Privacy Policy
How we collect, use, and safeguard your personal data
This Privacy Policy is compliant with the UAE Personal Data Protection Law (PDPL — Federal Decree-Law No. 45 of 2021) and applicable GCC data protection regulations. All personal data we process is subject to these protections.
1. Introduction
EMTEJA is a brand name of e-invoicing solution of Infocus Technologies LLC-FZ, it operates the EMTEJA enterprise e-invoicing platform and related services.
This Privacy Policy explains what personal data we collect when you use our platform, website (emteja.com), or related services; how we use and protect it; and the rights available to you under applicable law.
By accessing or using our services, you acknowledge that you have read and understood this Policy. For questions, please contact our Data Protection Officer at security@emteja.com.
2. Information We Collect
We collect personal data in the following categories:
Account Information
Name, business email, job title, company name, phone number.
Business & Tax Data
VAT/TRN registration numbers, company registration, invoice transaction data.
Technical Data
IP address, browser type, OS, pages visited, session duration, error logs.
Communications
Support tickets, demo requests, form submissions, email correspondence.
ERP Integration Data
API credentials, connection logs, and data transmitted through integrations.
Payment Data
Billing contact details and invoice history. Card data is processed by PCI-DSS compliant third parties.
3. How We Use Your Information
We process personal data only for specific, lawful purposes:
- Delivering, maintaining, and improving the EMTEJA platform and services
- Processing electronic invoices and submitting data to UAE FTA as required by law
- Managing your account, licences, and subscription billing
- Providing technical support, onboarding, and training
- Sending service notifications, security alerts, and compliance updates
- Conducting security monitoring, fraud detection, and abuse prevention
- Analysing aggregate usage patterns to improve user experience
- Complying with UAE legal and regulatory obligations
We do not sell personal data to third parties. We do not use personal data for automated decision-making that produces legal or similarly significant effects without human review.
4. Data Residency
UAE-First Data Residency
All customer data — including invoice records, account information, and transaction logs — is stored exclusively in UAE-based data centres. We do not transfer personal data outside the UAE without your explicit written consent and appropriate safeguards as required by UAE PDPL Article 26.
5. Data Retention
We retain data for the minimum period necessary to fulfil the purpose for which it was collected:
| Data Category | Retention Period | Legal Basis |
|---|---|---|
| Invoice transaction data | 7 years minimum | UAE VAT Law requirement |
| Account & contact data | Duration + 2 years post-termination | Contractual obligation |
| Technical logs | 12 months | Security & fraud detection |
| Support communications | 3 years | Dispute resolution |
| Marketing consents | Until withdrawn | Consent (withdrawable) |
6. Your Rights Under UAE PDPL
Under the UAE Personal Data Protection Law, you have the following rights:
Right to Access
Request a copy of the personal data we hold about you.
Right to Rectification
Correct inaccurate or incomplete personal data.
Right to Erasure
Request deletion of your data where no legal obligation requires retention.
Right to Data Portability
Receive your data in a structured, machine-readable format.
Right to Withdraw Consent
Withdraw consent for consent-based processing at any time.
Right to Object
Object to processing based on legitimate interests.
To exercise any right, email security@emteja.com. We will respond within 30 days. Where requests are complex or numerous, we may extend this by a further 30 days with notice.
7. Security Measures
We implement technical and organisational measures appropriate to the risk level of our processing:
- AES-256 encryption at rest; TLS 1.3 for all data in transit
- Multi-factor authentication (MFA) and role-based access control (RBAC)
- Continuous security monitoring and intrusion detection systems
- Annual penetration testing by independent third-party security firms
- Data breach notification within 72 hours as required by UAE PDPL
8. Third-Party Processors
We engage carefully selected sub-processors who meet our data protection standards. Categories of sub-processors include:
- Cloud infrastructure providers (UAE-region data centres only)
- Payment processors (PCI-DSS certified; receive billing contact data only)
- Customer support platforms (access to support ticket content only)
- Analytics providers (aggregated, anonymised data only)
All sub-processors are bound by data processing agreements consistent with UAE PDPL requirements.
9. Policy Changes
We may update this Privacy Policy periodically to reflect changes in law, our practices, or the services we offer. Material changes will be notified via email or a prominent notice on our platform at least 30 days before they take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.
10. Contact & Data Protection Officer
Registered Address
EMTEJA / Infocus Technologies
Dubai, United Arab Emirates