Legal

Privacy Policy

Last updated: 23 October 2026

1.Who we are

This policy explains how Cragstone Corporate Service Providers FZCO (“Cragstone”, “we”, “us”) collects and uses personal data when you visit www.cragstone.global or contact us.

Cragstone is the controller of your personal data. We are a free zone company licensed by the International Free Zone Authority (IFZA), licence no. 51853, at Dubai Silicon Oasis, IFZA Business Park, Dubai, United Arab Emirates.

Questions about this policy or your data: info@cragstone.global or +971 58 581 9490.

We process personal data in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, “PDPL”). Where you are in the European Union or the United Kingdom, we also follow the EU and UK General Data Protection Regulation (GDPR) to the extent they apply.

2.Information we collect

We collect what you give us, limited technical data from your visit and, for clients, the results of the compliance checks we are required to carry out.

Please don’t send identity documents or other sensitive information through the website contact form. We’ll ask for onboarding documents separately, through a secure channel, once you decide to engage us. If you give us data about other people (such as fellow shareholders or directors), please make sure they know you’re sharing it and have seen this policy.

3.How and why we use it

We use your data to answer your enquiry, provide our services and run the website, and we never sell it.

We will not add you to a mailing list or send marketing emails unless you separately agree, and you can opt out at any time. We do not use your data for automated decisions that have legal or similarly significant effects on you.

4.Cookies

We set non-essential cookies only after you choose “Accept all” or allow them under “Manage cookies”.

Cookies are small files stored on your device. Our website is hosted by Squarespace, which sets them in two groups:

• Essential cookies keep the site secure, remember your cookie choice and make the contact form work. They can’t be switched off.
• Analytics and performance cookies tell us, in aggregate, how visitors use the site, such as pages viewed and how people arrived. They’re used only with your consent.

We don’t use advertising or cross-site tracking cookies.

You can change your choice at any time using the Cookie Preferences button shown on the site, or delete cookies in your browser settings. Squarespace lists the individual cookies it uses in The cookies Squarespace uses.

5.Who we share it with

We share personal data only where it’s needed to deliver our services, run our website and email, or meet the law.

• UAE government bodies and free zones, when we apply or file on your behalf: the International Free Zone Authority (IFZA) and other free zone authorities, the Dubai Department of Economy and Tourism, the Federal Authority for Identity, Citizenship, Customs and Port Security (ICA), the General Directorate of Residency and Foreigners Affairs (GDRFA), the Ministry of Human Resources and Emiratisation (MOHRE) and the Federal Tax Authority.
• Banks and payment providers, when we help open or operate accounts, or to process payments.
• Identity-verification and screening providers, to carry out the checks described above.
• Squarespace hosts the website, receives contact-form submissions and provides cookie and analytics tools. See Squarespace’s Privacy Policy.
• Microsoft 365 hosts our business email (info@cragstone.global), where form submissions and enquiries are delivered.
• Professional advisers such as lawyers, auditors, tax advisers and accountants, under confidentiality duties, where needed.
• Regulators, law enforcement and courts, where we’re legally required to disclose data, including reports required under anti-money-laundering law, or need to protect our legal rights.
• A successor business, if Cragstone is restructured, merged or sold, under the same protections set out here.

Our service providers act on our instructions and may not use your data for their own purposes. Government bodies, banks and regulators use the data under their own legal duties and policies. We never sell or rent personal data.

6.International transfers

Your data may be stored and processed outside the UAE, mainly in the United States and Europe, where Squarespace and Microsoft operate their data centres.

Where we transfer data out of the UAE, or out of the EU or UK, we rely on recognised safeguards: an adequacy finding for the destination where one exists, or standard contractual clauses in our providers’ data-processing terms. By contacting us through this website, you also acknowledge that your enquiry will be handled using these providers.

7.How long we keep it

We keep personal data only as long as we need it, then delete or anonymise it.

8.Security

We protect your data with encrypted connections, access controls and reputable providers, though no online system is completely secure.

The site runs over HTTPS, and form submissions travel encrypted. Access to enquiries and client data is limited to the people who need it. Our email and accounts are protected with strong passwords and, where available, multi-factor authentication.

If a breach is likely to put your rights at risk, we will notify the UAE Data Office and, where the risk is high, tell you without undue delay.

9.Your rights

You can ask us to access, correct, delete or stop using your personal data by emailing info@cragstone.global.

Depending on the law that applies to you, you have the right to:

• Access a copy of the personal data we hold about you
• Correct data that is inaccurate or out of date
• Delete your data, where we no longer have a reason to keep it
• Restrict or object to how we use it, including direct marketing
• Withdraw consent at any time, including cookie consent, without affecting earlier processing
• Data portability: receive your data in a structured, machine-readable format

We’ll reply without undue delay, and in any event within 30 days. We may need to confirm your identity first, and we won’t charge for a reasonable request.

If you’re unhappy with how we’ve handled your data, please tell us first so we can put it right. You may also complain to the UAE Data Office, or, if you’re in the EU or UK, to your local data-protection authority (in the UK, the Information Commissioner’s Office).

10.Other things to know

• Children: our services are for businesses, and the site isn’t directed at anyone under 18. We don’t knowingly collect children’s data, except where a client asks us to process a residency visa or Emirates ID for a dependant. In that case we process it only for that application.
• Other websites: links to other sites are covered by those sites’ own privacy policies.
• Changes: we may update this policy. The latest version will always be on this page, with the date it was last updated. For significant changes affecting clients, we’ll tell them directly.
• Governing law: this policy is governed by the laws of the United Arab Emirates as applied in the Emirate of Dubai, and the courts of Dubai have jurisdiction over any dispute. This doesn’t remove any rights you have under the data-protection law of the country where you live.