Privacy Policy

Smart Creation Group of Companies (“Smart Creation”, “we”, “our” or “us”) is a U.A.E. business-setup consultancy operating six owned business centres across Dubai and serving founders, family offices and multinationals since 2013. Our registered address is 19th Floor, Damac Executive Heights, Barsha Heights (Tecom), Dubai, U.A.E.

This Privacy Policy explains what personal data we collect when you visit thesmartcreation.com or engage our services, why we collect it, who we share it with and what rights you have over it.

We collect personal data in three ways:

• Information you give us when you fill in our contact form, book a consultation, request a cost estimate, subscribe to our newsletter or sign a service agreement: name, email, phone number, company name, jurisdiction preference, visa count and the details of your enquiry.
• Information collected automatically when you visit our website: IP address, browser type, device, pages viewed, referring URL and timestamps. See our Cookies Policy for details.
• Information from third parties such as banks we introduce you to, free-zone authorities, the FTA and other government bodies when required to process your file.

We use the personal data you share with us to:

• Respond to your enquiry and provide a costed proposal.
• Set up your U.A.E. company, file your visa or process your tax registration where you have engaged us to do so.
• Introduce you to U.A.E. banking partners (only after your express consent).
• Comply with our legal obligations under U.A.E. law, including anti-money-laundering (AML), ESR, UBO and Corporate Tax filings.
• Send you renewal reminders, regulatory updates and (only with your consent) our newsletter.
• Improve the website and the services we provide.

Where applicable, we process your personal data on one of the following lawful bases under U.A.E. Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and, where relevant, the EU General Data Protection Regulation (GDPR):

• Performance of a contract — to provide the services you engaged us to perform.
• Consent — when you subscribe to our newsletter or opt-in to marketing.
• Legitimate interests — to manage and improve our business and respond to enquiries.
• Legal obligation — for AML, ESR, UBO, Corporate Tax and other regulatory filings.

We share personal data only when necessary to deliver the services you have asked for, or when required by law. Recipients can include:

• U.A.E. licensing authorities (DET, free zones, MOFA, GDRFA, ICP) and the Federal Tax Authority.
• Banks and payment partners where we are facilitating an account opening on your instruction.
• Auditors, lawyers and notaries engaged in connection with your file.
• Technology providers that host our infrastructure, send our email and run our analytics (Supabase, Vercel, Google).

We do not sell your personal data, and we do not share it with third parties for their own marketing.

We keep your personal data only for as long as we need it to perform our services or to comply with our legal obligations. Specifically:

• Enquiry data (contact form, calculator submissions): up to 24 months from your last contact.
• Engagement files (licences, banking, visas, accounting): a minimum of five years after the end of the engagement, in line with U.A.E. commercial-law retention requirements.
• Newsletter subscribers: until you unsubscribe.

You have the right to:

• Access the personal data we hold about you.
• Correct any inaccurate or incomplete information.
• Request deletion of your data where we no longer need it for the purposes outlined above.
• Object to or restrict our processing of your data in certain cases.
• Withdraw consent at any time, where consent is the basis.
• Receive a portable copy of the data you provided to us.

To exercise any of these rights, email us at the address below. We aim to respond within 30 days.

We protect your information using industry-standard measures: encrypted transport (HTTPS / TLS), encrypted storage, access controls, and regular reviews of who in our team can see what. We run our infrastructure on tier-one providers with SOC-2-aligned practices.

No system is ever 100% secure. If we ever experience a personal-data breach that affects you, we will notify you and the relevant U.A.E. authority without undue delay.

We may update this Privacy Policy as our services or applicable laws change. The “Last updated” date at the top reflects the most recent version. Material changes will be announced on this page and, where appropriate, via email.