Privacy Policy & Data Protection Notice

Last updated: 18 May 2026

This Privacy Policy & Data Protection Notice is designed for enterprise procurement review. It describes how Arkan Legal Translation collects, processes, secures, retains, and discloses personal data in connection with interpretation, certified translation, and attestation routing services. For the governing data-processing addendum (DPA) and mutual non-disclosure agreement (NDA), see the Enterprise Resources page.

1. Controller Details

The controller responsible for personal data processed in connection with the services offered at arkancertifiedtranslation.ae is:

• Legal entity: Arkan Legal Translation (sole establishment under E-Tajer framework)
• Trade brand: Arkan Interpreters & Translators
• Dubai DED trade licence: #1333628
• Dubai Unified Licence (DUL): CJ9803 - verify at investindubai.gov.ae
• MOJ Licence: #701 (Khaled Mohamed Abdeltawab Aladl) - Arabic ↔ English scope
• Registered offices: The One Tower, Office 1302, Barsha Heights, Dubai · Tower Plaza Hotel, Office 1204B, Sheikh Zayed Road, Dubai
• Email: info@arkanlegaltranslation.ae
• WhatsApp: +971 50 709 1633
• Verify hotline: 800 333333

A designated privacy contact handles data-subject requests, lawful-basis assessments, and breach-notification coordination. Reach the privacy contact by writing to info@arkanlegaltranslation.ae with the subject line "Privacy request" or "Data subject request"; messages with these subject lines are routed for prompt handling.

2. Legal Basis under UAE PDPL

Personal data is processed in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL"). The lawful bases recognised under Article 4 of the PDPL are:

1. Consent of the data subject;
2. Performance of a contract to which the data subject is a party, or pre-contractual steps at the data subject's request;
3. Compliance with a legal obligation imposed on the controller;
4. Protection of the data subject's vital interests;
5. Performance of a task carried out in the public interest;
6. Legitimate interests of the controller or a third party, balanced against the rights of the data subject.

The bases that ordinarily apply to our work are contract performance (translating documents you submit, issuing certified copies, invoicing), legal obligation (MOJ ledger duties, anti-money-laundering checks where applicable, tax record-keeping), and legitimate interests (network security, fraud prevention, service-quality monitoring, and limited analytics - see Section 13). Where we rely on consent (for example, marketing communications), you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

3. Categories of Data Collected

• Contact information: name, employer/organisation, email address, telephone and WhatsApp numbers, postal address, role.
• Document contents submitted for translation: this is the central category. Source documents may contain special-category data including data revealing legal proceedings, criminal records, court judgments, medical conditions, financial statements, biometric identifiers, photographs, government identification documents (passport, Emirates ID, residence visa), family-status data (marriage/divorce/birth/death certificates), academic records, employment data, and similar personal data of the data subject and of third parties named in those documents.
• Payment data: we do not store full card numbers. Payment instruments are processed by a third-party PCI-DSS-compliant payment processor; we retain transaction references, invoice records, and tax records as required by UAE law.
• Communications: WhatsApp messages, email correspondence, call logs, and in-office intake notes related to your project.
• Technical and cookie data: IP address, browser type, device identifiers, pages visited, referring URL, and similar telemetry collected by the analytics provider described in Section 13.

4. Purpose Limitation - How Each Category Is Used

• Contact information - to quote, confirm, deliver, invoice, follow up on, and provide support for the requested service; to send transactional notifications; and (with consent) to send marketing updates.
• Document contents - to produce the translation, perform quality assurance, attach the MOJ certification stamp, and retain the certified copy in the MOJ-licensed translator's ledger as required by law. Document contents are not used for any purpose other than performing the service and complying with statutory retention.
• Payment data - to process the payment, issue tax invoices, and meet UAE Federal Tax Authority record-keeping obligations.
• Communications - to coordinate the project, evidence instructions, and resolve disputes.
• Technical and cookie data - to keep the site secure and to measure aggregate site usage. We do not sell or share this data with advertising networks.

5. Document Confidentiality and Chain of Custody

Document confidentiality is the cornerstone of the service. The following controls apply to every file accepted for translation:

• Per-project access-controlled folders. Each project is stored in a dedicated folder accessible only to personnel assigned to it. Folder access is logged.
• Role-based access. Permissions follow the chain admin → assigned translator → QA reviewer → certified (MOJ-licensed) translator who signs and stamps the final output. Personnel outside this chain do not receive access to the file.
• Encryption at rest and in transit. All storage is encrypted at rest. Web traffic uses TLS 1.2 or higher. Backups are stored on encrypted cloud infrastructure.
• Subcontractor file handling. Where a project requires a contracted MOJ-licensed translator (for language pairs outside the in-house Arabic ↔ English scope), that translator signs an NDA of equivalent scope to in-house staff before the file is released to them. Where no UAE MOJ translator exists for a given language pair, the translation is performed under Arkan company certification (DUL #CJ9803) by vetted translators bound by NDA; any subcontracting beyond the in-house team is identifiable to the client on request.
• Document destruction. The default retention period for project working files is 30 days after delivery, after which working copies are securely deleted. Extended retention is available only on the client's written request (some enterprise clients require this for audit trails). On enterprise contracts a secure-deletion certificate can be issued on file destruction.
• MOJ-mandated retention. The MOJ-licensed translator must retain a stamped copy of every certified translation in their professional ledger for the period required by the Ministry of Justice. This statutory copy is held under the same access controls described above and is not used for any purpose other than statutory retention and verification of authenticity.

