Privacy Policy | Identiqa UAE

This privacy policy explains which personal data we process when you visit the website www.identiqa.com, for which purposes we do so, and which rights you have. It is provided in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data of the United Arab Emirates (PDPL).

1. Who is responsible

The following companies are jointly responsible, as controllers, for the processing described in this policy:

Identiqa Inc., 1440 Broadway, Oakland, CA 94612, United States
Identiqa Europe Operations Ltd., 1 Ballycoolin Rd, Ballycoolen, Dublin, D15 AKK1, Ireland

The two companies have agreed between them which of them handles privacy information and requests. You may address your requests to either company. The arrangement also governs the processing of data between the two companies and their respective rights and obligations. Access to personal data is logged and reported between the companies. Identiqa Inc. complies with requests from individuals who are protected by the GDPR and handles them in accordance with it.

You may exercise your rights against either company. The central point of contact for all privacy requests is:

Email: privacy.uae@identiqa.com
Postal address: Identiqa Europe Operations Ltd., 1 Ballycoolin Rd, Ballycoolen, Dublin, D15 AKK1, Ireland

2. Principles of processing

2.1 Scope

We process personal data only to the extent necessary to operate a functioning and secure website and to handle your requests. We use services that set cookies or record your behaviour (Google Analytics, Matomo and Microsoft Clarity) only with your consent. In addition, we evaluate server log data and the information from your requests in aggregated form; see the sections “Server log files” and “Contacting us” for details.

2.2 Legal bases

Under the PDPL we process personal data on the basis of your consent or where the law permits processing without consent, in particular where it is necessary to perform a contract with you or to take steps at your request before entering into a contract, to comply with obligations under the laws of the United Arab Emirates, or to establish, exercise or defend legal claims. Protecting the website against misuse is part of delivering it to you. We measure how the website is used only with your consent, which must be specific, clear and unambiguous and which you may withdraw at any time.

2.3 Retention

We delete personal data as soon as the purpose of the processing no longer applies. We retain data for longer only where statutory retention obligations apply, for example under company and tax law, or where the data is needed to establish, exercise or defend legal claims. Where fixed periods apply, they are stated for each processing activity below.

3. Providing the website

3.1 Server log files

Each time the website is accessed, our systems automatically record the following data from the requesting device:

IP address (shortened where technically possible)
date and time of access
the address requested and the referring address (referrer)
browser and operating system used
internet service provider

This processing is necessary to deliver the website, to keep it stable, and to detect and defend against misuse and attacks.

In addition, we transfer the log data to central systems of Identiqa Inc. in the United States. There it is aggregated and processed by downstream systems for evaluation purposes, in particular for statistics on the operation and use of the website. No cookies are set and no information is read from your device for this purpose.

Legal basis: the processing is necessary to deliver the website and the functions you request, which the PDPL permits without consent as processing necessary to take steps at your request. The purpose is the secure and stable operation of the website and its evaluation and improvement on the basis of aggregated data. You may ask us to stop processing your personal data for statistical purposes; see the section “Your rights” for details.

Retention: log files on the delivering servers are generally deleted after seven days, unless a security incident requires longer retention for investigation. We keep the log data transferred to the central systems, and the evaluations derived from it, for as long as they are needed for the purposes stated, and delete them afterwards.

3.2 Hosting and delivery

The website is operated on infrastructure owned by the Identiqa group. Our central servers are located in the United States (State of New Jersey). The website for visitors in Europe is delivered from servers in the Netherlands, which are operated by Identiqa Europe Operations Ltd. The cooperation between the two companies is governed by the arrangement described in the section “Who is responsible”. Data from the operation of the website, from audience measurement and from your requests is transferred to the central systems of Identiqa Inc. in the United States, aggregated there and processed by downstream systems for evaluation purposes. What this means for each kind of data is described in the respective sections; see the section “International transfers” for details. Images, fonts and scripts are delivered from our own servers. Content from third-party servers is not loaded without your consent, with one exception: the DNS query in the instant domain check, which you trigger yourself (see the section “Instant domain check”).

4. Storage in your browser and consent management

This website does not set any cookies without your consent. In your browser's local storage (local storage and session storage) we store only settings that are technically necessary to operate the website as you have requested:

idqa-consent: your decision on consent for each purpose, with the time it was made and your Privacy Consent ID; valid for 180 days
idqa-theme: the display mode you selected (light, dark or automatic)
idqa-region: the country edition you selected
idqa-region-auto: a note that you were automatically redirected to your country edition; deleted when you close the browser tab

This information stays in your browser. Only your decision on consent is transmitted to us, as described in the section “Record of your decision”.

