Guide
Privacy Policy
How consultzone.ae treats your privacy, written from the site's own code rather than from a template.
Reading consultzone.ae tells us nothing about you beyond what the request for a page has to carry. The site sets no cookies for readers, runs no analytics, advertising or tracking scripts, and serves its typeface and images from its own server. Nearly everything it collects, you type into a form and send on purpose.
This page was written from the site's code, not adapted from a template. It replaces the policy dated 4 September 2023, which described accounts, purchases and a cookies policy this site does not have. We, us and our mean ConsultZone; you means anyone who uses this site.
ConsultZone controls this data, and one address reaches the people who handle it
This website is operated by ConsultZone, a business setup and corporate services consultancy at International Business Tower, Office 1710, Al Amal Street, Business Bay, Dubai. Under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, the UAE's federal data protection law, ConsultZone is the controller of the personal data this site collects — the party that decides why and how it is processed — and this page is written to that law.
Any question, request or complaint about your personal data goes to info@consultzone.ae or to either direct line, +971 56 411 0920 or +971 56 515 5115. No form is needed.
Reading this site sends us nothing but the request for the page
Each time you open a page, this site's server receives your IP address, the details your browser sends about itself and the page's address, because no server can answer a request without them. The site's own code keeps no record of those visits. The company that hosts the server may keep technical logs, as web hosts generally do.
Nothing watches you read. No analytics, advertising or tracking scripts load, and the security policy the site sends tells your browser to refuse scripts from other websites and to stop any script sending data to one.
Nothing is borrowed from other servers. The typeface and every image come from this site, and WordPress's emoji script, which on some browsers fetches images from WordPress.org, has been removed.
Nothing asks you to join. There is no comment form, no account and no newsletter. Searches are not saved, though like any search they appear in the page address.
Only the footer map contacts another company without a click from you
Every page's footer carries an embedded Google map of the office, set to load as you near it — on a short page, straight away. When it loads, Google receives your IP address, your browser's details and the address of the page, and may read or set its own cookies, depending on your browser settings, under Google's own privacy policy. The map frame carries a referrer setting of its own, so the address Google receives is the full address of the page you are reading and not merely the name of this site — the one place where that happens. The site's settings stop the map, and everything else on the page, from asking for your location, camera or microphone.
Everything else involving another company waits for your click:
- the WhatsApp links in the header, the footer and the floating button open WhatsApp with a short greeting already written, and nothing you typed here goes with it;
- the share buttons on articles, guides, service pages and free zone profiles hand the page's address, and for WhatsApp its title, to LinkedIn or WhatsApp;
- our LinkedIn, Instagram, Facebook and X profiles are plain links, and no social button, feed or pixel loads by itself;
- Get directions opens Google Maps, and the phone numbers and email address open your own apps.
Any site you reach from a link here learns only that you came from consultzone.ae, not which page.
The consultation form asks for seven things, and needs only two of them
Most pages — service pages, articles, the free zone profiles and the Contact page — carry the same consultation form. It asks for:
- your full name, which is required;
- a phone number, which is required;
- an email address;
- your country of residence;
- what you need, from a list of nine services;
- the business activity you have in mind;
- anything else worth knowing.
The homepage popup asks only for your name, phone number, email address and what you intend to do.
Five things travel with your answers without being typed: the page you sent them from, which form it was, the date and time, and, added by the server, your IP address and your browser's identification string. There is no file upload, and nothing asks about identity documents, finances or health; the free-text box is not the place for them.
Every submission is saved here first, then copied to at most two other places
When you press the button, the site checks the page's security token, runs the spam checks below, then sends the submission on in a fixed order. The order matters, because the first step is the only one that cannot be skipped.
- A private enquiry record in this site's own database — always, and first. It holds everything you typed, the page you sent it from, which form it was and the date and time, and, added by the server rather than typed by you, your IP address and your browser's identification string. Nothing else is attempted until that record exists. If it cannot be written, the site tells you to call instead and sends nothing anywhere.
- The advisory team's mailbox, straight after the record is saved. The message carries everything you typed, the page and the form. It does not carry your IP address or your browser's identification string. Whether it was accepted for delivery is noted on the record.
- Zoho CRM, the firm's customer relationship system, last — and only if the firm has connected this site to its Zoho account. Zoho receives your name, split into a first and a last name, your email address, your phone number and your country, and a short description repeating the service, the activity, your message, the page and the form. It receives no IP address and no browser identification. Whether Zoho accepted the enquiry, and the error it returned if it did not, is noted on the record.
Neither of the last two steps can lose an enquiry. If the email or the CRM step fails, the record has already been written and the failure is filed beside it, so the enquiry can be picked up by hand rather than disappearing quietly.
The record is private. It cannot be reached from the public site, its search or its feeds, and only an administrator signed in to the site can open it: the enquiry type hands every one of its permissions to the administrator's, and refuses to let anyone create an enquiry by hand at all. The email's reply address is the one you gave, with characters that could slip a second address in behind your name stripped out. The CRM receives the enquiry from this site's server, not your browser, over an encrypted connection.
Spam is stopped by a hidden field and a counter, not by a third-party puzzle
There is no CAPTCHA, so no outside verification service watches you fill in the form. Two checks do the job instead.
The first is a field people never see and automated programs tend to fill in. A submission that arrives with it filled is thanked and then discarded: nothing is stored, emailed or sent. If you ever send the form and hear nothing back, call.
The second is a counter. After five submissions from one IP address in close succession, the site refuses more for an hour and asks you to call instead. The count is filed under a hash, a scrambled form of your IP address, and expires an hour after the last submission. A hash of an IP address can be matched back to the address, so we treat it as personal data too. Failed attempts to sign in to the site's administration are counted the same way, for fifteen minutes.
The security token is part of the page, not a cookie. A page left open for a very long time may ask you to reload it.
One homepage form hands your details to WhatsApp, not to this site
The form in the homepage section headed Tell us what you intend to build — the one the Free Consultation button at the top of every page leads to — does not follow that route.
Its button opens WhatsApp in a new window with a message already written from what you typed: your name, phone number, email address, the service you chose and anything in the last box. The country and activity you entered are left out. Nothing is stored on this site, emailed or passed to the CRM, and we receive the message only if you send it, to +971 56 515 5115.
Because the message travels inside the link, WhatsApp, which Meta operates, can receive what you typed as soon as the link opens, whether or not you then press send. If you would rather avoid that, use the form on the Contact page or the homepage popup.
The site sets no cookies, and its one note in your browser names nobody
This site sets no cookies for anyone reading it. WordPress sets its standard cookies only on the sign-in page and for people who sign in to manage the site.
Your browser keeps one note for this site, in session storage rather than as a cookie. After you send an enquiry through the homepage popup, the site stores an entry named czPopupConverted with the value 1, so that the popup does not open again while that tab stays open. It holds nothing about you, is never sent to our server, and is deleted when you close the tab. Closing the popup without sending anything is not recorded, so it can open again on your next visit to the homepage.
An enquiry is used to answer it, and it is never sold
What you send is used to reply and, if you want one, to prepare advice or a proposal; to keep a record of what you asked and what we told you; to keep that record verifiable and to spot misuse of the form, which is what the stored IP address and browser identification are for; and, if the enquiry becomes client work, to meet the legal duties that come with it, including the anti-money-laundering rules the firm is subject to.
It is not sold, and it is not passed to anyone for their own marketing. An enquiry puts you on no mailing list, and nothing on the site decides anything about you automatically beyond the spam checks.
The federal law prohibits processing personal data without consent, then lists the cases in which processing is lawful without it. Those cases include processing needed to take steps towards a contract at your request, which is what an enquiry asks for, and processing needed to meet obligations that other UAE laws place on the firm.
Outside ConsultZone, your enquiry reaches only the services that carry it
The site sends every enquiry to the same record and the same inbox, whichever service you pick. Beyond the firm, your data reaches the company that hosts the site and its database; the email service that carries the notification and holds the advisory team's mailbox; Zoho, if the CRM connection is switched on; WhatsApp, only if you choose to use it; Google, when the map loads; and any authority entitled to it by law, such as a regulator or a court.
Some of these services may hold data outside the UAE, depending on the provider and the firm's account with it. The federal law lets personal data leave the country only in the cases it sets out: to a country with data protection legislation of the kind it describes, or one covered by an agreement the UAE has joined, in cases the regulator approves; or in listed cases that include a contract binding a recipient in a country without such a law to its standards, your express consent, and a transfer needed to enter into or carry out a contract with you.
How long an enquiry is kept depends on whether it becomes client work
The federal law does not allow personal data to be kept once its purpose has been fulfilled, unless it has been anonymised so it can no longer be linked to you.
An enquiry record, with its copies in the advisory team's mailbox and in the CRM, is kept for as long as it is needed to respond to you and to meet legal record-keeping obligations. If the enquiry becomes client work, it joins a client file, and the anti-money-laundering rules the firm is subject to decide how long that file is kept.
Ask us to delete an enquiry and we will, unless it has become a record we are required to keep — in which case we will say so, rather than keep it quietly.
Federal law gives you rights over this data, and most start with one email
Federal Decree-Law No. 45 of 2021 gives the person the data is about the rights below, summarised as the law states them. Each carries conditions and exceptions, and the law leaves further procedure to executive regulations; where it does, this page does not guess at the detail.
- To know. On request and without charge: what types of your data are processed and why, any automated decisions about you, who it is shared with inside or outside the UAE, the standards for how long it is kept, how to correct, erase or restrict it or object, the protections for processing outside the UAE, the steps taken in a breach, and how to complain. A controller may refuse only in limited cases, such as a request that is excessively repetitive or would affect other people's privacy.
- To correct. Inaccurate data corrected or completed, without undue delay.
- To erase. Where the data is no longer needed, you withdraw the consent it depended on, you object and there is no legitimate reason to continue, or it was processed unlawfully. The law excludes, among others, a request that would affect investigations or legal proceedings, or one that conflicts with other legislation the firm is subject to; anti-money-laundering record-keeping is the obvious example.
