Privacy Policy

This Privacy Policy explains how RR studio ("we", "us", "our"), a website development and AI integration studio operating in Dubai, United Arab Emirates, collects, uses, discloses and protects personal data belonging to clients, website visitors and prospective clients ("you").

This Policy is drafted to align with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "UAE PDPL") and its Executive Regulations, and with the rules of the TDRA, the UAE regulator responsible for electronic marketing communications.

1. Who we are

RR studio provides custom website design and development, and AI integration for businesses. We are based in Dubai, UAE, and work with clients internationally.

Contact and data controller: RR studio, operated by Rafeek Rabbat. Email rafeekrabbat@gmail.com. Phone and WhatsApp +971 52 798 9825.

2. What personal data we collect

We do not collect location data, biometric data or health data, and we do not use automated decision-making or profiling.

3. How our enquiry forms work

This is worth stating plainly, because the forms on this site behave differently from most.

The forms do not send your details to a database of ours. When you press send, what you typed is formatted into a message and handed to either WhatsApp or your own email application, and you choose whether to send it. Nothing reaches us until you do.

If you send by WhatsApp, the message is delivered through WhatsApp and handled under Meta's own privacy policy, which is outside our control. If you would rather not use WhatsApp, use the email option on the same form, or contact us directly by email or phone.

4. Why we process your data (legal basis)

Under the PDPL, we rely on one or more of the following legal bases for each processing activity:

• Consent. For any marketing communication, opted into and revocable at any time.
• Contractual necessity. To quote for and deliver the website or AI integration you have engaged us for.
• Legal obligation. UAE tax, invoicing and record-keeping requirements.
• Legitimate interest. Responding to business enquiries, fraud prevention, and keeping our systems secure, balanced against your rights.

5. How we use your data

• Respond to your enquiry and prepare a quote or scope
• Deliver, manage and support the website or AI integration we build for you
• Communicate about project milestones, approvals and payments
• Process payments under our agreed 30 / 40 / 30 billing terms
• Troubleshoot technical issues and maintain the security of what we deliver
• Comply with UAE legal and regulatory requirements

6. Cookies and website analytics

This website sets no cookies. We run no analytics, no advertising pixels and no behavioural tracking of any kind.

Fonts, images and scripts are all served from our own domain, so loading this website makes no request to any third party and no outside company learns that you visited. If we introduce cookies or analytics in future, this section and a consent banner will be added before they go live.

7. Sharing and third-party processors

We share personal data only where necessary, with:

• Hosting and infrastructure. Vercel, which serves this website and keeps the server logs described above. Client sites may be hosted with Vercel, Netlify or a provider of your choosing.
• Messaging and email. WhatsApp, operated by Meta, and Google, which provides our email, where you use those channels to reach us.
• Payment processors. Ziina and Stripe, which process payment details directly. We never see or store your full card or bank details.
• AI providers. Where an engagement includes AI integration, the provider chosen for that project. This is set out in the scope before work begins.
• Professional advisors. Accountants or lawyers, where required.
• UAE authorities. Where legally required, for example a court order or regulatory request.

We do not operate a database of our own for website enquiries, and we do not sell personal data.

8. International data transfers

Some of these providers, including Vercel, Google, Meta and Stripe, process or store data outside the UAE, including in the United States and the European Union. Where this happens we take reasonable steps to ensure the receiving country or organisation provides an adequate level of protection consistent with PDPL requirements, relying on established providers that offer recognised contractual safeguards.

If you would prefer your enquiry stay on a single channel, email or phone us directly and say so.

9. Data retention

We retain personal data only as long as necessary for the purposes described above, or as required by UAE law:

• Enquiries that do not become projects: deleted within twenty-four months.
• Client records: kept for the engagement and afterwards for as long as UAE accounting and tax rules require.
• Project credentials: removed from our password manager once the project ends and access is no longer needed.

10. Your rights under the PDPL

Subject to applicable exceptions, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Erase your data, the right to be forgotten, where applicable
• Restrict or object to certain processing, including direct marketing
• Withdraw consent at any time, without affecting prior lawful processing
• Data portability, where technically feasible
• Object to automated decision-making that significantly affects you

To exercise any of these, contact us at rafeekrabbat@gmail.com. We respond within a reasonable timeframe as required under the PDPL, normally within thirty days, and we do not charge for it. If you are not satisfied with our response you may complain to the UAE Data Office.

11. Data security

We apply reasonable technical and organisational measures to protect personal data against unauthorised access, loss or misuse. This site is served over HTTPS, access to our inbox and project accounts is protected by strong authentication, and credentials you share are stored in an encrypted password manager and removed when a project ends.

12. Data breach notification

In the event of a data breach that risks your rights and freedoms, we will notify the UAE Data Office and affected individuals as required under the PDPL and its Executive Regulations.

13. Children's data

Our services are directed at businesses and at individuals over 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us and we will delete it.

14. Marketing communications

We do not currently send marketing emails, SMS or WhatsApp messages. Should we introduce them, they will go only to individuals who have opted in, in line with TDRA rules on unsolicited electronic communications, and every message will carry a clear unsubscribe option. Messages about a live project, such as approvals, milestones and invoices, are service communications rather than marketing.

15. Changes to this policy

We may update this Policy from time to time. Material changes will be notified via this website or by direct communication to existing clients. Continued use of our services after changes constitutes acceptance.

16. Governing law and contact

This Policy is governed by the laws of the United Arab Emirates. For questions or to exercise your rights, contact:

RR studio
rafeekrabbat@gmail.com
+971 52 798 9825
Dubai, United Arab Emirates