Legal
Privacy
This notice covers information collected through this website, kerah.ae. Processing Kerah carries out on a client's documented instructions is governed by that client's own notice and by the data processing agreement, not by this one. Kerah products have their own policies, published on their own sites.
Kerah states plainly what it does with information rather than describing it in the abstract. This notice covers this website and Kerah’s own business correspondence. It does not cover the systems Kerah builds for its clients — the clause headed "What this notice does not cover" explains why that distinction matters and where the answer lives instead.
Effective from 2026-08-23.
- 01
Who we are, and who is responsible for your information
Kerah - F.Z.E ("Kerah", "we", "us") is responsible for the personal information described in this notice. Kerah is a Free Zone Establishment — Limited Liability, licensed by the Free Zones Authority of Ajman, United Arab Emirates under licence number 53032, and registered at B.C. 1304527, Ajman Free Zone C1 Building, Ajman Free Zone, Ajman, United Arab Emirates (Makani 4442612247).
For any question about this notice, or to exercise any right described in it, write to privacy@kerah.ae. Kerah publishes accountability by role rather than by name, so correspondence is answered by the role responsible for data protection rather than by a named individual. That is a deliberate position rather than an evasion: the person accountable is named in a bid response or under a confidentiality agreement, to the people carrying out an assessment.
- 02
What this notice covers
This notice covers two things and nothing else.
The first is the information collected through this website, kerah.ae — what you send us through the enquiry form, and the ordinary technical record of your visit.
The second is the business contact information Kerah holds about the people it corresponds with in the ordinary course of business: enquirers, buyers, procurement and tender contacts, suppliers and professional advisers.
For both, Kerah decides why the information is processed and how, and is therefore the controller for it.
- 03
What this notice does not cover
Most of the personal information Kerah handles is not covered by this notice, and it matters that you can tell which is which.
When Kerah designs, builds, integrates or supports a system for a client, the personal information inside that system is the client's to control, not Kerah's. In that work Kerah acts as a processor, on that client's documented instructions. What may be done with it, how long it is kept, who may see it and how a request from an individual is answered are all set by that client's own privacy notice and by the data processing agreement between Kerah and that client. This notice governs none of it, and nothing in this notice gives Kerah any right over it.
So if you are a customer, employee, applicant, supplier, citizen or beneficiary of an organization that uses a system Kerah built, that organization is the controller for your information, not Kerah. Their privacy notice is the one that answers your question, and they decide the outcome of a request. Where a request reaches us instead, we pass it to them and support them in responding.
Which role Kerah holds is decided by what it actually does in a given piece of work, not by the label. In most engagement work it is a processor. There is work where it is not — deciding for itself what to keep and why, as it does with the enquiries and business contacts this notice covers. Where Kerah is the controller for something, this notice is the one that applies to it, and the engagement's own agreement says which is which.
Kerah products are separate from this website. Where a Kerah product is published, it carries its own privacy notice on its own site, and this notice does not extend to it.
- 04
What you send us through the enquiry form
The enquiry form is the only place on this website where you can send us anything. It asks for:
- Your name — required
- Work email — required, and the address we reply to
- Organization — required
- Role — optional
- What are you trying to solve? — required; this is your message, and the only free-text field
- Rough timeline — optional, chosen from a fixed list
- How did you hear about Kerah? — optional. We ask because it helps us understand which of the things we write is worth writing. It is not used to build a profile of you, and leaving it blank changes nothing about the reply you get. Like the rest of the form, it travels inside the enquiry itself, so it passes through the provider that delivers the message and sits in the mailbox that receives it
- A confirmation that we may use the message to reply to you — required before the form will submit
- A separate acceptance of the website terms and the acceptable use policy — also required, and deliberately not combined with the confirmation above
Alongside your message we record what you accepted and when: which version of this notice and of the website terms was published at the time, which language the form was shown in, and the moment the submission arrived, stamped by our server rather than by your device. That record travels with the enquiry. It is kept for longer than the message itself, because its purpose is to answer a question that may only be asked much later — what you were shown and what you agreed to — and deleting it on the same schedule as an ordinary enquiry would destroy the answer before anyone thought to ask.
