This Privacy Policy explains how The Business Gallery Ventures FZE LLC ("we", "us"), a company registered with the Free Zones Authority-Ajman, United Arab Emirates, under licence number 58893, collects and uses personal data when you use The Business Gallery at thebusinessgallery.com (the "Gallery"). We are the controller of this data. We follow Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and its implementing regulations.
1. What we collect
Details you give us
- Account details: your email address, first and last name, date of birth, country and emirate of residence, and your preferred language.
- Your mobile number, and the fact and time that you verified it.
- Listing content: business or professional names, descriptions, services, prices, areas served, trade licence or permit details, photos, logos, videos, the contact details you choose to publish, and, if you turn on a gallery greeter, the photo you may upload to style it.
- Business-for-sale details, including the financial information you choose to share.
- Messages and enquiries you send through the Gallery or to our support team. An enquiry to a Lister is passed to them with your name, email address and mobile number.
- Your choices: the agreements you accepted and when (including which version of these documents), your greeter settings, and your email preferences.
Details collected when you use the Gallery
- Activity on the Gallery: listings you save or like, and a record of each listing you view, open in the gallery, reveal the contact details of, or tap to contact (WhatsApp, call, email, website, Instagram or LinkedIn), with the time. When you are signed in, the record names your account. When you are not, it carries only a keyed code derived from your IP address, never the address itself. We record at most one event per hour for each listing, kind of event and visitor.
- Technical data: your IP address, browser type and device, used for security checks, the human check and short-lived logs. Our rate limits store only an irreversible code derived from your IP address, never the address itself.
- Cookies and similar storage: a cookie that keeps you signed in; a cookie that remembers your language for a year; a short-lived signed cookie recording that you have nothing new to accept; and, if you accept analytics, a setting in your browser's local storage that remembers your choice.
- Analytics, only with your permission: Google Analytics counts visits and shows us which pages people find useful. It loads only after you choose "Accept" in the cookie banner, its advertising features are switched off, and you can change your choice at any time from "Cookie settings" in the footer.
Details from others
- Payment status from Stripe (we never see or store your full card number).
- The result of our human check (Cloudflare Turnstile) and the delivery status of WhatsApp messages from Meta.
2. Why we use it, and our legal basis
- To provide the Gallery and your account, including publishing your listings and showing contact details to members (performance of our contract with you).
- To verify your identity and age, and to check that each mobile number belongs to one account (contract, and our legitimate interest in keeping the Gallery trustworthy).
- To take payments and keep financial records (contract, and our legal obligations).
- To keep the Gallery safe: reviewing listings, screening photos and videos automatically for nudity and violence, preventing spam, scraping and fraud, and enforcing our Terms (legitimate interests and legal obligations).
- To understand how listings are used: which accounts and visitors viewed, revealed or tapped a listing. Our admins can see these records by name; Listers see counts only (our legitimate interest in running the marketplace, preventing scraping and abuse, and improving the service).
- To make your gallery greeter and its voice clips, only if you turn the greeter on. You can turn it off at any time from your dashboard (consent).
- To suggest an Arabic translation of the English you type, only when you press the translate button (contract).
- To contact you about your account, listings, enquiries and changes to our terms (contract).
- To send news and offers, only if you opted in. You can opt out at any time from your account page (consent).
- To comply with the law and respond to lawful requests from UAE authorities (legal obligation).
3. Who we share it with
- Other users: listing content and the contact details you choose to publish. Contact details are shown only to signed-in members with a verified UAE mobile number. Enquiries you send are passed to the Lister as described above. Listers see only how many times their listing was viewed, revealed or tapped, never who did it.
- Service providers who process data for us under contract:
- Supabase: database, sign-in and file storage, in Singapore.
- Vercel: website hosting, in Singapore.
- Stripe: payments and invoices.
- Resend: the emails we send you.
- Meta: WhatsApp messages carrying your sign-in codes.
- Cloudflare: the Turnstile human check on sign-in and phone verification.
- Google: Google Analytics, only with your consent; Cloud Translation, for the Arabic suggestions you ask for; and Cloud Run in Singapore, where our media worker resizes and re-encodes uploaded photos and videos and works out greeter colours, and where our photo check scores photos for nudity and violence.
- Microsoft Azure: the speech service that turns listing text into the greeter and receptionist voice clips.
- Sentry: error reports when something breaks. It is set not to collect personal data, although a report can include the address of the page and the form fields that caused the error.
- Authorities, advisers and successors: where the law requires it, to protect our rights, or as part of a sale or restructuring of our business.
We do not sell your personal data. We do not use an SMS provider at present; if we add one for sign-in codes, we will name it here.
4. International transfers
Our database, sign-in, file storage, website hosting and media processing (Supabase, Vercel and Google Cloud Run) are located in Singapore. Some of our other service providers, such as Stripe, Resend, Meta, Cloudflare, Google, Microsoft and Sentry, may process data in other countries, including the United States and the European Union. When we transfer data outside the UAE, we rely on the grounds the PDPL allows, such as the provider's contractual commitments to protect the data, transfers to countries with adequate protection, or your consent.
5. How long we keep it
- Account and listing data: while your account is open. When you delete your account, we delete it, including your photos, videos, greeter photo and voice clips, except as described below.
- Payment and invoice records: for seven years, as UAE tax law and commercial law require. They keep your name and the email address you paid with.
- Records of what you accepted and when: while your account is open. When you delete your account, we keep an anonymised record (a code derived from your account that we cannot link back to you, the document version and the time) for up to five years, so that we can show that consent was given.
- Enquiries you sent and support requests: when you delete your account, your name, email address and mobile number are removed from them. The text of an enquiry stays with the Lister who received it, and the text of a support request stays in our support records.
- Listing activity records: your account and the visitor code are removed after 12 months. When you delete your account, the link to your account is removed straight away; the visitor code stays until the 12-month clear-out. The rows then stay as anonymous counts. Contact reveal counters: one day. Security logs and rate limit counters: a short period, usually no more than 90 days.
6. Your rights
Under the PDPL you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct inaccurate data or complete incomplete data;
- delete your data, or restrict how we use it;
- stop using your data for direct marketing, or object to other processing;
- send your data to you in a structured, commonly used format.
You can download your data and delete your account yourself from your account page. For anything else, email hello@thebusinessgallery.com. We answer within 30 days and may need to confirm your identity first. If you are not satisfied with our answer, you can complain to the UAE Data Office.
We make no decision about you by automated means alone. Photos and videos are screened automatically, but anything the screening holds is looked at by a person before any decision is made.
7. Security
We use encryption in transit, access controls and row-level security in our database, and limit who on our team can see personal data. No system is completely secure, so please keep your sign-in email safe. If a breach of your personal data is likely to put your rights at risk, we will notify the UAE Data Office and you as the PDPL requires.
8. Children
The Gallery is for people aged 18 and over. We do not knowingly collect data from anyone younger.
9. Changes to this policy
We may update this policy. Each version has a number and a date. When we publish a new version, we will ask signed-in users to read and accept it before they continue. Earlier versions remain available on this page.
10. Contact
The Business Gallery Ventures FZE LLC, licence number 58893, registered with the Free Zones Authority-Ajman, United Arab Emirates. Address: AMC-BLA-B.C-6010454, Ajman Media City, Ajman, United Arab Emirates. Email: hello@thebusinessgallery.com
