Privacy Policy
1. Introduction and scope
Ibrahim Al Zaabi Advocates and Legal Consultants (the “Firm”, “we”, “us”) is committed to protecting privacy and to processing personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”) and its Executive Regulations, other applicable laws of the United Arab Emirates, and the professional secrecy rules of the legal profession.
This Policy applies to visits to www.iblawyer.ae, to the completion of contact or consultation forms, and to preliminary correspondence with the Firm before an attorney-client relationship arises. Processing of client data after a written engagement letter is signed is governed, in addition to this Policy, by that letter and by professional secrecy.
2. Data controller
The controller of personal data processed through this website is Ibrahim Al Zaabi Advocates and Legal Consultants, established in the Emirate of Abu Dhabi, United Arab Emirates.
For privacy enquiries or to exercise the rights set out below, please write to info@iblawyer.ae with the subject line “Privacy Request”.
3. Personal data we collect
Depending on how you interact with the website, we may collect:
• Identity and contact data: name, telephone number, email address, the organisation you represent, and nationality if provided voluntarily.
• Enquiry data: a description of the legal matter and any documents you choose to attach. You are cautioned not to send confidential or sensitive information before the Firm has accepted an engagement in writing.
• Technical data: IP address, browser and device type, pages visited, and the date and duration of the visit, to the extent needed to operate and secure the website.
• Compliance data upon engagement: client-identification and source-of-funds information required by law, including a copy of a passport or Emirates ID where applicable.
We do not knowingly collect personal data from persons under the age of eighteen through this website.
4. Purposes and legal bases
We process personal data for the following purposes, on the bases indicated:
• Responding to consultation requests and initial contact: steps prior to entering a contract, or consent where required.
• Providing legal services and administering a file after engagement: performance of a contract and professional duties.
• Identity verification, conflict checks, and anti-money-laundering and counter-terrorist-financing compliance: legal obligation.
• Website security and prevention of misuse or fraud: a legitimate interest consistent with the data subject’s rights, or a legal obligation.
• Improving content and browsing experience using aggregated or de-identified data where practicable: legitimate interest.
• Sending informational materials or legal briefings: explicit consent, which may be withdrawn at any time.
We do not further process data in a manner incompatible with the purpose of collection, and we limit processing to what is necessary (data minimisation).
5. Consent and withdrawal
Where consent is the legal basis, it must be freely given, specific, informed and unambiguous, and will be recorded by appropriate means, including the consent box on the booking form. A data subject may withdraw consent at any time by writing to the address above. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
6. Sharing and disclosure
We do not sell or rent personal data. We may share it, only to the extent necessary, with:
• Members of the team and contracted consultants bound by confidentiality, on a need-to-know basis.
• Technical and operational service providers (hosting, email, practice-management systems) under appropriate contractual obligations.
• Translators or experts if required by a file, with the client’s authority or as required by law.
• Courts, public prosecution and competent public authorities where disclosure is required by law or by a court order, and only to the necessary extent.
Professional secrecy continues to apply within the limits permitted by the legislation governing the legal profession.
7. Cross-border transfers
If a service requires a transfer of personal data outside the UAE, we will comply with the PDPL, including transfers to jurisdictions offering an adequate level of protection, the use of appropriate contractual safeguards, or another ground permitted by law. Safeguards will be described to the data subject upon request.
8. Retention
We retain personal data for as long as needed for the purpose of collection, and then delete or anonymise it, subject to limitation periods, pending proceedings, professional record-keeping and AML requirements. Website-form data that does not lead to an engagement is reviewed periodically and is not kept indefinitely.
9. Security
We implement technical and organisational measures appropriate to the nature of a law firm and to the sensitivity of legal data, to protect against unauthorised access, loss, alteration or disclosure. No transmission over the internet can be guaranteed as absolutely secure.
10. Data-subject rights
Subject to statutory exceptions (including those relating to judicial proceedings and information security), a data subject has the following rights under the PDPL:
• To receive information on the types of data processed, the purposes, the recipients or sectors with whom data may be shared, and the storage criteria.
• To access personal data.
• To obtain rectification of inaccurate data without undue delay.
• To request erasure where the data are no longer necessary or consent is withdrawn and no other ground remains.
• To restrict or object to processing in the cases provided by law, including direct marketing.
• To receive data in a structured, commonly used and machine-readable format where applicable.
• To object to decisions based solely on automated processing, if any. This website does not take automated decisions producing legal effects on a visitor.
• To lodge a complaint with the UAE Data Office.
We will seek to respond to legitimate requests free of charge and within a reasonable time. We may request proof of identity before acting.
11. Cookies
The website may use cookies that are strictly necessary for operation and security. Non-essential cookies (analytics or marketing, if used) will be activated only after clear prior consent. Preferences may be managed in the browser; disabling certain cookies may affect site functions.
12. Personal-data breaches
If a breach occurs that poses a direct and serious threat to the privacy or confidentiality of personal data, we will give the notifications required by law to the data subject and to the competent authority, and will describe the measures taken.
13. Changes
This Policy may be updated. The revised version will be published on the website with a new effective date. Continued use of the website after publication constitutes acceptance of the new version to the extent permitted by law.