PHOTOLICIOUS Start a project
Abu Dhabi

Privacy

Last updated: 19 October 2026

This policy explains what personal data Photolicious collects, why we collect it, who we share it with, and the rights you have over it. We have written it to meet the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the “PDPL”) and, where it applies to you, the EU/UK General Data Protection Regulation (“GDPR”).

1. Business identity and contact

Photolicious is operated by PHOTOLICIOUS EVENTS - L.L.C, Abu Dhabi economic licence CN-5188703. Our business contact address is Madar 39, Mina Zayed, Abu Dhabi, United Arab Emirates. For privacy requests, contact management@photolicious.ae.

2. What we collect

2.1 Information you provide and how you reached us

We collect the information you choose to provide through our enquiry form or when you contact us, such as your name, contact details, brand and project brief.

Our enquiry form also records available information about how you reached our website. This may include a Google ad, a Facebook or Instagram ad, a search engine, an AI assistant such as ChatGPT, our Google Business Profile, social media, another website, an email, or a direct visit. It may include the referring website, the page you first landed on, the page you sent the form from and its language, campaign tags in the link, and an ad click identifier such as gclid, gbraid, wbraid or fbclid.

To do this, our website passes source information between pages in the page address. It does not store this source record on your device unless you allow ad and source measurement. Our enquiry form, provided by Typeform, receives the page address when it loads. When you submit the form, the available source information is stored with your enquiry. If you allow ad and source measurement, we can also remember how you first found us on an earlier visit. We use this information to understand which channels bring enquiries and projects.

2.2 Form security

Our enquiry form is provided by Typeform. Typeform can use Google reCAPTCHA when its spam-prevention feature is enabled.

2.3 Photography and film

Our work involves photographing and filming food, places and, sometimes, people. An image or recording of an identifiable person is personal data under the PDPL and the GDPR. Section 7 explains how we handle it.

2.4 Analytics and advertising measurement

With your consent, we use Google Analytics and Google Ads measurement cookies on this website as described in section 3. We do not run social media pixels and we do not buy personal data from third parties. We do not knowingly collect data from children.

3. Cookies and similar technologies

We ask for your choice the first time you visit. You can change it at any time: Change your cookie settings.

Necessary, always on: cookies that remember your language and cookie choice, and cookies used by our host for security and caching. We also store your appearance preference in your browser's local storage.

Analytics, only with your consent: Google Analytics cookies that help us understand how visitors use the site.

Ad and source measurement, only with your consent: Google Ads cookies and our own source record, which remembers how you first and most recently reached our website for up to 90 days. We use these to understand which ads and channels lead to enquiries. This website’s measurement tags are configured to deny ad personalisation. Google signals collection is turned off in our Google Analytics property.

When you decline a measurement cookie category, the relevant Google tags may send limited signals without setting or reading cookies in that category. Google may use these signals for aggregate measurement and modelling. If you decline ad and source measurement cookies, your submitted enquiry may still include available source information for the current visit, without saving our source record on your device.

Our enquiry form runs inside a Typeform frame on our page. Typeform may set its own cookies to provide the form, security and enabled features. If spam prevention is enabled, the form may also use Google reCAPTCHA. The form has autosave progress enabled: unfinished answers can be stored in your browser on the same device for up to 15 days so you can return and finish. These locally saved answers are not completed enquiries. Typeform provides separate cookie-consent controls within the form. These provider cookies and browser storage are separate from this website's measurement cookies and cookie settings.

4. Why we use this information

We use the information you provide to respond to your enquiry and discuss your project. We also use available enquiry source information to understand which ads, channels and pages bring enquiries. We ask for your consent through the cookie banner before storing analytics or ad and source measurement information on your device.

  • To answer your enquiry and prepare a quotation: because you asked us to, and because it is necessary to take steps toward a contract at your request.
  • To deliver a project you have booked: necessary to perform our contract with you.
  • To send you marketing: only with your prior opt-in consent. We do not add clients to a mailing list automatically, and there is no “soft opt-in”.
  • To keep the site secure and prevent spam: necessary to protect our systems and to meet our legal obligations.
  • To keep accounting and tax records: necessary to comply with UAE law.
  • To use images of identifiable people: on the basis of a signed release, as described in section 7.