Legal basis: the storage is necessary to provide the settings you request.

On your first visit we ask for your consent to the services described in the sections “Audience measurement” and “Session analysis”. You may give or refuse consent for each purpose separately. Until you have consented, none of these services are loaded. Refusing consent has no disadvantage for your use of the website.

You can change your choice or withdraw your consent with effect for the future at any time using the “Privacy settings” link at the bottom of every page. Withdrawal does not affect the lawfulness of processing carried out before it. When you withdraw consent, we delete the cookies set by the services to the extent this is technically possible from our website. After 180 days, and whenever the services we use change, we ask for your consent again. If your browser sends the Global Privacy Control signal, we treat it as a refusal.

4.1 Record of your decision

We must be able to demonstrate your consent. We therefore also store on our server every decision you make in the consent dialog, whether you consent or refuse. We store a randomly generated identifier (Privacy Consent ID), the time, your choice for each purpose, the version of the information shown in the dialog and the country edition of the website. We do not store your IP address together with this information; to protect against misuse, we merely keep a hash value of the IP address separately for no more than ten minutes.

We show you the Privacy Consent ID each time a decision is stored; you can also find it in the consent dialog at any time. If you contact us about your consent, we can locate your decision using this identifier. Without the identifier we cannot attribute the stored information to any person.

Legal basis: the processing is necessary to comply with our obligation under the PDPL to be able to prove your consent.

Retention: we keep the record for as long as it is needed to demonstrate consent and its withdrawal, and delete it afterwards.

5. Audience measurement

We use the following services only if you have consented to the purpose “Audience measurement”.

5.1 Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The service shows us how the website is used so that we can improve its content and structure. The data processed includes in particular:

the IP address (Google shortens it before storage)
pages viewed, time spent and click paths
the referring address and the source of the visit
device and browser information
approximate location at city or region level
pseudonymous user and session identifiers

Google Analytics sets the cookies “_ga” and “_ga_” followed by an identifier, each with a lifetime of up to two years. We use Google Analytics exclusively for statistical evaluation. Through Google Consent Mode we signal to Google that no consent has been given for storing or using data for advertising purposes.

Legal basis: your consent in accordance with the PDPL.

Data processing agreement: we have a data processing agreement in place with Google.

International transfers: Google Ireland Limited engages Google LLC, Mountain View, United States, as a sub-processor; the data is therefore also processed in the United States. See the section “International transfers” for details.

Retention: user-level and event-level data is deleted by Google after no more than 14 months.

Further information: https://policies.google.com/privacy

5.2 Matomo

We also use the web analytics software Matomo. We operate Matomo on servers owned by Identiqa Inc. in the United States (analytics.identiqa.com); we do not disclose this data outside the Identiqa group, unless we are required to do so by law. The measurement data is aggregated there and processed for evaluation purposes by downstream systems of Identiqa Inc. The data processed includes in particular the IP address, pages viewed, clicks on links, the referring address, and device and browser information. Matomo sets the cookies “_pk_id” (lifetime 13 months) and “_pk_ses” (lifetime 30 minutes).

Legal basis: your consent in accordance with the PDPL.

International transfers: the data is processed in the United States. See the section “International transfers” for details.

Retention: the measurement data is deleted as soon as it is no longer needed for statistical evaluation.

6. Session analysis

We use the following service only if you have consented to the purpose “Session analysis”.

6.1 Microsoft Clarity

We use Microsoft Clarity, a service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, United States. Clarity records your interactions with the website, in particular mouse movements, clicks, scrolling and the pages you view; Microsoft receives this information directly from your browser while you use the website. It is used to create session recordings and heatmaps. Entries in form fields are masked; their content is not recorded. Clarity is not loaded, and nothing is recorded, before you give your consent. The IP address, device and browser information, and pseudonymous identifiers are also processed. Clarity sets the cookies “_clck” (lifetime one year) and “_clsk” (lifetime one day).

We use the results to identify usability problems and to improve the website. According to Microsoft, it also processes the data for its own purposes, including improving its own services and advertising. For that further processing Microsoft acts as an independent controller. Your consent to the purpose “Session analysis” covers the transmission of the data to Microsoft.

Legal basis: your consent in accordance with the PDPL.

International transfers: the data is processed in the United States. See the section “International transfers” for details.

Retention: according to Microsoft, session recordings are stored for 30 days, and tagged recordings and heatmaps for up to 13 months.

Further information: https://privacy.microsoft.com/privacystatement

7. Instant domain check

The website offers an instant check for domains. The check starts only when you enter a domain and trigger it.

