Privacy
policy.
7 August 2026
UAE PDPL 45 of 2021
GDPR, for the EU/EEA
privacy@padesign.com
Four things
before the detail.
We collect very little
We do not sell data
You can ask what we hold
Two studios, two regimes
Sixteen clauses,
no hidden ones.
Who is responsible for your data
P+A Design L.L.C. is the data controller for the personal data collected through this website. Our head office is at Office 2nd Floor, Lamar Building, Al Nahyan Camp, Abu Dhabi, United Arab Emirates, and we also operate a studio at Via Roma 19, Cortina d’Ampezzo (BL), Italy.
Data protection enquiries: privacy@padesign.com. REPLACE THIS SENTENCE with the name and contact details of a Data Protection Officer if one has been appointed.
The law this policy follows
Processing carried out from the United Arab Emirates follows Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”), which came into force on 2 January 2022, together with any Executive Regulations issued under it and any guidance published by the UAE Data Office established under Federal Decree-Law No. 44 of 2021. Where Executive Regulations are issued after the date of this policy, we will align this policy with them.
Where we process the personal data of individuals in the European Union or European Economic Area — including through the Cortina d’Ampezzo studio — Regulation (EU) 2016/679 (the “GDPR”) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 also apply, and clause 12 sets out the additional rights that follow.
What we collect
When you send an enquiry. Your name, email address, telephone number if you give one, the location of the site, the type of project, the stage it has reached and whatever you write in the message field.
When you subscribe to Insights. Your name and email address.
When you become a client. The information needed to run and document a project — contact details, correspondence, site and plot information, title and ownership documents where an authority submission requires them, and the commercial terms of the appointment.
Automatically, when you browse. Standard technical data logged by our hosting: IP address, browser and device type, referring page, pages viewed and time of visit. Where analytics or embedded content such as a map are used, cookies and similar technologies may collect further usage data — see clause 6.
We do not ask for and do not want sensitive personal data through this website. Please do not send passport copies, Emirates ID copies, health information or financial account details through the enquiry form.
Why we use it, and on what basis
To answer your enquiry and prepare a proposal. Basis: your consent, and steps taken at your request before entering into a contract.
To deliver a project once appointed. Basis: performance of the contract between us.
To make authority submissions. Basis: performance of the contract, and compliance with a legal obligation where the authority requires the information.
To send you Insights articles. Basis: your consent, withdrawn at any time by using the unsubscribe link.
To keep the website secure and understand how it is used. Basis: our legitimate interest in running and improving the site, balanced against your rights.
To keep records required by law and by professional practice. Basis: compliance with a legal obligation, and the establishment or defence of legal claims.
Marketing
We send an Insights email only to people who have asked for it. There is no weekly digest and no automated marketing sequence. Every email carries a one-click unsubscribe, and unsubscribing removes you from the list rather than suppressing you within it.
We do not use your data for advertising and we do not share it with advertising networks.
Cookies and similar technologies
This site uses cookies that are strictly necessary for it to work, and may use analytics cookies to count visits and understand which pages are read. Embedded third-party content — for example a Google map on the contact page — may set its own cookies once it loads.
You can block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop parts of the site from working. Where consent is required for non-essential cookies, we ask for it before those cookies are set.
Who we share it with
Service providers acting on our instructions. Website hosting, email, form delivery, newsletter delivery, cloud storage and IT support. They process data only for us and under an agreement that requires appropriate security.
Project consultants and contractors. Where a project needs a specialist input, and only the data needed for that input.
Government authorities. Submissions for a live project may require your information to be given to the competent authority — for example the Department of Municipalities and Transport, Abu Dhabi Distribution Company, Civil Defence, or the Estidama programme — and to any regulator, court or law enforcement body entitled to it.
Professional advisers. Auditors, insurers and lawyers, where necessary.
We never sell, rent or trade personal data.
Transfers outside the UAE
We operate from Abu Dhabi and from Cortina d’Ampezzo, and some of our service providers are outside the United Arab Emirates. Your personal data may therefore be transferred to and stored in another country.
Under the PDPL, personal data may be transferred outside the UAE to a jurisdiction with an adequate level of protection, or otherwise on the basis of an appropriate contract, your explicit consent, or another lawful ground. Where personal data moves from the EU or EEA to the UAE, we rely on the European Commission’s Standard Contractual Clauses together with the additional measures those clauses require.
Health data is held and processed in accordance with the specific restrictions that UAE law places on it. We do not routinely process health data through this website.
How long we keep it
Enquiries that do not become projects: up to twenty-four (24) months from the last contact, then deleted.
Newsletter subscribers: until you unsubscribe.
Project records: for the period required by UAE law, by the terms of the appointment and by our professional indemnity cover, and in any event for as long as a claim relating to the project can still be brought.
Website technical logs: a rolling period, normally not more than twelve (12) months.
When a retention period ends we delete the data or irreversibly anonymise it.
How we protect it
The site is served over an encrypted connection. Access to enquiry and project data is limited to the people in the studio who need it, accounts are individually held, and our service providers are chosen on the basis that they can meet appropriate security standards.
No transmission over the internet is completely secure. If a personal data breach occurs that is likely to prejudice your privacy or confidentiality, we will notify the competent authority and, where required, notify you, in accordance with the PDPL and, where it applies, the GDPR.
Your rights under the PDPL
You may ask us to: confirm what personal data we hold about you and why, and give you a copy; give you the data in a structured, machine-readable format, or send it to another controller, where the processing is based on your consent or on a contract; correct data that is inaccurate or incomplete; delete data that is no longer needed for the purpose it was collected for; restrict or stop processing that is not in line with the stated purpose or with the law; and object to a decision produced solely by automated processing that has a legal effect on you.
We do not make decisions about you by automated means and we do not profile visitors to this site.
We answer within one (1) month of receiving a request, which may be extended by a further two (2) months where a request is complex — if it is, we will tell you within the first month. There is no charge unless a request is manifestly excessive or repetitive.
To exercise any of these rights, write to privacy@padesign.com.
Additional rights for visitors in the EU and EEA
If you are in the European Union or European Economic Area, the GDPR gives you the rights above and, in addition, the right to withdraw consent at any time without affecting processing already carried out, the right to object to processing based on our legitimate interests, and the right to lodge a complaint with a supervisory authority.
For the Cortina d’Ampezzo studio the supervisory authority is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, Italy.
Children
This website is intended for adults and for professional audiences. We do not knowingly collect personal data from anyone under eighteen (18). If you believe a child has sent us personal data, write to us and we will delete it.
Complaints
If you are not satisfied with how we have handled your personal data, tell us first at privacy@padesign.com so that we can put it right.
You may also complain to the UAE Data Office, the federal data protection regulator established under Federal Decree-Law No. 44 of 2021, or — if you are in the EU or EEA — to your local supervisory authority.
Changes to this policy
We update this policy when our processing changes and when the Executive Regulations to the PDPL or related guidance are issued. The date at the top of this page shows when it was last changed. Material changes affecting how we use data you have already given us will be notified to you directly where we hold a contact address for you.
Contact
Data protection: privacy@padesign.com
General enquiries: info@padesign.com
Telephone: +971 XX XXX XXXX
P+A Design L.L.C., Office 2nd Floor, Lamar Building, Al Nahyan Camp, Abu Dhabi, United Arab Emirates
Three requests,
one address.
Ask what we hold
Write to privacy@padesign.com with your name and the email address you used. We reply within one month.
Correct or delete it
Same address. Tell us what is wrong, or what you want removed and why. Where a live authority submission depends on the data we will tell you what we are required to keep and for how long.
Stop the emails
Use the unsubscribe link at the bottom of any Insights email, or write to us. It takes effect immediately and we do not send a confirmation sequence.