What the desk keeps, for how long, and why.

1. Controller

dubaitopupdesk (Al Sharq St, Al Qulai'aah, Sharjah, UAE — TRN 100 458 273 100 003) is the controller of personal data submitted through this website. Contact: help@dubaitopupdesk.org.

2. What is collected

1. Request data: the Etisalat mobile number you entered, the AED amount, your name, your email, any optional notes.
2. Correspondence: the email or WhatsApp thread that follows the request. Kept as part of the closure record.
3. Payment metadata: the last four digits of the card, the transaction reference and the timestamp — passed from the payment processor. The desk never receives the full card number.
4. Technical logs: IP address, user-agent, referrer — retained for 30 days to detect abuse.

3. Why the desk collects it

1. To read and act on the top-up request (contract performance).
2. To follow up on refunds, complaints and re-posts (legitimate interest / contract).
3. To meet UAE record-keeping obligations for taxable retail transactions (legal duty).
4. To send the closure email and, only if you tick the footer subscribe box, the small notes email when the process changes (consent).

4. Retention windows

1. Request data + correspondence: 5 years, in line with UAE record-keeping duties for VAT-relevant transactions.
2. Payment metadata: 5 years, same window, passed on to the payment processor.
3. Technical logs: 30 days.
4. Newsletter emails: until you unsubscribe, then removed within 30 days.

5. Who sees the data

1. The manager on the desk, for reading and answering the request.
2. The payment processor, for handling the card transaction. They receive your name, email and amount; not the Etisalat number.
3. The mobile carrier, for posting the top-up. They receive the Etisalat number and the amount.
4. Competent UAE authorities on a valid legal order.

Data is not sold, rented, or shared with ad networks. There are no third-party trackers on this site.

6. Your rights

1. Access — get a copy of the data the desk holds on you.
2. Correction — fix a mistake in a stored field.
3. Deletion — remove data outside legal retention duties.
4. Objection — ask the desk to stop using data for reasons beyond the request itself.
5. Portability — receive your request record in a machine-readable file.

Write to help@dubaitopupdesk.org to exercise any of the above. Reply in the standard 24-hour window.

7. Cookies

This site uses one first-party cookie: xk_pref, to remember the language you chose (EN or AR). No third-party cookies, no ad IDs, no analytics beacons.

8. Children

The desk does not knowingly process data of users under 18. If a request is placed on behalf of a minor, an adult must supply the details and take responsibility.

9. Changes to this policy

Material changes are announced on this page with a new "last updated" date. If a change materially affects a running request, the version in force at the time of the request applies.