Your data, handled properly.

1. Who we are

UMAC (Unity Martial Arts Club) is operated by Unity Elite Martial Arts Club L.L.C, trade licence number 1641976, issued by the Dubai Department of Economy and Tourism (DET). For the purposes of the PDPL, we are the Controller of the personal data described in this notice and we decide what is collected and why.

Questions about this notice, or any request about your data, should go to info@umac.club.

2. What we collect

Depending on how you deal with us, we may hold:

• Member details: This includes name, date of birth, gender, nationality, photograph, and (for children) the school year or grade.
• Parent and guardian details: This includes name, relationship to the member, phone number, email address, and home address.
• Emergency contacts: The name and phone number of the individuals we should call if an incident occurs in class.
• Health and medical information: Injuries, medical conditions, allergies, medication, and anything a coach needs to know to train someone safely. Under the UAE PDPL, this is classified as Sensitive Personal Data, and we treat it accordingly.
• Performance and testing data: Attendance records, grading history, competition results, and (where an athlete opts into SPSA testing) their measured results, H-Score, and training plan.
• Payment information: Your chosen membership plan, invoices, and payment status. Card details are handled directly by our payment provider and are not stored by UMAC.
• Communications: WhatsApp messages, emails, digital enquiries, and free-trial form submissions.
• Website data: If, and only if, you accept the relevant cookie category: pages visited, how you reached the site, approximate location by country, basic device and browser information, and, for advertising cookies specifically, whether you took an action we count as a conversion, such as starting a free-trial enquiry. See “Cookies and the website” below.
• CCTV footage: We operate closed-circuit television cameras at our facility entry points and training floor boundaries for safety, security, and insurance purposes. Footage is viewable only by authorized management staff, is stored securely, and is automatically overwritten after 30 days unless required for an ongoing investigation.

3. Children’s data

Most UMAC members are under 18, and our youngest programme starts at age 4. Where a member is a child, we take instructions from and deal with the parent or legal guardian; we rely on the guardian’s consent where consent is the basis for processing.

A guardian can see what we hold about their child, correct it, or ask us to delete it, on the same terms set out under “Your rights” below. We do not use children’s data for marketing or profiling, and we do not sell it to anyone.

4. Health and medical information

We ask for health information so that coaches can train members safely, adapt sessions to an injury or condition, and act correctly in an emergency. It is seen only by the coaching and management staff who need it.

Where the PDPL requires explicit consent for Sensitive Personal Data, we ask for it separately at enrolment rather than bundling it into general terms. In a medical emergency we may act, and share information with medical responders, to protect the vital interests of the member.

5. Why we use it, and on what basis

• To deliver the training a member has signed up for and to administer their membership: This is necessary to perform our contract with you.
• To keep members safe in class and respond to injuries or emergencies: This aligns with our legitimate interest in safe operation, as well as the vital interests of the member.
• To take payment and keep accounting records: This fulfills our performance of contract and ensures compliance with UAE legal obligations.
• To enter members for gradings and competitions through WAKO and the UAE MKFED pathway: This is done with consent, and only for those who opt in.
• To carry out SPSA performance testing and produce an H-Score and training plan: This is done with consent, and only for those who opt in.
• To send you class information, timetable changes, and academy news: This is done with your consent, which you can withdraw at any time.
• To measure and improve our advertising, including whether an ad led to a free-trial enquiry: This is done with your consent, given through the advertising cookie category described below, which you can withdraw at any time.
• To comply with UAE law and respond to lawful requests from authorities: This is our legal obligation.

6. Photography and video

We may photograph or film training, gradings, and competitions for the academy’s own records and for our website and social media.

This is always separate and optional. We ask for specific consent; a guardian can refuse it without it affecting their child’s membership in any way. Consent can be withdrawn later by notifying us; we will stop using the images going forward and remove them from channels we control. Images already printed or shared onward by third parties may not be fully recoverable, and we will say so honestly rather than promise otherwise.

7. Who we share it with

We do not sell personal data. We share it only where there is a valid reason to do so:

• UMAC coaches and management, limited strictly to what each person needs to do their job.
• SPSA, for members who opt into performance testing, so results and training plans can be produced.
• WAKO and the UAE MKFED, for members entered into gradings or competitions.
• Our payment provider, Stripe, to take and reconcile membership payments.
• Our insurers and, where necessary, medical providers in connection with an injury or claim.
• IT and hosting providers who run our website and systems under contract, and who may not use the data for their own purposes.
• Google, as our website analytics provider (Google Analytics 4) and advertising measurement provider (Google Ads), and Meta, as our advertising measurement provider (Meta Pixel), each only for visitors who accept the relevant cookie category. See “Cookies and the website” below.
• Government authorities, regulators, or courts where UAE law requires it.

8. Transfers outside the UAE

Some of the services we use store data outside the UAE. Where the UAE PDPL permits cross-border transfers, UMAC relies on the destination country having an adequate level of data protection or on appropriate contractual safeguards with service providers. The UAE PDPL’s Executive Regulations, which are expected to set out a formal adequacy list and approved transfer mechanisms, have not yet been issued as of this draft; UMAC will review this section again once they are published.

