Privacy Notice
1. Who we are
Marters & Co. Applied Intelligence Ltd. is a company registered in the Dubai International Financial Centre (DIFC), licence number CL14351. Our registered office is Innovation One, Zaa'beel Second, DIFC, Dubai, UAE. Contact us about data protection at hello@martersandco.com.
We follow DIFC Data Protection Law No. 5 of 2020 and, where it applies, the UAE Personal Data Protection Law (Federal Decree-Law 45 of 2021).
2. Our two roles
We are the controller for our own data: website visitors, enquirers, prospective clients, client contacts, staff, job applicants and suppliers.
We are a processor for data our clients load into systems we run for them. For that data the client is the controller, and requests should go to them.
3. What we collect and why
| People | Data | Purpose | Lawful basis |
|---|---|---|---|
| Website visitors | Contact form entries, IP address, browser data | Answer messages, keep the site secure | Legitimate interests; consent for non-essential cookies |
| Prospective clients | Name, job title, company, email, phone, conversation notes | Reply to enquiries, prepare proposals | Legitimate interests |
| Client contacts | Name, title, work contact details, contract and billing records | Deliver and invoice our services | Contract; legal obligation |
| Job applicants | CV, contact details, interview notes | Assess applications | Steps before a contract |
4. Special category data
We do not seek special category data, such as health, religion or biometric data.
5. Sharing
We never sell personal data. We share it with:
- sub-processors that help us run our services (see Trust & Security);
- professional advisers;
- authorities, when the law requires it; and
- a buyer of our business, under the same protections.
6. International transfers
Systems we host for clients run in the UAE. Some providers process data in the USA, the EU or the UK. Transfers outside the DIFC are made to jurisdictions the DIFC recognises as adequate, or under the DIFC Commissioner of Data Protection’s standard data protection clauses (Article 27(2)(c)).
7. Retention
We keep data for 30 days after it is no longer needed for its purpose, unless the law or a contract requires longer. Then we delete or anonymise it.
8. Security
We protect data with encryption, access controls, audit logs and regular backups. The details are on our Trust & Security page.
9. Your rights
You have the right to:
- access your personal data;
- have it corrected;
- have it deleted;
- restrict how we use it;
- object, including to direct marketing and to processing based on legitimate interests;
- receive it in a portable format;
- withdraw consent; and
- not be subject to decisions based solely on automated processing.
We reply within two weeks, free of charge. Use the Your Data Rights page to make a request.
10. Complaints
You can complain to the Commissioner of Data Protection, DIFC Authority. We would be glad to try to resolve it with you first.
11. Changes to this notice
If we change this notice we will update the date at the top of this page. Last updated: 14 September 2026.