Privacy Policy
How Muronah Human Resources and Management Consultancy LLC OPC collects, uses and protects personal data.
Effective 5 September 2026. Version 1.0.
1. Who we are
Muronah Human Resources and Management Consultancy LLC OPC (“Muronah”, “we”, “us”) is a limited liability company, one person company, licensed in the Emirate of Abu Dhabi, United Arab Emirates, trading as Muronah Consulting. We are the data controller for the personal data described in this policy.
- Registered office
- Dar Al Salam Building, Corniche, Abu Dhabi, United Arab Emirates
- Telephone
- +971 50 720 2885
- Website
- muronahconsulting.com
2. Scope and legal framework
This policy applies to personal data we process through this website, through our advisory, training and simulation programs, and through our correspondence with clients, participants and prospective clients.
We process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL), together with UAE Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes, UAE Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services, and Federal Law No. 15 of 2020 on Consumer Protection, in each case as amended.
The PDPL is in force. At the effective date of this policy its Executive Regulations had not yet been issued and the UAE Data Office was not yet fully operational. We apply the standards set out in the PDPL itself and, where they are more protective, generally accepted international standards. We will update this policy when the Executive Regulations are published.
Where we process the personal data of individuals located in the European Economic Area or the United Kingdom, for example participants attending a program on behalf of a client established there, we also apply Regulation (EU) 2016/679 (GDPR) and the UK GDPR to that processing.
3. Personal data we collect
3.1 Website visitors
- Technical data: IP address, browser type and version, device type, operating system, referring page, and pages viewed.
- Usage data: time spent on pages and interactions with page elements.
3.2 Enquiries and bookings
- Identity and contact data: name, email address, telephone number, employer, and job title.
- The content of your message, and any scheduling information you provide when booking a call.
3.3 Readiness check
- Your email address and company name, which are required before the check begins.
- Your name, if you choose to give it.
- Your answers to the twelve statements, and the scores calculated from them.
3.4 Program participants and clients
- Identity and contact data, role, function and reporting level.
- Assessment data: responses to the same set of questions administered before a program begins and again after it ends, together with the resulting scores.
- Attendance records, exercise and simulation outputs, and feedback you give about the program.
- Where you engage us for one to one work, notes recording the substance of that work.
- Contractual and billing data for the client organization that engages us.
3.5 Data we do not seek
We do not seek sensitive personal data as defined in Article 1 of the PDPL, including data revealing racial or ethnic origin, political or philosophical opinions, religious beliefs, criminal records, biometric data, or data concerning health. Please do not send us such data unless we have asked for it and explained why it is needed. If you send it to us unsolicited, we will delete it unless we are required to retain it.
4. Why we process personal data, and on what basis
Article 4 of the PDPL prohibits processing personal data without the data subject’s consent, subject to the exceptions it sets out. We rely on the following.
| What we do | Why | Basis |
|---|---|---|
| Respond to an enquiry or book a call | To answer you and to assess whether we are the right fit | Steps taken at your request prior to entering a contract; our legitimate interest in responding to enquiries |
| Deliver an advisory, training or simulation program | To perform our contract with the client organization | Performance of a contract; necessary for the legitimate interests of the controller |
| Administer assessments before and after a program | To measure whether capability actually changed, and to report that to the sponsor in aggregate | Consent for individual results; performance of a contract for aggregate reporting |
| Provide a readiness check result | To calculate and show your score on screen, and to know who has taken the check | Consent |
| Send you material about our work | Marketing and program updates | Consent, which you may withdraw at any time |
| Keep accounting and tax records | To comply with UAE tax, commercial and anti money laundering obligations | Compliance with a legal obligation |
| Maintain and secure this website | To keep the site available and protect it from misuse | Our legitimate interest in the security of our systems |
| Establish, exercise or defend legal claims | To protect our legal position | Necessary for the establishment, exercise or defence of a right or claim |
Where we rely on consent, you may withdraw it at any time by writing to info@muronahconsulting.com. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
5. Assessment results and confidentiality
Two commitments govern the assessment data we collect during programs.
Individual results are not reported to your employer. Where we report to a sponsoring organization, we report in aggregate: group averages, distributions, and the change between the assessment taken before the program and the assessment taken afterwards. We do not attribute individual scores to named participants in sponsor reporting unless you have given us your specific, written and freely given consent to do so.
One to one work is confidential. Where you engage us directly for one to one work, the content of that work and, if you ask, the fact that we are working together, is treated as confidential. We will disclose it only with your consent, or where we are required to do so by UAE law or by an order of a competent court or authority.
Nothing in this policy prevents us from acting where we reasonably believe there is a serious and immediate risk to the life or safety of any person.
6. Who we share personal data with
We do not sell personal data. We share it only as follows.