The form also contains one hidden field that must be left empty. It is an anti-spam control and it is not shown to you. To be exact rather than reassuring: whatever is in it IS sent to us and IS checked, because checking it is the whole point — a submission that fills it in is rejected. Nothing about you is collected by it, because a person never sees it and so never fills it in.
There is no account, no login, no password, no newsletter sign-up, no comment facility, no payment and no job application route on this website. The form above is the only place you can send us anything, so apart from it and the technical record of your visit described below, the site collects nothing about you.
- 05
What you must not send us
Please do not submit personal, medical, financial, identity-document or other sensitive information through this form — your own or anyone else's. It is a general business enquiry route and is not an appropriate channel for personal or confidential material.
That warning is shown on the form itself, because a warning in a notice nobody opens is not a control. It applies more widely than the categories it names. Please also do not send us, through the form or to any of our published mailboxes:
- Records about your own customers, employees, applicants, patients, students, citizens or beneficiaries
- Tender-restricted, commercially confidential or price-sensitive material
- Government, official or security-classified material
- Credentials, keys, access tokens or connection details
- Source code, system documentation or architecture material you are not free to share
- A curriculum vitae or other job application material
None of it is needed to have a first conversation. Describe the problem; the detail belongs in a channel agreed for it, under a confidentiality agreement where one is appropriate.
If material of that kind reaches us anyway, we delete it and tell you that we have, unless a law requires us to keep it. We do not use it, act on it, forward it or copy it into any other system.
- 06
What is collected automatically
Serving a web page produces a technical record, and this site is no exception. Our hosting provider records the ordinary details of each request: the internet address it came from, the time, the page requested, the response the server gave, and the browser's own description of itself. Those records exist so the site can be operated, faults diagnosed and abuse identified. They are not used to build a profile of you, and they are not combined with anything you send us through the form.
When you submit the form, the internet address of the request is used to count how many submissions have come from the same connection in a short period, so that the form cannot be flooded. That count is held only in the memory of the server handling the request, for a short window, and is never written to a database.
Nothing on this site runs in your browser to collect information about you. There is no analytics script, no tag manager, no session recorder, no fingerprinting and no third-party pixel.
- 07
Business contacts we hold from outside this website
Kerah also holds ordinary business contact information about people it deals with away from this website — a contact named in a tender or on a procurement portal, a supplier's account manager, a professional adviser, or someone met at a professional event. What we hold is business contact information: name, role, organization, work email address and work telephone number, together with the record of our correspondence.
We do not buy contact lists, we do not enrich a contact record from a data broker, and we do not use these records for marketing.
If we hold your details because we obtained them somewhere other than from you — a tender document, a procurement portal, a supplier record — you will not have visited this page first. When we write to you, ask us where we got your details and we will tell you, and you can ask us to stop holding them at any time. We would rather you did not have to ask, and making that notice automatic at first contact is an open item rather than something already in place.
- 08
Unsolicited applications, proposals and product ideas
There is no careers page on this website and no route for a job application, but applications arrive at published mailboxes anyway, as do product pitches and partnership proposals.
If you send us a curriculum vitae or an application without our having asked for one, we do not enter it into a recruitment process, because there is none to enter it into. We delete it.
If you send us an idea, a proposal or a specification, please read the website terms first. Material sent to us unsolicited is not received in confidence, and the terms set out what happens to it. This notice governs only the personal information inside such a message.
