Privacy Policy

The controller of any personal data described in this policy is:

• NABAD COMPUTER SOLUTIONS - L.L.C - S.P.C, trading as Nabad
• Statutory name in Arabic · نبض لحلول الكمبيوتر - ذ.م.م - ش.ش.و
• Legal form · One Person Limited Liability Company (Sole Proprietorship LLC)
• Commercial licence · CN-6501499, issued by the Abu Dhabi Registration Authority (ADRA), Abu Dhabi Department of Economic Development
• Unified Registration No. · 101-2026-200102468
• Emirate · Abu Dhabi, United Arab Emirates
• Email · hello@nabadcs.ae

Email is the channel for everything in this policy: questions, requests about your data, and complaints. Write to hello@nabadcs.ae and a person answers. We do not publish a street address, because we hold no office premises and the licence carries none.

Almost nothing happens on this site. That is the honest summary, and every line below is verifiable in the code we serve.

• No forms. There is no field anywhere on this site in which you could type your name, your email address, your phone number, or anything else about yourself. Not one.
• No cookies. The site sets none, for any purpose. There is no consent banner because there is nothing to consent to.
• No tracking scripts. This site loads no third-party script of any kind, and the content security policy it is served with permits scripts only from nabadcs.ae. There is no Google Analytics, no tag manager, no advertising pixel, no heatmap and no session recording anywhere in the pages we serve. Measurement our hosting provider carries out at its own layer is Cloudflare's processing, described in section 3(a), not a script we put in the page.
• No third-party content. Every script, stylesheet, font and image comes from nabadcs.ae. Fonts are files we host ourselves, not calls to a font service. Nothing is fetched from a third-party CDN, and there is no embedded frame and no remote image. Our own hosting provider does serve this site from its edge network · that is section 3(a).
• No accounts. No login, no password, no session, no user identifier.
• No database. The server that runs this site has nowhere to write and writes nothing. No visit, and no quote you configure, creates a record with us. What we do keep, because the law requires it, is listed in section 7.
• No tracking and no profiling. We do not follow you across pages or sites, we build no profile of you, and we make no automated decision about you.

What remains is a website that sends you pages, a payment link handled by a payment provider, and an email address. The rest of this policy is the detail behind those three things.

Six things happen on this site that touch personal data at all. Here is each one, what it is for, and the lawful ground we rely on.

(a) Serving you the site

Every request to nabadcs.ae reaches Cloudflare, which hosts the site and runs the code that serves it. To route a request and return a page, Cloudflare necessarily handles your IP address, connection and encryption metadata, the address you asked for (including the language marker if you chose Arabic), ordinary request headers such as your browser and referring page, and the response status. Cloudflare also operates its own security, performance and measurement features at its layer as part of hosting. Those are its processing under its own policy, not something we add to the page. All of that happens at Cloudflare's layer, as our hosting provider, under its own policy. We do not receive it and we do not control it.

Our own code reads exactly three request headers, none of which identify you: two to decide whether to force a secure connection, and one to check the content type of a payment request. It never reads your IP address, your browser string, your referring page or your language header. Our ground: our legitimate interest in delivering and securing the site you asked for.

(b) Remembering your language, theme and dismissals

The site saves a few of your choices in your own browser so it does not have to ask again. These stay on your device. They are never sent to us and we cannot read them, so there is nothing here for us to process. Section 6 lists every one of them.

(c) Pricing your quote

On the websites page you tick options and set two quantities. That selection is sent to our own server so it can price it, and it contains no personal data: option names and numbers only. There is no free-text field on the page, so nothing you have written can be in it, because there is nothing to write in. Our ground: steps taken at your request before a contract.

(d) Taking the deposit

When you press pay, our server asks Ziina to create a payment. What we send is seven fields: the amount our server computed, the currency, a one-line machine-built description of the options you ticked, three return addresses, and a test flag. No name, no email address, no phone number, no IP address. You then pay on Ziina's own checkout. Your card details are entered there and never touch our systems: we never see them, receive them or store them. Ziina sends back an identifier and a checkout address, and when you return we ask whether that payment succeeded. The answer we get is the status word and nothing else, with no amount, no description and no identifiers attached. What Ziina itself collects from you as the payer is governed by Ziina's own privacy policy. Our ground: performance of the contract you are entering with us.

