How we handle your personal data.

The law we work to

UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL) is in force and applies to us. Its Executive Regulations have not yet been issued, and the supporting enforcement machinery — including any adequacy list for cross-border transfers and any operational complaints procedure — is not yet fully established.

We do not claim compliance with regulations that do not yet exist. We apply the requirements the PDPL itself sets out, and we will update this notice when the Executive Regulations are published.

We also handle personal data of individuals in the European Union and the United Kingdom. For those individuals, the EU GDPR and the UK GDPR together with the Data Protection Act 2018 apply, and the rights described below include the rights those laws give you.

1. What we collect, by channel

We only collect what a channel actually needs. There is no tracking pixel, advertising tag, or profiling on this site.

CONSULTATION INTAKE FORM

Full name, email, company, role or title (optional), phone (optional), plus the context you choose to give: sector, organisation size, region, the challenges you select, your ISO position, your priorities, your timing, and any free-text note. We use it to assess the enquiry and respond. Lawful basis: steps taken at your request prior to entering a contract, and our legitimate interest in responding to business enquiries.

CHAT ASSISTANT

Your messages, our replies, a randomly generated session identifier, the page the conversation started on, timestamps, your browser's user-agent string (recorded once against the conversation for abuse control and fault diagnosis), an outcome marker recording whether the conversation ended in a callback request, a booking or a WhatsApp handoff, and a keyed hash of your IP address used only to limit abuse. That hash is produced with a secret held only by Q•UNIQUE; it cannot be turned back into your IP address without that secret, and we treat it as personal data. Section 2 sets out how the assistant works in full. Lawful basis: our legitimate interest in operating a support channel and preventing misuse.

CALLBACK REQUEST INSIDE THE CHAT

Name, email, phone, organisation, preferred time window, and your note — together with the transcript of the conversation that preceded it, so the consultant who calls you has context. Lawful basis: steps taken at your request prior to entering a contract.

WHATSAPP HANDOFF FROM THE CHAT

The chat offers a WhatsApp option. If you choose it, we open WhatsApp with a message already written for you containing the first message you sent the assistant, in your own words, truncated to 180 characters, so the consultant has context when you arrive. Nothing is sent unless you send it. From that point the conversation is handled inside WhatsApp by Meta Platforms under Meta's own terms, outside Q•UNIQUE's systems and this notice. We record only that the chat ended in a WhatsApp handoff. Lawful basis: your choice to use that channel, and our legitimate interest in responding to enquiries.

EXECUTIVE INSIGHTS SUBSCRIPTION

Email address, the topics and industry you select, and the record of your consent — including the confirmation you give by email. Lawful basis: consent. You can withdraw it at any time using the unsubscribe link in any email or by writing to us.

GATED RESOURCE DOWNLOADS

Full name, email, phone (optional), which resource you requested, and whether you also opted in to Executive Insights. We also record a keyed hash of your IP address, produced the same way as in the chat, purely to limit repeated automated requests for the same document. The download link in the browser is valid for 15 minutes; the link we email you is valid for 7 days. Lawful basis: performance of your request for the document, and consent for any subscription you separately tick.

BOOKING A CALL

Bookings are taken in Calendly, embedded on this site. The name, email, and any answers you give go to Calendly and then to us. We do not receive your Calendly account data beyond the booking itself. Lawful basis: steps taken at your request prior to entering a contract.

LOGGING AND ANALYTICS

We use Google Analytics 4 to understand how the site is used, and only if you accept it when asked. Nothing analytics-related is stored on your device or sent to Google before that. Lawful basis: your consent. Section 8 lists the cookies it sets and how to withdraw. Our hosting and database platforms keep standard technical logs — IP address, request time, user agent, error traces — for security and fault diagnosis. We keep a log of emails we send so we can confirm delivery. Lawful basis: legitimate interest in keeping the service secure and working.

FOLLOW-UPS

When an enquiry arrives we open an internal reminder against it so it is not dropped. It holds your contact record, the source of the enquiry, and an internal note. Lawful basis: legitimate interest in responding to enquiries properly.

2. The AI assistant

This is the part that needs the plainest explanation, so here it is.

• Conversations are stored in Q•UNIQUE's own database, not only in your browser.
• The content of your messages is transmitted to a third-party AI model provider through the Lovable AI gateway in order to generate a reply. The model currently used is Google's Gemini, accessed through that gateway.
• Transcripts are visible to authorised Q•UNIQUE staff in our admin panel. They are read by people, not only machines.
• If you request a callback from within the chat, the transcript is attached to that request so the consultant has your context before calling.
• The assistant does not make decisions about you. It answers questions and hands you to a person.
• Separately from answering you, we analyse the questions people ask so we can see what visitors most want to know and improve the answers. Once a night, the text of the questions asked — not your contact details — is sent to the same model provider to be sorted into a fixed list of subject themes such as pricing or ISO 9001:2026. Only the theme, a confidence score and the model version are stored against the message. The result is a count of questions by theme; it is not used to profile you or to make any decision about you.