DNS queries: your browser queries public DNS records of the domain you entered directly from the service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States (cloudflare-dns.com). Cloudflare receives the domain you entered and technical connection data, in particular your IP address, and processes them on its own responsibility under its privacy policy: https://www.cloudflare.com/privacypolicy/
Checks by our server: our own server checks the mail servers and security headers of the domain you entered. For this purpose we process the domain you entered; it appears in the server log files as part of the address requested.
Protection against misuse: to limit the number of requests, we store a hash value of your IP address together with the times of your requests. We evaluate only the requests of the last ten minutes; older entries are deleted with your next request.

8. Contacting us

If you contact us by telephone, by email or through a form, we process the information you provide, in particular your name, contact details, company and the content of your request, in order to handle your request. If you call us, we also process the telephone number transmitted.

Legal basis: the processing is necessary to respond to your request and, where applicable, to enter into or perform a contract with you, as permitted by the PDPL.

Retention: we delete the data as soon as it is no longer needed to handle your request. We retain business correspondence for the periods required by the tax and record keeping laws that apply to us.

We use a customer relationship management system to manage communication with customers and prospective customers. This system and our other central systems are operated in the United States, so your information is stored there. It is also aggregated there and processed by downstream systems for evaluation purposes, in particular for internal statistics on requests and business relationships. We do this to manage and improve our services. We operate these systems ourselves and do not use external service providers for them.

9. Links to other websites

The website contains links to third-party services, such as LinkedIn and GitHub. These are simple links. Data is transmitted to the respective provider only when you click the link; that provider alone is responsible for any subsequent processing.

10. Recipients

Within the Identiqa group, access to your data is given to those units that need it to perform their tasks. Outside the group, the following categories of recipients receive data:

Google and Microsoft, to the extent you have consented to the respective services
Cloudflare, to the extent you use the instant domain check
tax advisers, auditors and lawyers, where this is necessary to protect our rights
public authorities and courts, where we are legally obliged to disclose data

We do not sell your data.

11. International transfers

Personal data is transferred outside the United Arab Emirates to the extent described in this policy. This concerns the United States, where the central systems of Identiqa Inc. are located (State of New Jersey), including the systems used for audience measurement with Matomo, for evaluating operational data and for managing customer relationships, as well as Ireland and the Netherlands, where Identiqa Europe Operations Ltd. is established and operates servers. Data is also processed in the United States where you use, or have consented to, the services of Google, Microsoft and Cloudflare.

Where the UAE Data Office has not determined that the destination country provides an adequate level of protection, we rely on the grounds the PDPL recognises for such transfers: for transfers within the Identiqa group and to our service providers, contracts that require the recipient to protect personal data to the standard set by the PDPL; for Google Analytics and Microsoft Clarity, your express consent to the transfer of your data to the United States, which we ask for in the consent dialog; and for handling your requests, the necessity of the transfer to respond to you or to perform a contract with you. We will provide you with information about these safeguards on request.

12. Your rights

Under the PDPL you have the following rights regarding your personal data:

to obtain information about the personal data we process about you, the purposes of the processing and the recipients
to receive your personal data in a structured and machine-readable format and to have it transferred to another controller where technically feasible
to have inaccurate personal data corrected and incomplete personal data completed
to have your personal data erased where the law provides for this
to stop the processing of your personal data for direct marketing or for statistical purposes, and where the processing is no longer necessary for its purpose or does not comply with the law
to have the processing restricted while you contest the accuracy of your personal data or object to its processing, and in the other cases provided by law
to object to decisions based solely on automated processing, including profiling, that have legal consequences for you or seriously affect you
to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal

To exercise your rights, you may contact us in any form, for example by email to privacy.uae@identiqa.com. Exercising your rights is free of charge, except where the law allows us to charge a fee or to refuse a request.

13. Complaints

If you believe that we have not handled your personal data in accordance with the PDPL, please contact us first using the contact details above. You also have the right to lodge a complaint with the UAE Data Office.

14. No obligation to provide data

You are under no statutory or contractual obligation to provide us with personal data. Without the technically necessary connection data, however, we cannot deliver the website to your device.

15. No automated decision-making

We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

16. Data security

We take technical and organisational measures to protect your data against accidental or intentional manipulation, loss, destruction and unauthorised access. These include in particular encryption in transit (TLS), access controls, regular security reviews and the use of our own security platform. We review these measures regularly and develop them further. No method of transmitting data over the internet is completely secure, and we cannot guarantee absolute security.

17. Changes to this privacy policy

We update this privacy policy when the law, our website or the services we use change. The version published on this page applies. If we make material changes, we will publish the updated policy on this page with a new date. This version was last updated in November 2026.