Last updated: 19 May 2026.
Note: This privacy notice describes how Khamas Innovations handles personal data on this website. It should be reviewed by qualified legal counsel before being treated as final, particularly with respect to the EU/UK GDPR, the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and any other jurisdictions you operate in.
Who we are
Khamas Innovations FZCO is a management consulting and innovation firm registered in the United Arab Emirates with offices in Jumeirah Lake Towers, Dubai, United Arab Emirates, and operations in Denmark and the wider European Union. References below to “we”, “us” and “our” mean that entity. The data controller for this website is Khamas Innovations.
If you have any questions about this notice or your personal data, contact us at admin@khamasinnovations.com.
What information we collect
Information you provide directly
When you contact us via the website form or by email, we collect the information you choose to share — typically your name, email address, organization, area of interest, and the content of your message.
Information collected automatically
- Server logs — IP address, browser and device characteristics, the pages you view, the referring URL, and access timestamps. Retained for a limited period for security and operational purposes.
- Cookies and similar technologies — see the dedicated section below.
Information collected by third-party tools
- Google reCAPTCHA v3 — to protect the contact form against automated abuse. Google may collect hardware and software information (including device, application data, mouse movements, keystrokes patterns, and time on page) and uses it for the purpose of providing, maintaining and improving reCAPTCHA. This processing is described in Google’s Privacy Policy and is subject to the Google Terms of Service.
- Google Analytics 4 (GA4) — to understand how visitors use the site. We use Google Consent Mode v2: analytics cookies and identifiers are only set after you grant consent through our cookie banner. Until you grant consent, GA4 does not store cookies and only sends anonymous, cookieless signals.
Sub-processors and locations
We use the following sub-processors to deliver this site and our communications. Where personal data is transferred outside the EEA or the UAE, we rely on appropriate safeguards as described under “International data transfers” below.
- Google LLC — Google Analytics 4, reCAPTCHA, and Gmail outbound. Processing in the US with EU/UK transfers; safeguarded by Standard Contractual Clauses and the EU-US Data Privacy Framework.
- Microsoft Corporation — Microsoft 365 mailbox. Processing in the US and EU; safeguarded by Standard Contractual Clauses and the EU-US Data Privacy Framework.
- Simply.com — website hosting. Processing in Denmark; data remains within the EEA.
We update this list when we add or change providers. The most current version is published on this page.
Cookies and similar technologies
We classify cookies into the following categories. You can review and change your choices at any time via the cookie settings link in the banner.
- Necessary — required for the site to function (e.g. consent record, session). Cannot be switched off.
- Functional — remember choices you make to provide enhanced functionality.
- Performance — measure and improve site performance (anonymised).
- Analytics — Google Analytics 4. Only active after consent.
- Advertisement — currently not in use; reserved for future advertising features. Only active after consent.
- Others — uncategorised cookies that don’t fit the above categories.
We do not currently respond to “Do Not Track” browser signals. You can control which cookies are set on your device at any time via the cookie banner on this site.
Why we use it (lawful bases)
- To respond to your enquiry — necessary to take steps at your request before entering into a contract (GDPR Art. 6(1)(b)) and our legitimate interest in conducting our business (Art. 6(1)(f)).
- To run, secure and improve the website — our legitimate interest in operating a functional, secure website (Art. 6(1)(f)).
- To set non-essential cookies and run analytics — your consent (Art. 6(1)(a)), withdrawable at any time.
- To comply with legal and regulatory obligations — Art. 6(1)(c).
How long we keep it
- Contact-form submissions and related correspondence — for as long as necessary to handle your request and any subsequent client relationship; if no engagement results, typically up to 24 months from last contact.
- Server logs — typically 30 days, longer where required for security investigation.
- Analytics data (Google Analytics 4) — default user-level retention of 14 months. Aggregated reports may be retained longer.
- Cookie consent record — up to 12 months, after which the banner reappears.
