Legal

Privacy notice

Version 1.0 · In effect from 18 August 2026

This notice explains how SOVA FZ LLC collects, uses and protects personal data in connection with this website and with enquiries made through it. It is given in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL) and its implementing framework.

1. Who we are

SOVA FZ LLC is a limited liability company registered in Fujairah Creative City, United Arab Emirates, under Licence No. 18524/2022, with its registered office at Twin Tower – M1 Floor, Hamad Bin Abdulla Road, Fujairah, P.O. Box 4422 (SOVA, we, us). We are the controller of the personal data described in this notice. Enquiries about this notice, or about the exercise of any right under it, should be addressed to hello@sova.ae.

2. Scope

This notice applies to personal data we process in connection with sova.ae and enquiries arising from it. It does not govern the processing of personal data within a client engagement, which is addressed in our terms of business and, where applicable, in a separate data processing agreement.

3. What we collect, and from where

This website has no user accounts, takes no payments and sets no tracking cookies. We collect personal data in one circumstance: where you choose to contact us.

  • Enquiry data, provided directly by you by email, by telephone or by messaging application: your name, your email address, and the content of your message, which may include information about your business, your circumstances or a matter you wish to discuss.
  • Correspondence data, being the record of communications between us following an enquiry.
  • Technical data, being the standard server logs generated by our hosting provider when any website is accessed, including IP address, request time and user agent. These are retained by the hosting provider for security and diagnostic purposes and are not used by us to identify individuals.

We do not collect special categories of personal data through this website, and we ask that you do not provide them. We do not knowingly collect personal data relating to children through this website.

4. Why we process it, and on what basis

We process enquiry and correspondence data for one purpose: to consider and respond to your enquiry and, where an engagement follows, to establish and perform it. The lawful basis is your consent, given when you send the enquiry, and thereafter the performance of a contract to which you are party or the taking of steps at your request prior to entering into one. Where we retain records after an engagement has ended, we do so on the basis of compliance with a legal obligation and our legitimate interest in establishing, exercising or defending legal claims.

We do not use personal data collected through this website for marketing without separate consent, and we do not carry out automated decision-making or profiling.

5. Please do not send confidential information

Until an engagement has been agreed in writing, an enquiry does not make you a client. Information sent to us before that point is not protected by an engagement, and sending it may in some circumstances prevent us from acting for another party. Please keep an initial enquiry general.

6. Cookies

This website sets no tracking, advertising or analytics cookies, and runs no behavioural analytics. No consent banner is presented because no consent is required for the operation of the site as it currently stands. If this changes, this notice will be amended before the change takes effect.

7. Who else processes it

We share personal data only with the service providers that operate our infrastructure, and only to the extent necessary:

  • our website hosting provider, which hosts sova.ae on servers in the United Arab Emirates;
  • Google Workspace, which provides our email service.

Each processes personal data on our behalf under its own contractual and security commitments. We do not sell personal data, and we do not disclose it to any other party except where required by applicable law, by a competent authority or by a court of competent jurisdiction, or where necessary to establish, exercise or defend legal claims.

8. Transfers outside the UAE

Some of our processors operate infrastructure outside the United Arab Emirates, and personal data may therefore be transferred outside the UAE. The PDPL permits such transfers to jurisdictions providing an adequate level of protection, and otherwise on one of the statutory bases. No adequacy determinations have been published to date. We therefore rely on contractual undertakings binding the recipient to standards of protection consistent with the PDPL, and on your consent where the transfer is necessary to respond to your enquiry.

9. How long we keep it

Enquiries that do not result in an engagement are deleted within twelve months of the last correspondence. Where an engagement follows, records are retained for the period required by professional, regulatory and limitation considerations, and are then deleted. Server logs are retained by our hosting provider in accordance with its own retention policy.

10. Security

We apply technical and organisational measures appropriate to the risk, including encryption of the website in transit, access controls and multi-factor authentication on the accounts through which personal data is handled, and restriction of access to those who need it. No transmission over the internet can be guaranteed secure, and we cannot warrant the security of information sent to us before it reaches us.

11. Your rights

Subject to the conditions and exceptions in the PDPL, you have the right to request access to your personal data; to request correction of inaccurate or incomplete data; to request erasure; to request restriction of processing; to object to processing; to request transfer of your data to another controller; and to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, write to hello@sova.ae. We will respond within the period prescribed by the PDPL. We may ask for information to verify your identity before acting on a request. If you are not satisfied with our response, you may complain to the competent supervisory authority in the United Arab Emirates.

12. Data protection officer

Given the nature, scope and volume of our processing, we are not required to appoint a data protection officer and have not appointed one. Responsibility for data protection matters rests with the managing partner, contactable at the address above. We keep this position under review.

13. Changes

We may amend this notice. The current version and its effective date appear at the top of this page. Where a change is material, we will take reasonable steps to bring it to the attention of those affected.