Data Protection Policy

Effective Date: 29, May 2025
Version: 1.0

1. Policy Purpose

Sparktrics FZCO (“we,” “us,” or “our”) is committed to complying with the UAE Personal Data Protection Law (PDPL) (Federal Decree-Law No. 45 of 2021) and international data protection standards. This policy outlines our internal procedures for handling personal data collected through our ecommerce platform ([Your Website URL]), ensuring confidentiality, integrity, and lawful processing.

2. Scope

Applies to:

• All employees, contractors, and third parties processing data on our behalf.
• Personal data collected via:
  • WooCommerce transactions (orders, accounts).
  • Google Analytics and similar tools.
  • Customer communications (email, reviews).

3. Core Principles

We adhere to:

• Lawfulness & Transparency: Process data only for specified, legitimate purposes.
• Data Minimization: Collect only necessary information (e.g., billing details for orders).
• Accuracy: Maintain up-to-date customer records.
• Storage Limitation: Retain data only as long as required (see Section 7).
• Confidentiality & Security: Implement robust technical/organizational safeguards.
• Accountability: Document all processing activities.

4. Roles and Responsibilities

• Data Protection Officer (DPO): [Name/Contact] – Oversees compliance, conducts audits.
• Employees: Complete annual PDPL training, report breaches immediately.
• Third Parties (e.g., payment gateways): Bound by data processing agreements (DPAs) aligning with this policy.

5. Data Processing Activities

6. Data Security Measures

• Technical Safeguards:
  • SSL encryption for all data transmissions.
  • Firewalls, intrusion detection, and regular vulnerability scans.
  • Pseudonymization of analytics data.
• Organizational Safeguards:
  • Role-based access controls (only authorized staff handle data).
  • Mandatory NDAs for employees/contractors.
  • Secure disposal of physical/digital records.

7. Data Retention & Deletion

• Retention Periods:
  • Order data: 6 years (to comply with UAE tax/financial laws).
  • Marketing data: Until consent withdrawal or 2 years of inactivity.
  • Analytics: Aggregated/anonymized after 14 months (Google Analytics default).
• Deletion Process: Automated erasure after retention periods or upon user request.

8. International Data Transfers

• Data may be transferred outside the UAE (e.g., Google servers in the USA).
• We ensure protections via:
  • UAE-approved standard contractual clauses.
  • Verification of third-party compliance (e.g., Google’s GDPR/PDPL alignment).

9. Data Subject Rights

We facilitate:

• Access/Correction: Users may review/edit data via account dashboard.
• Erasure: Requests processed within 30 days (exceptions: legal obligations).
• Consent Withdrawal: “Unsubscribe” links in marketing emails.
• Portability: Data provided in CSV format upon request.
  Submit requests to: [dpo@yourwebsite.com]

10. Breach Response Protocol

1. Contain: Isolate affected systems immediately.
2. Assess: DPO evaluates risk to data subjects.
3. Notify: Report breaches to UAE Data Office within 72 hours if high risk.
4. Communicate: Inform impacted users if legally required.
5. Review: Implement measures to prevent recurrence.

11. Training & Compliance

• Annual PDPL training for all staff.
• Bi-annual audits of data processing activities.
• Policy updates reviewed by UAE legal counsel.

• Contact:
  Sparktrics FZCO
  Venture Zone Business Center, 1703, 17th Floor,
  Al Musalla Towers, Bur Dubai, Dubai, UAE
  PO Box: 44320
  Email: info@sparktrics.com