- Service providers acting on our instructions. Website hosting, email, scheduling, and survey and assessment tooling. These providers process personal data as processors on our behalf, under written terms that require them to keep it confidential and secure and to process it only as we instruct.
- The client organization that engaged us, in aggregate form only, as described in section 5.
- Professional advisers, including our auditors, accountants and lawyers, where they need the data to advise us.
- Competent authorities, where we are required to disclose personal data by UAE law, by court order, or to establish, exercise or defend a legal claim.
- A successor entity, in the event of a reorganization, merger or transfer of our business, subject to this policy continuing to apply.
7. Transfers outside the UAE
Some of our service providers are located outside the United Arab Emirates. Where personal data is transferred outside the UAE, Articles 22 and 23 of the PDPL permit the transfer where the receiving jurisdiction has an adequate level of protection, or where one of the specified conditions applies, including a contract or agreement obliging the recipient to apply the protections of the PDPL, or the express consent of the data subject.
At the effective date of this policy, the UAE Data Office had not published a list of jurisdictions it considers adequate. We therefore rely on contractual protections with each recipient, and, where relevant, on your consent. You may ask us for details of the safeguards applied to a particular transfer by writing to the address in section 1.
8. How long we keep personal data
| Category | Retention |
|---|---|
| Enquiries that do not become engagements | 24 months from last contact |
| Readiness check answers and scores | 24 months, or until you ask us to delete them |
| Program assessment data | For the duration of the engagement and 24 months afterwards, then aggregated so it no longer identifies you |
| One to one work notes | 24 months from the end of the engagement |
| Marketing contacts | Until you withdraw consent or unsubscribe |
| Contracts, invoices and accounting records | As required by UAE commercial and tax law, currently a minimum of five years |
We delete or irreversibly anonymize personal data at the end of the applicable period, unless we are required to keep it longer by law or need it to defend a legal claim.
9. Security
We apply technical and organizational measures appropriate to the risk, as required by Article 20 of the PDPL. These include encryption of data in transit, access controls on a need to know basis, multi factor authentication on administrative accounts, secure disposal, and confidentiality obligations on our personnel and contractors.
No transmission over the internet is completely secure. If we become aware of a breach of personal data that would prejudice your privacy, confidentiality or security, we will notify the UAE Data Office immediately upon becoming aware of it, and will notify you where the breach is likely to cause you serious harm, in each case as required by Articles 9 and 10 of the PDPL.
10. Your rights
Subject to the conditions and exceptions in the PDPL, you have the right to:
- request information about how we process your personal data, and obtain a copy of it (Articles 13 and 14);
- request that it be transferred to you or to another controller in a structured, machine readable format (Article 14);
- have inaccurate or incomplete data corrected (Article 15);
- request erasure of your personal data (Article 16);
- request that processing be restricted (Article 17);
- object to processing, including processing for direct marketing and processing based on automated decision making (Articles 18 and 19); and
- withdraw consent at any time where our processing is based on consent.
Where GDPR or UK GDPR applies to the processing, you have the equivalent rights under those laws, including the right to lodge a complaint with your local supervisory authority.
11. How to exercise your rights, and how to complain
Write to info@muronahconsulting.com with the words “Data request” in the subject line. We may ask you for information to verify your identity. We will respond within one month of receiving a valid request. Where a request is complex or where we have received a number of requests from you, we may extend that period, and we will tell you if we do.
We do not charge for responding to a request unless it is manifestly unfounded or excessive.
If you are not satisfied with our response, you may complain to the UAE Data Office. Until the Data Office is fully operational, the Telecommunications and Digital Government Regulatory Authority acts as the point of contact for data protection matters in the United Arab Emirates.
12. Cookies and analytics
This website is built to work without advertising or tracking cookies. We use only cookies that are strictly necessary for the site to function, together with any cookie set by our hosting provider for security and load balancing.
If we introduce analytics or other non essential cookies in future, we will ask for your consent before setting them and will update this section to describe what they do, who provides them and how long they last.
13. Children
Our services are directed at working professionals and organizations. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, write to us and we will delete it.
14. Automated decision making
The readiness check calculates a score from the answers you give and displays it to you on screen. That calculation is arithmetic and produces an indicative result for your own use. We do not use it, or any other automated process, to make a decision that produces legal effects concerning you or similarly significantly affects you.
15. Changes to this policy
We may update this policy from time to time. The version and effective date appear at the top of this page. Where a change materially affects how we process your personal data, we will tell you by email if we hold your email address, or by a notice on this website.
16. Contact
Questions about this policy or about how we handle personal data should go to info@muronahconsulting.com, or by post to Muronah Human Resources and Management Consultancy LLC OPC, Dar Al Salam Building, Corniche, Abu Dhabi, United Arab Emirates.