Privacy Notice

Information We Collect

We collect only personal data that is necessary to operate our business, deliver services, evaluate talent, or respond to enquiries.

This may include contact details, professional information, communications submitted through our website forms, project-related artefacts, and correspondence history. When you submit information via a contact form, the data you provide is collected explicitly for the purpose stated at the time of submission.

With your consent, we collect website usage data through Google Analytics as described in the Cookies & Analytics section below. We do not sell or rent personal data.

Lawful Basis & How We Use Data

Personal data is processed in accordance with the UAE Personal Data Protection Law (PDPL) and applicable regulations.

We process personal data based on one or more of the following lawful bases:

• Your explicit consent
• The performance of a contract or pre-contractual steps
• Compliance with legal or regulatory obligations
• Our legitimate business interests, where these do not override your rights

Data submitted via our contact forms is used to respond to enquiries, provide requested information, and, where relevant, to follow up regarding our services. By submitting a contact form, you acknowledge that we may contact you using the details provided for these purposes.

We do not use contact form submissions for unsolicited marketing unrelated to the original enquiry.

Data Storage, Third Parties & Transfers

Personal data may be stored and processed using trusted third-party service providers acting as data processors on our behalf. This includes providers for cloud infrastructure, communication tools, customer relationship management, and recruitment systems.

All third parties are subject to contractual data protection obligations and are permitted to process personal data only for specified purposes and in accordance with our instructions.

Data may be stored or processed within the UAE, the European Union, or other jurisdictions that provide an adequate level of data protection. Where cross-border transfers occur, appropriate safeguards are applied, including contractual protections and encryption of data in transit and at rest.

Cookies & Analytics

Our website sets optional cookies only with your consent. When you first visit, a consent banner lets you accept, reject, or configure them individually. No analytics or marketing cookies are set before you agree, and rejecting them does not limit your use of the website.

With your consent, we use Google Analytics 4, a web analytics service provided by Google LLC, to understand how visitors use our website and to improve content and performance. Google processes this data on our behalf as a data processor under Google's data processing terms. Analytics data may be processed on Google servers outside the UAE and the European Economic Area; such transfers are protected by contractual safeguards, including the EU Standard Contractual Clauses. Google Analytics 4 does not log or store IP addresses.

You can withdraw or change your consent at any time via the Cookie settings link in the website footer. Withdrawing consent stops analytics collection and removes the analytics cookies set by this website.

The map on our contact page is provided by Google Maps and loads only after you choose to load it. Loading the map connects your browser to Google, which may set its own cookies.

Contact & Communication

If you contact us through our website or other channels, we may use your contact details to respond to your enquiry, provide follow-up information related to your request, and continue professional communication where a legitimate interest exists.

You may opt out of further communications at any time by contacting us or using unsubscribe mechanisms where provided.

Job Applicants & CVs

When you apply for a role through our careers pages, we collect your name, email address, optional phone number, optional LinkedIn profile and location, any note you write to us, and the CV you attach. Your CV is transmitted to our recruitment mailbox and is not stored on this website.

Please include only what is relevant to the role. We do not need, and ask you not to send, a photograph, your date of birth, marital status, nationality, religion, or details of dependants. Where a CV contains such information we do not use it to assess your application.

We process applications to assess you for the role you applied for, which is a step taken at your request prior to entering a contract of employment. If you tick the optional box asking us to keep your CV on file for other roles, that additional retention is based on your consent and you may withdraw it at any time by emailing privacy@trueforge.ae.

Applications are handled using our website host and form endpoint (Netlify), an email transmission provider (Resend), our business email provider (Microsoft 365), and a bot-protection service on the application form (Cloudflare Turnstile). Some of these providers process data outside the UAE; such transfers are covered by standard contractual clauses or an equivalent safeguard.

AI-assisted screening. We use AI tooling to summarise applications and rank them against the published requirements for the role, as an aid to our recruiters. Every shortlisting and rejection decision is made by a person, not by the tool. You may ask us to explain a decision or to review it without AI assistance by emailing privacy@trueforge.ae.

How long we keep applications. If we do not proceed with your application, we tell you and ask whether you would like us to keep your CV on file. If you decline, or do not reply within 14 days, we delete your CV and supporting documents and keep only a minimal record that you applied and when. If you consent, we keep your CV for up to six months from that point and then delete it. The seven-year period described under Retention & Security applies to client engagement records and does not apply to job applications.

Your Rights

In accordance with the UAE PDPL, you have the right to request access to your personal data, request correction of inaccurate or incomplete data, request deletion of your data where legally permissible, withdraw consent where processing is based on consent, and object to or restrict certain processing activities.

Requests can be made by emailing privacy@trueforge.ae. We will respond within the timeframes required by applicable law.

Retention & Security

Personal data is retained only for as long as necessary to fulfil its intended purpose or to comply with legal, contractual, or regulatory obligations. Engagement-related records are typically retained for no longer than seven years unless otherwise required. Job applications are an exception and are kept for much shorter periods; see Job Applicants & CVs above.

We apply appropriate technical and organisational security measures, including access controls, network segmentation, encryption, and continuous monitoring, to protect personal data against unauthorised access, loss, or misuse.