The short version

01

Who we are

AlCaz Media Marketing Services FZCO ("AlCaz Media", "we", "us") is a digital marketing agency in Dubai. We decide how and why your personal data is used, which makes us the data controller under UAE law.

02

What this policy covers

This policy covers personal data we collect through alcazmedia.ae, our contact form and booking calendar, email, phone, WhatsApp and video calls, and our work with clients and suppliers.

We follow the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). When we offer our services to people in the United Kingdom or the European Union, including the Netherlands, or measure how they use our website, we also follow the UK GDPR and the Data Protection Act 2018, the EU General Data Protection Regulation (GDPR), and the cookie rules in the UK Privacy and Electronic Communications Regulations (PECR) and the Dutch Telecommunications Act (Telecommunicatiewet).

This policy does not cover the other websites we link to, or the websites and ad accounts of our clients. Those have their own privacy policies.

03

Information we collect

Information you give us

• Contact form: your name, business email, business phone, company website, monthly marketing budget and the details of your request.
• Booking a call: your name, email, the time you pick and any answers you add when you book through Calendly.
• Emails, calls, WhatsApp and video meetings: what you tell us and any files you send. If we record or transcribe a video call to keep notes, we tell you at the start of the call and stop if you ask.
• Clients and suppliers: contact details of the people we work with, contract and invoice details, and access to the ad accounts, analytics and websites a client asks us to manage.

Information collected automatically

• Website use: your IP address, browser and device type, the pages you visit, the site that sent you and the time of your visit.
• Campaign details: the source of your visit (UTM tags) and ad click IDs from Google, Meta and LinkedIn, which our form stores with your inquiry.
• Cookies and similar tools, listed in section 6.

We do not ask for sensitive data such as health, religious or biometric data. Please do not send it to us.

If you apply for a job

If you apply for a job with us, we collect your CV, contact details, portfolio and interview notes, and use them only to assess your application. We keep them for 12 months after the role is filled, unless you agree that we keep them longer for future roles.

04

How we use it and why

The law requires a reason for each use of your data. These are ours.

We do not make decisions about you based only on automated processing.

05

Advertising and measurement

We advertise AlCaz Media on Google, Meta (Facebook and Instagram) and ChatGPT. To learn which ads bring real inquiries, our website uses the Google Ads tag, the Meta Pixel and the OpenAI ads pixel.

When you send our contact form or book a call, we pass your email address and phone number to Google and Meta in hashed form, which means they are turned into a code before they leave your browser. Google and Meta use that code to match your inquiry to an ad you saw. They may also use this data under their own privacy policies.

You can limit ad personalization in your Google account at myadcenter.google.com and in the Ad Preferences section of your Facebook or Instagram settings.

06

Cookies and similar tools

Cookies are small files a website stores in your browser. Our website loads the tools below through Google Tag Manager.

We follow the cookie rules of the country you visit from. In the EU, the EEA and the UK, you see a cookie banner with Reject all next to Accept all, and analytics and advertising cookies only load if you accept. In Turkey, Brazil and Quebec, advertising cookies stay off unless you turn them on in Cookie settings (in Turkey and Quebec, analytics cookies too). Visitors from other countries can turn analytics and advertising cookies off at any time from Cookie settings at the bottom of every page. We keep your choice in your browser for 12 months. You can also block or delete cookies in your browser settings, or stop Google Analytics on every website with Google's opt-out add-on at tools.google.com/dlpage/gaoptout.

07

Who we share it with

We never sell or rent out your personal data. We share it only with:

• Providers that run parts of our business: website hosting (Webflow), email and files (Google Workspace), bookings (Calendly), spam protection (Cloudflare), analytics and advertising (Google, Meta, OpenAI), and our CRM and accounting tools. We have data processing terms in place with each of them, and they may use the data only to provide their service, except where section 5 says otherwise.
• AI assistants we use for drafting, meeting notes and campaign analysis, such as Claude (Anthropic), ChatGPT (OpenAI) and Gemini (Google). We use their business settings, which do not allow the provider to train its models on your data.
• Professional advisers, such as our accountants, auditors and lawyers.
• Authorities, courts and regulators, when the law requires it.
• A buyer or investor, if AlCaz Media is ever sold or merged. They must protect your data as this policy does.

08

International transfers

Several of our providers store data outside the UAE, mainly in the United States and the European Union. When your data leaves the UAE, we use providers that commit by contract to protect it. For data from the EU, we rely on approved safeguards such as the European Commission's Standard Contractual Clauses. For data from the UK, we rely on the UK Addendum to those clauses.

09

How long we keep it

When a period ends, we delete the data or make it anonymous.

10

How we protect it

• Our website and contact form run over an encrypted HTTPS connection.
• Only team members who need your data for their work can see it.
• We use two-step verification on our email, advertising and CRM accounts.
• We remove our access to a client's ad accounts and tools when the contract ends.

No system is completely secure. If a breach puts your data at risk, we will tell you and the relevant authority as the law requires.

11

Data we handle for clients

When we run campaigns for a client, we may handle data about that client's customers, such as leads from their ad forms or customer lists they use to build audiences. In that work the client is the data controller, and we act on the client's written instructions under our agreement.

If you are a customer of one of our clients, please contact that business first. We will help them answer your request.

How we count ad spend managed

The $3M+ ad spend figure on our homepage is the media budget clients have spent through campaigns AlCaz Media has run for them since 2023. It counts client spend only, not our fees and not ads for AlCaz Media itself.

$2.24M of it is measured in the ad accounts we still manage, from the ad platforms' own reporting for January 2024 to November 2026. The rest ran in accounts that clients have since moved in-house and we can no longer access, so that part is our estimate. We never publish what any single client spends.

12

Your rights

Under UAE law, and EU or UK law where it applies, you can ask us to:

• give you a copy of the personal data we hold about you
• correct data that is wrong or incomplete
• delete your data
• limit or stop how we use it, including for marketing
• send your data to you or to another company in a usable format
• withdraw any consent you gave us

Email contact.us@alcazmedia.com with "Privacy request" in the subject line. We may ask you to confirm your identity. We reply within 30 days. If your request is complex, we may need up to 30 more days, and we will tell you why.

If you have a complaint about how we handle your data, please contact us first. We will confirm we received it within 30 days and tell you what we did about it. If you are still unhappy, you can complain to the data protection authority where you live or work:

• UAE: the UAE Data Office, the federal data protection authority.
• United Kingdom: the Information Commissioner's Office at ico.org.uk.
• Netherlands: the Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl.
• Other EU countries: your national data protection authority.

13

Marketing messages

We send marketing emails only to people who agreed to receive them, or to business contacts who would expect to hear from us. Every email has an unsubscribe link. You can also email us, or reply "stop" on WhatsApp. We will still send you messages about a contract or an invoice.

14

Children

Our website and services are for businesses and adults. We do not knowingly collect data from anyone under 18. If you think a child has sent us their data, contact us and we will delete it.

15

Changes to this policy

We update this policy when our tools or the law change. The date at the top of this page shows the current version. If a change affects how we use data you already gave us, we will email you before it takes effect.