Privacy

Last updated: 28 July 2026

This policy explains what personal data Photolicious collects, why we collect it, who we share it with, and the rights you have over it. We have written it to meet the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the “PDPL”) and, where it applies to you, the EU/UK General Data Protection Regulation (“GDPR”).

1. Who we are

Photolicious is a food and beverage photography and film studio based in Abu Dhabi, United Arab Emirates. We are the data controller for the personal data described in this policy.

• Legal entity: [REGISTERED COMPANY NAME]
• Trade licence number: [TRADE LICENCE NUMBER]
• Licensing authority: Abu Dhabi Department of Economic Development (ADDED)
• Registered address: [REGISTERED ADDRESS], Abu Dhabi, United Arab Emirates
• Email: management@photolicious.ae
• Phone and WhatsApp: +971 50 937 3729

For any question about this policy or your data, contact us at the email address above and mark your message “Data protection”.

2. What we collect

2.1 When you send us an enquiry

Our contact form collects only what we need to answer you properly:

• Your name
• Your email address
• Project type, timeline and budget range
• The brief you write for us

If you contact us by email, phone or WhatsApp instead, we hold whatever you choose to send us, including your phone number.

2.2 Technical data

Our web host and security plugin record standard server information, including IP addresses, browser type and pages requested. This is used to keep the site available and to block attacks, not to build a profile of you.

To stop automated abuse of the contact form, we briefly store a one-way hashed version of your IP address (it cannot be reversed back into your IP) for up to one hour, purely to count submissions. We do not store your raw IP address for this purpose.

2.3 Photography and film

Our work involves photographing and filming food, places and, sometimes, people. An image or recording of an identifiable person is personal data under the PDPL and the GDPR. Section 7 explains how we handle it.

2.4 What we do not collect

We do not run advertising trackers, analytics profiling, or social media pixels on this website, and we do not buy personal data from third parties. We do not knowingly collect data from children.

3. Cookies and local storage

This website does not set advertising or analytics cookies.

We store one item in your browser’s local storage: your choice of light or dark appearance, so the site remembers it on your next visit. It stays on your device, is never sent to us, and you can clear it at any time through your browser settings.

Our host may set strictly necessary cookies for security and caching. If we introduce analytics or marketing cookies in future, we will update this policy and ask for your consent first.

4. Why we use your data, and our legal basis

The PDPL treats consent as the default basis for processing and, unlike the GDPR, does not offer a general “legitimate interests” basis. We therefore rely on consent or on necessity for a contract in most cases.

• To answer your enquiry and prepare a quotation — because you asked us to, and because it is necessary to take steps toward a contract at your request.
• To deliver a project you have booked — necessary to perform our contract with you.
• To send you marketing — only with your prior opt-in consent. We do not add clients to a mailing list automatically, and there is no “soft opt-in”.
• To keep the site secure and prevent spam — necessary to protect our systems and to meet our legal obligations.
• To keep accounting and tax records — necessary to comply with UAE law.
• To use images of identifiable people — on the basis of a signed release, as described in section 7.

Where the GDPR applies to you, our bases are consent (Article 6(1)(a)), performance of or steps toward a contract (Article 6(1)(b)), and legal obligation (Article 6(1)(c)).

5. Who we share it with

We do not sell your personal data. We share it only with service providers who help us run the studio, and only as far as they need it:

• Our website host and email provider
• Our website security and anti-spam provider
• Accounting, payment and professional advisers
• Crew or freelance collaborators engaged on your project, where relevant
• Government or regulatory authorities, where we are legally required to disclose

These providers act on our instructions under a contract and may not use your data for their own purposes.

6. Transfers outside the UAE

Some of our providers store data outside the United Arab Emirates. The UAE has not yet published a list of countries deemed to give adequate protection, so where we transfer personal data abroad we rely on contractual safeguards with the provider, including standard contractual clauses where they are available.

Where the GDPR applies, transfers out of the EEA are made under the European Commission’s standard contractual clauses or another lawful transfer mechanism. You can ask us for details of the safeguards in place.

7. Photography, film and image rights

This section matters more for us than for most studios, so we set it out plainly.

• Consent. Where an identifiable person appears in a commissioned shoot, we obtain a written release before using the material commercially. UAE law requires consent to photograph, keep and publish images of a person, and requires us to be able to prove that consent.
• Withdrawal. A release can be withdrawn. If you withdraw, we will stop using the material going forward. We may not be able to recall copies already published or delivered to a client, and withdrawal does not affect use that was lawful before you withdrew.
• Client shoots. Where a client brings talent, staff or customers to a shoot, the client is responsible for obtaining releases and confirms to us that it has done so.
• Private locations. We obtain the owner’s permission before filming on private property, and the permits required for filming in public locations in Abu Dhabi.
• Requests. If you appear in our work and want it removed from our own channels, email us and we will act on it. See section 9.

8. How long we keep it

• Enquiries that do not become projects: up to 24 months, then deleted.
• Project and client records: for the life of the relationship and then as long as UAE accounting and tax law requires.
• Marketing consents: until you withdraw, plus a short record of the withdrawal so we do not contact you again in error.
• Model and property releases: as long as we use the material, plus the limitation period that applies to any claim.
• Anti-spam hashes: up to one hour.
• Server and security logs: a short rolling period set by our host and security provider.

9. Your rights

Under the PDPL you have the right to:

• Ask what personal data we hold about you and receive a copy
• Have inaccurate or incomplete data corrected
• Have your data deleted, subject to records we must keep by law
• Restrict or object to how we process it
• Receive your data in a portable, machine-readable format
• Withdraw consent at any time, including consent to marketing
• Require us to stop processing your data for marketing purposes

Where the GDPR applies, you have equivalent rights under Articles 15 to 22, including the right to object to processing and rights in relation to automated decision-making. We do not carry out automated decision-making or profiling.

To exercise any of these, email management@photolicious.ae. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

10. Security

The site is served over HTTPS. Access to enquiries and project files is limited to the people who need it. Our contact form is protected against automated abuse, and we keep our systems patched. No system is perfectly secure, but if a breach occurred that presented a risk to you, we would notify you and the relevant authority as the law requires.

11. Complaints

Please raise any concern with us first, at management@photolicious.ae. We would rather fix it directly.

If you are not satisfied, you may complain to the UAE federal data protection authority. Where the GDPR applies to you, you may also complain to the supervisory authority in your country of residence or work.

12. Changes to this policy

If we change how we handle personal data, we will update this page and change the date at the top. If the change is significant, we will make that clear.