OUR PRIVACY POLICY

01 Introduction

MKAY Event Services ("MKAY," "we," "us," or "our") provides end-to-end live event production, operations, and creative services across the United Arab Emirates, the Kingdom of Saudi Arabia, Qatar, and internationally. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website at www.mkayevents.com (the "Site"), engage us for services, submit a project brief or RFP, apply for a role with us, or otherwise interact with us.

We take the privacy of our clients, partners, talent, vendors, and website visitors seriously. Please read this policy carefully. By using the Site or providing us with your information, you acknowledge that you have read and understood the practices described here.

02 Who We Are

MKAY Event Services is the data controller responsible for the personal information described in this policy, unless we are acting as a data processor on behalf of a client (for example, when managing attendee lists or staffing rosters for an event we are delivering on a client's behalf) — in which case the client is the controller and MKAY processes that data under their instruction.

Registered Entity. MKay Events

UAE Office Dubai, United Arab Emirates: +971 50 118 3785

KSA Office Kingdom of Saudi Arabia: +966 53 382 2608

Qatar Office Qatar: etails on request

Email: info@mkayevents.com

This policy is primarily governed by UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL"), the UAE's federal data protection law, and its Executive Regulations. The PDPL applies to organisations operating in mainland UAE (including our Dubai office) that process personal data wholly or partly through electronic means. Where we operate in or process data relating to individuals in Saudi Arabia or Qatar, we also observe the relevant local data protection law of that jurisdiction, as noted throughout this policy.

Free zone note: If MKAY's UAE entity is registered in — or processes data on behalf of a client registered in — a financial free zone such as the DIFC or ADGM, that entity's processing may instead fall under the DIFC Data Protection Law or ADGM Data Protection Regulations, which operate as separate regimes with their own regulators. Please confirm your entity's registration status with legal counsel so this section can be finalised accurately.

The PDPL is enforced by the UAE Data Office (established under Federal Decree-Law No. 44 of 2021), the UAE's federal data protection regulator. Where our processing activities meet the thresholds set out in the Executive Regulations (for example, large-scale processing of sensitive personal data), MKAY will appoint a Data Protection Officer and publish their contact details here.

03 Scope of This Policy

This policy covers personal information we collect through:

Our website, including contact forms, project brief submissions, and newsletter sign-ups;
Direct communications — email, phone, WhatsApp, or in person — related to a proposed or active event;
The delivery of our services on-site at events (for example, staff, crew, or vendor coordination);
Recruitment and career applications; and
Our social media pages and professional networking profiles, where applicable.

It does not cover the practices of third parties we do not control, including venues, artists' management, ticketing platforms, or other vendors who may separately collect information in connection with an event —

we encourage you to review their respective privacy policies.

04Information We Collect

Information You Provide to Us

Contact and identification details — name, job title, company name, email address, phone number, and country.

Project information — event briefs, budgets, guest lists, venue preferences, technical riders, and other details you share when requesting a proposal.

Communications — records of correspondence, meeting notes, and support requests.

Recruitment data — CV/resume, cover letter, portfolio, references, and interview notes, if you apply for a role with us.

Payment and billing information — invoicing details for clients and vendors (we do not store full payment card numbers; these are processed by our banking or payment partners).

Information Collected Automatically

Device and usage data — IP address, browser type, operating system, referring URLs, pages viewed, and time spent on the Site.

Cookies and similar technologies — see Section 7 below.

Approximate location — inferred from IP address, for analytics purposes only.

Information From Third Parties

Referrals from event partners, agencies, or existing clients who introduce us to a new project;

Publicly available information from professional networking platforms, used for business development; and

Information from venues, authorities, or vendors that is reasonably necessary to deliver a contracted event (e.g., accreditation lists, security clearances).

We do not knowingly collect sensitive categories of personal data (such as health information, religious beliefs, or biometric data) through the Site, except where strictly necessary for event operations — for example, dietary or accessibility requirements shared voluntarily for hospitality planning, or accreditation and security screening required by a venue or governmental authority.

