Privacy Policy
Last updated October 2026 · v2.0.3
Who we are
mestaria.com is operated by Mestaria Consultancy L.L.C, licensed by Dubai's Department of Economy and Tourism under licence 1121786, in Dubai, United Arab Emirates. We're the controller of the personal data described in this policy. We handle it in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where they apply to you, other data protection laws such as the GDPR and UK GDPR. For any question about it, email privacy@mestaria.com.
What this policy covers
This policy covers personal data collected through mestaria.com: the contact form, the mailing list, sign-in to private pages, and the technical data that comes with any visit. It doesn't cover our client work, which our engagement terms deal with, or other Mestaria sites, which have their own policies.
Before you send us anything
Please don't send confidential or sensitive information, or details about other people, through the contact form until we've confirmed we can help. For legal matters in particular, we need to check for conflicts of interest first.
What we collect and why
| Activity | What we collect | Why | Basis |
|---|---|---|---|
| Contact form | Name, email address and message. Optional: company, role, phone number, LinkedIn profile, how you heard about us, an attachment | To route your enquiry to the right person and reply | Steps you've asked us to take |
| Mailing list | Email address and the topics you choose | To send the updates you signed up for | Your consent, which you can withdraw at any time |
| Private pages | Name and email address, received from Google if you sign in with it | To check you're on the approved list and keep you signed in | To give you the access you've asked for |
| Any visit | IP address, browser and device details, pages requested and when | To deliver the site securely, keep spam and abuse off it, and fix errors | Necessary to provide the site you're using, securely |
These are the bases the UAE law recognises. Where the GDPR or UK GDPR applies to you, our basis for site and security data is our legitimate interest in running the site securely.
We don't use your data for advertising or profiling, and we don't sell it.
Who sees it
We use these service providers to run the site. Each sees only what it needs to do its job:
- A database host, to store form submissions and mailing list entries.
- An email delivery service, to send our replies and mailing list emails.
- A hosting and security provider, to host the site, store form attachments, keep spam off the form, control sign-in to private pages and keep request logs.
- Our email provider, to host the mailboxes where enquiries arrive.
If you sign in with Google, Google handles your data under its own privacy terms.
We may also share data with another related business, where your enquiry is meant for it; with our professional advisers; and with authorities where the law requires it. We keep this list up to date.
Where it's processed
We're based in the UAE. Our providers run infrastructure in other countries, including within the European Economic Area, the United Kingdom and the United States. Where data leaves the UAE, we rely on each provider's contractual data protection and security commitments, and send only what the service needs.
How long we keep it
- Contact form submissions and attachments: 24 months from receipt, then deleted. If an enquiry becomes an engagement, our engagement terms apply instead. We may keep a short record of who contacted us and about what for as long as we need it to check conflicts of interest or deal with a claim.
- Mailing list: while you're subscribed. When you unsubscribe, we stop emailing you and keep your email address on a suppression list so we never email you again.
- Private page sign-in: your access ends as soon as it's withdrawn. Sign-in records are kept by our hosting and security provider for a limited period, then deleted.
- Request logs: for a limited period under our providers' standard settings, then deleted.
Your rights
Depending on where you're based, you may have the right to ask what personal data we hold about you and receive a copy, including in a portable format. You may also be able to have it corrected or deleted, and to object to or restrict how we use it. Where we rely on your consent, you can withdraw it at any time; that doesn't affect what we did before.
To use any of these rights, email privacy@mestaria.com. We may need to confirm your identity. We'll respond without undue delay and within the time the law allows.
Complaints
If you're unhappy with how we've handled your data, please tell us first so we can put it right. You can also complain to the competent UAE data protection authority, and if you're in the European Economic Area or the United Kingdom, to your local data protection authority.
Security
We use encryption in transit, access controls and reputable providers to protect your data. No system is completely secure, which is one reason for the request above not to send confidential material before we've confirmed we can help.
Children
The site isn't aimed at anyone under 18, and we don't knowingly collect their personal data.
Cookies
We use no cookies. Our Cookies page explains more.
Changes to this policy
We'll update this policy if what we do changes. The version and date at the top show the latest.