Privacy Policy

This Privacy Policy describes how Noor Royal Gallery ("we", "us", "our") collects, uses, discloses, and safeguards personal data in compliance with Federal Decree-Law No. (45) of 2021 on the Protection of Personal Data ("UAE PDPL") and its Executive Regulations issued by the UAE Data Office.

1. Data Controller

Noor Royal Gallery is the Data Controller for personal data processed through this platform. Contact our Data Protection Officer at dpo@royaldailycrm.com.

2. Personal Data We Collect

• Identification: full name, date of birth, address, phone, email, profile photograph, Emirates ID details where required.
• Account data: hashed password, role, department, status.
• Operational data: daily reports, cleaning checklists, attachments, AI-generated analyses, urgent alerts.
• Technical data: IP address, device information, browser type, timestamps.
• Location data: approximate GPS coordinates captured at the moment a report or checklist is submitted, used to verify presence on site.

3. Lawful Basis for Processing (Art. 5 UAE PDPL)

• Performance of the employment contract — managing attendance, performance and reporting.
• Legitimate interests — fraud prevention, operational oversight, security of the Services.
• Legal obligation — compliance with UAE Labour Law, tax and regulatory requirements.
• Consent — where you actively opt-in (e.g. browser geolocation prompt).

4. How We Use Your Data

• To operate the staff portal and provide the requested Services.
• To verify the authenticity and location of daily reports.
• To generate AI-assisted performance analyses for management.
• To investigate misuse, security incidents, or legal complaints.
• To comply with our legal and regulatory obligations in the UAE.

5. Disclosure of Personal Data

We do not sell personal data. We may disclose data to: (a) authorised personnel and administrators of Noor Royal Gallery; (b) trusted processors (hosting, AI inference, email) bound by written agreements; (c) UAE competent authorities when required by law or court order.

6. International Data Transfers

Where personal data is transferred outside the UAE, we ensure the recipient jurisdiction provides an adequate level of protection, or we rely on contractual safeguards, in line with Articles 22-23 of the UAE PDPL.

7. Retention

Daily reports, checklists, and related metadata are retained for the duration of employment plus a minimum of two (2) years, or longer where required by UAE labour, tax or regulatory law. Account data is deleted within thirty (30) days of a verified erasure request, unless retention is legally required.

8. Security

We apply organisational and technical safeguards including encryption in transit (TLS), encrypted storage, Row-Level Security policies in the database, role-based access control, audit logging, and least-privilege administration.

9. Your Rights (Art. 13 UAE PDPL)

• Right to be informed and to access your data.
• Right to request correction of inaccurate data.
• Right to request erasure (subject to legal retention).
• Right to restrict or object to processing.
• Right to data portability in a structured, machine-readable format.
• Right to withdraw consent at any time (without affecting prior lawful processing).
• Right to lodge a complaint with the UAE Data Office.

Submit requests to dpo@royaldailycrm.com. We will respond within thirty (30) days.

10. Cookies & Local Storage

We use strictly necessary cookies and local storage to maintain your authenticated session. We do not use third-party advertising or tracking cookies.

11. Children

The Services are intended for adults employed by or contracted to Noor Royal Gallery and are not directed at minors.

12. Changes

We may revise this Policy. Material changes will be notified in-app and will require renewed acknowledgement where appropriate.