The commercial terms of that payment · what the deposit is, when the balance falls due, and what happens if you cancel · are not a privacy matter and are not stated here. Our terms and refunds pages set them out.

Terms of Use and Website Project Agreement

Refunds, Cancellation and Returns

(e) Email you send us

Every contact route on this site opens your own email program. Nothing is transmitted by the site itself. When you write to us we receive your message, your email address and whatever you chose to put in it, and it sits in a hosted business mailbox provided by a third-party email provider, which handles it under its own policy as our provider. Our ground: performance of a contract, or steps you asked us to take before one.

(f) Contacting you after you pay a deposit

We promise a payer that we will email within one business day with the written scope and the start date. The site never asks you for an email address, so the only address we can have is one Ziina passes on to us with your payment. Where it does, we use it to contact you about your project and nothing else. If you have not heard from us within one business day, email hello@nabadcs.ae and we will reply there. Our ground: performance of the contract you started by paying.

Three parties, all of them necessary to run the site or take a payment.

• Cloudflare · hosting and edge delivery. Every request to nabadcs.ae terminates at Cloudflare and is served by code running there, so Cloudflare necessarily handles the connection data described in section 3(a). Cloudflare operates a global network, so this includes processing outside the UAE. See section 5.
• Ziina · payment processing. A UAE-based payment provider that runs the checkout where you pay the deposit and enter your card details. It receives our payment request and whatever it needs from you to take the payment, and it handles that under its own privacy policy.
• Our email provider · a third-party hosted mailbox service that holds correspondence between you and us, under its own policy. Where it processes that correspondence outside the UAE, see section 5.

That is the complete list. We sell personal data to nobody, and we share nothing for advertising. We add no analytics provider, no marketing platform and no data broker to it. Nothing about your visit flows into a customer database anywhere in that chain, because nothing about your visit reaches us at all.

Serving a website at the edge means processing outside the United Arab Emirates. There is no version of edge hosting that avoids it, so we tell you the measures we apply rather than pretending the transfer does not happen.

We do not rely on any country having been declared adequate for this purpose, because no such determination has been published. We rely on two things instead. First, binding written data processing terms with the overseas provider that oblige it to apply the protections, measures, controls and requirements set by UAE data protection law, including the provisions that impose those measures through the supervisory or judicial authority named in the contract. Second, that the processing is necessary to enter into and perform the contract between you and us, and to deliver the site you asked for.

Where Ziina processes your payment data outside the UAE, that transfer is likewise necessary to perform the payment you asked it to take, and Ziina applies its own arrangements as the payment provider.

Our email correspondence sits with a third-party mailbox provider. Where that provider processes correspondence outside the United Arab Emirates, we rely on the same two grounds: binding written data processing terms obliging it to apply the protections UAE data protection law requires, and the necessity of the processing to perform, or take steps towards, the contract between you and us.

We transfer personal data to no one else. Not for marketing, not for measurement, not for enrichment, not for convenience.

This site sets no cookies. None, for any purpose, on any page. There is no consent banner because there is nothing to consent to, and no cookie regime is imported here from a legal system that is not ours.

The site does use your browser's own storage to remember a handful of settings. This is the complete list, and each one is stored under the name shown.

• nabad-lang · English or Arabic. Remembers the language you chose. Stays on your device.
• nabad-theme · automatic, light or dark. Remembers the appearance you chose. Stays on your device.
• nabad-popup-dismissed · set when you close the promotional card on the home page, so it is not shown to you again. Stays on your device.
• nabad-quote-intent · on the websites page only, and only for the current browser tab. Holds the identifier of a payment you started, so that when you come back from the checkout we can ask our own server whether it completed. This identifier is the one item here that is sent anywhere, and it is sent only to nabadcs.ae.
• nabad-quote-test · on the websites page only, and only for the current tab. Marks a payment made in test mode. Stays on your device.
• nabad-intro · set once the short opening animation on the home page has played, so it is not shown to you again. Stays on your device.

