Privacy Policy

1. Scope & Data Controller

Dusetra Corporate Services, operating in Dubai, United Arab Emirates, acts as the Data Controller for personal data submitted through our website, client portal, and mobile applications. We process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data (UAE PDPL) and, where we serve founders residing in the United Kingdom or European Economic Area, the UK GDPR and EU GDPR.

2. Data We Collect & Data Minimization

We collect only the minimum information required for the exact stage of your interaction with Dusetra. You can explore our Interactive Package Builder and UAE Business Activities Explorer completely anonymously without creating an account. We do not call third-party IP geolocation trackers to fingerprint visitors.

• Consultation & Setup Guide Requests: Full name, email address, optional WhatsApp phone number, selected package preferences, and explicit marketing consent choice.
• Client Portal & License/Visa Applications: Shareholder/applicant full legal name, nationality, passport copy, passport-style photograph, residential address proof, proposed UAE trade names, shareholding percentages, and entry stamp or Emirates ID records required by UAE licensing and immigration authorities.
• Bot & Abuse Prevention: Firebase App Check and Google reCAPTCHA Enterprise security attestation signals strictly to protect public forms against automated abuse.

3. Legal Basis & Purpose Limitation

Data collected for one purpose is never repurposed without fresh explicit consent:

• Contractual Performance: Preparing itemized incorporation quotes, filing UAE Free Zone or Mainland license applications, processing Establishment Cards, residency visas, Emirates IDs, and FTA Corporate Tax registrations.
• Statutory KYC / AML Compliance: Verifying Ultimate Beneficial Ownership (UBO) and identity documents under UAE Anti-Money Laundering (AML) and Know Your Customer (KYC) regulations.
• Explicit Consent: Sending optional UAE regulatory updates or promotional offers only when you opt in. You may withdraw consent at any time.

4. UAE Authorities & Infrastructure Sub-Processors

We never sell personal data. When you instruct us to incorporate a company or process a visa, your application data is shared solely with the relevant UAE government and Free Zone authorities (such as Sharjah Publishing City Free Zone, IFZA Dubai, Dubai Department of Economy and Tourism, GDRFA/ICP immigration authorities, the Federal Tax Authority, and your designated UAE partner banks) and stored on encrypted Google Cloud / Firebase infrastructure.

5. Client Portal & Optional AI / MCP Integrations

Dusetra never uses client KYC documents or private company records to train artificial intelligence models. If you choose to connect an external AI assistant to your Dusetra account via our OAuth-protected Model Context Protocol (MCP) server, access is governed by explicit user-granted scopes, raw passport files remain inside your encrypted Dusetra Document Vault, and any license or visa filing staged by an AI agent requires human founder review and attestation in the Dusetra Portal.

6. Security Controls & Data Retention

All data is encrypted in transit (TLS 1.3 / HSTS) and at rest (AES-256) on Google Cloud Platform with strict tenant-isolated access controls, non-SVG MIME verification, and verified administrator claims. Unconverted inquiry leads are reviewed for deletion after 24 months, while statutory corporate formation and KYC records are retained for the minimum period mandated by UAE commercial and AML law (typically 5 years post-relationship).

7. Your Data Rights: Access, Correction & Erasure

Under the UAE PDPL and GDPR, you have the right to request a copy of all personal data we hold about you, correct inaccurate details, restrict or object to processing, export your records, and request deletion (erasure) of any data not subject to mandatory statutory AML retention.