Who is the controller?
Smart IT - FZCO, registered at: UAE, Dubai, IFZA Business Park, DDP
Contact for PDPL queries: legal@smart-it.io
Your rights under UAE PDPL
- Be informed about how we process your personal data
- Access your personal data and receive a copy
- Correct inaccurate or incomplete data
- Erase your data, where legal grounds support deletion
- Restrict processing in specific situations
- Object to processing for direct marketing
- Withdraw consent at any time
- Data portability — receive data in a structured, machine-readable format
- Lodge a complaint with the UAE Data Office: u.ae/en/about-the-uae/digital-uae/data/data-protection-law
Email legal@smart-it.io — we respond within 30 days as required by PDPL.
Lawful bases for processing
| Processing activity | Lawful basis |
|---|---|
| Marketing emails you opted into | Consent |
| Non-essential cookies (analytics, advertising) | Consent (via cookie banner) |
| Aggregate analytics | Consent (via cookie banner) |
| Pre-launch product validation (broken-paywall testing) | Consent — by initiating the checkout flow, you provide consent for processing of your interaction data (clearly disclosed before card details) |
| Site operation, security, fraud prevention | Necessary for service security and protection of our legal interests |
| Responding to legal/regulatory requests | Legal obligation |
You can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing done before withdrawal.
Cross-border transfers
Some of our service providers (Google, Meta, Stripe, HubSpot) are based in the United States. PDPL permits cross-border transfers under specific conditions. For US-based providers, we rely on each provider's contractual data-protection commitments plus encryption in transit and at rest.
Sensitive personal data
In the standard Wave 1 flow, we do not ask for sensitive personal data. Because Penumbra relates to migraine pattern tracking, your interaction may reveal interest in health-related topics. We do not use such inferences for advertising or ad targeting. If we later add functionality collecting sensitive personal data, we will obtain explicit consent before collection.
Data Protection Officer
We are not currently required to appoint a DPO under PDPL given the current scale and nature of processing. If our processing changes such that DPO appointment becomes required, we will update this notice.