Privacy policy
What personal data we collect, why we collect it, who we share it with, and what you can ask us to do with it. Last updated 5 October 2026.
The short version
- This website sets no cookies, runs no analytics and loads nothing from other companies' servers. Fonts and images are hosted here.
- The quote form doesn't send anything to us by itself. It opens your own email app, and we only receive what you choose to send.
- We use your details to answer you, quote, deliver orders and meet our legal duties. We don't sell personal data and we don't use it for advertising.
- You can ask to see, correct or delete your data at any time by writing to privacy@amanitrading.ae.
1. Who is responsible for your data
The data controller is:
Bab Al Amani General Trading LLC
Office 541 D, 5th Floor, Office Tower, Al Ghurair Centre (Entrance 3), Al Rigga Road, Al Muraqqabat, Deira, Dubai, United Arab Emirates
Trade licence no. [000000], Department of Economy and Tourism, Dubai
Email: privacy@amanitrading.ae · Phone: +971 4 584 5996 · Mobile: +971 58 215 6089
Privacy contact: [Name, role]. Contact them at the email address above.
EU and UK representative. We are based outside the EU and UK. If we regularly offer goods or services to people in the EU or UK, or monitor their behaviour, we will appoint a representative under Article 27 GDPR / UK GDPR and list their details here: [Representative name and address, if appointed].
2. Which laws apply
We follow the data protection laws that apply to us and to the people we deal with, mainly:
- UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL);
- the EU General Data Protection Regulation (GDPR) and the UK GDPR, where they apply to you;
- Kenya's Data Protection Act, 2019;
- Uganda's Data Protection and Privacy Act, 2019;
- Tanzania's Personal Data Protection Act, 2022;
- Rwanda's Law No. 058/2021 relating to the protection of personal data and privacy;
- Ethiopia's Personal Data Protection Proclamation No. 1321/2024;
- Zambia's Data Protection Act No. 3 of 2021;
- Somalia's Data Protection Act, 2023;
- and other local laws in the countries we deliver to, where they apply.
Where these laws differ, we apply the stricter standard where we reasonably can.
3. What personal data we collect
When you visit this website
Like any web server, our hosting provider automatically records technical data for each request: IP address, date and time, the page requested, the referring page, browser type and operating system. We use it only to deliver the site, keep it secure and fix faults. We don't combine it with other data or use it to identify you.
When you contact us or request a quote
The form on our contact page runs only in your browser. When you press send, it opens your email app with a pre-filled message. Nothing is sent to us or stored by the website. If you then send the email, we receive what you included, usually your name, company, email address, phone number, the products you need, the destination and your message.
The same applies when you email, phone or message us directly.
When you contact us on WhatsApp
Our WhatsApp links only open WhatsApp when you click them. Nothing is loaded from WhatsApp before that. If you message us there, WhatsApp (operated by Meta Platforms) processes your phone number, profile name and messages under its own terms and privacy policy, and messages are end-to-end encrypted. We use what you send us for the same purposes as an email. If you'd rather keep Meta out of it, email or call us instead.
When you become a customer, supplier or partner
We process the business contact details of the people we work with, such as names, job titles, email addresses and phone numbers. We also keep order, delivery, invoicing and payment records. Some shipments require consignee or contact details on customs and transport documents.
We don't ask for, and you shouldn't send us, sensitive data such as health information, religious beliefs or biometric data. Please don't send identity document numbers or bank card details through email or the contact form unless we have specifically asked for them for a legal requirement.
4. Why we use your data, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Delivering the website and keeping it secure | Server log data | Legitimate interests in running a secure website (GDPR Art. 6(1)(f); PDPL Art. 4) |
| Answering questions and preparing quotes | Contact details, request content | Steps taken at your request before a contract (GDPR Art. 6(1)(b)), or legitimate interests where you write for a company |
| Fulfilling orders: sourcing, shipping, customs, delivery, after-sales | Contact, order and delivery data | Performance of a contract (GDPR Art. 6(1)(b)) |
| Invoicing, accounting, tax, customs and export control records | Order, invoice and payment data | Legal obligation (GDPR Art. 6(1)(c)), including UAE commercial, VAT and customs law |
| Fraud prevention and checking payment instructions | Contact and payment data | Legitimate interests in preventing fraud |
| Sanctions and anti-money-laundering screening of business partners | Names, company details | Legal obligation and legitimate interests |
| Defending or bringing legal claims | Any relevant data | Legitimate interests |
We don't send marketing newsletters. If we ever do, we will ask for your consent first where the law requires it, and you can withdraw it at any time.
We don't make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.
5. Who we share it with
We share personal data only when needed for the purposes above:
- Service providers working for us: website hosting ([hosting provider, country]), email ([email provider, country]), WhatsApp Business (Meta Platforms) when you choose to contact us there, accounting software and IT support. They act on our instructions under data processing agreements.
- Logistics partners: shipping lines, freight forwarders, trucking companies, clearing agents and inspection companies, when needed to move your goods.
- Banks, insurers and payment providers: for payments, letters of credit, bonds and cargo insurance.
- Authorities: customs, tax and other public bodies when the law requires it.
- Professional advisers: lawyers, auditors and accountants, under confidentiality duties.
We never sell personal data or share it for advertising.
6. International transfers
We are based in the UAE, and our business moves goods between the UAE and several African countries, so personal data is necessarily transferred across borders. For example, a consignee's name and phone number appear on a bill of lading travelling from Dubai to Mombasa.
The European Commission has not issued an adequacy decision for the UAE or most of the countries we deliver to. When the GDPR or UK GDPR applies to a transfer, we rely on:
- standard contractual clauses approved by the European Commission (or the UK International Data Transfer Addendum) with service providers; or
- where that isn't possible, the transfer being necessary to perform a contract with you or at your request (GDPR Art. 49(1)(b) and (c)).
For transfers out of the UAE we follow Articles 22 and 23 of the PDPL. For transfers out of Kenya, Uganda, Tanzania, Rwanda, Ethiopia, Zambia or Somalia, we follow the cross-border transfer rules in those countries' laws. You can ask us for a copy of the safeguards we use.
7. How long we keep it
| Data | Kept for |
|---|---|
| Web server logs | [14] days, unless needed to investigate a security incident |
| Enquiries and quotes that don't lead to an order | 24 months after our last contact |
| Customer and supplier contracts, orders, invoices and shipping documents | At least 5 years after the end of the financial year they relate to, as UAE commercial and tax law requires, or longer if another law or an open claim requires it |
| Tender documents | For the period set by the tender or the funding body, usually 5 to 7 years |
After that we delete or anonymise the data.
8. Security
We use technical and organisational measures to protect personal data. These include encrypted connections (HTTPS) for this website, access controls and multi-factor authentication on our email and business systems, limited staff access, and confidentiality agreements. If a breach is likely to put your rights at risk, we will notify the competent authority and you as the applicable law requires.
9. Your rights
Depending on the law that applies to you, you have the right to:
- access: ask for a copy of the personal data we hold about you;
- rectification: have inaccurate data corrected or incomplete data completed;
- erasure: have your data deleted when we no longer need it or have no legal basis for keeping it;
- restriction: ask us to limit how we use your data while a question about it is resolved;
- portability: receive data you gave us in a structured, machine-readable format, or have it sent to someone else;
- objection: object to processing based on our legitimate interests, and to direct marketing at any time;
- withdraw consent where we rely on consent, without affecting what we did before;
- not be subject to decisions based solely on automated processing (we don't make any).
To use any of these rights, email privacy@amanitrading.ae. We may need to confirm your identity first. We reply within one month, or sooner if your local law requires. If a request is complex we may extend that, as the law allows, and tell you why. Using your rights is free unless a request is clearly unfounded or excessive.
10. Complaints
Please tell us first if you're unhappy with how we've handled your data. We'd like the chance to put it right. You also have the right to complain to a data protection authority, for example:
- UAE: the UAE Data Office;
- Kenya: the Office of the Data Protection Commissioner (ODPC);
- Uganda: the Personal Data Protection Office (PDPO);
- Tanzania: the Personal Data Protection Commission (PDPC);
- Rwanda: the National Cyber Security Authority (NCSA);
- Zambia: the Office of the Data Protection Commissioner;
- Somalia: the Data Protection Authority;
- EU: the supervisory authority in the country where you live or work, or where the issue arose;
- UK: the Information Commissioner's Office (ICO).
11. Cookies
This website does not set cookies or use similar tracking technologies. The only exception is the optional Google map on our contact page. It loads only after you press "Show the map", and that is your consent (GDPR Art. 6(1)(a)). From then on Google, as an independent controller, receives your IP address and may set cookies. Details are in our cookie policy.
12. Other points
Children. Our services are for businesses and public bodies. We don't knowingly collect data from anyone under 18.
Links. Our pages may link to other websites. Their own privacy policies apply when you visit them.
Whether you have to give us data. You don't have to give us personal data to browse this site. To get a quote or place an order we need your contact details, and some shipments legally require consignee details. Without them we can't serve you.
13. Changes to this policy
We'll update this page when our practices or the law change, and change the date at the top. If a change materially affects how we use data you've already given us, we'll tell you directly.