Who we share it with
We do not sell personal data. We use a small number of trusted service providers to operate the site, each bound by appropriate confidentiality and data-protection terms:
- Hosting provider — operates the web server and infrastructure.
- Google LLC — for Google Analytics 4, Google reCAPTCHA, and Gmail (used as our outbound mail relay for replies to enquiries). Google’s processing is described in their Privacy Policy.
- Microsoft Corporation — our primary mailbox (admin@khamasinnovations.com) is hosted on Microsoft 365.
- Professional advisors and authorities — e.g. legal, accounting, regulators, where required by law.
International data transfers
Some of our service providers (notably Google and Microsoft) are based outside the EEA and the UAE. Where personal data is transferred internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, the EU-US Data Privacy Framework, or other valid transfer mechanisms.
Your rights
Depending on where you live, you may have the following rights regarding your personal data:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure — ask us to delete your data, subject to legal retention obligations.
- Restriction — ask us to limit how we use your data while a query is being resolved.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on our legitimate interests.
- Withdraw consent — for any processing that relies on your consent (e.g. analytics cookies). Use the cookie banner at any time.
- Complaint — lodge a complaint with your local data protection authority. In Denmark this is Datatilsynet; in the UAE it is the UAE Data Office.
To exercise any of these rights, email admin@khamasinnovations.com. We will respond within one month, or sooner where required by applicable law.
Before responding to a rights request, we may need to verify your identity using reasonable means (for example, by confirming the email address on file or asking for additional information). We may extend our response time by up to two further months for complex or numerous requests, and will notify you of any extension within the first month. We may refuse or charge a reasonable fee for requests that are manifestly unfounded, excessive or repetitive; in such cases we will explain our reasoning and your right to complain to a supervisory authority.
We do not engage in automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.
Marketing communications
We will only send you marketing communications about our services where we have a lawful basis to do so (typically your prior consent, or our legitimate interest in contacting an existing business contact). You can opt out at any time by clicking the unsubscribe link in any marketing email or by emailing admin@khamasinnovations.com. Opting out of marketing does not affect service-related communications relating to an active enquiry or engagement.
Security
We apply commercially reasonable technical and organizational measures to protect personal data, including:
- TLS/HTTPS encryption for data in transit.
- Access controls and multi-factor authentication on administrative accounts.
- Encrypted backups and segregated production environments.
- reCAPTCHA on the contact form to mitigate automated abuse.
- Periodic review of access privileges and provider security posture.
No system is perfectly secure. You acknowledge that you transmit information to us at your own risk and that we cannot guarantee absolute security of any data transmitted over the internet.
Personal data breach notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it (where required under GDPR Art. 33 and the UAE Personal Data Protection Law) and will notify affected individuals without undue delay where required under GDPR Art. 34.
Children
This site is not directed at children. We do not knowingly collect personal data from anyone under the age of 18. Where we process the personal data of an individual under the age of 21 in the United Arab Emirates, we will only do so with the verifiable consent of a parent or legal guardian. If you believe a child has provided us with personal data, please contact admin@khamasinnovations.com and we will delete it.
Notice to California residents
If you are a California resident, you have additional rights under the California Consumer Privacy Act (as amended by the CPRA):
- The right to know what personal information we have collected about you and how we use it.
- The right to request deletion of your personal information, subject to legal exemptions.
- The right to correct inaccurate personal information.
- The right to opt out of the “sale” or “sharing” of personal information — we do not sell or share personal information for cross-context behavioural advertising.
- The right to limit the use of sensitive personal information — we do not collect sensitive personal information for purposes that would trigger this right.
- The right not to be discriminated against for exercising any of these rights.
To exercise any of these rights, email admin@khamasinnovations.com with the subject line “California privacy request”.
Changes to this notice
We may update this notice from time to time. The “Last updated” date at the top reflects the most recent revision. Material changes will be communicated via the site itself.
Contact
Khamas Innovations
Jumeirah Lake Towers, Dubai, United Arab Emirates
Email: admin@khamasinnovations.com