GDPR & Data Rights

1.Which laws we work to

We build to the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and to the EU and UK General Data Protection Regulation where our customers or their end customers are in those territories. Where another regime gives a person stronger rights, we honour the stronger position.

This page explains your rights in plain terms and how to exercise them. Our Privacy Policy sets out the underlying detail of what we collect and why.

2.Ask the right organisation first

This determines who can actually act on your request, so it is worth getting right.

If you are a customer, prospect or website visitor of ALAbrish, we are the controller and you should come to us directly. If you received a message from a business that uses ALAbrish, that business is the controller: it chose to contact you and holds your consent record. We are only its processor and cannot lawfully amend or delete its data on our own initiative. Come to us anyway if you cannot identify or reach them, and we will forward your request and press for a response.

3.Your rights

• Access: obtain confirmation of whether we process your data and receive a copy of it.
• Rectification: have inaccurate data corrected and incomplete data completed.
• Erasure: have your data deleted where there is no overriding lawful reason to keep it.
• Restriction: have processing paused while an accuracy or legitimacy question is resolved.
• Portability: receive data you provided in a structured, machine-readable format, or have it sent to another provider where technically feasible.
• Objection: object to processing based on legitimate interests, and object to direct marketing at any time with no justification needed.
• Withdraw consent: withdraw it as easily as it was given, without affecting processing already carried out.
• Human review: ask for a person to review a decision made solely by automated means that significantly affects you.

4.How to make a request

Email ceo@alabrishtechnologies.com with the subject "Data rights request". Tell us which right you are exercising, the email address or phone number your data is held under, and the business you were messaging if your request concerns a conversation.

We will verify your identity before acting, because releasing or deleting data on an unverified request would itself be a breach. Verification is proportionate: usually confirming control of the contact details already on record rather than asking for identity documents.

5.Timescales and cost

We acknowledge requests within 5 business days and respond substantively within 30 days. For a genuinely complex request we may extend by a further 60 days and will tell you why within the first 30.

Requests are free. We may charge a reasonable administrative fee, or decline, only where a request is manifestly unfounded or repetitive; if we decline we will explain why and tell you how to challenge it.

6.What we may not be able to delete

Some data must be retained despite an erasure request, and we will tell you specifically which categories are affected rather than refusing wholesale. Typical examples are invoices and accounting records required by UAE tax law, suppression-list entries that exist precisely to ensure you are not contacted again, and security logs needed to investigate abuse. We keep the minimum necessary for the shortest lawful period.

7.Complaints

If you are unhappy with our response, tell us first and we will escalate it internally. You also have the right to complain to a supervisory authority: the UAE Data Office for processing in the United Arab Emirates, your national data protection authority in the EEA, or the Information Commissioner's Office in the United Kingdom.

8.For our business customers

If you use ALAbrish and need to answer a request from one of your own end customers, the platform provides search, export and deletion tools that cover most cases without our involvement. Our Data Processing Addendum sets out the assistance we provide, and our Sub-processors page lists the vendors involved so you can complete your own records of processing.