05How We Use Your Information

We use the information we collect to:

Respond to enquiries and prepare proposals, quotes, and event plans;
Plan, deliver, staff, and manage live events and productions;
Coordinate with venues, authorities, vendors, and talent management on your behalf;
Process invoices, payments, and vendor or supplier onboarding;
Communicate updates, scheduling changes, and operational information before and during an event;
Evaluate job applications and manage recruitment;
Operate, secure, and improve the Site and our internal systems;
Send marketing communications, where you have opted in (see Section 13); and
Comply with legal, regulatory, permitting, and licensing obligations across the jurisdictions in which we operate.

06 Our Legal Basis for Processing

Under the PDPL, we process personal information only where we can rely on one of the following lawful grounds:

Consent — freely given, specific, informed, and unambiguous, and capable of being withdrawn at any time (for example, opting in to marketing emails or non-essential cookies).
Performance of a contract — processing necessary to deliver the services you or your organisation have engaged us for, or to take steps at your request before entering a contract.
Compliance with a legal obligation — for example, permitting, licensing, tax, or health and safety requirements.
Protection of vital interests — where necessary to protect someone's life or physical safety, including on-site at an event.
Performance of a task carried out in the public interest — in limited circumstances involving government or regulatory coordination.
Our legitimate interests, or those of a third party — such as business development, Site security, and improving our services — balanced against your rights and reasonable expectations.

Where we process any special category of personal data (see Section 4.3), we do so only where an additional lawful ground under the PDPL applies — such as your explicit consent, a legal or judicial requirement, or where the data has manifestly been made public by you.

The Executive Regulations to the PDPL have been issued by Cabinet Decision, with public legal commentary citing differing decision numbers as the Regulations have evolved. Please confirm the current, correctly cited Cabinet Decision number with legal counsel before this policy is published.

07 Cookies & Tracking Technologies

Our Site uses cookies and similar tracking technologies to operate reliably, understand how visitors use the Site, and, where you consent, to support marketing efforts.

Strictly Necessary: Required for the Site to function — e.g., security, load balancing. Cannot be disabled.

Analytics: Help us understand aggregate visitor behaviour so we can improve site performance and content.

Functional: Remember preferences such as language or region.

Marketing: Used, where consented to, to measure the effectiveness of campaigns and social media content.

You can control or disable cookies through your browser settings [and via our cookie banner/preference centre, if implemented]. Disabling certain cookies may affect the functionality of the Site.

The UAE does not currently have a dedicated cookie-specific regulation (unlike the EU's ePrivacy rules). However, where a cookie or similar technology collects personal data, that collection is subject to the general principles of the PDPL described throughout this policy, including the requirement for a valid lawful basis such as consent.

08 How We Share Your Information

We do not sell personal information. We may share information with:

Service providers and vendors — staging, AV, logistics, security, F&B, staffing agencies, and other subcontractors engaged to deliver a specific event, on a need-to-know basis.
Venues and authorities — for permitting, licensing, accreditation, and HSSE compliance.
Talent management and agents — where booking or coordinating artists and performers.
Professional advisors — lawyers, accountants, and insurers, where necessary.
Technology providers — website hosting, email, analytics, and customer relationship management platforms, under appropriate data processing agreements.
Government or regulatory bodies — where required by law, court order, or to protect the rights, safety, or property of MKAY, our clients, or the public.
Successors — in connection with a merger, acquisition, or sale of business assets, subject to standard confidentiality protections.

09 International Data Transfers

Given the international nature of live events, information may be transferred to, stored, and processed in countries other than where it was originally collected — including the UAE, Saudi Arabia, Qatar, and countries where our vendors, cloud providers, or event venues are located.

Under the PDPL, we may transfer personal data outside the UAE where:

The destination country or territory is recognised by the UAE Data Office as providing an adequate level of protection; or, where it is not, where one of the following safeguards applies:
The transfer is made under a contract that incorporates the PDPL's data protection requirements (equivalent to standard contractual clauses);
We have obtained your express consent to the specific transfer, after informing you of the possible risks;
The transfer is necessary for the performance of a contract between you and MKAY, or a contract entered into in your interest;
The transfer is necessary for international judicial cooperation; or
The transfer is necessary to protect the public interest.