None of these identifies you or is used to recognise you later. Clearing your browser storage removes all of them, and the site works exactly as before. It simply forgets your preferences.

From the site itself, nothing. The server that runs it holds no database, so an ordinary visit leaves nothing with us and a quote you configure leaves nothing with us. There is no visitor record and no browsing record anywhere in our hands.

Four things do persist. Three of them are held by someone else. The fourth is ours, and we keep it because the law requires us to.

• Operational records at Cloudflare. Cloudflare keeps request and security records for its own hosting purposes, on its own schedule and under its own policy. We do not receive them and we do not set how long they are kept.
• The payment record at Ziina. Ziina holds the record of your payment as the payment provider, under its own policy and the record-keeping rules that apply to it.
• Email correspondence. Messages between you and us sit in our mailboxes with our email provider. We keep correspondence while it is useful for your project and for our own records and tax obligations, and we delete it when it is not. If you ask us to delete correspondence we will, unless we are required to keep it.
• Invoices. We issue an invoice for every payment and keep it for as long as UAE commercial and tax record-keeping rules require. We write it ourselves from the payment record · nothing on this site produces it. It carries the transaction, not your browsing.

One line of server output exists in the entire system, and only when the payment provider rejects a request. It records that the call failed, the status code, and the provider's error text. The request that produced it carried nothing about you, so it cannot contain your personal data. It goes to our hosting provider's ordinary log stream and is not collected or stored by us.

The protections here are structural. They are built into how the site is served, not added as a policy statement.

• Every plain HTTP request is redirected to a secure connection before anything at all is served, and the redirect fails closed: where the connection cannot be shown to be secure, it is redirected rather than assumed safe.
• A strict content security policy limits the page to loading scripts, styles, fonts and images from nabadcs.ae, and to sending anything only there. No third-party script can run, and no script in the page can send anything to another destination.
• Scripts, styles, fonts and images are all served from our own domain. There is nothing embedded from anywhere else.
• The browser is denied access to geolocation, camera, microphone and payment interfaces on our pages, and the advertising interest and topic interfaces are switched off.
• Prices are recomputed on our server for every payment request. A price supplied by the browser is rejected outright rather than charged.
• Payment credentials never reach us. Cards are entered on the payment provider's own checkout. Our payment key is held server-side only, is never sent to the browser, and is never written to a log.
• The same protections apply to the Arabic version and to every response our own code builds, and an automated check refuses a release where they are not identical.

No system is perfect and we will not claim otherwise. Section 15 sets out one limitation we know about and have not finished fixing. What we can otherwise say is that this site holds almost nothing worth taking.

UAE data protection law gives you the following rights over your personal data. We use the law's own names for them.

• The right to obtain information. To be told what personal data we process about you, why, who receives it, whether it moves outside the UAE, and how long it is kept. This policy is written to answer that in advance.
• The right to request personal data transfer. To receive the personal data you gave us in a structured, machine-readable form, and to have it moved to another controller where that is technically possible.
• The right to correction or erasure. To have inaccurate or incomplete data corrected, and to ask us to delete data we no longer need.
• The right to restrict processing. To have us hold data without using it, for example while a question about its accuracy is being settled.
• The right to stop processing. To object and require us to stop, including any direct marketing.
• The right to processing and automated processing. To object to a decision taken about you by automated means alone. We take none. See section 14.

Where we relied on your consent for something, you may withdraw it at any time. Withdrawing it stops the processing from that point and does not undo what was lawful before. You may also complain to the regulator. See section 12.

One channel: hello@nabadcs.ae. Tell us in your own words what you want us to do. You do not need a form, a template or a legal phrase.

• To correct something, tell us what is wrong and what it should say.
• To have something erased or restricted, tell us what you want removed or held.
• To object, tell us what you want stopped.
• To get a copy or transfer, tell us where you want it sent, or ask us to send it to you.

We may need to be satisfied that you are the person the data belongs to before we act, and we will ask only for what is needed to establish that. If we cannot do what you asked, we will tell you why in writing.

Our own commitment for a data-rights request, not a statutory period. UAE data protection law sets no response deadline for these rights, so this is a promise we are making rather than a period we are quoting: we will acknowledge a data-rights request within two business days and answer it within thirty days. If a request is complex enough that we need longer, we will tell you before the thirty days are up, and tell you why.

A complaint is a different thing and moves faster · section 12 gives the figures for that.

If personal data we hold is exposed, lost, or accessed without authority, we will contain it, investigate what happened, and notify the competent UAE federal data protection regulator.

Where the breach would prejudice your privacy or the confidentiality of your data, we will tell you as well, in plain language: what happened, what data was involved, what we have done about it, and what you can do.

No fixed notification period is currently set in UAE law. We will notify without delay once we understand what has happened, rather than waiting until we understand everything.

Come to us first. Write to hello@nabadcs.ae with what happened and what you want done about it.

We acknowledge every complaint within one business day with a reference number, and every message about that complaint quotes the same reference so you can follow it from start to finish. We give you a substantive answer within five business days of that acknowledgement, or tell you before those five days are up why we need longer. These are commitments we set for ourselves, not statutory periods, and they are the same two figures our terms and refunds pages publish.

If our answer does not satisfy you, you have the right to complain to the competent UAE federal data protection regulator. Complaints follow the procedures that regulator publishes, and those procedures are the authoritative source for how to file one. We will not obstruct a complaint and we will cooperate with the regulator.

We send no marketing email. There is no newsletter, no mailing list and no campaign, and there is nowhere on this site to sign up for one.

If that ever changes it will be opt-in. We will ask first, you will be free to choose which channel we use, and you will be able to stop it at any time by saying so once. Your right to object to direct marketing is absolute under UAE law. There is no business interest we could weigh against it, and we would not try to.

The email address you gave the payment provider is used to run your project. It is not used for marketing and it goes on no list.

We make no decision about you by automated means, and we build no profile of you. Nothing on this site scores you, ranks you, segments you or infers anything about you.

The quote builder does arithmetic on options you ticked. It prices a configuration, not a person, and it returns the same number to anyone who ticks the same boxes.

We sometimes hand files to a client through a page at an address of the form nabadcs.ae/d/ followed by a random token. The page itself collects nothing: no form, no sign-in, no analytics, and no record of who opened it or when. It is a download link and nothing more.

We keep these pages out of our sitemap and ask search engines not to index, follow or archive them. Those are discovery controls only. They are not authentication, and we do not present them as such. These pages are not secure and not private, we will not describe them that way, and you should not use one for anything you would not be willing to send by ordinary email.

This policy covers nabadcs.ae. It does not cover a website, an agent or a system we build or operate for a client.

In that work the client decides what personal data is processed and for what purpose. The client is the controller and we act on the client's written instructions, under the contract signed for that engagement. If you want to know what a client's system holds about you, ask that client.

Government entities and government data sit outside the federal data protection law. Where we work for a government body, the governing framework is that body's own contract, policy and legal instrument. Nothing in this policy should be read as a representation about how data is handled in that work.

Terms of Use and Website Project Agreement

This site is not directed at children. Nothing on it is designed for or marketed to them, and we do not knowingly process a child's personal data. We sell business and government services to organisations.

If you believe a child has sent us personal data, write to hello@nabadcs.ae and we will delete it.

This is Version 1.0, effective 30 August 2026. It is the first version of this policy.

If something material changes, such as a new recipient of personal data, a new purpose, or a new kind of data we handle, we will update this page, raise the version number, change the date, and state what changed. Corrections of wording that do not alter the substance are made without a version change.

The version and date shown at the top of this page always describe the text you are reading. The English and Arabic versions are published together and say the same thing. The Arabic version is the governing text.