Where the GDPR applies to you, our bases are consent (Article 6(1)(a)), performance of or steps toward a contract (Article 6(1)(b)), and legal obligation (Article 6(1)(c)).

5. Service providers

Our providers include Hostinger, which hosts this website; Google, which provides Google Workspace email, Google Analytics, Google Ads and Google Tag Manager; and Typeform, which provides our enquiry form.

  • Our website host and email provider
  • Our website security and anti-spam provider
  • Accounting, payment and professional advisers
  • Crew or freelance collaborators engaged on your project, where relevant
  • Government or regulatory authorities, where we are legally required to disclose

These providers act on our instructions under a contract and may not use your data for their own purposes.

6. Data processed outside the UAE

Google, Typeform and Hostinger may process or store information outside the United Arab Emirates when providing their services.

Some of our providers store data outside the United Arab Emirates. The UAE has not yet published a list of countries deemed to give adequate protection, so where we transfer personal data abroad we rely on contractual safeguards with the provider, including standard contractual clauses where they are available.

Where the GDPR applies, transfers out of the EEA are made under the European Commission’s standard contractual clauses or another lawful transfer mechanism. You can ask us for details of the safeguards in place.

7. Photography, film and image rights

This section matters more for us than for most studios, so we set it out plainly.

  • Consent. Where an identifiable person appears in a commissioned shoot, we obtain a written release before using the material commercially. UAE law requires consent to photograph, keep and publish images of a person, and requires us to be able to prove that consent.
  • Withdrawal. A release can be withdrawn. If you withdraw, we will stop using the material going forward. We may not be able to recall copies already published or delivered to a client, and withdrawal does not affect use that was lawful before you withdrew.
  • Client shoots. Where a client brings talent, staff or customers to a shoot, the client is responsible for obtaining releases and confirms to us that it has done so.
  • Private locations. We obtain the owner’s permission before filming on private property, and the permits required for filming in public locations in Abu Dhabi.
  • Requests. If you appear in our work and want it removed from our own channels, email us and we will act on it. See section 9.

8. How long we keep it

  • Enquiries that do not become projects: up to 24 months, then deleted.
  • Project and client records: for the life of the relationship and then as long as UAE accounting and tax law requires.
  • Marketing consents: until you withdraw, plus a short record of the withdrawal so we do not contact you again in error.
  • Model and property releases: as long as we use the material, plus the limitation period that applies to any claim.
  • Server and security logs: a short rolling period set by our host and security provider.

Measurement retention

Google Analytics event-data retention is set to 14 months. User-data retention is set to 14 months, with the retention period for a user’s identifier restarting when that user has new activity. Standard aggregated reports may be retained longer. Our own source record on your device: up to 90 days. Your cookie choice: up to 180 days, after which we ask again. Withdrawing ad and source measurement consent deletes our source record from your device. These periods do not replace the policy's separate retention rules for submitted enquiries and project records.

9. Your rights

Under the PDPL you have the right to:

  • Ask what personal data we hold about you and receive a copy
  • Have inaccurate or incomplete data corrected
  • Have your data deleted, subject to records we must keep by law
  • Restrict or object to how we process it
  • Receive your data in a portable, machine-readable format
  • Withdraw consent at any time, including consent to marketing
  • Require us to stop processing your data for marketing purposes

Where the GDPR applies, you have equivalent rights under Articles 15 to 22, including the right to object to processing and rights in relation to automated decision-making. We do not carry out automated decision-making or profiling.

To exercise any of these, email management@photolicious.ae. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

10. Security

The site is served over HTTPS. Access to enquiries and project files is limited to the people who need it. Our enquiry form uses Typeform's spam-prevention feature to help detect automated submissions, and we keep our systems patched. No system is perfectly secure, but if a breach occurred that presented a risk to you, we would notify you and the relevant authority as the law requires.

11. Complaints

Please raise any concern with us first, at management@photolicious.ae. We would rather fix it directly.

If you are not satisfied, you may complain to the UAE federal data protection authority. Where the GDPR applies to you, you may also complain to the supervisory authority in your country of residence or work.

12. Changes to this policy

If we change how we handle personal data, we will update this page and change the date at the top. If the change is significant, we will make that clear.