Privacy Policy

JMC Consulting LLC ("JMC", "we", "us", or "our") is a business consulting firm registered in Dubai, UAE, operating at Dubai World Trade Center, Dubai UAE. We are the data controller for personal information collected through this website (jmcmena.com) and any related forms or communications.

We are committed to protecting your personal data in accordance with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA) where applicable.

We collect the following categories of personal information:

• Contact details: name, email address, phone number, and company name — provided when you submit a booking request or complete our SME Health Survey.
• Survey responses: answers to our diagnostic questionnaire and any free-text comments you choose to provide.
• Usage data: IP address, browser type, pages visited, and time spent on the site — collected automatically via server logs and analytics tools.
• Communications: contents of emails or messages you send us directly.

We do not collect payment card data, government ID numbers, or special-category sensitive data.

We use your personal data for the following purposes and legal bases:

Survey results are used solely for internal analysis and service improvement. We do not publish individual responses or share them with third parties without your explicit consent.

This website uses strictly necessary cookies required for basic functionality (session management, security). We do not currently use advertising or behavioural tracking cookies. If this changes, we will update this policy and obtain consent where required.

You can control cookies through your browser settings. Disabling cookies may affect certain site features.

We do not sell, rent, or trade your personal data. We may share information with:

• Service providers: hosting providers, email delivery services, and CRM tools that process data on our behalf under data processing agreements.
• Professional advisors: lawyers and accountants, under duties of confidentiality.
• Regulators or law enforcement: when required by applicable law, court order, or regulatory authority.

All third-party processors are contractually required to protect your data and may not use it for their own purposes.

Our servers are located in the European Economic Area (EEA) and/or UAE. If your data is transferred outside your jurisdiction, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent mechanisms.

• Booking enquiries: 3 years from the date of last contact, or as long as needed to manage an ongoing client relationship.
• Survey responses: 2 years, in anonymised or aggregated form thereafter.
• Marketing communications: until you unsubscribe or withdraw consent.
• Legal obligations: as required by UAE commercial law (minimum 5 years for financial records).

Depending on your location, you have the following rights regarding your personal data:

• Access: request a copy of the data we hold about you.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): request deletion of your data, subject to legal retention obligations.
• Restriction: ask us to limit processing while a dispute is resolved.
• Portability: receive your data in a structured, machine-readable format (GDPR).
• Objection: object to processing based on legitimate interest.
• Withdraw consent: at any time, where processing is consent-based.
• Non-discrimination (CCPA): we will not discriminate against you for exercising your privacy rights.

To exercise any right, contact us at hello@jmcmena.com. We will respond within 30 days (GDPR) or 45 days (CCPA). We may need to verify your identity before processing your request.

If you are in the EEA, you have the right to lodge a complaint with your local data protection authority. If you are in the UAE, you may contact the UAE Data Office.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encrypted connections (TLS), access controls, and regular security reviews.

In the event of a data breach that is likely to result in high risk to your rights, we will notify you and the relevant supervisory authority within 72 hours, as required by GDPR.

This website is not directed at children under the age of 16. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us immediately.

We may update this Privacy Policy from time to time. Material changes will be communicated via a notice on this page with an updated effective date. We encourage you to review this page periodically.

For any privacy-related questions, requests, or complaints: