HELLOU Privacy Policy

This Privacy Policy will be updated as and when the Executive Regulations are published and additional regulatory guidance becomes available.

This Privacy Policy applies to all users of the HELLOU platform:

● Service Providers (Suppliers) ● Employer Companies ● Individual Users / Employees

It should be read alongside the HELLOU Terms of Service and should be read alongside the Terms of Service. By using the Platform, you agree to the practices described in this Policy.

The following terms have the meanings set out below wherever they appear in this Policy:

HELLOU CONSULTANCY & TECHNOLOGY L.L.C – S.P.C ("HELLOU", "we", "us") is the Data Controller for personal data collected through the HELLOU platform. This Privacy Policy explains how we collect, use, store, share, and protect your personal information.

This Policy is prepared in accordance with UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection ("PDPL") and its implementing regulations. All personal data is stored exclusively on UAE-based servers (AWS me-central-1, Abu Dhabi region).

• Full name, email address, phone number

• Company name and registration number (Employers and Suppliers)

• User role, account type, password (stored in encrypted form only)

• Passport copy (biographical data page and all visa/stamp pages)

• Emirates ID (front and back, including biometric reference number — see Section 4.1)

• Current UAE residence visa; medical fitness certificate (health data — see Section 4.2)

• Labour contract / employment offer letter; personal photograph (biometric quality)

• Job title, department, employer details, start date, employment status

• Salary information — classified as sensitive financial personal data (see Section 4.3)

• IP address, browser type, device information, pages visited, features used

• Communication logs within the Platform; AI feature interaction history

• Visa and immigration application processing through MOHRE and ICA

• Generation of employment certificates, salary certificates, and NOC letters

• Workforce management and document tracking for employers and suppliers

• Automated reminders for visa and document expiry dates

• Billing and invoice management between suppliers and employers

• Identity verification, fraud prevention, and AML/CTF compliance

• Platform improvement, technical support, and security monitoring

• Compliance with UAE legal and regulatory obligations

The Platform uses automated processing to: (a) match employers with service providers;(b) prioritise document renewal alerts based on expiry dates; and (c) generate service usage summaries. These processes do NOT make legally binding decisions.

Your Emirates ID contains a biometric reference number issued by ICA. HELLOU stores this number solely to verify your identity when submitting applications to ICA. It is not used for biometric matching, facial recognition, or any commercial purpose. Explicit consent is obtained via the Data Processing Consent Form (Schedule I of this Privacy Policy).

Special Category Data — Health Information (PDPL Article 1)

Your medical fitness certificate contains health data, which is subject to a higher level of protection under PDPL. This data is processed exclusively for UAE visa application requirements (MOHRE/DHA). It is shared only with the relevant government portal and your assigned service provider. A separate consent option is available on the Platform upload screen if you wish to consent to all other documents but not health data.

Salary information is classified as sensitive financial personal data. It is collected solely for the purpose of generating employment and salary certificates as requested by the individual. It is not shared with employers in a way that enables cross-individual salary comparison without explicit consent.

As an Abu Dhabi-registered entity processing health data submitted to Abu Dhabi Health Services (SEHA) or the Abu Dhabi Department of Health (DoH), HELLOU complies with the Abu Dhabi Health Data Governance Framework in addition to UAE PDPL. Medical fitness certificate data is stored in a separate, access-restricted partition with enhanced audit logging.

• Consent — for sensitive documents: passport, Emirates ID, medical certificates, salary data

• Contractual necessity — to fulfil our service obligations to you

• Legal obligation — to comply with UAE immigration and labour laws

• Legitimate interests — for platform security, fraud prevention, AI service matching, and platform improvement

• Between employees, suppliers, and employers as necessary to fulfil visa processing and workforce management services

• Platform administrators for account management and support purposes

• MOHRE for visa and labour permit applications

• ICA for Emirates ID and visa stamping

• DHA or SEHA for medical certificate verification

• Cloud infrastructure: AWS (within UAE data residency requirements)

• Payment processing services (PCI-DSS compliant)

• Email and notification service providers

We do not sell, rent, or trade your personal data to any third parties for marketing or commercial purposes.

All personal data is stored and processed exclusively within UAE (AWS me-central-1, Abu Dhabi). No data is transferred outside the UAE without explicit consent and adequate protection as required by PDPL.

