Effective Date: 1 April 2025
Last Reviewed: April 2025
Jurisdiction: United Arab Emirates
Governing Law: UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL)

1. Introduction and Scope

JUR (hereinafter “JUR”, “the Firm”, “we”, “us”, or “our”) is a licensed law firm established in the Emirate of Dubai, United Arab Emirates, operating under the regulatory authority of the Dubai Legal Affairs Department. JUR provides legal and advisory services across onshore UAE, the Dubai International Financial Centre (DIFC), and the Abu Dhabi Global Market (ADGM).

This Privacy Policy (the “Policy”) governs the collection, processing, storage, disclosure, and deletion of personal data by JUR in connection with: (i) your use of JUR’s website located at jur.ae (the “Website”); (ii) any engagement, inquiry, or instruction provided to JUR in a professional capacity; and (iii) any other interaction between you and JUR, whether digital, written, or in person.

This Policy is issued in compliance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“PDPL”) and its implementing regulations, as may be amended from time to time. Where JUR processes data in connection with matters before the DIFC Courts or under DIFC jurisdiction, the DIFC Data Protection Law (DIFC Law No. 5 of 2020, as amended) may also apply.

By accessing the Website or engaging JUR in any capacity, you acknowledge that you have read, understood, and accepted the terms of this Policy. If you do not accept these terms, you must immediately cease use of the Website and must not provide personal data to JUR.

2. Data Controller

For the purposes of applicable UAE data protection legislation, JUR acts as the data controller in respect of personal data processed through the Website and in the context of professional engagements. Contact information for data-related matters is as follows:

  • Email: info@jur.ae
  • Telephone: +971 50 327 3454

3. Categories of Personal Data Collected

JUR may collect and process the following categories of personal data:

3.1 Data Provided Directly by You

  • Full name, title, and professional designation
  • Contact information including email address, telephone number, and postal address
  • Corporate or organisational affiliation
  • Nature of the legal matter or enquiry submitted
  • Any additional information voluntarily provided in correspondence, intake forms, or consultations
  • Identity documentation where required for client onboarding, AML/KYC compliance, or regulatory purposes

3.2 Data Collected Automatically

When you access or interact with the Website, JUR and its authorised third-party service providers may automatically collect certain technical and behavioural data, including but not limited to:

  • Internet Protocol (IP) address and approximate geolocation derived therefrom
  • Browser type, version, and operating system
  • Device identifiers and hardware characteristics
  • Referring URL and exit pages
  • Pages visited, time spent on pages, and clickstream data
  • Date and time of access
  • Cookie identifiers and session data (see Section 8)

3.3 Data Received from Third Parties

JUR may receive personal data about you from third parties in circumstances where lawfully permitted, including from referring parties, counterparties in legal proceedings, public registries, credit reference agencies, government authorities, or other professional advisors acting in connection with a matter on which JUR is instructed.

4. Legal Basis for Processing

JUR processes personal data on one or more of the following legal bases, as applicable under the PDPL and relevant UAE law:

  • Contractual necessity: Processing required to perform legal services pursuant to a client engagement or retainer agreement.
  • Legal obligation: Processing required to comply with UAE law, including anti-money laundering (AML) obligations under Federal Decree-Law No. 20 of 2018, KYC requirements, court orders, regulatory directions, or mandatory reporting obligations.
  • Legitimate interests: Processing necessary for the legitimate interests of JUR, including the operation and security of the Website, management of professional relationships, maintenance of business records, and pursuit or defence of legal claims.
  • Consent: Where JUR relies on your express consent, such as for the receipt of marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.
  • Vital interests or public task: In exceptional circumstances where processing is necessary to protect the vital interests of an individual or to perform a task in the public interest.

5. Purposes of Processing

JUR processes personal data for the following purposes:

  • Responding to enquiries and providing information about JUR’s services
  • Conducting conflict-of-interest checks prior to and during an engagement
  • Client onboarding, identity verification, and AML/KYC compliance
  • Provision of legal advice, representation, and related professional services
  • Administration of billing, invoicing, and financial records
  • Compliance with court orders, regulatory requirements, and applicable law
  • Operation, maintenance, and improvement of the Website
  • Website analytics, traffic monitoring, and user experience optimisation
  • Security monitoring, fraud prevention, and protection of JUR’s IT systems and assets
  • Sending legal updates, newsletters, and marketing communications where consent has been obtained or where a legitimate interest applies
  • Establishment, exercise, or defence of legal claims

6. Website Tracking and Analytics

The Website employs tracking technologies including web analytics platforms such as Google Analytics (operated by Google LLC), and may additionally employ equivalent or supplementary analytics services, session recording tools, heatmapping software, and server-side logging. Google Analytics collects data including IP addresses, browser type, device information, pages visited, session duration, and referral sources. This data is processed by Google LLC and may be stored on servers outside the UAE. JUR uses this data in aggregate and pseudonymous form to improve Website performance and user experience. You may opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on available at tools.google.com/dlpage/gaoptout.

The Website may further employ the following categories of third-party tracking tools, as updated from time to time:

  • Social media pixels, including but not limited to Meta Pixel (Facebook/Instagram), LinkedIn Insight Tag, and equivalent technologies, which collect data about your interactions with the Website for the purposes of audience measurement, remarketing, and conversion tracking. Each such platform operates under its own privacy framework and data processing terms.
  • Google Tag Manager, used to manage and deploy tracking scripts on the Website without direct code modification.
  • Remarketing and behavioural advertising tools that enable JUR to display targeted content to prior Website visitors across third-party platforms.

JUR further reserves the right to use pixel tags, web beacons, and similar tracking mechanisms embedded in email communications to determine whether such communications have been opened and to track click-through rates. This data is processed on the basis of JUR’s legitimate interest in measuring communication effectiveness.

You acknowledge that by accessing the Website, certain data will be collected automatically as described in this Policy and in Section 8 (Cookies). JUR shall bear no liability for data collected by third-party analytics or advertising platforms operating under their own privacy frameworks, provided that JUR has taken reasonable steps to ensure such processors operate in compliance with applicable law.

7. Disclosure of Personal Data

JUR does not sell, rent, or trade personal data. JUR may disclose personal data to the following categories of recipients, strictly on a need-to-know basis:

  • Members, partners, associates, and authorised staff of JUR with a direct professional need
  • Barristers, co-counsel, expert witnesses, translators, and other professional advisors engaged in connection with a specific matter
  • Courts, tribunals, arbitral bodies, regulatory authorities, and government agencies, whether in the UAE or internationally, where required by law, court order, or enforceable demand
  • Third-party service providers acting as data processors on behalf of JUR, including IT infrastructure providers, document management platforms, case management software vendors, and communications service providers, subject to appropriate data processing agreements
  • Counterparties in transactions or disputes where disclosure is necessary for the conduct of the matter and where permitted by professional conduct rules
  • Any successor entity in the event of a merger, acquisition, restructuring, or transfer of JUR’s practice or any part thereof

Where disclosure is required by a competent authority or by operation of law, JUR shall comply with such requirements and shall not be liable for any consequences arising from such mandated disclosure, to the fullest extent permitted by applicable law.

8. Cookies and Similar Technologies

The Website uses cookies and similar tracking technologies. Cookies are small text files stored on your device by your browser when you visit a website. JUR uses the following categories of cookies:

  • Strictly necessary cookies: Essential for the functioning of the Website. These cannot be disabled without impairing core Website functionality.
  • Performance and analytics cookies: Used to collect statistical data about how visitors use the Website, including traffic sources and page-level engagement. This includes Google Analytics and may include other third-party analytics services.
  • Functional cookies: Used to remember your preferences and settings to enhance your experience on return visits.
  • Marketing and targeting cookies: Used to deliver relevant content and, where applicable, to measure the effectiveness of marketing campaigns via tools including Meta Pixel, LinkedIn Insight Tag, and Google Ads. These are only placed with your consent where required by applicable law.

You may manage or disable cookies through your browser settings. Please note that disabling certain cookies may limit the functionality of the Website. JUR accepts no responsibility for the cookies or tracking practices of any third-party websites accessible via links on the Website.

9. International Data Transfers

JUR operates primarily within the UAE. However, in the course of providing legal services or operating its business, personal data may be transferred to, stored in, or processed in jurisdictions outside the UAE, including in connection with the use of Google Analytics, Meta platforms, LinkedIn, and other third-party services whose servers may be located in the United States, the European Union, or elsewhere. Where such transfers occur, JUR will take reasonable steps to ensure that appropriate safeguards are in place in accordance with the PDPL and applicable UAE regulatory guidance.

By engaging JUR or using the Website, you acknowledge and consent to the potential transfer of your personal data to jurisdictions that may have different data protection frameworks to those applicable in the UAE. JUR shall take commercially reasonable steps to ensure appropriate protections, but cannot guarantee that foreign authorities will not seek access to personal data in accordance with their own legal powers.

10. Data Retention

JUR retains personal data for as long as is necessary to fulfil the purposes described in this Policy, to comply with applicable legal and regulatory obligations, to resolve disputes, and to enforce agreements. The following general retention periods apply:

  • Client matter files and associated correspondence: Minimum ten (10) years from the date of closure of the relevant matter.
  • AML/KYC documentation: Minimum five (5) years from the end of the business relationship, as required by Federal Decree-Law No. 20 of 2018.
  • Financial and accounting records: Minimum five (5) years in accordance with UAE commercial law requirements.
  • Website analytics and log data: Up to twenty-four (24) months from collection.
  • Marketing communication data: Until withdrawal of consent or upon a valid objection, following which data will be suppressed rather than deleted where required to give effect to the opt-out.

Upon expiry of the applicable retention period, personal data will be securely deleted, anonymised, or rendered inaccessible, unless its continued retention is required by law, regulatory direction, court order, or ongoing legal proceedings.

11. Data Subject Rights

Subject to the conditions, limitations, and exceptions set out in the PDPL and applicable UAE law, you may have certain rights in respect of your personal data. JUR’s obligations in this regard are governed exclusively by UAE law, and no broader rights are conferred by this Policy. The following rights may be available to you:

  • Right of access: The right to request confirmation of whether JUR processes personal data about you and to receive a copy of such data, subject to applicable exemptions.
  • Right to rectification: The right to request correction of inaccurate or incomplete personal data.
  • Right to erasure: The right to request deletion of personal data in certain circumstances, subject to JUR’s overriding legal, regulatory, and professional obligations.
  • Right to restriction: The right to request that JUR restrict processing of your personal data in specific circumstances.
  • Right to object: The right to object to processing based on legitimate interests.
  • Right to withdraw consent: Where processing is based on consent, the right to withdraw consent at any time without affecting the lawfulness of prior processing.

11.1 Important Limitations on Data Subject Rights

JUR expressly reserves the right to decline, defer, or partially fulfil any data subject request in the following circumstances:

  • Where complying with the request would require disclosure of information subject to legal professional privilege or professional secrecy obligations under UAE law or the rules of the Dubai Legal Affairs Department, DIFC Authority, or ADGM Registration Authority.
  • Where retention is required by law, court order, or regulatory mandate, including without limitation AML/KYC record-keeping requirements.
  • Where the request is manifestly unfounded, excessive, or repetitive, in which case JUR reserves the right to charge a reasonable administrative fee or to refuse the request.
  • Where complying with the request would prejudice the establishment, exercise, or defence of legal claims.
  • Where JUR determines, in its reasonable discretion, that providing the requested data would adversely affect the rights, freedoms, or legitimate interests of third parties.

JUR does not guarantee response to data subject requests within any particular timeframe and shall endeavour to respond within a reasonable period as required by applicable UAE law. JUR shall bear no liability for delays or failures to respond where such delays or failures result from circumstances outside JUR’s reasonable control, or where the applicable legal framework does not impose a mandatory response obligation.

To submit a data subject request, you must contact JUR in writing at info@jur.ae and provide sufficient information to allow JUR to verify your identity and locate the relevant personal data. JUR is not obliged to respond to requests submitted through any other channel. JUR reserves the right to request additional identity verification before processing any request and to decline requests where identity cannot be satisfactorily established.

12. Data Security

JUR implements technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Such measures include, without limitation, access controls, encryption in transit and at rest where appropriate, network security protocols, and staff training on data protection obligations.

Notwithstanding the foregoing, no method of data transmission over the internet or electronic storage is entirely secure. JUR does not warrant or guarantee the absolute security of personal data and shall not be liable for unauthorised access, breaches, or losses that occur despite JUR having implemented reasonable security measures. The transmission of data to JUR via the Website or email is at your own risk.

13. Third-Party Websites and Services

The Website may contain hyperlinks to third-party websites, platforms, or services that are not operated or controlled by JUR. This Policy does not apply to such third-party websites. JUR accepts no responsibility for the privacy practices, data collection, or content of any third-party site. You access such third-party sites entirely at your own risk and are advised to review the applicable privacy policies of those sites.

14. Limitation of Liability

To the fullest extent permitted by applicable UAE law, JUR, its partners, associates, employees, and agents shall not be liable for any direct, indirect, incidental, special, consequential, or exemplary damages arising out of or in connection with:

  • Any unauthorised access to or alteration of your personal data, unless directly attributable to JUR’s gross negligence or wilful misconduct
  • Any failure or delay in responding to a data subject request, whether or not such failure or delay is attributable to circumstances within JUR’s control
  • Any processing of personal data by third-party platforms, processors, or services operating independently of JUR
  • Any loss, damage, or harm arising from your use of or inability to use the Website
  • Any reliance on information contained on the Website, which is provided for general informational purposes only and does not constitute legal advice
  • Any mandatory disclosure of personal data made pursuant to a court order, regulatory direction, or applicable law

Where liability cannot be excluded by law, JUR’s aggregate liability to you in connection with this Policy shall not exceed the amount, if any, paid by you to JUR in the twelve (12) months preceding the event giving rise to the claim, or AED 1,000, whichever is the lesser. Nothing in this Policy excludes or limits liability for death or personal injury caused by JUR’s negligence or for fraud or fraudulent misrepresentation.

15. Legal Professional Privilege and Confidentiality

Personal data processed by JUR in the context of a professional legal engagement is subject to legal professional privilege and the duty of confidentiality owed by JUR to its clients under UAE law and the applicable professional conduct rules of the Dubai Legal Affairs Department, the DIFC, and the ADGM. Nothing in this Policy shall be construed to waive, limit, or otherwise diminish legal professional privilege or professional confidentiality obligations. Where there is a conflict between this Policy and JUR’s duties of professional confidentiality, such duties shall take precedence.

16. Children’s Data

The Website is not directed at, and JUR does not knowingly collect personal data from, individuals under the age of eighteen (18). If JUR becomes aware that personal data has been collected from a minor without appropriate parental or guardian consent, JUR will take steps to delete such data. JUR bears no responsibility for personal data submitted by or on behalf of minors without JUR’s knowledge.

17. Amendments to this Policy

JUR reserves the right to amend, update, or replace this Policy at any time, with or without prior notice, by publishing the revised Policy on the Website with a new effective date. Your continued use of the Website or continued engagement with JUR following the publication of any amendments constitutes your acceptance of the revised Policy. You are advised to review this Policy periodically. JUR is under no obligation to notify you of any changes to this Policy, whether by email or otherwise.

18. Governing Law and Dispute Resolution

This Policy is governed by and construed in accordance with the laws of the United Arab Emirates, including the PDPL and applicable federal and emirate-level legislation. Any dispute arising out of or in connection with this Policy, including any question regarding its existence, validity, interpretation, or termination, shall be subject to the exclusive jurisdiction of the courts of the Emirate of Dubai, unless the subject matter relates to matters within the jurisdiction of the DIFC Courts or the ADGM Courts, in which case the jurisdiction of such courts shall apply as appropriate.

19. Contact and Complaints

If you have questions or concerns regarding this Policy or JUR’s data processing activities, you may contact JUR as follows:

  • Email: info@jur.ae
  • Telephone: +971 50 327 3454
  • Operating hours: Monday to Saturday, 9:00 AM to 6:00 PM (GST)

If you are dissatisfied with JUR’s response, you may have the right to lodge a complaint with the competent supervisory authority under applicable UAE law. JUR accepts no liability in connection with any complaint, investigation, or enforcement action by any regulatory authority arising from your use of the Website or JUR’s data processing activities.