Introduction
This Privacy Policy (this “Policy”) explains how Ten Leaves Legability FZE (“Legability”, the “Firm”, “we”, “us” or “our”) collects, uses, discloses and protects personal data when you visit or interact with our website at ability.legal (the “Website”) or otherwise communicate with us.
Legability is a Free Zone Establishment licensed in the Sharjah Publishing City Free Zone (SPCFZ), Sharjah, United Arab Emirates (Licence No. 300497; Formation No. RSPC291), with its registered address at Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates. Legability provides legal consultancy and advisory services.
Your privacy is important to us. We are committed to protecting your personal data and to processing it in accordance with the UAE Federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021 (the “PDPL”), and other applicable laws of the United Arab Emirates.
Who is the data controller?
Legability is the controller responsible for the personal data processed through the Website and in connection with our services. If you have any questions about this Policy or how we handle your personal data, please contact us using the details in the “Contact us” section below.
What personal data do we collect?
“Personal data” means any information relating to an identified or identifiable natural person. Depending on how you interact with us, we may collect and process the following categories of personal data:
- identity and contact details, such as your name, job title, employer or organisation, postal address, email address and telephone number;
- the content of any enquiry, message or correspondence you send us, including information you provide through our contact form, by email or by telephone;
- information you provide when you subscribe to our newsletter, publications, podcasts, events or other communications;
- where you engage us or discuss a potential engagement, information relevant to the matter you ask us to consider (please do not send confidential or sensitive information through the Website before an engagement is in place – see our Terms of Use);
- technical and usage data collected automatically when you use the Website, such as your IP address, browser type, device information, referring pages and pages viewed, collected through cookies and similar technologies (see “Cookies and analytics” below); and
- any other personal data you choose to provide to us.
This list is not exhaustive, and we may collect and process additional personal data where necessary for the purposes described in this Policy.
How do we collect personal data?
We collect personal data:
- directly from you – when you complete our contact form, subscribe to our communications, email or call us, attend our events, or engage us for our services;
- automatically – when you use the Website, through cookies and similar technologies; and
- from third parties and public sources – such as your organisation, intermediaries or business partners, publicly accessible registers and professional or business networks, where relevant to our services or to our legal and regulatory obligations.
How do we use personal data, and on what lawful basis?
We process personal data for the following purposes:
- to respond to your enquiries and correspondence and to provide information you request;
- to provide, administer and improve our legal consultancy and advisory services;
- to send you newsletters, publications, event invitations and other communications you have asked to receive;
- to operate, maintain, secure and improve the Website;
- to manage our business relationship with you and to keep records of our dealings; and
- to comply with our legal and regulatory obligations and to establish, exercise or defend legal claims.
Under the PDPL, we process personal data on one or more of the lawful bases permitted by the law. In most cases this will be because processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract, because processing is necessary to comply with our legal obligations, or on the basis of your consent (for example, where you subscribe to our communications). Where we rely on your consent, you may withdraw it at any time, and withdrawal will not affect the lawfulness of processing carried out before withdrawal.
To whom do we disclose personal data?
We do not sell your personal data. We may disclose or transfer personal data:
- to other companies within the 10 Leaves group, where reasonably necessary for the purposes described in this Policy;
- to third-party service providers who process personal data on our behalf, such as providers of IT, hosting, email, website, communications, analytics and administrative services. Where a provider processes personal data on our behalf, we put in place appropriate contractual and organisational safeguards requiring them to protect your data and to process it only on our instructions;
- to professional advisers, subcontractors or intermediaries where necessary for the proper performance of our services;
- to competent authorities, regulators, courts or other bodies where we are required to do so by law or to protect our rights or those of our clients or to prevent fraud; and
- where you have otherwise consented to the disclosure.
International transfers
We may transfer personal data to recipients located outside the United Arab Emirates, including to other companies within the 10 Leaves group and to service providers. The personal data we process is stored on our servers and/or on the servers of the cloud-based service providers we engage, which may be located outside the UAE.
Where personal data is transferred to a country that does not ensure an adequate level of protection under the PDPL, we will put in place appropriate safeguards as required by the PDPL, such as contractual protections requiring the recipient to protect the data to a standard consistent with the PDPL, or we will rely on another lawful basis for the transfer, such as your explicit consent or the necessity of the transfer for the performance of a contract.
Data retention
We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including for the duration of our services or business relationship with you, and thereafter for as long as necessary to comply with our legal, contractual, tax or regulatory obligations, to resolve disputes, and to establish, exercise or defend legal claims.
Your rights
Subject to the conditions and exceptions set out in the PDPL, you have the following rights in relation to your personal data:
- Right to access / to obtain information – to be informed about, and to obtain access to, the personal data we hold about you;
- Right to data portability – to request the transfer of your personal data;
- Right to correction – to have inaccurate or incomplete personal data corrected or completed;
- Right to erasure – to request deletion of your personal data where we have no legal or regulatory basis to retain it;
- Right to restrict processing – to request that we restrict the processing of your personal data in certain circumstances;
- Right to stop processing – to request that we cease processing your personal data, including for direct marketing purposes; and
- Right in relation to automated decision-making – to object to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects concerning you.
You may exercise these rights by contacting us using the details below. You also have the right to lodge a complaint with the UAE Data Office regarding our processing of your personal data.
Cookies and analytics
The Website uses cookies and similar technologies to enable the Website to function, to remember your preferences, to understand how visitors use the Website and to improve it. Cookies are small text files stored on your device. We may also log IP addresses to help administer the Website and diagnose technical issues.
The Website uses cookies and similar technologies that are necessary for it to function and, where enabled, to help us understand how visitors use the Website so that we can improve it. You can accept, reject or manage non-essential cookies through your browser settings or through any cookie-preferences tool made available on the Website. Where required by applicable law, we place non-essential cookies only with your consent.
You can set your browser to warn you before accepting cookies or to refuse cookies. If you disable cookies, some parts of the Website may not function properly. Where required, we will only place non-essential cookies with your consent.
How we protect personal data
We take appropriate technical, physical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage, and we maintain a level of security appropriate to the risk. Our personnel are required to treat personal data confidentially and may access it only to the extent necessary for the purposes for which it is processed. No transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.
Personal data breaches
If a personal data breach occurs that is likely to prejudice the privacy, confidentiality or security of your personal data, we will notify the UAE Data Office and, where required, the affected individuals, in accordance with the UAE Personal Data Protection Law. Where we process personal data on behalf of another party, we will notify that party of any breach without undue delay so that it can meet its own obligations.
Changes to this Policy
We may update this Policy from time to time. The current version will always be available on the Website, and we encourage you to review it periodically.
Contact us
If you have any questions, concerns or complaints about this Policy or the way we handle your personal data, or if you wish to exercise any of your rights, please contact us at:
Ten Leaves Legability FZE
Email: connect@ability.legal