Privacy
Policy

Information We Collect

We collect information in two ways — directly from you and automatically through our systems:

How We Use Your Information

We process your personal data only where we have a lawful basis to do so. Our primary purposes include:

• Delivering the consultancy and management services you have engaged us for
• Responding to enquiries, proposals, and service requests
• Sending service-related communications and project updates
• Invoicing, financial administration, and contract management
• Improving our website and understanding user behaviour through analytics
• Marketing our services to prospective clients (with consent where required)
• Complying with legal, regulatory, and contractual obligations

Data Sharing

We may share your information with trusted third parties only where necessary:

• Service Providers: IT infrastructure, cloud hosting, accounting software, and CRM systems used to operate our business
• Professional Advisors: Legal counsel, auditors, and insurers bound by professional confidentiality obligations
• Regulatory Authorities: Government bodies or courts when legally required to do so
• Business Partners: Only with your explicit prior consent, and only to the extent necessary for project delivery

All third-party processors are contractually required to handle your data in compliance with applicable privacy laws and our data processing standards.

Cookies & Tracking

Our website uses cookies and similar technologies to enhance your experience. Types of cookies we use:

• Essential Cookies: Required for the website to function correctly — cannot be disabled
• Analytics Cookies: Help us understand how visitors interact with our site (e.g., Google Analytics)
• Preference Cookies: Remember your settings and preferences across sessions
• Marketing Cookies: Used to deliver relevant advertising on third-party platforms (only with consent)

You can manage your cookie preferences at any time through your browser settings or our cookie consent banner.

Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:

• SSL/TLS encryption for all data transmitted via our website
• Access controls and role-based permissions for internal systems
• Regular security assessments and vulnerability reviews
• Secure, encrypted storage for sensitive client documents
• Employee training on data protection and privacy obligations

In the event of a data breach that poses a risk to your rights, we will notify you and relevant authorities as required by law.

Your Rights

Under UAE data protection law, and where applicable GDPR, you have the following rights regarding your personal data:

To exercise any of these rights, contact our Data Protection Officer at privacy@sah-management.com. We will respond within 30 days.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by applicable law:

• Client project data: 7 years after project completion (for legal and tax compliance)
• Marketing contacts: Until withdrawal of consent or 3 years of inactivity
• Website analytics: 26 months (in line with Google Analytics defaults)
• Employee records: Duration of employment plus 5 years
• Enquiry data: 2 years from the date of enquiry

Contact Our DPO

If you have any questions about this Privacy Policy, want to exercise your rights, or wish to raise a complaint, please contact our Data Protection Officer:

• Email: privacy@sah-management.com
• Phone: +971 4 000 0000
• Postal Address: SAH Restaurants Management LLC, Data Protection Officer, Dubai, UAE

If you are not satisfied with our response, you have the right to lodge a complaint with the UAE Data Office or the relevant data protection authority in your country of residence.