Privacy Policy
Effective date: 18 October 2026
Last updated: 18 October 2026
This policy explains how MARCA LLC ("Marca", "we", "us") handles personal data when you visit marca.ae, contact us or ask to book a call. It also covers business contact details we hold about people at the companies and government entities we work with or talk to.
It does not cover personal data we process for a client during an engagement. That is governed by our contract with the client, including any data-processing terms and NDA agreed with them.
1. Who we are
| Legal name | MARCA LLC |
| Legal form and licence | A limited liability company licensed by Sharjah Media City (Shams), licence no. 2648958.01 |
| Registered address | Sharjah Media City (Shams), Sharjah, United Arab Emirates |
| Privacy contact | hello@marca.ae |
For the personal data described in this policy, Marca is the controller: we decide why and how it is used.
2. What we collect
a) What you give us through the booking form. The details you enter, which may include your full name, job title or role, organisation, type of organisation, work email, country, the services you are interested in, your preferred language for the call and your message. A phone number is optional. We also record the consents you give and the time you gave them.
b) Information collected automatically with your request. The page you sent it from, the site language, and campaign (UTM) tags in the link you followed. To protect the form from spam, we check your request with a bot-protection service and apply rate limits based on your IP address.
c) Website usage. We don't use analytics tools on the site. Our hosting and security providers keep server logs (such as IP address, browser type, time and page requested) to run the site and keep it secure. The site uses only strictly necessary cookies, such as __dpl, set by our hosting provider so that each visit is served consistently by the same version of the site (about 1 year), and __cf_bm, set by our network and security provider to tell people from bots (30 minutes), plus the booking form's security check. See our Cookie Policy.
d) Business contact data. We may hold the work contact details of people at clients, prospective clients, partners, suppliers and government entities. This includes your name, title, organisation, work email and work phone, and notes of our dealings with you. We get these from you, from your colleagues, at events, from introductions, or from professional sources your organisation has made public.
e) Correspondence. If you email us, we keep the email and our reply.
We do not ask for sensitive personal data through this site, such as health, religion, ethnicity, biometric or criminal-record data. Please don't include it in your message.
This site is meant for professionals. It is not directed at anyone under 18, and we do not knowingly collect their data.
3. Why we use it, and our legal basis
Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the "PDPL"), the default basis for processing personal data is consent. The law also allows processing without consent in the specific cases it lists.
| Purpose | Data | Legal basis (UAE PDPL) |
|---|---|---|
| Replying to your request, arranging and holding the call, and sending you a confirmation email | Booking form data | Your consent, given on the booking form, and steps you ask us to take before entering into a contract |
| Preparing a proposal or scope, and handling procurement or vendor registration with your organisation | Business contact data, notes | Steps before a contract at your organisation's request, and performing a contract once one exists |
| Keeping the form and site secure: spam and abuse checks, rate limits, security logs | IP address, bot-check token, logs | Steps needed to provide the service you asked for and, where the law requires it, your consent |
| Meeting our legal, tax, accounting and regulatory obligations, and answering lawful requests from authorities | As needed | Legal obligation |
| Sending you insights or event invitations | Name, work email | Only with your separate opt-in consent. You can unsubscribe at any time |
Saudi Arabia. If you are in the Kingdom of Saudi Arabia, the KSA Personal Data Protection Law may also apply. Where it does, we rely on the bases it allows and follow its rules on transfers outside the Kingdom.
Other GCC countries. Where a visitor's local data-protection law applies, we will meet its requirements as well.
4. Automated processing and AI
We may use automated tools, including AI-assisted tools provided by our service providers, to help organise and summarise enquiries. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
5. Who we share it with
We do not sell personal data, and we do not share it with other clients.
Within Marca, only authorised Marca team members who need it can access your data. Outside Marca, we share it only with:
- Service providers that process data for us under contract and only on our instructions, in these categories:
- website hosting and database
- transactional email for confirmations and notifications
- business email
- bot protection and website security
- AI-assisted productivity tools
- IT and professional advisers (such as lawyers and accountants) bound by confidentiality
- Your own organisation, for example when your colleagues take part in the same procurement process.
