1. Introduction
Welcome to the privacy policy of Vermeulen Legal Consultancy FZ LLE (Vermeulens, we, us, or our). Vermeulens is a UAE-registered legal consultancy operating within the Fujairah Creative City, Media Free Zone. As the Controller of the personal data we collect through this website, we are committed to complying with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).
This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data in accordance with the PDPL.
For further information, or if you wish to exercise your rights under the PDPL, you may contact our appointed Data Protection Officer (DPO):
Marthinus Vermeulen (Managing Partner)
Contact Email: enquiry@vermeulens.ae
Subject Line: “Data Request”
2. Scope of This Privacy Policy
This Privacy Policy applies to personal data we process when you interact with our website, submit enquiries, request legal consultancy services, or otherwise engage with us. It includes personal data collected directly from you and through automated processes, such as cookies and analytics. This Privacy Policy also explains our commitment to protecting your privacy and maintaining transparency in our data-handling practices.
3. Data We May Collect
3.1 Contact Data
- Name.
- Email address.
- Telephone number.
- Company name (if applicable).
- The contents of your communications with us (e.g., messages submitted via our contact form).
3.2 Usage and Technical Data
- IP address.
- Device and browser details.
- Pages viewed, links clicked, and interactions with our website.
- Data collected via cookies, including analytics data from Google Analytics.
3.3 Business Correspondence
- Emails exchanged with us.
- Files shared or transmitted via cloud services (e.g., Microsoft 365, Google Workspace).
Important Note: We do not intentionally collect sensitive personal data through this website. If such data is inadvertently shared with us, we will treat it in accordance with applicable legal requirements, including the PDPL.
4. Purpose of Processing
We process your personal data lawfully and transparently for the following purposes:
- Responding to Enquiries: To provide legal consultancy services or respond to your queries.
- Website Operations: To monitor and optimise website performance through analytics, including aggregating usage statistics.
- Regulatory Compliance: To meet legal and regulatory obligations under UAE law.
- Security and Fraud Prevention: To safeguard our digital platforms and services against unauthorised access or malicious activity.
5. Legal Basis for Processing
We rely on the following lawful bases under the PDPL:
- Consent: For specific processes such as subscribing to communications or accepting cookies.
- PDPL Article 4 Exemptions:
- The processing is necessary to perform a contract to which you, as the data subject, are a party.
- The processing is required to comply with legal obligations or public interest mandates.
- To safeguard the vital interests of the data subject.
We ensure that all processing aligns with the PDPL principles of fairness, transparency, purpose limitation, minimisation, accuracy, security, and storage limitation.
6. Your Rights as a Data Subject
Under the PDPL, you have the following rights concerning your personal data:
- Right to Information: Receive clear details about how your personal data is used.
- Right to Portability: Request the transfer of personal data to another entity, where technologically feasible.
- Right to Correction and Erasure: Request corrections or deletion of inaccurate or unnecessary data.
- Right to Restriction: Request restricted processing in specific circumstances.
- Right to Objection: Object to the processing of personal data for direct marketing or automated decision-making (subject to safeguards).
- Right to Withdraw Consent: Where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew it.
- Right to Complain: If you believe your personal data has been processed in breach of the PDPL, you may lodge a complaint with the UAE Data Office.
To Exercise Your Rights: Send an email to enquiry@vermeulens.ae with the subject line “Data Request.” We aim to respond within 30 days, in accordance with the PDPL and its Executive Regulations, subject to any exemptions that apply.
7. Sharing of Personal Data
We only share personal data with third parties when necessary for the following purposes:
- Cloud/Email Providers: Microsoft 365, Google Workspace.
- Professional Advisors: External consultants (e.g., for conflict checks or legal compliance).
- IT Service Providers: For website hosting and analytics.
Processor Obligations: We ensure that any third parties processing personal data on our behalf comply with PDPL obligations, including maintaining appropriate safeguards and processing records.
8. International Data Transfers
As a consultancy that uses reputable cloud service providers, Vermeulens may store or access personal data in jurisdictions outside the UAE.
Any such transfer is made in accordance with Articles 22 and 23 of the PDPL, which may include:
- transfers to jurisdictions recognised under the PDPL as providing an adequate level of data protection;
- contractual safeguards requiring the recipient to protect personal data to a standard consistent with the PDPL, where adequate protection is not in place; or
- obtaining express consent, or relying on another ground permitted under the PDPL, where other mechanisms are not available.
Queries regarding these safeguards can be directed to us using the contact details in Section 13.
9. Retention of Personal Data
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required to comply with legal or regulatory obligations.
Retention Schedule Examples:
- General enquiries: Retained for 12 months, unless further interaction occurs.
- Legal correspondence: Retained for 7 years, or longer to comply with professional obligations.
- Cookie data: Retained as per the expiry of the relevant cookies (e.g., 6 months for Google Analytics).
When personal data is no longer necessary, we securely delete or anonymise the data in accordance with the storage limitation principle under the PDPL.
10. Data Security
We implement appropriate technical and organisational measures to ensure a high level of protection for your personal data. These measures include:
- Encryption and Pseudonymisation: Protecting data when stored or transmitted.
- Incident Breach Management: Procedures for notifying the UAE Data Office immediately upon becoming aware of a personal data breach, and affected individuals where required, within the timeframe and manner prescribed by the PDPL and its Executive Regulations.
- Regular Security Assessments: Periodic reviews to ensure compliance with the latest standards.
11. Cookies and Analytics
Our website uses a small number of cookies and similar technologies. Google Analytics is used, only if you accept, to track aggregated, pseudonymised data regarding site usage:
- Necessary: your cookie choice is stored in your browser’s local storage so that we do not ask you again. No other cookies are required for the website to function.
- Non-Essential Cookies: Used for tracking and analytics (user consent required). Google Analytics cookies (_ga and _ga_*) are only set after you select Accept, and expire after 6 months.
Cookie Preferences and Management: You may change your choice at any time using the Cookie settings link in the footer of this website, or manage or disable cookies through your browser settings.
12. Updates to This Policy
This Privacy Policy was last updated on 7 October 2026. We reserve the right to amend this policy to align with changes in the PDPL or our internal practices. Updates will be reflected here, and, where significant changes occur, we will notify you via appropriate channels.
13. Contact Details
For any enquiries or to exercise your rights, please reach out:
- Email: enquiry@vermeulens.ae
- Subject Line: “Data Request”
- DPO Name: Marthinus Vermeulen