Data Protection Policy

Our Privacy Policy tells you what we do with your information. This document sets out the internal standards our own people are required to meet when they handle it. We publish it because a policy nobody outside the company can read is difficult to hold anyone to.

It applies to every director, employee, contractor and temporary worker who has access to personal data through their work with us.

All personal data handled by this company must be:

• Collected for a specific, stated purpose and not repurposed later without a fresh basis.
• Limited to the minimum necessary for that purpose.
• Accurate, and corrected promptly when we learn it is not.
• Retained only for as long as the stated purpose or the law requires.
• Protected by appropriate technical and organizational measures.
• Handled in a way the individual concerned would find reasonable and unsurprising.

A named member of management holds overall responsibility for data protection within the company, including maintaining our record of processing activities, responding to data subject requests and handling any incident.

Supervisors are accountable for the data handling of their teams, including field devices, job sheets and photographs. Every employee is individually responsible for following this policy, and failure to do so is treated as a disciplinary matter.

• Client contact details are entered into our job system and are not stored in personal phone contacts, personal email or personal messaging apps.
• Job photographs are taken on company devices, uploaded to the job record and removed from the device gallery.
• Access codes, key safe combinations and alarm codes are recorded only where the client has asked us to hold them, are restricted to the assigned team, and are deleted when the relationship ends.
• Paper job sheets are returned to the office and are never left in vehicles overnight.
• Client information is never discussed at another client's property, and never shared on social media in any form.

Every new employee receives data protection briefing as part of induction, before they are given access to any client record. Refresher briefing is delivered annually and after any material change to this policy or to the law.

Where a specialist subcontractor is engaged, they receive only the information necessary to perform the specific task, are contractually bound to confidentiality and equivalent data standards, and are prohibited from retaining the information after completion.

We keep a register of every third party with whom personal data is shared, what is shared and on what basis.

Any suspected loss, unauthorized disclosure or unauthorized access must be reported internally the same day, however minor it appears. We assess the risk, contain it, record it in our incident log, and notify affected individuals and the relevant authority where the risk to their rights requires it.

If you believe your information has been mishandled by us, contact info@downtownservices.ae immediately. We take these reports seriously and will tell you what we find.

This policy is reviewed annually and after any significant change to our systems, our operations or applicable law, including the United Arab Emirates federal personal data protection framework. Last reviewed 18 August 2026.