Website hosting is provided by Railway within its US, EU, and Asia-Pacific cloud infrastructure regions. CMS media assets are stored on cloud object storage outside the UAE under vendor DPAs incorporating UAE-specific compliance protections. For visitors who opt into the relevant cookie category, Google and Meta each process data outside the UAE under their own standard data processing terms and the visitor’s explicit consent.

9. How long we keep it

We keep member records for as long as someone remains an active member. After the termination or expiration of a membership, data is securely archived and deleted on the following schedules:

• General profiles, contact details, and marketing data: This information will be permanently deleted or anonymized within 24 months of inactivity, unless the member has explicitly consented to remain on our mailing lists. Students may request immediate erasure of this general profile data after departure.
• Enquiries that do not become memberships: This data is automatically deleted or anonymized within 24 months of initial inactivity.
• Financial transactions, membership contracts, and tax invoices: These items are securely archived for 5 years to satisfy applicable UAE Commercial and Tax Law requirements.
• Signed liability waivers, health declarations, and incident logs: These are retained for 7 years following a client’s departure due to the physical risks inherent in martial arts training and to protect against future insurance, medical, or civil liability claims.

10. Keeping it secure

Access to member records is restricted to staff who need it, systems are password-protected, and health information is not circulated more widely than necessary. No system is perfectly secure, and we will not claim otherwise; however, if a breach affects your data and the PDPL requires it, we will notify the relevant UAE data protection authority and, where the risk to you warrants it, notify you directly. As of this draft, oversight is transitioning from the UAE Data Office to the newly announced Federal Authority for Artificial Intelligence and Data, established June 2026; we will confirm the correct notification channel once this transition settles.

11. Your rights

Under the PDPL you can ask us to:

• Tell you what we hold about you and give you a copy.
• Correct anything inaccurate or incomplete.
• Delete your data where there is no overriding reason for us to keep it.
• Restrict or stop a particular use of it.
• Provide it in a portable, machine-readable form, or transfer it to another controller.
• Withdraw a consent you previously gave (including for photography, marketing, advertising measurement, or performance testing) without that affecting anything done before you withdrew it.
• Object to a decision made about you by automated means alone.

12. How to exercise them, and how to complain

Write to info@umac.club and tell us what you want. We will verify your identity to protect your privacy and respond to your request within the statutory timeframes required by UAE law. If you believe your data has been handled in breach of the law, you also have the right to lodge a formal complaint with the relevant UAE data protection authority. As of this draft, that oversight is transitioning from the UAE Data Office to the newly announced Federal Authority for Artificial Intelligence and Data; UMAC will publish the confirmed contact once this transition is complete.

13. Cookies and the website

The UMAC website sets no cookies of its own. It does not need them to work; you can browse every page, read the timetable and pricing, and start a free-trial enquiry without a single cookie being stored.

We use two categories of optional tracking, each gated behind your explicit consent: analytics, through Google Analytics 4, and advertising measurement, through Meta Pixel and Google Ads conversion tracking. Analytics helps us understand, in aggregate, which pages visitors find useful and how they reach us. Advertising measurement helps us understand whether a visitor who saw or clicked one of our ads went on to start a free-trial enquiry, so that our marketing budget goes toward what actually works rather than toward cheap clicks alone.

These tools set identifiers, such as _ga and _gid for Google Analytics, and equivalent identifiers used by Meta Pixel and Google Ads, that can distinguish browsers for up to two years. This data is transferred to and processed by Google and Meta on servers located outside the UAE.

We require your explicit permission before any tracking takes place. On your first visit, you are shown a banner with “Accept” and “Decline” given equal prominence, covering both analytics and advertising cookies. Until you actively select “Accept,” these scripts are blocked entirely: no cookies are written and no data is transmitted to Google or Meta. Your choice is stored in your browser’s local storage rather than in a cookie. Choosing “Decline” leaves zero tracking artifacts on your device. If your browser transmits a Global Privacy Control (GPC) signal, our website automatically treats it as a directive to decline all analytics and advertising cookies without prompting.

You can change your mind at any time using the “Cookie settings” link located in the footer of every page. Withdrawing your consent instantly stops these tools from loading and deletes any previously set cookies.

Meta Pixel and Google Ads conversion tracking build a record of which of our ads led to a visit or a free-trial enquiry. This may result in you seeing UMAC ads again on Meta or Google properties, commonly known as retargeting. We do not use this data to identify you individually within our own membership records; it is used at the level of ad campaigns and audiences, managed within Meta’s and Google’s own advertising platforms. We have enabled IP masking and anonymisation for Google Analytics. We do not combine analytics or advertising data with membership records.

Analytics and advertising processing are both based on explicit opt-in consent. Processing by Google and Meta outside the UAE is subject to the applicable UAE PDPL cross-border transfer requirements and to Google’s and Meta’s respective standard data processing terms.

14. Changes to this notice

If we change how we handle personal data, we will update this page and change the revision date at the top. Where a change is significant, we will notify members directly rather than relying on them to re-read the page.