Privacy Policy

This policy explains how we handle personal data when you visit our website and when you work with us, write to us or meet us.

Who we are

This website is run by M R F Technology Consultancy L.L.C ("MARAF Group", "we"), a company registered in the United Arab Emirates, which decides how your personal data is used.

Registered address: Office 4-B 19, Bin Dasmal Building, Plot 354-207, Al Quoz Industrial First, Dubai, United Arab Emirates.

For any question about your data, or to exercise your rights, write to [email protected].

In short

• Our website uses no cookies of its own and keeps no identifier on your device.
• We measure visits with our own analytics, hosted in the United Arab Emirates. It never stores your IP address and shows us your city, not who you are.
• We respect your browser's Do Not Track setting.
• We never sell your data, show advertising or build profiles.
• We do not use your data to train AI models or to make automated decisions about you.

When you visit our website

Visit statistics

Our analytics runs on our own servers, so no analytics company receives your data. When a page loads, your browser shares:

• the address of the page you open, including any campaign tags in it, and the site that brought you here;
• your browser, operating system, device type, screen size and language;
• your country, region and city, worked out from your connection;
• clicks on a few links, such as the contact link;
• how quickly the page loads and responds;
• where on the page you click and how far you scroll, which we see as heatmaps. We do not record your session or anything you type.

To count each visitor once, our analytics turns your IP address and browser details, together with a secret key and a value that changes every month, into an irreversible code. Only that code is kept, never your IP address. Each month you get a new code, so visits in different months are not linked. We could only match the code to you if you gave us your IP address and browser details.

If your browser sends a Do Not Track signal, our website shares none of this.

Delivery and security

Every website needs your IP address to deliver its pages. Cloudflare delivers and protects our website and keeps its own network logs under its privacy policy. It also gives us a visit count that uses no cookies. Our hosting provider, Microsoft, keeps security logs that include IP addresses for up to 30 days.

When you work with us or contact us

When you write to us, exchange business cards with us, or work with us as a client, prospect, supplier or partner, we keep your name, work contact details, company and role, and our correspondence with you. We use them to answer you, prepare and carry out our work, manage our business relationship and keep the records the law requires.

If you send us your CV, we use it only to consider you for a role at MARAF Group, and we keep it for as long as we are considering you for a role, unless you ask us to delete it sooner.

We manage this information in Microsoft 365 (email, calendar and files) and in Odoo (our customer relationship management system). We use AI assistants, Microsoft 365 Copilot and Anthropic's Claude, to help us organise and draft our work. Under our business agreements with them (Microsoft's commercial terms and Anthropic's Commercial Terms), they do not use your data to train their models.

We also have a LinkedIn company page. LinkedIn shares visitor statistics for it with us. For LinkedIn members in the European Economic Area and Switzerland, we are jointly responsible with LinkedIn for those statistics, as set out in LinkedIn's Page Insights Joint Controller Addendum.

Why we use your data

• Visit statistics: to understand which pages are useful, how people find us and whether the website is fast. This is our legitimate interest in running and improving our website.
• Delivery and security: to deliver the website and keep it safe, also our legitimate interest.
• Business contacts: to answer your enquiry and take the steps you ask for before working together, to carry out our contracts, and our legitimate interest in keeping business relationships.
• Job applications: to assess your application, at your request.
• Records: to meet our legal obligations, such as keeping business and tax records.

How long we keep it

• Visit statistics: each visit's details for 25 months. After that we keep only monthly totals, such as page views per page, which say nothing about any single visit.
• Security logs: up to 30 days.
• Business contacts and correspondence: while our relationship lasts, and afterwards for as long as the law requires us to keep business and tax records: currently five years under the UAE Commercial Transactions Law, and seven years for tax records.
• CVs: for as long as we are considering you for a role, unless you ask us to delete them sooner.

Where your data is kept and who helps us

Our website, our analytics and our email are hosted in the United Arab Emirates. These providers process data on our behalf, under their data processing terms:

• Microsoft: website hosting, email and files, stored in the United Arab Emirates;
• Microsoft 365 Copilot: our AI assistant, processed by Microsoft, sometimes outside the United Arab Emirates;
• Cloudflare: website delivery and security, worldwide;
• Odoo: customer relationship management, in Saudi Arabia;
• Anthropic: the Claude AI assistant, in the United States.

When a provider processes data outside the United Arab Emirates, it does so under contractual safeguards, including the European Commission's standard contractual clauses where they apply. Our team may also access data from wherever they are working, always under our security controls. We share data with no one else, except our professional advisers, such as accountants, auditors and lawyers, who are bound by confidentiality, or when the law requires it.

How we protect it

Data is encrypted in transit and at rest. Access is limited to the people who need it, each with their own account, protected with multi-factor authentication wherever our systems offer it. We choose providers with strong security commitments. If a breach ever put your data at risk, we would tell you and the authorities as the law requires.

Your rights

Wherever you live, you can ask us to:

• tell you what data we hold about you and give you a copy;
• correct it or delete it;
• limit how we use it, or stop using it, including for visit statistics;
• give it to you in a portable format.

Write to [email protected]. We reply within one month, free of charge, and may ask you to confirm your identity first. Because our visit statistics are designed not to identify anyone, we can find your visits only if you give us details that let us match them.

You can also complain to a data protection authority, such as the one where you live. In Spain this is the Agencia Española de Protección de Datos (AEPD); in the United Arab Emirates, the UAE Data Office, now part of the Artificial Intelligence and Data Authority.