- 09
Why we process this information
We process the information described above for these purposes and no others:
- To read your enquiry and reply to it, and to have the conversation that follows from it
- To keep a record of our business correspondence, including what was proposed, agreed or declined
- To operate this website, keep it available and keep it secure — including identifying and stopping abuse of the enquiry form
- To meet an obligation the law places on us, and to establish, exercise or defend a legal claim
We do not use any of it to profile you, to score you or to advertise to you. We do not sell personal information and we do not share it for anyone else's marketing.
- 10
The lawful basis we rely on
The law starts from the position that we may not process your personal information at all unless a specific ground allows it. Below is the ground we rely on for each thing we do.
- Replying to your enquiry — because you asked us to. Sending the form is a step you take towards possible work together, and the reply is the thing you came for.
- Keeping the enquiry afterwards as a business record — because we need to know what was asked and what we answered, for the period stated in the retention clause below.
- Holding business contact details for people we deal with — because it is necessary for the ordinary conduct of our business with the organization concerned. That includes telling you when something you have accepted, such as the website terms, changes in a way that affects you.
- Server and edge logging, and counting requests from an internet address to stop abuse — because we are obliged to keep this service secure, and cannot do that without a record of what reached it.
- Establishing, exercising or defending a legal claim, and meeting an obligation the law puts on us — where either arises.
The box you tick on the enquiry form is CONSENT, and it is worded that way — "I agree". It is unticked when the page loads and the form will not submit without it, so ticking it is a deliberate act rather than something that happens to you.
What it covers is replying to you, and only that. It is not the ground for everything else on this page: keeping the enquiry as a business record, carrying it through a delivery provider, and the security processing around it each stand on their own ground, described above.
You can withdraw it at any time by writing to the address in the first clause. Withdrawing stops us relying on it from that point; it does not undo what was lawfully done beforehand, and it does not reach anything we are required to keep.
We keep the evidence of what you agreed to: the exact wording shown to you, which version of this notice and of the terms it was given against, the language it was shown in, and the moment it arrived, stamped by our server. Consent nobody can evidence is not consent, and that record is how we can answer the question later.
- 12
No analytics, advertising, profiling or tracking
No analytics provider is enabled on this website. Beyond that, this site loads nothing from a third party: no script, no font, no image, no stylesheet, no frame, no chat widget and no embedded video. Its content security policy forbids it, and an automated test asserts that loading a page makes no external request before any change can be released.
One thing sits outside that guarantee, and it is fairer to name it than to let the sentence above imply more than it covers. This site is served through a content delivery network, and that network sets standard response headers asking your browser to report network errors — a failed connection, a broken response — back to the network operator. Those reports are not part of the page, they carry nothing you send us, and an ordinary visit produces none. They go to the network operator rather than to us: Kerah does not receive the reports themselves, though the operator makes summary information about reachability available to the accounts it serves. We describe it this way rather than more absolutely because the exact configuration is the operator's, not ours.
We say all of this positively because it is unusual and because it can be checked. If an analytics provider is ever enabled, it will be named in this notice, with what it records and where it processes, before it is switched on rather than after.
- 13
Marketing
Kerah sends no marketing from this website. There is no newsletter, no mailing list and no marketing automation behind the enquiry form. If you send an enquiry, you receive a reply about your enquiry.
- 14
If you message us on WhatsApp
This site offers a WhatsApp route as well as email. Using it is your choice, and everything else on this site works without it.
If you message us there, WhatsApp is the messenger and its operator carries the message. That means the operator processes your number and whatever your account makes visible — a display name, a profile photo — along with the message itself and the times it was sent and delivered. That is how the service works; it is not something Kerah adds or can switch off.
What Kerah does with it is ordinary: we read your message and reply to it, the same as we would an email. We do not add your number to a list, we send nothing promotional, and we do not use WhatsApp to reach you unless you started the conversation there.
If you would rather we did not hold your number, email us instead. The address is in the clause above and the answer will be the same.
- 15
Service providers
A small number of providers handle information for this website. Each is engaged for the purpose stated beside it.
Where a provider is acting for Kerah it acts on Kerah's instructions. That is not the whole picture for every provider or every function: a network that delivers this site also protects it, and a messaging or mail service operates its own platform and meets its own legal obligations. We describe it this way rather than claiming these providers do nothing but follow instructions, because the second statement is stronger than what we have verified.
- Cloudflare — Serves this website from its global edge network, and keeps the request and application logs described above
- Brevo (formerly Sendinblue) — Transmits an enquiry from the website to Kerah's mailbox
- Google Workspace — Hosts the mailbox an enquiry is delivered to, and Kerah's business correspondence
An enquiry is delivered from an address at kerah.ae to a mailbox at kerah.ae, with your address set as the reply address so that a reply reaches you. The content of an enquiry is never written to an application log; where a delivery fails, only the provider and the failure code are recorded.
Beyond these three, we do not transfer personal information to anyone, except where the law requires it, where it is necessary to establish, exercise or defend a legal claim, or in the narrow circumstances set out in the clause on abuse and security reports below.
- 16
Information that leaves the United Arab Emirates
This website is not hosted in the United Arab Emirates, and we would rather say so plainly than let a reader assume otherwise. It is served from a global edge network, which means your request is answered by whichever location is closest to you — inside or outside the UAE. An enquiry then travels through our delivery provider's infrastructure and is delivered to a mailbox hosted by our email provider. Each of those may process outside the UAE, whatever the position for the website itself.
Kerah makes no residency claim about this website. The residency commitments Kerah makes for a client platform are a separate matter, set in that engagement's contract, and must not be read from this page.
- 17
The basis for those transfers
Two things put information outside the country, and they are on different footings.
Delivering your enquiry is the first. You send us a message so that we can read it and reply; it cannot reach us without travelling through the provider that carries it and the mailbox that receives it. That transfer is necessary to do the thing you asked for, and there is no version of the enquiry form that avoids it.
Serving the page is the second. This site is delivered from a global network, so the request that fetched this page was answered by whichever location was closest to you, and the technical record of it sits with that provider.
In both cases the provider handles the information on our written instructions and for the purpose we have given it, and nothing more. We do not sell information, and we do not transfer it to anyone else except where the law requires it or to establish, exercise or defend a legal claim.
- 18
Artificial intelligence
No artificial intelligence service processes anything you submit through this website. An enquiry is checked for completeness, transmitted and delivered to a mailbox. It is not summarised, classified, scored or drafted against by a model, and it is not sent to a model provider. If that ever changes, this notice will first say which service is involved, what it receives, what is retained and whether a person reviews the result.
Two commitments apply whatever Kerah builds in future. Content submitted through this public form is never used to decide any person's eligibility for assistance, employment, credit, health, legal or financial services. Client data is never used to train a general-purpose model.
- 19
Automated decision-making and profiling
No decision that produces a legal effect on you, or an effect of similar significance, is made by automated means on this website. No profile is built about any visitor.
Two automatic checks do exist, and it is more honest to name them than to let the sentence above sound wider than it is. A submission that fills in the hidden anti-spam field is rejected automatically, and repeated submissions from the same connection in a short period are refused automatically. Neither decides anything about you — they decide whether one submission goes through — and neither looks at who you are. If either has stopped you reaching us and you think it should not have, email us and a person will read what you send.
Two automated checks do run on the enquiry form: a hidden field that must be left empty, and a limit on how many submissions may come from the same connection in a short period. Either can cause a submission to be refused. Neither makes a decision about you as a person — if a submission is refused the page says so, and every one of our published contact addresses reaches the same people directly.
Where you believe an automated decision has been made about you by a system Kerah built for a client, the clause headed "What this notice does not cover" applies: that client is the controller, and the right to human review is exercised with them.
- 20
How long we keep information
We keep information for as long as the purpose it was collected for requires, and then we delete it.
- An enquiry in our mailbox — 90 days from the day it arrives, or from our last substantive reply, whichever is later. If it becomes a live piece of work it stops being an enquiry and is kept under the agreement covering that work instead.
- A WhatsApp conversation that does not become work — 90 days from the last substantive message.
- Business correspondence, tender material and anything belonging to a live or completed engagement — at least five years, because commercial correspondence carries a statutory retention period.
- Rights requests and complaints — three years after the matter closes, or five where it is tied to a dispute or forms part of a commercial record.
- Records of an abuse or security investigation — twelve months after the matter is documented as closed. Where an incident was substantiated, up to three years, and only where that is genuinely needed for a claim or a compliance obligation.
- Failed submissions and failed deliveries — 30 days.
- Ordinary edge and security logs — 30 days, and beyond that only where a documented threat makes it necessary.
- The count we hold against an internet address to stop abuse — in memory only, never written to a database, and never part of a backup. It stops counting against you when its short window ends. The entry itself is cleared when the server next has reason to touch it, when the site's memory is swept, or when the server restarts — so in practice it may sit unused for a while after it has stopped having any effect.
- Business contact details — for as long as we are dealing with the organization concerned, and then for as long as we need the record of it.
- An unsolicited application or curriculum vitae — deleted within seven days of us seeing it, because there is no recruitment process here to hold it in.
- Delivery events at the email provider — one month.
Deleting something from a live system does not always remove it from a backup at the same moment. A backup copy ages out on its own schedule, it is not routinely restored, and where one is restored a deletion request is applied to it again.
Where the law requires us to keep something, or where it is needed for a legal claim, we keep it for as long as that lasts and no longer. A hold like that is recorded — what it covers, why, who authorised it and when it is next reviewed — and deletion resumes once it is lifted.
The 90-day deletion is carried out monthly by a named person, and the run is recorded. A published period nobody executes is not a retention policy.
- 21
How we protect what you send
We describe only what is actually in place, because a security section that overstates is the first thing a reviewer catches.
What follows is about this website. It is not a description of how Kerah secures an engagement — that is set by the agreement covering that work, and is assessed there rather than asserted here.
- The site is served only over an encrypted connection, and instructs browsers to refuse an unencrypted one
- A strict content security policy prevents the page from loading or contacting anything outside this site, and the site may not be embedded in a frame by anyone
- An enquiry travels to us over an encrypted connection to our delivery provider's interface
- The content of an enquiry is never written to an application log
- The form is protected by a hidden anti-spam field and by a limit on repeated submission from the same connection
- There is no account, no password and no payment on this site, so there is no credential and no payment record here to lose
No system is without risk and we do not suggest otherwise. Kerah holds no security certification today and does not claim or imply one.
- 22
Abuse, security reports and misuse of this website
Two things sit outside the ordinary description above, and they are the reason this clause exists.
The first is misuse. If this website is attacked, flooded, scanned or used to send something unlawful, we keep the technical record of it — the internet address, the timing, the request, and where a message is involved, its headers. We keep it to understand what happened, to stop it continuing, to defend a claim, and where the law requires us to report it.
The second is a security report. If you tell us about a weakness, we keep your report and our correspondence with you for as long as it takes to fix the issue and to show that we did.
We may pass either to a law enforcement agency or a regulator, or to another person directly affected — a client whose systems are implicated, or a provider whose network is being used. We disclose only what is lawful, necessary and proportionate, and only the part that is actually relevant. We do not publish it, and we do not use it for anything else.
Where we can, we tell you if information about you has been passed on. There are times we cannot — where telling you would defeat an investigation, or where we are instructed not to.
This is the one place where the general promise elsewhere in this notice — that we delete what should not have been sent and do not forward it — gives way. It gives way only for conduct of this kind, and only to the extent described here.
- 23
Your rights, and how to use them
Under UAE personal data protection law you have rights over your personal information. Subject to the conditions and exceptions the law itself sets, you may:
- Ask what we hold about you, and obtain a copy of it
- Have it corrected where it is inaccurate or incomplete
- Have it deleted, where the law provides for deletion
- Ask us to restrict what we do with it while a question about it is resolved
- Object to processing carried out for direct marketing, including any profiling connected to it — Kerah does no direct marketing, so there should be nothing here to object to
- Object to processing carried out for the purposes of statistical surveys, unless that processing is required in the public interest
- Object to processing that does not comply with the principles the law sets for handling personal information
- Receive it in a portable form, or have it transmitted to another controller, where that right applies
- Withdraw consent where we relied on your consent, without affecting what was lawfully done beforehand
- Ask for a human review of a decision made by automated means. The only automatic decisions this site makes are the two anti-abuse checks described in the clause on automated decision-making, and a person will read anything you send us instead
To use any of these, write to privacy@kerah.ae and tell us what you want. We may ask for enough information to be satisfied that the request is yours, so that we do not disclose your information to somebody else. There is no charge.
Where your request concerns information held inside a system Kerah built for a client, we will pass it to that client, because they are the controller and they decide the outcome. We will tell you that we have done so.
- 24
Complaints
If you are unhappy with how we have handled your information, or with how we answered a request, you may complain to the Emirates Data Office, the federal authority for personal data protection. That right is yours directly. You do not have to raise it with us first, and nothing on this page is a condition of using it. How a complaint is filed is set by the Office itself under its own published procedures, so we point you to the authority rather than to a form that may not be the current one.
You are also welcome to come to us, either instead or as well, at privacy@kerah.ae. Set out what happened and what you would like us to do. We would rather resolve it directly, and we will tell you what we find — but that is an offer, not a step you are required to take.
- 25
Children
This is a business website. It is not directed at children, it carries nothing intended for a child, and nothing on it is designed to appeal to one.
The enquiry form is for adults contacting us about work. By sending one you confirm you are old enough to enter into a contract and, where you are writing for an organization, that you are authorised to do so on its behalf. We do not ask for your age and we do not want an identity document — asking for one to prove age would collect far more about you than the question is worth.
We do not knowingly collect information about a child. If a child has sent us an ordinary enquiry by mistake, tell us at the address above and we will restrict who can see it and delete it.
One thing works differently, deliberately. If a message suggests a child is being harmed, is at risk, or is asking for help, we do not delete it and we do not treat it as a privacy request. We restrict it to the people who need to see it, we keep only what is needed, and we pass it to the authority whose job it is — and we follow what they tell us to do with it after that.
In that situation we do not contact a parent or guardian as a matter of course. Who is told, and when, is a decision for the people with the authority and training to make it, not something a website decides in advance. Nor do we tell anyone who reported it that we have passed it on, where doing so could put them at risk.
If you are a parent or guardian asking what we hold about your child, write to us and we will answer — after we have satisfied ourselves who you are, and unless answering would cut across the paragraph above.
- 26
If something goes wrong
If a security incident affects personal information we are responsible for, we will investigate it, take what steps we can to contain it, and notify the competent authority and the people affected where the law requires us to.
Where an incident touches a client engagement, we tell that client as soon as we become aware of it — not once we understand it. The first message says what we know and what we do not yet know, and the detail follows as we establish it. A client who is the controller for that information has their own deadlines to meet, and those deadlines start whether or not our investigation has finished.
Where Kerah is the one responsible for the information, we notify the Emirates Data Office as soon as the statutory trigger is met, and the people affected where the law requires it. Where Kerah is acting for a client, our contractual target is to tell them within 24 hours of becoming aware — that is a commitment Kerah makes, not a restatement of the statutory deadline, which is simply on becoming aware.
- 27
Version, effective date and changes
We may change this notice. When we do, the version and effective date below change with it, and a material change is recorded with the date it took effect, so that you can tell which version applied when. We do not change this notice silently.
This is version 1.0 of this notice.
2026-08-23 — First published version of this notice.