• Account and profile data: Duration of account plus 3 years after termination

• Immigration documents: 5 years from last visa expiry (UAE labour law requirement)

• Employment certificates and transaction records: 7 years (UAE FTA financial compliance)

• Salary data: 7 years or until consent withdrawn, whichever is earlier

• Usage logs: 12 months on a rolling basis

After retention periods expire, data is securely deleted or anonymised. In the event HELLOU ceases operations, users will receive at least 90 days' notice.

• HELLOU will contain and investigate any breach immediately

• Notification to the UAE Data Office within 72 hours of discovery, as required by applicable regulations

• Notification to affected users without undue delay if the breach is likely to cause significant harm

• All breaches documented, including their effects and remedial actions taken

To report a suspected data breach: services@wehellou.com

• Right to Access — request a copy of personal data held about you

• Right to Rectification — request correction of inaccurate or incomplete data

• Right to Erasure — request deletion (subject to legal retention obligations)

• Right to Restriction — request limitation of processing in certain circumstances

• Right to Data Portability — request data in a structured, machine-readable format

• Right to Object — object to processing based on legitimate interests (including AI processing)

• Right to Withdraw Consent — withdraw consent for consent-based processing at any time via emailing services@wehellou.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

• Role-based access controls limiting data access to authorised personnel only

• Regular security audits and penetration testing

• Two-factor authentication for all administrative accounts

• Data stored exclusively within UAE territory

The Platform uses:

• Strictly necessary cookies — for authentication and session management. These cannot be disabled.

• Functional cookies — to remember your preferences and settings. Manageable via Account Settings > Privacy > Cookie Preferences.

We do not use advertising cookies or third-party tracking pixels. A cookie consent banner is presented on first access.

HELLOU has designated a Data Protection Officer (DPO) pursuant to PDPL Article 13. The DPO oversees data protection compliance and handles data subject rights requests.

Address: HELLOU CONSULTANCY & TECHNOLOGY L.L.C – S.P.C, Abu Dhabi, UAE

We may update this Privacy Policy from time to time. We will notify users of material changes via email or platform notification at least 14 days before the changes take effect. Continued use of the Platform after notification constitutes acceptance of the updated Policy.

This Consent Form is required under Article 12 of UAE PDPL. Documents you upload to HELLOU — including passport copies, Emirates ID, visa copies, medical certificates, and personal photographs — are classified as sensitive personal data requiring your explicit consent before any processing begins.

• Passport copy (biographical data page and all visa/stamp pages)

• Emirates ID card (front and back, including biometric reference number)

• UAE residence visa copy

• Medical fitness certificate — HEALTH DATA — see special notice below

• Personal photograph (biometric quality, white background)

• Labour contract or employment offer letter (including salary information — FINANCIAL DATA)

• Any other immigration or employment documents uploaded to the Platform

• Submission to UAE government portals (MOHRE, ICA, DHA) for visa and Emirates ID applications

• Sharing with your designated employer and/or manpower supplier as necessary for visa processing

• Secure storage in your HELLOU account for document management and renewal purposes

• Generation of employment certificates, salary certificates, and other requested documents

• Automated reminders when documents are approaching expiry

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal, but it may affect HELLOU’s ability to continue processing your visa application or providing related services.

• To withdraw consent:Send a withdrawal request from your registered email address to services@wehellou.com with the subject line “Consent Withdrawal”. HELLOU will confirm within 5 business days.

Effect of Withdrawal:

• Documents not subject to legal retention will be deleted within 30 days of withdrawal

• Documents subject to UAE legal retention obligations will be held for the mandated period and then securely deleted

• Ongoing visa applications may be affected — HELLOU will notify you of the impact before processing your withdrawal if an application is in progress

• You may re-consent at any time by ticking the consent checkbox on the upload screen

By ticking the consent on the HELLOU Platform, you confirm that you:

• (a) Have read and understood this Privacy Policy and Data Processing Consent Form

• (b) Freely, explicitly, and informedly consent to HELLOU processing your sensitive personal documents for the purposes of UAE visa processing and employment management services

• (c) Understand that your consent was recorded BEFORE any document upload was initiated

• (d) Are aware of your right to withdraw consent at any time via account settings or by email

• (e) Understand that health data (medical fitness certificate) has a separate consent option

• (f) Understand that AI features on the Platform are for reference only, that all decisions are made by the user, and that HELLOU is not responsible for any outcome arising from reliance on or rejection of any AI suggestion.

HELLOU Privacy Policy v1.1 · HELLOU CONSULTANCY & TECHNOLOGY L.L.C – S.P.C · services@wehellou.com