such as cookies and analytics. This Privacy Policy also explains our commitment to protecting your privacy and maintaining transparency in our data-handling practices.

3. Data We May Collect
3.1 Contact Data:

Name.
Email address.
Telephone number.
Company name (if applicable).
The contents of your communications with us (e.g., messages submitted via our contact form).
1. Usage and Technical Data:

IP address.
Device and browser details.
Pages viewed, links clicked, and interactions with our website.
Data collected via cookies, including analytics data from Google Analytics.
1. Business Correspondence:

Emails exchanged with us.
Files shared or transmitted via cloud services (e.g., Microsoft 365, Google Workspace).

Important Note: We do not intentionally collect sensitive personal data through this website. If such data is inadvertently shared with us, we will treat it in accordance with applicable legal requirements, including the PDPL.

4. Purpose of Processing
We process your personal data lawfully and transparently for the following purposes:

Responding to Enquiries: To provide legal consultancy services or respond to your queries.
Website Operations: To monitor and optimise website performance through analytics, including aggregating usage statistics.
Regulatory Compliance: To meet legal and regulatory obligations under UAE law.
Security and Fraud Prevention: To safeguard our digital platforms and services against unauthorised access or malicious activity.

5. Legal Basis for Processing
We rely on the following lawful bases under the PDPL:

Consent: For specific processes such as subscribing to communications or accepting cookies.

PDPL Article 4 Exemptions:

The processing is necessary to perform a contract to which you, as the data subject, are a party.
The processing is required to comply with legal obligations or public interest mandates.
To safeguard the vital interests of the data subject.

We ensure that all processing aligns with the PDPL principles of fairness, transparency, purpose limitation, minimisation, accuracy, security, and storage limitation.

6. Your Rights as a Data Subject
Under the PDPL, you have the following rights concerning your personal data:

Right to Information: Receive clear details about how your personal data is used.
Right to Portability: Request the transfer of personal data to another entity, where technologically feasible.
Right to Correction and Erasure: Request corrections or deletion of inaccurate or unnecessary data.
Right to Restriction: Request restricted processing in specific circumstances.
Right to Objection: Object to the processing of personal data for direct marketing or automated decision-making (subject to safeguards).

To Exercise Your Rights: Send an email to enquiry@consura.ae with the subject line "Data Request." We will respond within [30] days, consistent with the obligations and exemptions under the PDPL.

7. Sharing of Personal Data
We only share personal data with third parties when necessary for the following purposes:

Cloud/Email Providers: Microsoft 365, Google Workspace.
Professional Advisors: External consultants (e.g., for conflict checks or legal compliance).
IT Service Providers: For website hosting and analytics.

Processor Obligations: We ensure that any third parties processing personal data on our behalf comply with PDPL obligations, including maintaining appropriate safeguards and processing records.

8. International Data Transfers
As a consultancy utilising reputable cloud service providers, data processed by Consura may be stored in, or accessed from, jurisdictions outside the UAE.
We ensure compliance with Article 23 of the PDPL, including:

Transfers only to jurisdictions deemed to provide adequate levels of data protection by the UAE Data Bureau.
Use of legally approved contractual safeguards for transfers to non-adequate jurisdictions.
Obtaining explicit consent where other mechanisms are unavailable.

Queries regarding these safeguards can be directed to our DPO.

9. Retention of Personal Data
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required to comply with legal or regulatory obligations.
Retention Schedule Examples:

General enquiries: Retained for [12 months] unless further interaction occurs.
Legal correspondence: Retained for [7 years], or longer to comply with professional obligations.
Cookie data: Retained as per the expiry of the relevant cookies (e.g., [6 months] for Google Analytics).

When personal data is no longer necessary, we securely delete or anonymise the data in accordance with the storage limitation principle under the PDPL.

10. Data Security
We implement appropriate technical and organisational measures to ensure a high level of protection for your personal data. These measures include:

Encryption and Pseudonymisation: Protecting data when stored or transmitted.
Incident Breach Management: Procedures for notifying the UAE Data Bureau in the event of data breaches within [72 hours], consistent with the PDPL.
Regular Security Assessments: Periodic reviews to ensure compliance with the latest standards.

11. Cookies and Analytics
Our website uses cookies to deliver an optimised user experience. Google Analytics is used to track aggregated, pseudonymised data regarding site usage:
• Necessary Cookies: Essential for website functionality.
• Non-Essential Cookies: Used for tracking and analytics (user consent required).
Cookie Preferences and Management: You may manage or disable cookies through your browser settings.

12. Updates to This Policy
This Privacy Policy was last updated on 16 October 2025. We reserve the right to amend this policy to align with changes in the PDPL or our internal practices. Updates will be reflected here, and, where significant changes occur, we will notify you via appropriate channels.

13. Contact Details
For any enquiries or to exercise your rights, please reach out:

Email: enquiry@consura.ae
Subject Line: "Data Request"
DPO Name: Marthinus Vermeulen

Consura's Privacy Policy

Name.

Email address.

Telephone number.

Company name (if applicable).

The contents of your communications with us (e.g., messages submitted via our contact form).

Usage and Technical Data:

IP address.

Device and browser details.

Pages viewed, links clicked, and interactions with our website.

Data collected via cookies, including analytics data from Google Analytics.

Business Correspondence:

Emails exchanged with us.

Files shared or transmitted via cloud services (e.g., Microsoft 365, Google Workspace).

Responding to Enquiries: To provide legal consultancy services or respond to your queries.

Website Operations: To monitor and optimise website performance through analytics, including aggregating usage statistics.

Regulatory Compliance: To meet legal and regulatory obligations under UAE law.

Security and Fraud Prevention: To safeguard our digital platforms and services against unauthorised access or malicious activity.

5. Legal Basis for Processing We rely on the following lawful bases under the PDPL:

Consent: For specific processes such as subscribing to communications or accepting cookies.

PDPL Article 4 Exemptions:

The processing is necessary to perform a contract to which you, as the data subject, are a party.

The processing is required to comply with legal obligations or public interest mandates.

To safeguard the vital interests of the data subject.

We ensure that all processing aligns with the PDPL principles of fairness, transparency, purpose limitation, minimisation, accuracy, security, and storage limitation. 6. Your Rights as a Data Subject Under the PDPL, you have the following rights concerning your personal data:

Right to Information: Receive clear details about how your personal data is used.

Right to Portability: Request the transfer of personal data to another entity, where technologically feasible.

Right to Correction and Erasure: Request corrections or deletion of inaccurate or unnecessary data.

Right to Restriction: Request restricted processing in specific circumstances.

Right to Objection: Object to the processing of personal data for direct marketing or automated decision-making (subject to safeguards).

Cloud/Email Providers: Microsoft 365, Google Workspace.

Professional Advisors: External consultants (e.g., for conflict checks or legal compliance).

IT Service Providers: For website hosting and analytics.

Transfers only to jurisdictions deemed to provide adequate levels of data protection by the UAE Data Bureau.

Use of legally approved contractual safeguards for transfers to non-adequate jurisdictions.

Obtaining explicit consent where other mechanisms are unavailable.

Queries regarding these safeguards can be directed to our DPO. ​ 9. Retention of Personal Data We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required to comply with legal or regulatory obligations. Retention Schedule Examples:

General enquiries: Retained for [12 months] unless further interaction occurs.

Legal correspondence: Retained for [7 years], or longer to comply with professional obligations.

Cookie data: Retained as per the expiry of the relevant cookies (e.g., [6 months] for Google Analytics).

Encryption and Pseudonymisation: Protecting data when stored or transmitted.

Incident Breach Management: Procedures for notifying the UAE Data Bureau in the event of data breaches within [72 hours], consistent with the PDPL.

Regular Security Assessments: Periodic reviews to ensure compliance with the latest standards.

Email: enquiry@consura.ae

Subject Line: "Data Request"

DPO Name: Marthinus Vermeulen

5. Legal Basis for Processing
We rely on the following lawful bases under the PDPL:

We ensure that all processing aligns with the PDPL principles of fairness, transparency, purpose limitation, minimisation, accuracy, security, and storage limitation.

6. Your Rights as a Data Subject
Under the PDPL, you have the following rights concerning your personal data:

Queries regarding these safeguards can be directed to our DPO.

9. Retention of Personal Data
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required to comply with legal or regulatory obligations.
Retention Schedule Examples: