Skip to main content

Privacy Policy

Last updated: 4 November 2026 · Version 3.0 (UAE)

1. Preamble

This privacy policy describes how Practech collects, uses, retains and protects the personal data of visitors to practech.ch/ae, of its prospects and of its clients established in the United Arab Emirates.

Practech undertakes to process your data fairly, lawfully and transparently, in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its executive regulations, under the supervision of the UAE Data Office. Processing carried out from Switzerland also complies with the Swiss Federal Act on Data Protection (nFADP).

2. Data Controller

Practech
Serving Dubai and the UAE · registered seat: Bern, Switzerland
Phone: 0445938553
Email: contact@practech.ch
Publication director: Youness Bitite

Practech is not required to appoint a Data Protection Officer under Article 10 of the PDPL given the nature and scale of its processing. All questions about your data may be addressed directly to the controller at the email address above.

3. Data Collected

Practech only collects data strictly necessary for the provision of its services. The following categories of data may be collected:

  • Identification data: first name, last name, business name, role.
  • Contact data: postal address, email address, phone number.
  • Project data: brief content, description of needs, files transmitted (texts, images, logo, PDF, archives), reference links.
  • Billing data: amounts, payment method (anonymized token provided by Stripe or PayTabs, Practech never stores the card number), any VAT number.
  • Account data: login credentials, hashed password (bcrypt), language preferences.
  • Technical data: IP address, browser type, operating system, pages consulted, timestamp, error log.
  • Cookies and trackers: see the dedicated cookie policy.

No sensitive personal data within the meaning of Article 1 of the PDPL (racial or ethnic origin, political opinions, religious beliefs, criminal records, biometric data, health data, sexual life) is collected by Practech.

4. Processing Purposes and Legal Bases

Your data is processed for the following purposes, on the legal bases provided by the PDPL:

  • Performance of the contract (Article 4(1)(a) PDPL): design, development and delivery of the ordered website, provision of the client area, support by WhatsApp or email.
  • Legal obligation (Article 4(1)(d) PDPL): bookkeeping, invoicing, tax obligations including VAT, retention of commercial records for 5 years (Federal Decree-Law No. 32 of 2021 on Commercial Companies and Federal Decree-Law No. 28 of 2022 on Tax Procedures).
  • Legitimate interest (Article 4(1)(f) PDPL): fraud prevention, website security, anonymised internal statistics, service improvement.
  • Consent (Article 6 PDPL): sending commercial communications, setting non-essential cookies. Consent is free, specific, informed and may be withdrawn at any time.

5. Recipients and Processors

Practech does not sell, rent or transfer your data to third parties for commercial purposes. Your data may however be shared with the following technical processors, bound by a contract meeting Article 8 of the PDPL:

  • Vercel Inc. (United States, with compute regions in Frankfurt and Paris) — website hosting and code execution. Transfer covered by the Standard Contractual Clauses (SCCs) of the European Commission and the EU-US Data Privacy Framework.
  • Supabase Inc. (eu-central-1 region / Frankfurt, Germany) — main database (customer accounts, briefs, files, order history). Data stored in the EEA.
  • Anthropic PBC (United States) — brief analysis and content generation by the Claude model. Briefs are transmitted for one-off processing and are not used for training purposes, in accordance with the Anthropic commercial agreement. Transfer covered by SCCs.
  • Stripe Payments Europe Ltd (Ireland, with Stripe Inc. in the United States) — payment processing for Swiss and European clients.
  • PayTabs (United Arab Emirates / Saudi Arabia) — payment processing for Gulf clients (deployment upcoming).
  • Resend, Inc. (United States) — sending transactional emails. Transfer covered by SCCs.
  • Cloudflare, Inc. (United States) — DNS, anti-DDoS protection, TLS termination.
  • Hostpoint AG (Rapperswil-Jona, Switzerland) — hosting of the contact@practech.ch mailbox. Data stored in Switzerland.

Competent public authorities may also be recipients of your data in the event of a legal obligation.

6. Transfers of data outside the UAE

The processors listed in the previous section are established in Switzerland, the European Union or the United States. Cross-border transfers are governed by Articles 22 and 23 of the PDPL, with the following safeguards:

  • Transfers to countries with an adequate level of protection as determined by the UAE Data Office (including Switzerland and the Member States of the European Union).
  • For other destinations, contractual clauses guaranteeing an equivalent level of protection, supplemented by end-to-end encryption and pseudonymisation.
  • Your express consent where required by law, collected at the time of ordering.

You may obtain a copy of the applicable safeguards by writing to contact@practech.ch.

7. Retention Periods

Your data is retained for the duration strictly necessary for the purpose pursued, increased where applicable by legal retention periods:

  • Invoices and accounting records: 5 years from the end of the financial year (UAE commercial and tax legislation), and up to 10 years where Swiss accounting rules apply.
  • Contract data (briefs, correspondence, deliverables): for the duration of the contractual relationship, then archived for 5 years after the end of the contract for evidentiary purposes.
  • Client account data: as long as the account is active, then deleted 12 months after inactivity or upon request.
  • Support tickets: 3 years after closure.
  • Technical logs: 6 months, except in case of a security incident (12 months maximum).
  • Prospecting data: 3 years from the last contact, unless the data subject objects.
  • Non-essential cookies: 13 months maximum (cf. cookie policy).

8. Your Rights

In accordance with Articles 13 to 18 of the PDPL, you have the following rights over your data at any time:

  • Right of access: obtain confirmation that your data is being processed and receive a copy.
  • Right of rectification: have any inaccurate or incomplete data corrected.
  • Right to erasure ("right to be forgotten"): request the deletion of your data, subject to legal retention obligations.
  • Right to restriction of processing.
  • Right to data portability: receive your data in a structured, commonly used and machine-readable format.
  • Right to object to processing based on legitimate interest or for prospecting purposes.
  • Right to withdraw your consent at any time, without affecting the lawfulness of processing based on prior consent.

To exercise these rights, write to contact@practech.ch or on WhatsApp stating the subject of your request. A reply will be sent within 30 days at the latest. Proof of identity may be requested in case of reasonable doubt about your identity.

If you consider that the processing of your data does not comply with regulations, you have the right to lodge a complaint with the competent supervisory authority:

  • United Arab Emirates: UAE Data Office — uaedataoffice.ae. Clients of DIFC or ADGM entities may also contact the DIFC Commissioner of Data Protection or the ADGM Office of Data Protection.
  • Switzerland: Federal Data Protection and Information Commissioner (FDPIC) — edoeb.admin.ch, for processing carried out from Switzerland.

9. Data Security

Practech implements appropriate technical and organizational measures to ensure the security of your data:

  • Encryption of communications using TLS 1.3 (HTTPS) with automatically renewed certificates.
  • Encryption at rest of databases (AES-256) and of uploaded files.
  • Password hashing using the bcrypt algorithm.
  • HTTP security headers (Content Security Policy, HSTS, X-Frame-Options, Referrer-Policy).
  • Daily encrypted backups with 30-day retention.
  • Access strictly limited to authorised staff, logging of administrative access.
  • Two-factor authentication (2FA) for administration consoles.
  • Documented procedure for notifying personal data breaches to the UAE Data Office and to data subjects as required by Article 9 of the PDPL.

10. Protection of Minors

Practech services are not intended for persons under 18 years of age. Practech does not knowingly collect data about minors. If you believe a minor has provided us with personal data without valid consent from a legal guardian, please inform us at contact@practech.ch so that we can delete it promptly.

11. Cookies and Trackers

The use of cookies and trackers on practech.ch is described in detail in our cookie policy. You may change your choices at any time via the consent banner present at the bottom of the page.

12. Changes to the Policy

Practech reserves the right to amend this policy in order to adapt it to the evolution of its services, legislation or recommendations of supervisory authorities. The applicable version is always the one published on this page, on the date indicated in the header. In the event of substantial modifications, active clients will be informed by email at least 30 days before the new provisions enter into force.

13. Contact

Any question relating to this policy or to your personal data may be addressed to:

Practech
Bern, Suisse
contact@practech.ch
0445938553

See also: legal notice · terms of service · cookie policy.