- Authorities, where the law requires it or a court or regulator lawfully asks.
- A buyer or successor, if Marca's business is reorganised or sold. The same protections would apply.
We describe our providers by category rather than by name. The current list of service providers that would touch your data is available to clients and prospective clients under NDA. You can also ask us at hello@marca.ae which categories of provider have handled your own data.
6. Where your data is stored, and transfers outside the UAE
Our website is hosted on enterprise-grade cloud infrastructure. Booking requests and other website data are stored in the United States and may be processed in other countries outside the UAE. Only authorised Marca team members and service providers can access them. Some of our service providers may also process data in other countries.
When you submit the booking form, we ask for your explicit consent to your data being processed outside the UAE, including in the United States. We also put contractual safeguards in place with our service providers that require them to protect your data. You can withdraw your consent at any time by emailing hello@marca.ae. Withdrawing does not affect processing already carried out, but we may then be unable to handle your request.
If you have data-residency requirements, we'll discuss them on a call.
7. How long we keep it
| Data | Kept for |
|---|---|
| Booking requests in our website database | 24 months from the date of the request, then we delete them, or sooner if you ask us to |
| Emails and notes about an enquiry that didn't lead to a contract | 24 months from the date of the request, then we delete them, or sooner if you ask us to |
| Business contact data and records of clients and suppliers | For the relationship, then as long as UAE law requires us to keep business records, then deleted |
| Security and server logs | Only as long as needed to run and secure the site, unless we need them to investigate an incident |
| Marketing opt-in consent records | Until you withdraw, plus 24 months as proof of consent |
We may keep data longer if the law requires it or we need it for a legal claim.
8. How we protect it
We use technical and organisational measures that suit the risk. They include:
- encryption in transit;
- access to booking data restricted to authorised Marca team members;
- admin accounts by invitation only;
- bot protection and rate limits on forms;
- secrets kept out of code;
- confidentiality obligations for the people who handle personal data.
No system is perfectly secure, but we review these measures regularly.
9. If something goes wrong (data breaches)
If a breach puts the privacy, confidentiality or security of your personal data at risk, we will notify the competent UAE data-protection authority and tell you where the law requires it, promptly after we become aware of it. We will also take steps to contain the breach and stop it happening again.
10. Your rights
Under the UAE PDPL you have the right to:
- Be informed and get access. Find out whether we process your data, why, and who receives it, and get a copy.
- Data portability. Receive your data in a structured, machine-readable form and have it sent to another controller, where technically feasible.
- Correction. Have inaccurate or incomplete data corrected.
- Erasure. Have your data deleted, in the cases the law sets out.
- Restriction. Have processing restricted, for example while an accuracy dispute is checked.
- Objection. Object to or stop processing, including for direct marketing.
- Automated decisions. Object to decisions based solely on automated processing that have legal or similarly significant effects.
- Withdraw consent at any time. This doesn't affect processing that has already taken place.
To use these rights, email hello@marca.ae. We may need to confirm your identity. We will respond within the time the law requires, and in any case within 30 days.
If you are not satisfied, you can complain to the UAE Data Office or any authority that takes over its role. In Saudi Arabia, the regulator is the Saudi Data & AI Authority (SDAIA).
11. Government and enterprise visitors
If you contact us on behalf of a government, semi-government or regulated entity, we handle your details only for your request and the procurement or engagement that follows. If your entity's own data-handling, classification or confidentiality rules apply, tell us and we will discuss how to meet them.
A mutual NDA is available before you share a brief. Please don't send classified or confidential material through the website form.
12. Links to other sites
Our site links to other websites and social platforms. Their privacy practices are their own, so please read their policies.
13. Changes to this policy
We may update this policy. The "Last updated" date shows when. If a change is significant, we will say so on the site and, where appropriate, tell people whose data we hold.
14. Language
This policy may be published in English and Arabic. If the two versions differ, the Arabic version prevails.
15. Contact
MARCA LLC, Sharjah Media City (Shams), Sharjah, United Arab Emirates · hello@marca.ae