Privacy Policy

Legal Basis for Processing Personal Data

We process personal data based on the following lawful grounds under the PDPL: (a) Consent: You provide explicit consent for specific data processing activities when you register and use the Platform; (b) Contractual Necessity: Processing is necessary to perform our contract with you and provide Platform services; (c) Legal Obligation: Processing is required to comply with applicable UAE laws and regulations; (d) Legitimate Interests: Processing is necessary for our legitimate business interests, such as fraud prevention, security, and platform improvement, provided such interests do not override your fundamental rights and freedoms. You have the right to withdraw consent at any time, though this may limit your ability to use certain Platform features.

Information Collection

1. Identity and Account Data: We collect name, email address, phone number, password (encrypted), profile photograph, date of birth, nationality, Emirates ID number and documentation, passport number and documentation, and UAE Pass authentication data and credentials.
2. Employer Data: For Employer accounts, we collect company name, trade name, company description, business address and location, business license number and documentation, commercial registration details, tax registration information, authorized representative details, industry classification, company size, and company logo.
3. Cookies and Tracking Technologies: We use cookies, web beacons, pixels, and similar tracking technologies to enhance user experience, remember preferences and settings, authenticate users and maintain sessions, analyze Platform usage and performance, track marketing campaign effectiveness, and provide personalized content. Users can control cookie preferences through browser settings, though disabling cookies may limit Platform functionality. We use both session cookies (temporary) and persistent cookies (stored on your device).
4. Sensitive Personal Data: We may collect and process sensitive personal data (special categories of data under the PDPL) where necessary for Platform operation and with appropriate safeguards, including: Emirates ID information (containing biometric data and religious affiliation), nationality and ethnicity data, and profile photographs (potentially revealing ethnic origin or religious affiliation). We process sensitive personal data only where: (a) you have provided explicit consent; (b) processing is necessary to comply with legal obligations; or (c) processing is necessary for the establishment, exercise, or defense of legal claims. We implement enhanced security measures for sensitive personal data and limit access to authorized personnel only.

Use of Information

We use personal data for the following purposes: (a) to operate, maintain, and provide Platform services and features; (b) to process user registrations and create and manage accounts; (c) to verify user identities and conduct know-your-customer (KYC) checks; (d) to facilitate connections between Employers and Workers; (e) to enable job posting, searching, and application processes; (f) to generate, execute, and store Work Contracts between parties; (g) to facilitate digital signatures through UAE Pass or Platform tools; (h) to process payments, hold funds, and execute payouts; (i) to enable messaging and communication between Users; (j) to administer reviews and ratings; (k) to provide customer support and respond to inquiries; (l) to investigate and resolve disputes between Users; (m) to detect, prevent, and address fraud, security threats, and illegal activities; (n) to enforce these Terms and comply with legal obligations; (o) to analyze Platform usage and improve services; (p) to personalize user experience and provide relevant content; (q) to send transactional communications, notifications, and Platform updates; (r) to conduct research and analytics; and (s) to fulfill any other purposes disclosed at the time of data collection or with your consent.

We also use personal data to comply with applicable UAE laws and regulations, including labor law, immigration law, tax law, anti-money laundering regulations, and data protection requirements. We may use data to respond to legal requests, court orders, or government inquiries, and to establish, exercise, or defend legal claims.

Disclosure of Information

We may share personal data with the following categories of third parties: (a) Between Users: We share relevant information between Employers and Workers to facilitate work connections, including profile information, contact details, job posting details, and Work Contract information; (b) Service Providers: We share data with third-party service providers who perform services on our behalf, including UAE Pass for authentication and identity verification, Stripe and NowPayments for payment processing, cloud hosting providers for data storage, email and SMS service providers for communications, customer support platform providers, analytics and performance monitoring tools, security and fraud prevention services, and legal and professional advisors; (c) Business Transfers: We may share data in connection with a merger, acquisition, reorganization, sale of assets, or bankruptcy proceeding; (d) Legal Authorities: We may disclose data to law enforcement, regulatory authorities, courts, or other government agencies when required by law, in response to legal process, to comply with legal obligations, to protect our rights and property, to ensure Platform security, or to prevent illegal activities; (e) With Consent: We may share data with other third parties when you provide specific consent for such sharing.

