Privacy Policy

1. Statutory Framework & Data Controller Identity

This Privacy Policy governs the collection, processing, storage, and transfer of personal data by ZDA Travel & Tourism (hereinafter referred to as "ZDA", "we", "us", or "our"), operating in the Emirate of Dubai, United Arab Emirates.

For the purposes of UAE Federal Decree-Law No. 45 of 2021 regarding Personal Data Protection ("PDPL"), ZDA acts as the designated Data Controller regarding personal information submitted through our website, consultation desks, electronic communication channels, and physical advisory office at Office No. 27, My Tower, Al Nada, Dubai.

2. Categories of Personal Data Collected

To facilitate official UAE visa applications, Free Zone company formations, Mainland commercial registrations, medical fitness appointments, and airline bookings, we collect the following categories of client information:

• Identity & Biographical Data: Full legal name (English and Arabic where applicable), gender, date of birth, marital status, nationality, passport details (passport number, issue/expiry dates, country of issuance), and high-resolution passport photographs.
• Contact & Communication Data: Personal and corporate email addresses, international telephone numbers, mobile WhatsApp contact details, residential address, and current accommodation location within the UAE.
• Immigration & Residency Status Records: Current and historic UAE tourist visas, entry stamps, previous residence visa cancellation papers, Emirates ID numbers, file reference numbers with the Federal Authority for Identity, Citizenship, Customs and Port Security (ICP), and General Directorate of Residency and Foreigners Affairs (GDRFA).
• Academic & Corporate Documentation: University degree certificates, transcripts, professional credentials, board resolutions, Certificates of Incorporation, and official Ministry of Foreign Affairs (MOFA) attestation records required for professional visa designations or corporate subsidiary filings.
• Financial & Transaction Records: Invoicing history, commercial bank transfer receipts, corporate payment confirmations, and billing addresses. (Note: ZDA does not store raw credit card numbers; payment gateway transactions are handled by accredited, PCI-DSS compliant UAE financial institutions.)
• Travel & Flight Data: Airline flight itineraries, Passenger Name Records (PNR), baggage preferences, and emergency contact details.

3. Lawful Grounds & Purposes of Processing

We process your personal data exclusively under lawful bases recognized by Article 4 and Article 5 of the UAE PDPL:

• Performance of Contract: To prepare, review, type, and submit official applications for trade licenses, establishment cards, entry permits, residence visa stamping, Emirates ID cards, and airline ticket reservations as agreed in your engagement contract.
• Compliance with Legal & Statutory Obligations: Complying with mandatory federal immigration requirements, municipal licensing standards, and anti-money laundering (AML/CFT) verifications required under UAE federal statutes.
• Consent: Where you voluntarily opt in to receive consultation updates, regulatory advisories, or promotional information regarding UAE residence visa opportunities. Consent may be withdrawn at any time.

4. Disclosure to UAE Sovereign Authorities & Third Parties

By engaging ZDA Travel & Tourism for visa and corporate setup services, you expressly understand and authorize the transmission of your personal documentation to authorized third-party entities strictly necessary to execute your requested services:

• UAE Sovereign Immigration & Labor Authorities: Including ICP, GDRFA Dubai, and the Ministry of Human Resources and Emiratisation (MOHRE).
• Free Zone & Economic Licensing Authorities: Including Ras Al Khaimah Economic Zone (RAKEZ), International Free Zone Authority (IFZA), Dubai Department of Economy and Tourism (DET), and related registrars.
• Authorized Healthcare & Identity Desks: Dubai Health Authority (DHA) and Emirates Health Services (EHS) medical fitness screening clinics, and approved Emirates ID biometric capture service centers.
• Commercial Aviation Carriers: Commercial airlines and Global Distribution Systems (GDS) for the issuance and management of scheduled airline tickets.
• Licensed Health Insurance Underwriters: Authorized UAE insurance companies to issue compulsory basic health insurance policies linked to residence visa stamping.

We enforce strict confidentiality agreements with all third-party vendors and never permit secondary processing or monetization of client data.

5. Data Retention & Secure Encryption Standards

ZDA employs industry-standard physical, electronic, and procedural safeguards to protect your personal data from unauthorized access, accidental alteration, disclosure, or destruction.

All electronic document scans (passports, certificates, MOAs) are archived on secure, encrypted servers utilizing SSL/TLS 256-bit encryption during transit and at rest. Access is strictly restricted to authorized case managers and senior PRO personnel directly handling your file.

Personal documentation is retained only for the duration required to complete the agreed consultancy services, fulfill statutory audit requirements under UAE Commercial Law, or support ongoing annual visa and corporate license renewals. When data is no longer necessary, it is permanently erased using certified data sanitization procedures.

6. Cookies & Tracking Technologies

Our website uses standard essential and analytical cookies to ensure responsive page loading, secure form submissions, and anonymous traffic measurement. You can adjust your browser settings to decline non-essential cookies; however, certain functional aspects of our consultation booking forms may require session cookies to function properly.

7. Cross-Border Data Transfers

When clients reside outside the United Arab Emirates and communicate with our Dubai office, their information is transferred across international borders into the UAE. The United Arab Emirates provides recognized statutory data protection safeguards under Federal Decree-Law No. 45 of 2021.

8. Your Rights as a Data Subject

Under the UAE Personal Data Protection Law, you hold specific statutory rights regarding your personal information:

• Right to Access: Request confirmation of whether your personal data is being processed and obtain a copy of your stored records.
• Right to Rectification: Request the correction of incomplete, inaccurate, or outdated personal documentation.
• Right to Erasure (Right to be Forgotten): Request the deletion of your personal data when it is no longer required for statutory or contractual purposes.
• Right to Restriction: Request the temporary restriction of processing under contested circumstances.
• Right to Object: Object to automated processing or withdraw consent for marketing communications.

9. Data Protection Officer & Inquiries

If you have questions regarding this Privacy Policy or wish to exercise any of your data protection rights, please contact our designated privacy team: