Who is responsible for your data
KAWN is operated by [KAWN legal entity name], [registered address], [trade licence number and issuing authority] ("KAWN", "we"). KAWN is the controller of the personal data described in this notice.
Privacy contact: [privacy contact email]. [data protection officer or privacy lead, if appointed]. [EU representative under GDPR Art. 27, if required].
KAWN is a UAE company, so the federal UAE Personal Data Protection Law applies to it. If KAWN's operating entity is established in the Dubai International Financial Centre or Abu Dhabi Global Market, the DIFC Data Protection Law 2020 or the ADGM Data Protection Regulations 2021 apply instead. Where you live in another country, its data protection law may also apply; the section "Your rights where you live" lists them. [Verify with counsel.]
The data we collect
We collect only what the platform needs to work. Depending on your role:
- Account: your name, email address, role, company (clients), job title (client contacts), phone number (engineers and client contacts), profile photo, account status, the date you joined, when you last signed in, which version of these terms you accepted and when. Your password is stored only as a one-way hash; an admin second factor is stored encrypted.
- Profile: for designers, country, city, areas of expertise, a short bio, up to two portfolio links and preferred categories; for engineers, discipline, city and a short bio.
- Your work: designs you upload (title, description, materials, keywords, dimensions, price and payment terms, images and technical files), briefs your company publishes, responses and revised concepts you submit, engineering jobs and the files delivered with them.
- Messages: the chat messages and attachments you send on the platform.
- Commercial records: purchase requests and confirmations, and fee records (amount, payment structure, status, reference) for purchases, design-for-hire and engineering jobs. Payment itself happens outside the platform.
- Activity: designs you like or save, the days you viewed a design, and the notifications we show you with whether you read them.
- Security records: your sign-in sessions, with a keyed hash of your IP address and browser (never the address itself), short-lived counters that limit repeated attempts, one-time codes and links stored only as hashes, and a log of administrative and sensitive actions (for example a status change or a download of source files).
We do not use advertising, analytics or tracking tools, and we do not buy data about you from others.
Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account, showing your profile and work to the people the platform rules allow, briefs, purchases, chats and engineering jobs | Performing our contract with you (GDPR Art. 6(1)(b); UAE PDPL Art. 4, processing necessary to perform a contract, and the equivalent basis of the other laws) |
| The three service emails: your registration code, an invitation and a password reset link | Performing our contract with you |
| Keeping the platform secure: sessions, limits on repeated attempts, the audit log, malware checks on uploads | Our legitimate interest in protecting users and the service (GDPR Art. 6(1)(f)); under the UAE PDPL and laws without a legitimate-interest basis, the contract and your acceptance of this notice |
| Moderating chats and listings when a problem is reported or a dispute needs it (moderators’ views are themselves logged) | Our legitimate interest in a safe marketplace and in resolving disputes |
| Keeping purchase and fee records | Legal obligations on commercial and tax records (GDPR Art. 6(1)(c); UAE PDPL Art. 4 and the equivalent basis of the other laws) |
We do not send marketing, we do not profile you and no decision about you is made by automated means. We do not ask for separate consent for what the contract requires; if we ever want to use your data for something that needs consent, we will ask first and you can withdraw it at any time. Where the law of your country requires your consent for the processing described here, you give it when you accept this notice on creating your account or accepting your invitation. [Verify with counsel.]
Who sees it
- Other users, as the platform rules allow: clients see designers’ public profiles and listed designs; designers see the open briefs they may answer; the people in a chat see its messages; source files unlock only for a buyer after a confirmed purchase. Contact details are not shown to other users.
- KAWN staff with an admin role, limited by the permissions of that role.
- Our processors, under written contracts: [hosting provider, for example Microsoft Azure, UAE North region] hosts the application, database and files; [email delivery provider] delivers the three service emails.
- Authorities, courts or professional advisers when the law requires it or to establish, exercise or defend legal claims.
We do not sell personal data.
Where it is stored
Your data is stored and processed in the United Arab Emirates. We do not transfer it to another country by default. If you use KAWN from outside the UAE, for example from Saudi Arabia, Egypt or the European Union, your data is sent to and kept in the UAE so the platform can serve you.
Several countries allow personal data to leave them only under conditions (for example Saudi Arabia, Egypt, Bahrain, Oman, Jordan and the European Union). For those transfers KAWN relies on [transfer mechanism per country, for example an adequacy decision, standard contractual clauses, a regulator licence or permit, or consent, to be confirmed by counsel]. Should a processor ever need to process data outside the UAE, we will do so only under the safeguards the applicable laws require, and update this notice first.
How long we keep it
| Record | Kept for |
|---|---|
| Your account, profile, work and messages | While your account exists, until you ask us to erase it |
| Sign-in sessions | Until they expire, then 30 days |
| One-time codes, reset links and invitations | 30 days after they were used or expired |
| Designer registrations that were never confirmed | 30 days, then deleted |
| Counters that limit repeated attempts | One day |
| The keyed hash of a session’s IP address and browser | 365 days from sign-in |
| Notifications you have read | 365 days after they last changed |
| Purchase and fee records | [period UAE law requires for commercial and tax records, for example five years], also after an erasure (without your name) |
| The audit log of administrative and sensitive actions | Kept as an accountability record; it holds account ids, never email addresses or phone numbers |
Your rights and how to use them
Under the UAE law, the law of the country where you live and, where it applies, GDPR you can ask to access your data, to receive it in a portable format, to correct it, to erase it, to restrict or object to its processing, and to withdraw any consent you gave.
- Access and portability: use “Download my data” in your profile or account page. You get a JSON file with everything KAWN holds about you and links to download the files you uploaded.
- Correction: edit your profile at any time. To change your sign-in email or a detail you cannot edit, contact us.
- Erasure: write to [privacy contact email] or ask a KAWN administrator. We replace your personal data with neutral values, delete your sessions, profile, photo and the designs and files nobody else depends on, and keep only the records the law or a contract requires (purchases, fee records and the designs a client bought), without your name.
- Restriction or objection: write to [privacy contact email]. An administrator can disable an account while a request is examined.
We acknowledge a request within 3 working days and answer it within the shortest period the law that applies to you sets (see the next section), and within 30 days at the latest. We may ask you to confirm your identity first. Using your rights is free of charge. [Verify with counsel.]
Your rights where you live
The rights above apply wherever you are. The law of your country and the authority you can complain to are:
| Where you live | Law | Authority |
|---|---|---|
| United Arab Emirates | Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (its executive regulations are pending) [verify with counsel] | UAE Data Office |
| UAE free zones (DIFC, ADGM) | DIFC Data Protection Law No. 5 of 2020 or ADGM Data Protection Regulations 2021, if KAWN’s entity is established there [verify with counsel] | DIFC Commissioner of Data Protection, or ADGM Office of Data Protection |
| Saudi Arabia | Personal Data Protection Law and its Implementing and Transfer Regulations; requests answered within 30 days (amendments under consultation) [verify with counsel] | Saudi Data and Artificial Intelligence Authority (SDAIA) |
| Qatar | Law No. 13 of 2016 on Personal Data Privacy Protection [verify with counsel] | National Cyber Governance and Assurance Affairs, National Cyber Security Agency |
| Bahrain | Law No. 30 of 2018 on Personal Data Protection [verify with counsel] | Personal Data Protection Authority |
| Oman | Royal Decree No. 6 of 2022 on Personal Data Protection and its executive regulations; requests answered within 45 days [verify with counsel] | Ministry of Transport, Communications and Information Technology |
| Kuwait | CITRA Data Privacy Protection Regulation (Decision No. 26 of 2024), where it applies to KAWN [verify with counsel] | Communication and Information Technology Regulatory Authority (CITRA) |
| Egypt | Law No. 151 of 2020 on Personal Data Protection and its executive regulations (2025) [verify with counsel] | Personal Data Protection Center |
| Jordan | Law No. 24 of 2023 on Personal Data Protection [verify with counsel] | Personal Data Protection Council and its directorate |
| European Union and EEA | General Data Protection Regulation (EU) 2016/679; requests answered within one month, extendable by two | The data protection authority of your country |
How we protect it
- Encryption in transit (HTTPS) everywhere, and encrypted storage at our hosting provider.
- Passwords hashed with Argon2id; one-time codes, links and session tokens stored only as hashes; IP addresses and browsers stored only as keyed hashes.
- Access by role and by record, checked on the server for every request; files in private storage, served through links that expire within five minutes.
- A tamper-resistant audit log of administrative actions and source-file downloads, and limits on repeated sign-in, registration and reset attempts.
If a personal data breach puts your rights at risk, we will inform the UAE Data Office and the other authorities the law requires, within the shortest period those laws set (as soon as we become aware of it, and within 72 hours at the latest), and you, without undue delay. [Verify with counsel.]
Age
KAWN is a professional platform for people aged 18 or over. We do not knowingly collect data about children.
Questions and complaints
Write to [privacy contact email] with any question about this notice or your data.
You can also complain to the UAE Data Office, or to the authority of the country where you live listed under "Your rights where you live". If you live in the European Union, you can complain to the data protection authority of your country.
Changes to this notice
The version and date at the top of this page change whenever we change this notice. When a change matters, we tell you on the platform and ask you to confirm the new version before you continue.