Privacy Policy

1. Who we are

Himam Heros FZ-LLC, RAKEZ E-Commerce Licence No. 45036101, Al Hulaila Industrial Free Zone, Ras Al Khaimah, UAE. Privacy contact: privacy@himamheros.ae.

2. What we collect

We practise data minimisation. We do not ask for diagnoses or medical reports. Please do not upload them.

3. Our legal grounds (PDPL Article 4)

• Your consent — for child profiles, sensitive data, sending data outside the UAE, and non-essential cookies.
• Performing our contract with you — for accounts, matching, bookings and payments.
• Legal obligations — for keeping booking and payment records and responding to authorities.

4. Sensitive data

A child's support need relates to health, and an LSA's police clearance relates to criminal record. Both are sensitive personal data under the PDPL. We collect them only with explicit consent, limit who on our team can see them, and never use them for advertising.

5. Who we share data with

We do not sell personal data.

6. AI matching

Our matching engine gives each LSA a score from 0 to 100 using the child's support need, emirate, budget, the LSA's certifications, distance and ratings. The score ranks results. It does not decide on its own whether a booking happens: a parent or school always chooses. You may object to automated matching and ask a member of our team to review your results by emailing privacy@himamheros.ae (PDPL Article 18).

7. Data stored outside the UAE

Our database is hosted with Amazon Web Services (AWS) in Mumbai (ap-south-1), India. We will move it to a UAE or GCC region when one is available to us. Until then we transfer data there under PDPL Article 23: with your explicit consent at signup and under a contract requiring the provider to protect it to PDPL standards. You can withdraw that consent, but we cannot run your account without it. Account email is sent via Google Workspace (outside the UAE).

8. How long we keep data

• Active accounts: while the account is open.
• Inactive accounts: deleted after 2 years without login.
• Child profiles: deleted immediately when you delete them or withdraw consent.
• LSA verification documents: see the LSA Verification Data Notice.
• Booking and payment records: 5 years for commercial and tax record-keeping.
• Cookie and analytics data: see the Cookie Policy.

9. Your rights

You can ask us, free of charge, to:

• Tell you what data we hold, why, who receives it and how long we keep it (Art. 13).
• Give you a copy in a machine-readable file or send it to another provider (Art. 14).
• Correct or complete your data (Art. 15).
• Delete your data, unless we must keep it by law (Art. 15).
• Restrict processing while a dispute is checked (Art. 16).
• Stop processing for marketing or surveys (Art. 17).
• Object to automated matching and ask for human review (Art. 18).
• Withdraw consent at any time (Art. 6).

How to exercise your rights

Email privacy@himamheros.ae or use Account → Privacy. We reply within 30 days. If you are not satisfied, you can complain to the UAE Data Office.

10. Security and breaches

Data is encrypted in transit and at rest, and access is role-based. Admin accounts use strong authentication. If a breach puts your data at risk, we will notify the UAE Data Office and you, with what happened and what we are doing about it, within the time the law sets.

11. Data Protection Officer

Our Data Protection Officer can be reached at privacy@himamheros.ae. The named DPO will be published here once appointed.

12. Changes

We will post changes here and email account holders before any significant change takes effect.