Please do not enter confidential commercial information, audit findings, non-conformity details, contractual positions, or anyone else's personal data into the chat. If the subject is sensitive, book a call or write to us instead — that is what the call is for.

Conversations are kept for 12 months from the last message, then deleted. Where a conversation produced a callback request, the transcript attached to that enquiry follows the enquiry retention period in section 5.

3. Who else processes your data

These are the providers and recipients this site actually uses. Where we state a location we have verified it; where it depends on an account setting we have not been able to confirm from the site itself, it is marked as a placeholder rather than guessed.

Each provider acts on our instructions under its own data processing terms, except Meta, which acts as an independent controller for anything you send inside WhatsApp. We do not sell data to anyone, and we do not pass it to advertisers or data brokers. We disclose personal data to public authorities only where the law requires it.

4. International transfers

Our providers sit outside the UAE, so personal data collected through this site leaves the country. Enquiry, subscription, chat and document data is stored in our managed database platform, in the region noted in section 3. Chat message content is additionally sent to the AI gateway and its model provider to generate replies. Email delivery, hosting and booking data is handled by the providers listed in section 3, in the regions stated there. If you choose the WhatsApp option, the message you send goes to Meta.

The PDPL restricts cross-border transfers and permits them where adequate protection is in place. The adequacy list that the Executive Regulations were expected to establish has not been issued, so we do not rely on an adequacy decision and we do not claim one exists. We rely instead on contractual data protection commitments from each provider, and — for data relating to individuals in the EU and UK — on the European Commission's standard contractual clauses and the UK International Data Transfer Addendum in those providers' terms.

We will reassess these arrangements against the Executive Regulations once they are published.

5. How long we keep it

A scheduled job runs nightly and deletes the records above that we hold ourselves — chat conversations and messages, enquiries and their follow-ups, gated download requests, our email send and delivery logs, and spent unsubscribe links — once they have passed the stated period. Enquiries measure from the last contact, meaning the most recent of the enquiry itself, a change to its status, and any follow-up activity against it. Records marked as an engagement in our system are excluded from the job and kept under the engagement period. Records held inside a provider's own platform, such as bookings in Calendly, are governed by that provider's retention terms. The one record we keep indefinitely is the reduced suppression record described above — an email address and the fact that it must not be contacted — precisely so an unsubscribe is honoured permanently.

6. Your rights

Under the PDPL you can ask us to:

• give you access to the personal data we hold about you and how it is processed;
• correct anything inaccurate or incomplete;
• erase your data;
• restrict processing while a matter is resolved;
• provide your data in a portable, machine-readable form;
• stop processing you object to;
• honour the withdrawal of consent you previously gave;
• stop any processing carried out by automated means that produces legal effects.

If you are in the EU or UK you have the equivalent rights under the GDPR and UK GDPR, and you may lodge a complaint with your local supervisory authority or, in the UK, with the Information Commissioner's Office.

The PDPL gives individuals a right to complain to the UAE Data Office. The procedure for doing so is expected to be set out in the Executive Regulations, which have not yet been issued, so we cannot describe an operational route today. We will state it here once it exists.

To exercise any right, email support@qunique.ae. We respond within 30 days. If a request is complex we will tell you before that deadline and explain the delay. We may ask you to confirm your identity before acting, so we do not disclose someone's data to the wrong person.

7. Security, and what we do not do

• Data is encrypted in transit over HTTPS.
• Database access is governed by row-level security, so records are reachable only through the paths we have explicitly allowed.
• The admin panel is restricted to named, authenticated administrators on an allow list, and administrator changes are logged.
• Gated documents are held privately and released only through short-lived links.

We do not sell personal data. We do not share it with advertisers. We do not use it to train third-party AI models, and we do not permit our providers to do so.

8. Cookies, storage, and housekeeping

This site uses no advertising cookies. It uses analytics cookies only if you accept them. It stores the following in your browser:

ANALYTICS CONSENT

Analytics runs only with your permission. Before you answer, Google Consent Mode is set to deny analytics and advertising storage, the Google Analytics library is not loaded at all, and no analytics cookie is written. If you decline, or simply ignore the banner, nothing analytics-related ever loads and the site works exactly as before. You can change your mind at any time through the Cookie preferences link in the footer; declining there also deletes the analytics cookies already set on this domain.

We measure the site across qunique.ae, www.qunique.ae and cost-of-lost-time-calculator.com so a single visit that crosses them is counted once. The analytics data is not used for advertising and is not sold: advertising features, ad personalisation signals and Google Signals are switched off in our configuration, and IP addresses are anonymised.

This site is intended for business audiences and is not directed at anyone under 18. We do not knowingly collect data from children.

Version 1.2, last updated 17 August 2026. We will update this notice when the PDPL Executive Regulations are published, and whenever our processing changes. The current version always sits at /privacy.