Privacy Policy

This policy explains how Sandstone Systems FZE handles personal data collected through sandstonesystems.com. It covers the two things this website actually does with personal data: our contact form and our job-application form. It applies to everyone who contacts us, wherever in the world you are. Where your local law gives you specific data-protection rights, for example under the UAE Personal Data Protection Law or the EU and UK GDPR, this policy is written to respect them.

Who we are

Sandstone Systems FZE is a Free Zone Establishment (Limited Liability) registered in the Ajman Free Zone, United Arab Emirates, under Licence and Registration No. 55415 issued by the Free Zones Authority of Ajman (Ajman Free Zone), first issued 29 June 2026. Our registered office is at Ajman Free Zone, C1 Building, Ajman, United Arab Emirates.

For anything you submit through this website, we are the data controller. If you have a question about this policy or want to exercise your rights, contact us at hello@sandstonesystems.com.

What we collect

We only collect what you choose to send us through a form. We do not build profiles, and we do not buy or enrich personal data from third parties.

Contact form

Your name, your email address, your company (optional), and the message you write.

Job-application form

Your name, your email address, your company (optional), your message, the role you are applying for, and a CV or profile link that you provide yourself. We do not host uploaded files through this form; the link points to content you already control.

Technical data

When you submit a form, our server and the proxy in front of it may record technical information such as your IP address and the time of the request in standard server logs. A hidden anti-spam field may be present in the form; it is a spam filter and is not intended to capture personal data.

Our forms are delivered in two ways: a mailto link that opens your own email client, and a backend relay that accepts the submission and forwards it to us by email. Which one you use does not change what we collect.

Why we use it, and our legal basis

We process this data under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, for visitors in the EU and the UK, under the EU/UK GDPR. Our purposes and the corresponding GDPR Article 6 legal bases are:

• To read and respond to a contact enquiry: taking steps at your request prior to entering into a relationship with you (GDPR Article 6(1)(b)).
• To assess and correspond about a job application: taking steps at your request before any employment relationship (GDPR Article 6(1)(b)) and, in any case, our legitimate interest in assessing and communicating with candidates (GDPR Article 6(1)(f)).
• To keep the service available and to protect it from abuse (including a rate limit of 8 submissions per 10 minutes per IP address, and standard server logging), which is in our legitimate interest in operating and securing the site (GDPR Article 6(1)(f)).

Under the UAE PDPL we rely on the equivalent grounds: processing that is necessary to respond to your request and to carry out our legitimate operational and security interests. We do not use your data for advertising, and we do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

No cookies and no tracking

sandstonesystems.com does not set cookies, run analytics, or load advertising or tracking scripts.

Who we share it with

We do not sell personal data and we do not share it for marketing. We rely on a small number of service providers who act as processors or sub-processors strictly on our instructions:

• An email delivery provider (SMTP), which transmits your form submission from our backend relay to our internal mailbox.
• Our hosting provider, which runs the containerised web and server infrastructure for this site on servers in Germany (European Union).

We may also disclose personal data where we are required to do so by law or by a competent authority.

International transfers

The website and its server infrastructure are hosted in Germany, within the European Union. We are, however, established in the United Arab Emirates: the messages you send us are received and read by us in the UAE, so personal data you submit is accessed from, and may be stored in, the UAE. The UAE has not been recognised by the European Commission as providing an adequate level of protection. Where personal data of visitors in the EU or the UK reaches us in the UAE, that transfer is limited to what is necessary to answer your enquiry or process your application and is made on the basis of appropriate safeguards. You can ask us for more detail about the safeguards that apply to your data at hello@sandstonesystems.com.

How long we keep it

We keep contact enquiries for as long as needed to handle your request and for a short period afterwards for reference, then delete them. We keep job applications for the duration of the relevant hiring process and for a limited period afterwards, unless we agree with you to keep your details on file for future roles. Server logs containing technical data such as IP addresses are kept only for a short operational and security window and are then rotated out.

Your rights

Depending on where you are, the UAE PDPL and the EU/UK GDPR give you rights over your personal data. These include the right to access the data we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, and, where it applies, to receive it in a portable form or to withdraw a consent you have given.

To exercise any of these rights, email us at hello@sandstonesystems.com. We will respond within the timeframes required by the applicable law.

If you believe we have not handled your data properly, you can lodge a complaint. In the UAE, you may complain to the UAE Data Office. In the EU or the UK, you may complain to your local data protection supervisory authority. We would appreciate the chance to address your concern first, so please consider contacting us before you do.

How we protect it

We apply technical and organisational measures appropriate to a small, form-based site: transport encryption for the website, a rate limit and a spam filter on submissions, access controls on the mailbox that receives them, and containerised infrastructure kept under maintenance. No method of transmission or storage is completely secure, but we work to keep the risk to your data low.

Changes to this policy

We may update this policy as our practices or the applicable law change. When we do, we will revise the date shown at the top of this page. Material changes will be reflected here.