Privacy Policy

1. Introduction

FoodWork (“FoodWork”, “we”, “us” or “our”) provides end-to-end cloud kitchen setup, delivery-platform onboarding, marketing, revenue-growth and virtual-brand expansion services to founders and restaurant operators in the United Arab Emirates. We operate the website https://foodwork.ae (the “Website”) and the related communication channels described below.

FoodWork is a brand operated by Clickster Marketing Management Co. L.L.C., a company duly incorporated and licensed in the Emirate of Dubai, United Arab Emirates. Unless expressly stated otherwise, all quotations, agreements, invoices, receipts, payments, and services provided under the FoodWork brand are issued, contracted, and administered by Clickster Marketing Management Co. L.L.C. Throughout this Policy, references to “FoodWork”, “we”, “us”, or “our” mean Clickster Marketing Management Co. L.L.C. trading as FoodWork.

We are committed to protecting the privacy of everyone who visits our Website, contacts us, books a call, requests a resource, or engages our services. This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, how we protect it, and the rights you have over it.

This Policy is issued in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”) and its Executive Regulations, together with other applicable UAE laws, including Federal Decree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes and Federal Law No. 15 of 2020 on Consumer Protection. As FoodWork operates from mainland Dubai (Business Bay), the federal PDPL applies to our processing of personal data; the separate data-protection regimes of the Dubai International Financial Centre (DIFC) and the Abu Dhabi Global Market (ADGM) do not govern our activities.

For the purposes of the PDPL, FoodWork acts as the Data Controller of the personal data described in this Policy.

By using the Website, contacting us, or providing us with personal data, you acknowledge that you have read and understood this Policy.

2. Definitions

To make this Policy easier to follow, the following terms carry the meanings given to them under the PDPL:

• Personal Data: any data relating to an identified natural person, or to a natural person who can be identified directly or indirectly, for example by reference to a name, voice, picture, identification number, electronic identifier, geographic location, or one or more physical, physiological, economic, cultural or social characteristics.
• Sensitive Personal Data: data that directly or indirectly reveals racial or ethnic origin, political or philosophical opinions, religious beliefs, criminal record, biometric data, or any data relating to a person’s health.
• Processing: any operation performed on personal data, such as collection, recording, storage, organisation, alteration, retrieval, use, disclosure, transfer, restriction, erasure or destruction.
• Data Controller: the entity that determines the manner, criteria and purpose of processing personal data; in this Policy, FoodWork.
• Data Processor: any entity that processes personal data on behalf of, and under the instructions of, the Data Controller.
• Data Subject: the natural person to whom the personal data relates; in this Policy, “you”.
• Consent: any freely given, specific, clear and unambiguous indication by which the Data Subject agrees to the processing of their personal data.
• UAE Data Office: the federal authority established under Federal Decree-Law No. 44 of 2021 and responsible for supervising the application of the PDPL.

3. The personal data we collect

We collect personal data in three ways: information you give us directly, information we collect automatically when you use the Website, and information we receive from third parties.

3.1 Information you provide directly

When you contact us via WhatsApp. Our Website encourages enquiries through WhatsApp (+971 52 288 5400). When you message us, we receive your WhatsApp display name, your mobile number, your profile photo (if visible to us), and the contents of your messages, including any business details, attachments or documents you choose to send.

When you book a strategy call. We use a third-party scheduling tool (Cal.com) to manage bookings. To reserve a call you typically provide your name, email address, and may provide a phone number and notes about your enquiry. The booking record, the time of your call and any information you add are stored within that tool and shared with us.

When you request a guide or the launch checklist. Some of our resources (for example, the Cloud Kitchen Launch Checklist) are delivered after you contact us through WhatsApp. We collect the contact details and request information you provide in that exchange.

When you email us. If you write to contact@foodwork.ae, we collect your name, email address, the contents of your message, and any attachments.

When you use our online calculators. Our Cloud Kitchen Setup Cost Calculator and Delivery Rating Recovery Calculator let you enter inputs such as kitchen type, licensing assumptions, staffing levels, operational model, current and target ratings, and review counts. Where these inputs are processed only in your browser to display a result, they are not retained by us; where you submit them to us or ask us to follow up, the inputs and any contact details you provide become part of your enquiry record.

