Privacy Policy

webgenerationgroup.ae · Last updated 18 August 2026 · Effective 18 August 2026

1. Who we are

This Privacy Policy explains how WGG MARKETING MANAGEMENT L.L.C (“we”, “us”, “our”, “the Company”) collects, uses, discloses and protects personal data when you visit webgenerationgroup.ae (the “Website”) or engage with our services.

For the purposes of applicable data protection law, we act as the Data Controller in respect of personal data collected through this Website.

Where we deliver advertising and marketing services to business clients, we may act as a Data Processor on behalf of that client. In that case, the client’s own privacy policy governs the processing, and our obligations are set out in a written data processing agreement.

2. Legal framework

We process personal data in accordance with:

• Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”) and its implementing instruments;
• Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes;
• Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services;
• Federal Decree-Law No. 14 of 2023 on Trading by Modern Technological Means;
• applicable regulations of the Telecommunications and Digital Government Regulatory Authority (TDRA) on electronic marketing communications.

Where you are located in the European Economic Area or the United Kingdom, we additionally apply the standards of the EU General Data Protection Regulation (GDPR) and the UK GDPR to your personal data.

The supervisory authority for the PDPL is the UAE Data Office.

3. Personal data we collect

3.1 Data you provide directly

3.2 Data collected automatically

We do not intentionally collect sensitive personal data (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data, genetic or biometric data, or data concerning sexual life). Please do not submit such data to us through the Website.

4. Why we process personal data and on what legal basis

Under the PDPL, consent is the default basis for processing, with defined exceptions including performance of a contract, compliance with legal obligations, and the legitimate interests of the controller.

You may withdraw consent at any time (see section 9). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

5. Cookies and similar technologies

We use cookies, pixels, SDKs, local storage and similar technologies. Non-essential technologies are activated only after you give consent through our cookie banner.

You can change or withdraw your cookie preferences at any time via the “Cookie settings” link in the Website footer. You can also block or delete cookies through your browser settings, though some Website features may then not work correctly.

[ Insert full cookie table with vendor, cookie name, purpose and retention period once the cookie scan of the live site is complete. ]

6. Who we share personal data with

We do not sell personal data. We disclose personal data only to:

Service providers acting on our instructions, including:

• Kommo (operated by QSOFT LLC) — customer relationship management. Enquiries submitted through the Website are stored here: name, email, phone number, company, and the content of your enquiry. Kommo acts as our processor and does not determine the purposes of this processing.
• Railway (Railway Corp) — hosting and infrastructure for the Website. Processes server logs containing IP addresses.
• Analytics and advertising platforms — see section 5. These providers do not receive your name, email address or phone number. They do process online identifiers such as IP address and cookie identifiers, which qualify as personal data under applicable law.
• Professional advisers — lawyers, auditors and accountants, where necessary and subject to professional confidentiality obligations.

We do not share the contact details you submit through the Website with any other third party.

Each provider acting on our behalf is bound by contract to process personal data only on our documented instructions and to apply appropriate security measures.

Other recipients:

• competent UAE authorities, courts and regulators where disclosure is required by law or by a valid legal request;
• a purchaser or successor entity in connection with a merger, acquisition or restructuring, subject to equivalent protections;
• our business clients, where we act as their processor.

7. International transfers of personal data

Some of our service providers store or process personal data outside the United Arab Emirates.

Under Articles 22 and 23 of the PDPL, personal data may be transferred outside the UAE where:

• the destination country has an adequate level of protection recognised by the UAE Data Office; or
• the transfer is made under a contract or binding agreement containing appropriate safeguards; or
• you have given explicit consent to the transfer; or
• the transfer is necessary for the performance of a contract, for legal claims, or to protect vital interests.

Where we transfer personal data to countries without a recognised adequacy decision, we put in place contractual safeguards, including standard contractual clauses where appropriate, and take account of the destination country’s legal environment.

Principal transfer destinations

Our hosting provider additionally operates a global edge network. Requests are terminated at the network point closest to you before being routed to the deployment region, meaning your IP address may transit infrastructure in other countries.

Transfers to Kommo and to our hosting provider are made on the basis of each provider’s data processing terms, which incorporate standard contractual clauses and equivalent transfer mechanisms.

8. How long we keep personal data

When a retention period expires, we delete or irreversibly anonymise the data.

9. Your rights

Subject to the conditions and exceptions in the PDPL, you have the right to:

• Be informed about how your personal data is processed and to obtain a copy of it.
• Request transfer of your personal data to another controller in a structured, machine-readable format, where technically feasible.
• Correct or complete inaccurate or incomplete personal data.
• Request erasure of your personal data where it is no longer necessary, where consent has been withdrawn, or where processing is unlawful.
• Restrict or stop processing in defined circumstances, including where you contest the accuracy of the data.
• Object to processing based on legitimate interests, and to processing for direct marketing purposes.
• Object to automated processing, including decisions producing legal effects, and to request human review.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with the UAE Data Office if you believe your rights have been infringed.

How to exercise your rights

Send a request to sales@webgenerationgroup.ae with the subject line “Data Subject Request”. We may ask for information to verify your identity.

We will respond within 30 days of receipt of a valid request. Where the request is complex or where we receive multiple requests from you, we may extend this period and will inform you of the reason for the delay.

Our services are exercised free of charge. We may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive.

10. Marketing communications

We send marketing emails and messages only where you have consented, or where you are an existing client and the communication concerns similar services.

Every marketing message includes an unsubscribe mechanism. You can also opt out at any time by emailing sales@webgenerationgroup.ae. Opting out of marketing does not stop service-related communications required to perform a contract.

Electronic marketing is carried out in line with applicable TDRA rules on unsolicited electronic communications.

11. Security

We apply technical and organisational measures appropriate to the risk, including:

• encryption of data in transit (TLS) and at rest where applicable;
• role-based access control and the principle of least privilege;
• multi-factor authentication on business-critical systems;
• regular backups and tested restoration procedures;
• confidentiality obligations imposed on personnel and contractors;
• vendor due diligence and written data processing agreements.

No method of transmission or storage is entirely secure. We cannot guarantee absolute security, but we maintain procedures to detect, investigate and respond to security incidents.

Data breach notification

If a personal data breach occurs that would prejudice your privacy, confidentiality or security, we will notify the UAE Data Office without undue delay after becoming aware of it, and will notify affected individuals where the breach is likely to result in a high risk to their rights.

12. Children

The Website is directed at businesses and is not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected personal data from a minor without appropriate consent from a parent or legal guardian, we will delete it. If you believe this has occurred, contact sales@webgenerationgroup.ae.

13. Third-party links

The Website may contain links to third-party websites, platforms and social media pages. We are not responsible for the privacy practices or content of those third parties. We encourage you to review their privacy policies before providing personal data to them.

14. Automated decision-making

We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you. Advertising platforms we use may apply automated audience segmentation; you can object to this through the cookie settings and platform-level ad preferences.

15. Changes to this Policy

We may update this Privacy Policy from time to time. The current version is always available at webgenerationgroup.ae/privacy-policy with the “Last updated” date at the top. Where changes are material, we will provide reasonable advance notice by email or a prominent notice on the Website.

16. Contact and complaints

For any question about this Policy or about how we handle personal data:

If you are not satisfied with our response, you may lodge a complaint with the UAE Data Office.

17. Governing law

This Privacy Policy is governed by the federal laws of the United Arab Emirates as applied in the Emirate of Dubai. Any dispute arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts of Dubai.

[ If an Arabic version is published: in the event of any discrepancy between the English and Arabic versions of this Policy, the Arabic version shall prevail. ]