All third-party service providers are contractually required to maintain appropriate security measures and process personal data only for specified purposes in accordance with our instructions and applicable data protection laws.

Data Security

We implement reasonable technical, administrative, and physical security measures designed to protect personal data from unauthorized access, disclosure, alteration, or destruction. Security measures include: encryption of data in transit and at rest, secure socket layer (SSL) technology for data transmission, access controls and authentication mechanisms, regular security assessments and vulnerability testing, employee training on data protection and security practices, incident response and breach notification procedures, and secure data backup and recovery systems. However, no method of transmission over the Internet or electronic storage is completely secure. While we strive to protect personal data, we cannot guarantee absolute security. Users are responsible for maintaining the security of their account credentials and should immediately report any suspected security breaches.

Data Retention

We retain personal data for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include: (a) Account Data: Retained while your account is active and for a period following account closure as required for legal compliance and business purposes; (b) Transaction Records: Retained for seven (7) years or as required by UAE tax and financial regulations; (c) Work Contracts: Retained for the duration required by applicable labor law and for potential legal claims; (d) Communications and Messages: Retained while accounts are active and for a reasonable period thereafter for dispute resolution purposes; (e) Identity Verification Documents: Retained in accordance with UAE anti-money laundering and KYC requirements; (f) Technical and Usage Data: Generally retained for shorter periods for analytics and security purposes. Following the applicable retention period, personal data will be securely deleted or anonymized. Users may request earlier deletion of certain data subject to legal and contractual obligations.

User Rights

Under the PDPL and this Policy, you have the following rights regarding your personal data: (a) Right of Access: You may request confirmation of whether we process your personal data and obtain a copy of your personal data; (b) Right to Rectification: You may request correction of inaccurate or incomplete personal data; (c) Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where processing is unlawful (subject to legal retention obligations); (d) Right to Restrict Processing: You may request limitation of processing in certain circumstances; (e) Right to Data Portability: You may request to receive your personal data in a structured, commonly used, and machine-readable format and have it transmitted to another controller where technically feasible; (f) Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes; (g) Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time (though this may affect your ability to use certain Platform features); (h) Right to Lodge a Complaint: You may lodge a complaint with the UAE Data Protection Authority if you believe your rights have been violated.

To exercise any of these rights, please contact us using the contact information provided at the end of this Policy. We will respond to your request within the timeframe required by the PDPL (generally within thirty (30) days). We may require verification of your identity before processing requests. Certain requests may be subject to legal or contractual limitations. You may also access, update, or delete certain account information directly through your Platform account settings.

International Data Transfers

Personal data may be transferred to, stored, and processed in countries outside the United Arab Emirates, including by third-party service providers located in other jurisdictions. We ensure that international data transfers comply with the PDPL by: (a) transferring data only to countries that provide an adequate level of data protection as determined by the UAE Cabinet or Data Protection Authority; (b) implementing appropriate contractual safeguards, such as standard contractual clauses; (c) ensuring third-party recipients maintain appropriate security measures and data protection standards; and (d) obtaining your explicit consent where required. By using the Platform, you acknowledge and consent to the transfer of your personal data outside the UAE subject to these safeguards.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the UAE Data Protection Authority without undue delay and, where required by law, within seventy-two (72) hours of becoming aware of the breach. Where the breach poses a high risk to your rights and freedoms, we will also notify affected individuals without undue delay. Breach notifications will include the nature of the breach, categories and approximate number of affected individuals and records, likely consequences of the breach, measures taken or proposed to address the breach, and contact information for further inquiries. We maintain an incident response plan to detect, respond to, and mitigate data breaches.

Contact Information

For questions, concerns, or requests regarding this Privacy Policy, personal data processing, or exercise of your data protection rights, please contact us at:

Smart Mehan LLC

United Arab Emirates

Data Protection Officer

Email: Support@mehan.ae

You also have the right to lodge a complaint with the UAE Data Protection Authority (Office of Data Privacy Protection) regarding our processing of your personal data.