When you engage our services. If you proceed beyond an initial enquiry, we collect the information needed to scope and deliver our work. This commonly includes your name and role, company or trade-licence details, contact information, your investment range, project timeline, target location, operational model, menu and pricing information, and details required for delivery-platform onboarding (for example, with Talabat, Deliveroo, Careem, Noon or Keeta). Some of this is business information, but where it identifies you as an individual it is treated as personal data under this Policy.

We do not seek to collect Sensitive Personal Data through the Website, and we ask that you do not send us such data unless it is strictly necessary and we have asked for it.

3.2 Information we collect automatically

When you visit the Website, we and our service providers automatically collect certain technical and usage data through cookies and similar technologies, including:

• your IP address and approximate location;
• your device type, operating system, browser type and language settings;
• the pages you view, the links you click, the calculators and resources you use, and the time and duration of your visit;
• the website or source that referred you to us; and
• aggregated analytics about how visitors interact with the Website.

Our Website uses Google Tag Manager to deploy tags and Google Analytics to measure traffic and usage. See Section 6 for details on cookies and how to control them.

3.3 Information from third parties

We may receive personal data about you from:

• Social media platforms: if you interact with us on Facebook, LinkedIn, Google or WhatsApp, we may receive your profile name, public profile information and the content of your interactions, subject to the privacy settings you have chosen on those platforms.
• Referrals and partners: if a client, partner or contact in the UAE restaurant ecosystem introduces you to us, we may receive your name and contact details together with the context of the introduction.
• Service providers: our scheduling, communication and analytics providers share with us the data described in Sections 3.1 and 3.2.

4. Why we use your personal data and our lawful basis

Under the PDPL, we may only process your personal data where we have a lawful basis to do so. In most cases that basis is your consent; in others we rely on the limited exceptions recognised by the PDPL, such as where processing is necessary to perform a contract to which you are a party, to comply with a legal obligation, to protect a public interest, or to establish, exercise or defend a legal right or claim.

Unlike some other frameworks, the PDPL does not recognise a general “legitimate interests” basis. Where we cannot rely on one of the bases above, we will ask for your consent and will not process your data for that purpose without it.

5. Marketing communications

We will only send you marketing communications about our services where you have consented to receive them, in line with the PDPL and Federal Law No. 15 of 2020 on Consumer Protection. Every marketing message will give you a simple way to opt out, and you can withdraw your consent at any time by replying to the message, messaging us on WhatsApp, or emailing contact@foodwork.ae. Withdrawing consent does not affect communications that are necessary to respond to your enquiries or to deliver services you have engaged us for.

6. Cookies and similar technologies

Cookies are small files placed on your device when you visit a website. We use them to make the Website work, to remember your preferences, and to understand how the Website is used.

The cookies and technologies we use fall into the following categories:

• Strictly necessary: required for the Website to function and to keep it secure. These are always active.
• Analytics and performance: set through Google Tag Manager and Google Analytics to measure visits and usage so we can improve the Website. These are used only where you consent.
• Functional: remember choices you make to improve your experience.

You can manage your preferences through the cookie controls presented on the Website and through your browser settings, which let you block or delete cookies. Blocking strictly necessary cookies may prevent parts of the Website from working correctly.

7. How we share your personal data

We do not sell your personal data. We share it only in the following circumstances, and only to the extent necessary:

• Service providers and processors who help us operate, including our website hosting provider, our scheduling provider (Cal.com), Google (for Tag Manager and Analytics), and the messaging platform behind WhatsApp (Meta). These providers process data on our behalf under appropriate contractual safeguards and only on our instructions.
• Delivery aggregators and platform partners (such as Talabat, Deliveroo, Careem, Noon and Keeta) where this is necessary to onboard or manage a client’s brand at the client’s request and as part of the service we provide.
• Professional advisers, such as our accountants, auditors and legal advisers, where reasonably required.
• Government authorities, regulators and law-enforcement bodies where we are required to disclose data by UAE law, by court order, or to protect a public interest, or where disclosure is necessary to establish, exercise or defend a legal claim.
• In a business transaction, such as a merger, acquisition or restructuring, where personal data may be transferred as part of the assets, subject to the protections in this Policy.

We require all parties who process personal data on our behalf to maintain confidentiality and appropriate security measures consistent with the PDPL.

