Samimi Documents Clearing Services (“Samimi DCS”, “we”, “us”), Dubai, United Arab Emirates, is the controller of the personal data processed through samimidcs.com (the “Website”). This policy explains what we collect, why, and the rights you have under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”).
1. What we collect
- Contact form: your name, email address, phone number (optional), the service you are asking about and your message.
- Account registration: your name, email address, mobile number with country code, and a password (stored only as a cryptographic hash — we never see or keep the password itself). A one-time verification code is emailed to you and stored only as a hash until it expires.
- Security data: the network address of requests, used solely for abuse prevention — rate limiting, temporary blocking of misbehaving addresses, and a security log of sign-in activity.
- Analytics: we use two kinds. Our own measurement is first-party and anonymous: we count page views using a salted daily hash of technical request details, which cannot be reversed into your identity, and it sets no cookie. In addition, we offer Google Analytics 4 — only if you accept it. We ask on your first visit, nothing is loaded until you agree, and declining costs you nothing: the site behaves identically. If you accept, Google Analytics sets its own cookies and sends technical details of your visit — pages viewed, approximate location derived from your network address, device and browser type, and how you arrived — to Google. It does not log or store your network address. We use no advertising pixels and run no advertising or remarketing features, and we do not sell or share this data for advertising.
2. Why we process it (legal bases under the PDPL)
- To answer you and provide our services — performance of a contract or steps taken at your request.
- To operate your account — performance of a contract; email verification also protects you against impersonation.
- To keep the Website safe — our legitimate interest in preventing fraud, flooding and unauthorised access.
- To meet legal obligations under UAE law, including responding to lawful requests from competent authorities.
3. Cookies
None of the cookies below are used for advertising or cross-site tracking.
Strictly necessary:
- samimi_member — keeps you signed in to your account; expires after at most 24 hours.
- samimi_session — used only by site administrators for the management panel; expires after at most 6 hours.
Analytics, set by Google Analytics 4 — only after you have accepted them:
- _ga and _ga_<id> — distinguish one visitor from another so visits can be counted; they expire after up to two years.
You are asked before any analytics cookie is set, and you can decline. To change your mind later, clear this site's data in your browser and the question will be asked again. You can also refuse at any time without losing access to any part of the Website: use your browser's cookie controls, or install Google's opt-out add-on at tools.google.com/dlpage/gaoptout. Browsers that send a “Do Not Track” or global privacy signal are respected where the browser enforces it.
4. Who we share data with
We do not sell or rent personal data. It is shared only with:
- Service providers that make the Website work — Cloudflare (network security and content delivery), Google (Google Analytics 4, which measures how the Website is used) and our email delivery provider (to send you verification codes and replies). They process data on our instructions.
- Transfers outside the UAE. Google Analytics may process the data described in section 1 on servers outside the United Arab Emirates. Where that happens, the transfer relies on the safeguards permitted by the PDPL for recipients subject to appropriate contractual protections, under Google's data processing terms.
- Government authorities, when you engage us to submit an application on your behalf, or where disclosure is required by UAE law.
5. How long we keep it
- Contact messages: for as long as needed to handle your inquiry and for our business records.
- Account data: for as long as your account exists. You may ask us to delete your account at any time.
- Documents you attach to a request: 30 days. Files you upload — such as a passport copy or a form — are deleted automatically 30 days after you send them, and the deletion is carried out by the Website itself rather than by hand. Your request and its messages remain, and will note that a file was sent and when it was removed. Attached files are excluded from our off-site backups for the same reason, so that nothing outlives the 30 days. Please send us a document only when we ask for it, and keep your own copy.
- Verification codes: at most 10 minutes; security logs and rate-limiting records: kept briefly and cleared on a rolling basis.
6. How we protect it
All traffic to the Website is encrypted (HTTPS). Passwords are stored only as strong one-way hashes, verification codes are hashed and short-lived, administrative access is restricted and logged, and the Website sits behind network-level filtering with strict rate limits and automatic blocking of abusive addresses. Documents you attach to a request are held outside the public part of the Website: they have no web address, cannot be reached by guessing a link, and are released only to you and to our staff after we have confirmed who is asking.
7. Your rights under the PDPL
Subject to the conditions in the PDPL, you have the right to:
- ask for access to the personal data we hold about you, and receive a copy;
- ask us to correct inaccurate data or complete incomplete data;
- ask us to delete your data or restrict its processing;
- object to processing, including any processing for direct marketing (we do none);
- ask for your data in a portable, machine-readable format;
- withdraw consent where processing is based on consent, without affecting prior processing;
- lodge a complaint with the UAE Data Office if you believe your rights have been infringed.
To exercise any of these rights, reach us through the contact page. We will respond within the timeframes the PDPL requires.
8. International transfers
Where data passes through infrastructure outside the UAE (for example our content delivery network or email provider), we rely on the transfer mechanisms permitted by Articles 22 and 23 of the PDPL, including transfers to jurisdictions with adequate protection or under appropriate contractual safeguards.
9. Children
The Website and our services are directed at adults. We do not knowingly collect personal data from anyone under 18.
10. Changes to this policy
We may update this policy from time to time; the date at the top shows the latest revision. Significant changes will be highlighted on the Website.
11. Contact us
For anything related to your personal data — questions, requests or complaints — contact us through the contact page, by email or by phone using the details published there.