6. Subcontractors and Sub-Processors

We engage the following categories of sub-processors:

• Contracted MOJ-licensed translators by language pair, where the in-house translator is not licensed for that pair;
• PCI-DSS-compliant payment processor for card and online payments;
• Cloud storage provider for encrypted project storage and backups;
• Communications platforms (WhatsApp Business, email) for client communication.

The named list of current sub-processors, including the legal name of each provider, is available to enterprise clients under NDA on written request. Material changes to the named sub-processor list will be notified to enterprise contract holders in line with the contractually-agreed change-notification period.

7. International Data Transfers

Arkan Legal Translation operates from the United Arab Emirates and processing ordinarily takes place in the UAE. Where a contracted translator is located outside the UAE (this is rare and limited to language pairs for which UAE-resident specialists are unavailable), the client is informed before any transfer of personal data takes place. Cross-border transfers are made only where the destination has been recognised as providing an adequate level of protection or where appropriate safeguards (such as standard contractual clauses) have been put in place, in accordance with Articles 22 and 23 of the UAE PDPL.

8. Data Subject Rights under UAE PDPL

Subject to the conditions and limitations set out in Articles 13–19 of the PDPL, you have the following rights with respect to your personal data:

• Right of access - to obtain confirmation of whether we process your data and, if so, a copy of that data and information about the processing (Article 13).
• Right to rectification - to have inaccurate data corrected and incomplete data completed (Article 14).
• Right to erasure - to have your data deleted where the data is no longer necessary for the purposes for which it was collected, where you withdraw consent and there is no other lawful basis, or where the data has been processed unlawfully (Article 15). Erasure may be restricted where retention is required by law, including the MOJ ledger duty and UAE tax record-keeping obligations.
• Right to restriction - to require that processing be restricted in defined circumstances (Article 16).
• Right to portability - to receive a structured, commonly-used and machine-readable copy of data you have provided to us (Article 17).
• Right to object - to object to processing carried out on the basis of our legitimate interests (Article 18).
• Right to withdraw consent - at any time, where processing is based on consent, without affecting the lawfulness of prior processing (Article 19).
• Right to lodge a complaint - with the UAE Data Office in accordance with the PDPL and its executive regulations.

Requests are handled by the designated privacy contact. We aim to respond within the timeframes set out in the PDPL and may need to verify your identity before acting on a request.

9. Retention Schedule

10. Security Measures

• Transport security: TLS 1.2 or higher for web and API traffic.
• Storage security: encrypted storage on hardened cloud infrastructure, with encrypted backups.
• Access control: per-project folders, role-based permissions, and access logging.
• People controls: binding NDAs for every staff member and every contracted translator before any file is released to them.
• WhatsApp intake: end-to-end encrypted; appropriate for routine documents. For higher-sensitivity files, Arkan agrees the intake channel with the client before work begins - options may include the client's secure upload system, encrypted email, a controlled cloud folder, or in-office delivery, with the agreed channel documented in the SOW.
• Physical custody: documents delivered in hard copy are accepted only at the registered offices; on enterprise contract a chain-of-custody log is maintained from intake to destruction.
• Incident response: in the event of a personal-data breach likely to result in a risk to the rights of data subjects, we will notify affected data subjects and, where required, the UAE Data Office, without undue delay in accordance with the PDPL.

No security control is absolute. The controls listed above are designed to be appropriate to the nature of the data we handle and to the procurement expectations of enterprise legal and corporate clients.

11. Children's Data

Our services are directed at adults (typically legal and corporate clients, individual professionals, and persons handling their own personal documents). We do not knowingly market to children under 18. Where a parent or legal guardian submits a minor's document - for example, a school transcript or birth certificate - that minor's personal data is processed under the same protections as any other data subject's, and rights under the PDPL are exercisable by the parent or legal guardian.

12. Related Sites and Single Controller

OnlineTranslation.ae is a related digital storefront of the same legal entity (Arkan Legal Translation, DED #1333628). Clients who engage with us via arkancertifiedtranslation.ae are governed by this Privacy Policy. The same controller responsibility applies regardless of the brand or domain through which you enter. Sister-site privacy notices may differ in presentation but the controller, the lawful bases, and the rights described here remain the same.

13. Cookies and Analytics

This site uses two categories of cookies and similar technologies:

• Essential cookies - required for the site to function (session management, security, preference storage). These cannot be switched off.
• Analytics cookies - used to understand aggregate site usage. Analytics is delivered through the Ahrefs analytics tag, loaded via a Partytown web-worker so it does not delay the main thread or read your DOM directly. The tag collects aggregate session data and does not collect document contents.

You can control cookies through your browser settings; blocking analytics cookies will not impair core site functionality.

14. Updates to This Policy

This Policy is versioned by the "Last updated" date at the top. Material changes - changes that affect lawful bases, sub-processor categories, retention, security controls, or data-subject rights - will be notified to enterprise contract holders in line with the contractually-agreed change-notification period and published on this page in advance of taking effect.

15. Contact for Data Subject Requests

To exercise any of the rights described in Section 8, or to make any other enquiry about the processing of your personal data, contact us:

• Email (designated privacy contact): info@arkanlegaltranslation.ae - use subject line "Privacy request" or "Data subject request"
• WhatsApp: +971 50 709 1633
• Postal: Arkan Legal Translation, The One Tower, Office 1302, Barsha Heights, Dubai, UAE