8. International transfers of personal data

Some of our service providers, including those supporting scheduling, analytics and messaging, store or process data on servers located outside the UAE. Where we transfer personal data outside the UAE, we do so only in accordance with the PDPL’s cross-border transfer rules. This means we transfer data either to jurisdictions that provide an adequate level of protection, or, where that is not established, on the basis of appropriate safeguards (such as contractual commitments requiring the recipient to protect the data to PDPL standards), or with your explicit consent, or where the transfer is otherwise permitted under the PDPL, for example because it is necessary to perform a contract with you or to establish or defend a legal claim.

9. How long we keep your personal data

We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, tax and regulatory requirements in the UAE.

• Enquiries that do not lead to engagement are generally retained for up to 24 months from your last contact, so we can respond if you return to us, after which they are deleted or anonymised.
• Client records are retained for the duration of our engagement and for the period afterwards required to comply with UAE legal, tax and commercial record-keeping obligations.
• Analytics data is retained in line with the retention settings of our analytics tools.

When personal data is no longer needed, we securely delete, destroy or anonymise it.

10. How we protect your personal data

We apply appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration and destruction. These measures include access controls limiting personal data to staff who need it, secure handling of communications and documents, use of reputable service providers under confidentiality obligations, and ongoing review of our practices.

While we take security seriously, no method of transmission or storage is completely secure. In the event of a personal data breach that is likely to prejudice your privacy, confidentiality or security, we will notify the UAE Data Office and, where required, affected individuals, in accordance with the PDPL and its Executive Regulations.

11. Children’s privacy

Our Website and services are intended for business founders, operators and investors and are not directed at children. We do not knowingly collect personal data from anyone under the age of 18. Consistent with the PDPL and Federal Decree-Law No. 26 of 2025 concerning child digital safety, if we become aware that we have collected personal data from a child without appropriate consent, we will delete it. If you believe a child has provided us with personal data, please contact us at contact@foodwork.ae.

12. Automated decision-making

We do not make decisions that produce legal effects concerning you, or that similarly significantly affect you, based solely on automated processing of your personal data. Our calculators provide indicative estimates only and do not, by themselves, determine any decision about you.

13. Your rights under the PDPL

Subject to the conditions and exceptions set out in the PDPL, you have the following rights in respect of your personal data:

• Right to be informed: to receive clear information about how your personal data is processed (this Policy serves that purpose).
• Right of access: to request confirmation of whether we process your personal data and to obtain a copy of it.
• Right to rectification: to have inaccurate or incomplete personal data corrected.
• Right to erasure: to request deletion of your personal data where there is no lawful reason for us to continue holding it.
• Right to restrict processing: to ask us to limit how we use your personal data in certain circumstances.
• Right to data portability: to receive personal data you provided to us in a structured, commonly used, machine-readable format, and to have it transferred to another controller where technically feasible.
• Right to object: to object to certain processing, including processing for marketing purposes.
• Right to withdraw consent: where we rely on your consent, to withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Right to object to automated processing: to object to decisions based solely on automated processing that produce legal or similarly significant effects.
• Right to complain: to lodge a complaint with the UAE Data Office if you believe your rights have been infringed.

14. How to exercise your rights

To exercise any of the rights above, please contact us at contact@foodwork.ae or by phone on +971 52 288 5400. We may need to verify your identity before acting on your request, to protect your data from unauthorised access. We will respond to your request within the timeframes required under the PDPL and its Executive Regulations. We do not charge a fee to handle a request unless it is manifestly unfounded, excessive or repetitive, in which case we will tell you in advance.

If you are not satisfied with our response, you have the right to escalate your complaint to the UAE Data Office.

15. Third-party links

The Website may contain links to third-party websites and platforms, including our social media pages and the delivery aggregators we work with. We are not responsible for the privacy practices or content of those third parties. We encourage you to read the privacy policies of any website you visit through a link from our Website.

16. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, technology, or legal requirements, including developments under the PDPL and its Executive Regulations. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you. We encourage you to review this Policy periodically.

17. Contact us

If you have any questions, concerns or requests regarding this Policy or how we handle your personal data, please contact us:

You also have the right to contact the UAE Data Office, the federal authority responsible for supervising personal data protection in the United Arab Emirates, if you believe your rights under the PDPL have not been respected.