- To restrict. While you dispute its accuracy and it is checked, or where it is processed outside the agreed purposes or unlawfully.
- To object and stop. Processing for direct marketing, for statistical surveys unless the public interest requires them, or in breach of the law's processing controls.
- To take your data with you. A structured, machine-readable copy of data you provided, where processing rests on your consent or a contractual obligation and is automated, and its transfer to another controller where technically feasible.
- To challenge automated decisions that have legal consequences for you or affect you seriously. This site makes none.
- To complain to the UAE Data Office, the federal regulator the law names, under the procedures that office sets. Check the UAE government portal, u.ae, for the current way to file.
For any of the first seven, write to info@consultzone.ae or call, saying what you want and which enquiry it concerns.
No website is breach-proof, and this one is built to expose little
These measures sit in the site's code, so they can be described rather than promised. Your browser is told to use only an encrypted connection with this site, for two years at a time, and to load nothing into its pages from any other service except Google, for the map, and Zoho, for the CRM. No other website can frame these pages to trick you into clicking. Staff account names are withheld from the site's public feeds and archives, the old remote-publishing interface is switched off, the site's code cannot be edited from its dashboard, and uploads that could run as code are refused.
None of that makes a breach impossible. If a breach ever threatened the privacy, confidentiality or security of your data, the law requires the firm to report it to the Data Office and to tell you, within periods and procedures its executive regulations are to set.
Some of your dealings with us fall under other documents, not this one
This page covers the website. Once you are a client, your file, including the identity documents and ownership details the anti-money-laundering rules require, is handled under your engagement documents and those rules. On finvisors.ae or any site linked from here, that site's policy applies. On WhatsApp, LinkedIn or another platform, the platform's terms govern what it does with the conversation. Staff, suppliers and job applicants are covered by other arrangements. And if a child has sent us an enquiry, a parent or guardian can ask us to delete it; the site is written for adults making business decisions.
The terms on which you may use the site itself are in the Terms of Use.
A revision replaces this page, and its date moves with it
A revised policy replaces this one here and takes effect on publication, and the date shown with the page moves with it. Nobody is told individually, so the version on this page is the one that applies.
International Business Tower, Office 1710, Al Amal Street, Business Bay, Dubai +971 56 411 0920 · +971 56 515 5115 · info@consultzone.ae
Frequently asked questions about this site and your data
Does reading a page here set a cookie?
No. This site sets no cookies for anyone reading it, and no analytics, advertising or tracking script loads. WordPress sets its standard cookies only on the sign-in page and for people who sign in to manage the site. Your browser does keep one note for this site, in session storage rather than as a cookie: after you send an enquiry through the homepage popup, an entry named czPopupConverted with the value 1 stops the popup opening again while that tab stays open. It holds nothing about you, is never sent to our server, and is deleted when you close the tab.
Does anything on the page reach another company before I click?
One thing does. The Google map embedded in the footer loads as you near it, and on a short page straight away. When it loads, Google receives your IP address, your browser's details and the full address of the page you are reading, and may read or set its own cookies, under Google's own privacy policy. Everything else waits for your click: the WhatsApp links, the share buttons, the social profiles, Get directions, the phone numbers and the email address.
What does the consultation form collect that I do not type?
Five things travel with your answers: the page you sent them from, which form it was, the date and time, and, added by the server, your IP address and your browser's identification string. Of the seven things the form asks for, only your full name and a phone number are required. There is no file upload, and nothing asks about identity documents, finances or health.
Where does a submission go, and in what order?
A private enquiry record in this site's own database first, always, and before anything else is attempted. Then the advisory team's mailbox, which receives everything you typed but neither your IP address nor your browser's identification string. Then Zoho CRM, last, and only if the firm has connected this site to its Zoho account; it too receives no IP address and no browser identification. A failure at either of the last two steps is filed beside the record, so the enquiry can be picked up by hand rather than disappearing quietly. The record cannot be reached from the public site, its search or its feeds, and only an administrator signed in to the site can open it.
Why is there no CAPTCHA?
Because two checks do the job without an outside verification service watching you fill in the form. The first is a field people never see and automated programs tend to fill in; a submission that arrives with it filled is discarded, and nothing is stored, emailed or sent. The second is a counter: after five submissions from one IP address in close succession, the site refuses more for an hour and asks you to call instead. That count is filed under a hash of the address and expires an hour after the last submission, and because a hash can be matched back to the address we treat it as personal data too.
Does the form on the homepage work the same way?
No. The form in the homepage section headed Tell us what you intend to build opens WhatsApp with a message already written from what you typed — your name, phone number, email address, the service you chose and anything in the last box, leaving out the country and the activity. Nothing is stored on this site, emailed or passed to the CRM. Because the message travels inside the link, WhatsApp can receive what you typed as soon as the link opens, whether or not you then press send. Use the form on the Contact page or the homepage popup if you would rather avoid that.
Questions about anything on this page? Contact ConsultZone
