Privacy Policy

The law this policy follows

Sikkah is based in the United Arab Emirates and handles personal data under Federal Decree Law No. 45 of 2021 on the Protection of Personal Data and the other laws that apply in the UAE. Where your organisation is subject to another data protection regime, tell us and we will work with you on what that requires.

Sikkah is the controller of the data described here. For anything in this policy, write to hello@sikkah.ae.

What we collect

To run Sikkah for Corporate we hold:

• Account details: your work email address, your name, and the organisation you belong to with your role in it.
• Company details: the organisation's name, legal name, billing address, emirate, industry, team size, tax registration number, and the email addresses that receive your documents.
• Event details: the name, date, start time, venue, access notes, headcount, the on site contact's name and phone number, and any security or setup notes you write.
• Bookings and payments: what you booked, the amounts, the payment method, the card brand and last four digits returned by Stripe, the bank transfer receipt you upload, and refunds.
• Baskets and wishlists you build, including guest baskets made before you log in.
• Messages you send to vendors through Sikkah.
• Technical records: the IP address and time of each log in and of actions in the audit log.

We do not collect card numbers; those go to Stripe directly. We do not use advertising or tracking SDKs and we do not sell data.

How long we keep it

What vendors see

A vendor on your booking receives what they need to deliver on the day: the event name, date and start time, the venue and access notes, the headcount, the options you chose, and the on site contact's name and phone number. They see your organisation's name. They never see your card details, your billing information, your other vendors' prices, or the personal details of anyone else in your team.

Messages you write to a vendor are relayed by Sikkah and kept on the booking record. Your email address is not passed to the vendor.

Processors

These providers process data only on our instructions:

• Supabase, for the database, authentication and private document storage.
• Stripe, for card payments and saved cards.
• Resend, for transactional email such as log in codes, confirmations and documents.
• Vercel, for hosting sikkah.ae.

Data may be stored or processed outside the UAE by these providers. Each holds recognised security certifications and is bound by a data processing agreement.

Your rights

You and the people in your organisation can:

• Access what Sikkah holds about your organisation from the dashboard, or ask us for a copy.
• Correct company and account details from the dashboard at any time.
• Request deletion of the organisation from the dashboard. The owner submits the request with a reason, a 30 day hold begins during which the request can be cancelled, and after the hold personal data is removed within 30 days. Commercial records such as receipts are kept for the period above as the law requires.
• Object to or ask us to restrict a use of your data by emailing us.

We reply within a few working days. If you are not satisfied with our answer you can raise it with the UAE Data Office.

Security

Data is encrypted in transit and at rest, each organisation's rows are isolated by row level security, and the database is backed up daily. The full statement is on the Security page.

Changes to this policy

When this policy changes in a way that matters, the date at the top changes and organisation owners are told by email.

Contact

For any privacy question, or to exercise a right above, email hello@sikkah.ae.