We take reasonable steps to ensure any cross-border transfer receives a level of protection consistent with this policy and the PDPL, including through contractual safeguards with recipients such as our hosting, email, and analytics providers.

10 Data Retention

We retain personal information only for as long as reasonably necessary to fulfil the purposes described in this policy, including satisfying legal, accounting, or reporting requirements. Retention periods vary by data type:

Enquiry/proposal data Retained for up to 24 months if no engagement results, to allow for follow-up.

Client & project records Retained for the duration of the relationship plus a period required for tax, contractual, and insurance purposes (typically 5–7 years).

Recruitment data Retained for 12 months for unsuccessful applicants, unless you ask us to delete it sooner or consent to a longer period for future opportunities.

Marketing data: Retained until you unsubscribe or withdraw consent.

11 Data Security

We implement administrative, technical, and physical safeguards designed to protect personal information against unauthorised access, alteration, disclosure, or destruction — including access controls, encryption in transit, and confidentiality obligations for staff and subcontractors. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

In the event of a personal data breach that is likely to compromise the confidentiality, integrity, or availability of your personal information, we will notify the UAE Data Office without undue delay, and in any case within the timeframe required under the PDPL and its Executive Regulations (commonly understood to be within 72 hours of becoming aware of the breach). Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly, providing details of the breach and the steps we are taking in response.

12 Your Privacy Rights

Under the UAE PDPL, you have the right to:

Be informed about how your personal data is collected and used, in a clear and transparent manner;
Access the personal information we hold about you, and receive a copy of it;
Correct inaccurate or incomplete information;
Erase your personal data ("right to be forgotten"), subject to legal or contractual retention requirements;
Restrict or object to certain processing, including for direct marketing purposes;
Receive and transfer your data in a structured, commonly used format, where technically feasible (data portability);
Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out beforehand;
Object to processing based on automated decision-making that produces legal effects concerning you or significantly affects you; and
Lodge a complaint with the UAE Data Office, the federal regulator responsible for the PDPL, if you believe your rights have been violated. [Insert current UAE Data Office complaint channel / URL once confirmed.]

If you are located in Saudi Arabia or Qatar, equivalent rights are available to you under the Saudi Personal Data Protection Law or Qatar's Law No. 13 of 2016, respectively, and you may raise a complaint with the relevant local authority in those jurisdictions.

To exercise any of these rights, contact us using the details in Section 17. We aim to respond within the timelines required by applicable law, and may need to verify your identity before actioning a request. We may decline requests that are manifestly unfounded, excessive, or where an exemption applies under the PDPL or other applicable law.

13 Marketing Communications

Where you have opted in, we may send you updates about MKAY's work, industry insights, and event highlights. You can opt out at any time by using the unsubscribe link in any marketing email or by contacting us directly. Opting out of marketing communications does not affect operational communications related to an active project or event.

14 Children's Privacy

Our Site and services are directed at businesses and individuals over the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected information from a minor without appropriate consent, we will take reasonable steps to delete it.

15 Third-Party Links

Our Site may contain links to third-party websites, social media platforms, or client and partner sites. We are not responsible for the privacy practices or content of those third parties. We encourage you to review their privacy policies before providing any personal information.

16 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. The "Last Updated" date at the top of this page indicates when it was last revised. Material changes will be communicated through the Site or, where appropriate, directly to affected individuals.

17 Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us:

Data Protection Enquiries

MKAY Event Services

info@mkayevents.com
UAE +971 50 118 3785 · KSA +966 53 382 2608
If you are not satisfied with our response, you have the right to lodge a complaint directly with the UAE Data Office, the federal authority responsible for enforcing the PDPL. [Insert current UAE Data Office contact details/complaint portal once confirmed with legal counsel.]