Personal Information Storage Policy

1. Purpose

This Personal Information Storage Policy outlines how PRUVA Acrylic Swimming Pools and Installation Works L.L.C collects, stores, processes, and protects personal information in compliance with UAE data protection laws and international best practices.

2. Types of Personal Information Stored

We store the following types of personal information:

Customer Information

• Full name and contact details
• Email addresses and phone numbers
• Physical and mailing addresses
• Company name and business details (for corporate clients)
• Project specifications and requirements

Transaction Information

• Quotations and project proposals
• Contract details and agreements
• Communication records and correspondence
• Project progress and completion records

Website Usage Information

• IP addresses and device information
• Browser type and operating system
• Pages visited and interaction data
• Cookie data and preferences

3. Storage Location and Infrastructure

Data Storage

Your personal information is stored:

• On secure cloud-based servers with encryption
• In our internal database systems with access controls
• In compliance with UAE data residency requirements
• With regular backups to prevent data loss

Physical Security

• Access to physical storage locations is restricted to authorized personnel only
• Our office premises are secured with access control systems
• Physical documents containing personal information are stored in locked cabinets

4. Data Protection Measures

Technical Safeguards

• Encryption: All personal data is encrypted both in transit and at rest
• Access Controls: Role-based access restrictions ensure only authorized personnel can access information
• Firewalls: Network security measures protect against unauthorized access
• Regular Updates: Security patches and software updates are applied promptly
• Monitoring: Continuous monitoring for suspicious activities and security breaches

Organizational Safeguards

• Employee training on data protection and privacy
• Confidentiality agreements with all staff members
• Regular security audits and assessments
• Incident response procedures for data breaches
• Data minimization principles - we only collect what is necessary

5. Data Retention Period

We retain personal information for the following periods:

• Customer Inquiries: 2 years from last contact
• Active Projects: Duration of project plus 7 years for warranty and legal purposes
• Completed Projects: 7 years from project completion (in accordance with UAE commercial law)
• Financial Records: As required by UAE tax and accounting regulations
• Marketing Contacts: Until consent is withdrawn or 3 years of inactivity

After the retention period expires, personal information is securely deleted or anonymized in accordance with data protection standards.

6. Data Access and Authorization

Who Can Access Your Information

Access to personal information is limited to:

• Authorized employees who need the information to perform their job duties
• Management personnel for business operations and oversight
• IT personnel for system maintenance and security
• Third-party service providers under strict confidentiality agreements

Authorization Levels

• Different access levels are assigned based on job roles and responsibilities
• Access is logged and monitored for compliance
• Regular reviews of access permissions are conducted

7. Third-Party Data Processors

We may engage third-party service providers to process personal information on our behalf, including:

• Cloud hosting and data storage providers
• Email and communication service providers
• Website analytics and performance tools
• Customer relationship management (CRM) systems

All third-party processors are carefully selected and required to maintain appropriate security standards and comply with data protection laws.

8. Data Breach Response

In the event of a data breach affecting your personal information:

• We will investigate the incident immediately
• We will take steps to contain and remediate the breach
• We will notify affected individuals within 72 hours when required
• We will report the breach to relevant authorities as required by law
• We will implement measures to prevent future occurrences

9. Your Rights Regarding Stored Information

You have the following rights concerning your stored personal information:

• Right to Access: Request a copy of the personal information we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete information
• Right to Erasure: Request deletion of your personal information (subject to legal obligations)
• Right to Restriction: Request limitation of processing in certain circumstances
• Right to Data Portability: Receive your personal information in a structured, commonly used format
• Right to Object: Object to processing of your personal information for certain purposes

To exercise any of these rights, please contact us using the information provided below.

10. International Data Transfers

If we transfer your personal information outside the UAE, we ensure that appropriate safeguards are in place, such as:

• Standard contractual clauses approved by relevant authorities
• Transfers to countries with adequate data protection laws
• Binding corporate rules for intra-group transfers

11. Regular Review and Updates

This policy is reviewed and updated regularly to ensure compliance with changing laws and best practices. We will notify you of any significant changes that affect how we store and protect your personal information.

12. Compliance

Our personal information storage practices comply with:

• UAE Federal Law on Data Protection
• Dubai International Financial Centre (DIFC) Data Protection Law
• General Data Protection Regulation (GDPR) principles where applicable
• Industry-specific standards and best practices

13. Contact Information

For questions or concerns about how we store your personal information, or to exercise your rights, please contact us: