Zayed National Museum | national museum of the United Arab Emirates

1 POLICY

This Policy applies to Websites, mobile applications, products,and services, which will provide links navigating to this Policy,and which will be displayed to Customers and Visitors for theiracceptance.

DCT Abu Dhabi is committed to respect privacy and secure PersonalInformation with compliance to all applicable data protection andprivacy laws and regulations in the Emirate of Abu Dhabi and theFederal Laws of the United Arab Emirates.

This Policy describes how DCT Abu Dhabi collects, discloses, andprocesses Personal Information, including, but not limited to, theuser’s name, address, credentials and/or Biometrics Data.

A Visitor’s landing on or use of a Website, any DCT Abu Dhabiwebservice, mobile application and customized solution may requireaccessing the Visitor’s Personal Information. Visitors will benotified by the Website of any product- and/or service-specificinformation collection in advance and will request the Visitor’sif the information request falls outside of the scope of thisPolicy the Website will provide the Visitor with a link to theapplicable supplementary policies and request the Visitor’sacceptance of the same.

Websites, products and services may contain links to, or may beembedded in another organization’s or agency’s website which havetheir own privacy policies. In this case the Visitor to the extenthe or she is no longer on a Website and is not providing DCT AbuDhabi with his or her Personal Information will become subject tothe privacy policy of the accessed external site and DCT Abu Dhabiwill have no liability for any Personal Information provided tothe third-party information gatherer through the websitecontrolled or operated by that third party.

2 PERSONAL/BIOMETRICS DATA COLLECTION AND USE

DCT Abu Dhabi collects information (including PersonalInformation) on Visitors when they interact with the visitedWebsite (including user account creation and submission of contactforms), uses a DCT Abu Dhabi mobile application, uses a DCT AbuDhabi product, or uses a DCT Abu Dhabi service. As permitted bylaw, DCT Abu Dhabi may also obtain data from public and commercialthird-party sources, including, without limitation, purchasingstatistics from third party providers. The Personal InformationDCT Abu Dhabi may collect includes, without limitation, theVisitor’s or Customer’s name, gender, job position, Emirates ID,passport (for international users only), email address(es),phone/mobile number(s), login information (account and password),and photos, depending on how the Visitor interacts with thevisited Website and the products or services being purchased orviewed by a prospective Customer.

In order to use DCT Abu Dhabi services, the Customers or Visitorsmay be requested to provide Personal Information. Customers andVisitors have the right to opt not to disclose personal andBiometric Data to DCT Abu Dhabi. However, not providing DCT AbuDhabi with some of the Personal Information may limit auser’s/prospective Customer’s experience or accessibility to someproducts and services.

Personal Information will be used for, without limitation, thefollowing purposes:

Account
Transitions and services requests fulfillments of bookings, orders, deliveries, activities, products verifications or
To add the Customer or Visitor contact (with Customer or Visitor consent) to a mailing list in order to send him or her information about events, services, products, participation invitations of activities (including, without limitation, promotional activities), market surveys, or satisfaction surveys; or sending Customer or Visitor marketing information, that might be of interest to In case Customer or Visitor does not wish to receive these types of information, they can opt out at any time.
Providing a Customer or Visitor with customized user experience and content, enabling DCT Abu Dhabi services and products to remember the Customer or Visitor’s preferred settings for later visits to
Providing a Customer or Visitor with personalization user experience and content, to display subjects related to his or her personal interest based on browsing
Sending important notices to Customer or Visitor, including, without limitation, prompts to install updates/upgrades to his or her operating system or web application.
Qualifying and managing suppliers and business partners, and communicating or working with suppliers and business
Improving DCT Abu Dhabi products and services through internal audits, data analysis, and
Analyzing the efficiency of DCT Abu Dhabi’s business operations and evaluating market
Troubleshooting when a Customer or Visitor sends DCT Abu Dhabi error
Synchronizing, sharing, and storing the data which the user uploads or downloads and the data needed for the uploading and
Ensuring the security of DCT Abu Dhabi products, services and Customer or Visitor, executing and improving DCT Abu Dhabi loss prevention and anti-fraud
Complying with the laws or regulation of the Emirate of Abu Dhabi and the Federal laws of the United Arab Emirates applicable in the Emirate of Abu Dhabi, and any legal requirements, industry standards and other DCT Abu Dhabi

Biometric Data will be used for, without limitation, the followingpurposes:

To carry out obligations of DCT Abu Dhabi or the user in the field of social protection and accessibility to buildings and security; and
If required by

DCT Abu Dhabi may also collect and use Non-PII data to understandhow Customers and Visitors use its Websites, products, andservices in order to improve its services and better satisfy itsCustomer and Visitor needs. DCT Abu Dhabi may collect, use,process, transfer, or disclose Non-PII for other purposes at itsown discretion.

DCT Abu Dhabi will process Personal Information following therequirements of applicable laws on an appropriate legal basis,including, without limitation:

Processing Biometric Data and/or Personal Information to fulfill the contract when responding to a transaction or service
Processing Biometric Data and/or Personal Information with Customer and Visitor consent.
Processing based on the legitimate interests of DCT Abu Dhabi or a Third Party when using Personal Information to contact the Customer and Visitor, conduct marketing or market surveys, improve DCT Abu Dhabi products and services, execute and improve its loss prevention and anti-fraud programs, and other purposes. Legitimate interests include, without limitation, enabling DCT Abu Dhabi to more effectively manage and operate its business and provide its products and services; protecting the security of its businesses, systems, products, services, and Customer and Visitor; internal management; complying with internal policies and processes; and other legitimate interests described in this
Processing Biometric Data and/or Personal Information as necessary to comply with and fulfill legal

3 COOKIES AND RELEVANT TECHNOLOGIES

4.1 COOKIES

DCT Abu Dhabi uses Cookies to identify the Customer or Visitorusing its Websites and services. The text in a Cookie oftenconsists of identifiers, site names, and some numbers andcharacters. Cookies are unique to the browsers or mobileapplications used by an individual, and enable Websites to storedata including, without limitation, Customer and Visitorpreferences or items in shopping carts.

The Visitor’s browser will return the Cookie information only tothe domain where the Cookie originated and its content can beretrieved or read only by the server that created the Cookie.

Like many other websites and internet service providers, DCT AbuDhabi uses Cookies on its Websites to improve the user experience.Session Cookies are deleted after each visit, while persistentCookies remain in place across multiple visits. Cookies allowWebsites to remember user settings including, without limitation,language, font size on user computer or mobile device, and otherbrowser preferences. This means that a user does not need to resetpreferences for every visit. If Cookies are not used Websites willtreat the user as a new Visitor every time user loads a web page.

DCT Abu Dhabi will not use Cookies for any purposes other thanthose stated in this Policy. The Custumer and Visitor can manageor delete Cookies based on their own preferences. The Customer orthe Visitor can clear all the Cookies stored on their devices, andmost web browsers provide the option of blocking Cookies. However,by doing so, the Customer or Visitor must change the user settingsevery time they visit the Websites or services.

4.2 WEB BEACONS AND PIXEL TAGS

In addition to Cookies, DCT Abu Dhabi may also use other similartechnologies on its Websites and web-services such as web beaconsand pixel tags. For example, when a Customer or Visitor receivesan email from DCT Abu Dhabi webservices, it may contain a

click-through URL that links to a Website. If a Customer orVisitor clicks the link, DCT Abu Dhabi will track their visit tohelp learn about their preferences for products and services andimprove its customer service. A web beacon is a transparentgraphic image embedded in a website or in an email. DCT Abu Dhabiuses pixel tags in emails to find out whether an email has beenopened. A Customer or Visitor can unsubscribe from the DCT AbuDhabi mailing list at any time if they do not want to be trackedin this manner.

By using the Websites, the Customer or Visitor consents to the useof Cookies, web beacons and pixel tags as described above.

4 PERSONAL/BIOMETRICS DATA DISCLOSURE

DCT Abu Dhabi may, when services are provided by third partiesauthorized by DCT Abu Dhabi, share Personal Information with thatthird party in the manner described in this Policy. For example,when a Customer or Visitor makes an online purchase of services orproducts from DCT Abu Dhabi, DCT Abu Dhabi may share theirPersonal Information with a logistics provider to arrange shipmentof the product or a third party to provide to the Customer thepurchased service. In addition, as a tourism organization, DCT AbuDhabi may share Personal Information with its affiliates,subsidiaries, stakeholders and other government entities based onneed-to-know basis.

To comply with applicable laws or respond to valid legalprocedures, DCT Abu Dhabi may also disclose the Biometrics Dataand Personal Information to law enforcement or other governmentagencies. If DCT Abu Dhabi is involved in a restructuring orlawsuit in a given jurisdiction, the Personal Information may bedisclosed. DCT Abu Dhabi may also disclose Customer or Visitordata when appropriate, including, without limitation, to executethe Terms and Conditions, when DCT Abu Dhabi believes disclosureis necessary or appropriate to prevent physical harm or financialloss, or when it is in connection with an investigation ofsuspected or actual illegal activity.

5 ACCESS CONTROL AND PERSONAL / BIOMETRICS DATA PROTECTION

It is the responsibility of the each Customer and Visitor toensure that all Personal Information submitted to DCT Abu Dhabi iscorrect. DCT Abu Dhabi is dedicated to maintaining the accuracyand completeness of Personal Information, keeping the data up-to-date and secure.

To the extent required by applicable law, Customer or Visitor may:

have the right to request access to his or her Personal Information that DCT Abu Dhabi has on file;
request that DCT Abu Dhabi updates or corrects inaccuracies in his or her Personal Information;
object to DCT Abu Dhabi’s use of his or her Personal Information; and
submit a written request to DCT Abu Dhabi asking it to delete his or her Personal Information from its . DCT Abu Dhabi may decline the request if it believes that the request is fraudulent or unfeasible, or may jeopardize the privacy of others.

If allowed by applicable laws, Customers and Visitors have theright to withdraw their consents given under this Policy at anytime. Notwithstanding a withdrawal of consent, DCT Abu Dhabi willhave no liability for any processing of Personal Information up tothe time the withdrawal of consent is processed by DCT Abu Dhabiand DCT Abu Dhabi will be permitted to continue processingCustomer and Visitor data and Personal Information if there issufficient justification under applicable law and will have noliability for acting in accordance with that justification.

6 PROTECTION AND RETENTION OF PERSONAL/BIOMETRICS DATA

DCT Abu Dhabi is committed to protecting Biometric Data and/orPersonal Information providing the maximum possible level ofsecurity measure to mitigate the risks of data leakage. DCT AbuDhabi uses appropriate physical, management, and technicalmeasures to protect Biometric Data and/or Personal Informationfrom unauthorized access, disclosure, usage, modification, damage,or loss. For example, DCT Abu Dhabi uses cryptographic, maskingand tokening technologies for data confidentiality, protectionmechanisms to prevent attacks, and access control mechanisms topermit only authorized access to Biometric Data and/or PersonalInformation. DCT Abu Dhabi also provides security, privacy andprotection trainings and campaigns for employees to raise theirawareness level of Biometric Data and/or Personal Informationprotection.

DCT Abu Dhabi will retain Biometric Data and/or PersonalInformation for no longer than is necessary for the purposesstated in this Policy, unless otherwise extending the retentionperiod is required or permitted by applicable laws. The datastorage period may vary with scenario, product, and service. Thestandards DCT Abu Dhabi uses to determine the retention periodare, but not limited to:

the time required to retain Biometric Data and/or Personal Information to fulfill business purposes, including providing products and services;
maintaining corresponding transaction and business records;
controlling and improving the performance and quality of products and services;
ensuring the security of systems, products, and services;
handling possible user queries or complaints and locating problems;
whether the Customer of Visitor agrees to a longer retention period; and
whether any applicable laws, contracts, and other equivalencies have special requirements for data

DCT Abu Dhabi will maintain user registration information as longas the account details are necessary for service provision. ACustomer of Visitor may choose to deregister their account. Afteran account deregistration, DCT Abu Dhabi will stop providing theCustomer of Visitor with products and services and delete theirBiometric Data and/or Personal Information, provided that deletionis not restricted or prohibited by applicable law or regulation.

7 PERSONAL INFORMATION OF MINORS

Some of the Websites, products and services are intended foradults and minors must not create a DCT Abu Dhabi account withoutthe consent of a parent or guardian. If the Personal Informationof a minor is collected with prior parental consent, DCT Abu Dhabiwill only use or disclose the data as permitted by law, with theexplicit consent of the minor's

parent or guardian, or when necessary for the protection of theminor. If DCT Abu Dhabi accidentally collects a minor's BiometricData and/or Personal Information without verified prior consentfrom the minor's parent or guardian, DCT Abu Dhabi will attempt todelete the data as soon as possible and will not be responsiblefor the negligence of providing the minor’s data for registration.

8 THIRD PARTY PROVIDERS SERVICES

To ensure a positive user experience, a user may receive fromWebsites content or web links to Third Parties’ websites. DCT AbuDhabi does not control Third Parties and a Customer’s or Visitor’sdecision to use the links, view the content and/or access theproducts or services provided by Third Parties will be his or herpersonal responsibility.

DCT Abu Dhabi does not control the privacy practices and dataprotection policies of Third Parties. Customers and Visitors whovisit Third Parties’ websites are encouraged to read their privacyand data protection policies. Any Personal Information provided toa Third Party by DCT Abu Dhabi’s under the terms of this Policywill be further subject to the Third Party’s privacy and dataprotection policy which DCT Abu Dhabi accepts no liability for.

9 INTERNATIONAL TRANSFER OF PERSONAL INFORMATION

Personal Information collected by DCT Abu Dhabi may be processedor accessed in the country/region where the user uses DCT AbuDhabi products and services or in other countries/regions whereDCT Abu Dhabi or its affiliates, subsidiaries, service providersor business partners have a presence. These jurisdictions may havedifferent data protection laws. In such circumstances, DCT AbuDhabi will take measures to ensure that data is processed asrequired by this Policy and applicable laws and regulations.

10 POLICY UPDATE

DCT Abu Dhabi reserves the right to update or change this Policyat any time. DCT Abu Dhabi will notify Customers and Visitors ofmaterial changes to this Policy by posting a notice on itsWebsites and/or sending a direct notification through email.

11 CONTACT US

A user with any privacy complaint or issue may contact the Information Governance and Security Team at:

Department of Culture and Tourism – Abu Dhabi, PO Box 94000, Abu Dhabi, United Arab Emirates, Telephone +971 (2) 599 5911

Email: infosec@dctabudhabi.ae

Privacy Policy