Privacy Policy
1. Introduction and Scope
Qaitas International Management Consultancies LLC (“Qaitas”, “we”, “us” or “our”) is committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains how we collect, use, share, transfer and safeguard personal data when you visit www.qaitas.com (the “Site”), use our services, apply for a role with us, or otherwise engage with us.
This policy is designed to support compliance with applicable data protection laws relevant to our activities, including the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and the Kingdom of Saudi Arabia Personal Data Protection Law. Where our processing activities fall within the territorial scope of the EU General Data Protection Regulation (“GDPR”) or the UK GDPR, we will comply with the applicable requirements of those laws.
2. Who We Are - Our Role
The data controller responsible for your personal data collected through this Site and through our direct business, recruitment and marketing activities is:
Qaitas International Management Consultancies LLC
Office 2604, Marasi Drive, Business Bay, Dubai, United Arab Emirates
Email: info@qaitas.com
Telephone: +971 4 447 2456
Privacy contact: Hussein Mansour - dpo@qaitas.com
Depending on the context, Qaitas may act as a data controller, data processor, or service provider. Where we process personal data on behalf of a client under a service agreement, the client may be the data controller and Qaitas may act as a processor or service provider in accordance with the relevant contract.
3. Personal Data We Collect
3.1 Information you provide to us
- Identity and contact data: name, email address, telephone number, postal address, and the company you represent.
- Account data: login credentials and profile information where you register for an account or client/candidate portal.
- Enquiry and communications data: the content of messages you send via contact forms, email, WhatsApp, customer support, or when you book a meeting with us.
- Marketing data: your preferences for receiving newsletters and marketing, and your subscription status.
- Payment and transaction data: information needed to process payments (note: card details are handled directly by our payment providers; we do not store full card numbers).
- Recruitment data: where you apply for a role or submit a CV, the information contained in your CV, cover letter and application.
3.2 Information we collect automatically
- Technical and usage data: IP address, browser type and version, device type, operating system, the pages you visit, dates and times of access, and the website that referred you.
- Cookie and tracking data: data collected through cookies and similar technologies.
3.3 Sensitive (special-category) personal data
We do not actively seek sensitive personal data. However, CVs and job applications can sometimes contain information that the law treats as sensitive - such as nationality, photographs, marital or family status, health information, or religious belief. Please do not include sensitive information in your CV or messages unless it is necessary.
4. How and Why We Use Your Personal Data
We only use your personal data where the law allows us to. The table below sets out our main purposes of processing, the personal data used, and the lawful basis we rely on where the GDPR / UK GDPR applies.
| Purpose of processing | Personal data used | Lawful basis (GDPR / UK GDPR) |
|---|---|---|
| Responding to enquiries and providing requested information | Name, contact details, enquiry content | Steps prior to entering a contract and our legitimate interests in responding (Art. 6(1)(b) and (f)) |
| Providing, administering and improving our services and your account | Account, contact and service data | Performance of a contract (Art. 6(1)(b)); legitimate interests in improving our services (Art. 6(1)(f)) |
| Assessing and managing job applications | CV / application data; correspondence | Steps prior to a contract and legitimate interests (Art. 6(1)(b)/(f)); explicit consent for any special-category data (Art. 9(2)(a)) |
| Sending newsletters, promotional offers and marketing | Contact details, marketing preferences | Your consent (Art. 6(1)(a)), withdrawable at any time |
7. International Transfers
Qaitas is based in the United Arab Emirates. Some of our service providers are located outside the UAE, KSA and the EEA - including in the United States - so your personal data may be transferred to, stored in, or accessed from other countries whose data protection laws may differ from those in your jurisdiction.
When we transfer personal data internationally, we put in place a lawful transfer mechanism appropriate to the law that applies, which may include Standard Contractual Clauses or transfers to a jurisdiction with an adequate level of protection.
8. Data Retention
We keep personal data only for as long as necessary for the purposes for which it was collected. Indicative periods:
- General enquiries: up to 24 months from last contact.
- Unsuccessful job applicants: 6 months after the hiring decision.
- Client and account records: for the duration of the engagement and generally up to 7 years afterwards.
- Marketing data: until you withdraw consent or unsubscribe.
9. Data Security
We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss, misuse or destruction. These safeguards may include access controls and role-based permissions, secure transmission and encryption where appropriate, backup and recovery controls, confidentiality obligations on staff, vendor due diligence, and incident response procedures.
10. Your Rights
Depending on the law that applies to you, you may have the following rights in relation to your personal data:
Access
obtain confirmation that we process your data and a copy of it
Rectification
have inaccurate or incomplete data corrected
Erasure
request deletion of your data in certain circumstances
Restriction
ask us to limit how we process your data
Objection
object to processing based on legitimate interests
Portability
receive certain data in a structured, machine-readable format
To exercise any of these rights, contact us at: dpo@qaitas.com