Privacy Policy

What personal data Moha collects on its website and platform, why, who sees it, where it is kept, and your rights under UAE law.

Version: 1.0
In force from: 10 Nov 2026
Last updated: 10 Nov 2026

1. Who we are and how to reach us

We are Moha, an Employer of Record in the UAE. We employ people in the UAE for client companies, sponsor their visas and run their payroll.

This policy explains what personal data we collect through our website, employerofrecord.ae, and our platform, at employerofrecord.ae/app/, what we do with it and what you can ask of us. “We” and “us” mean Moha. “You” means the person the data is about.

We follow Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, called “the PDPL” in this policy.

Email us at contact@employerofrecord.ae about anything in this policy, or to use your rights. We reply within 30 days.

This policy is written in English. If we give you a translation, it is for convenience only, and the English prevails.

2. When you visit our website

You can read our pages without an account, and we don’t ask who you are.

We don’t use analytics, advertising or tracking tools, and there is no code from other companies on our pages. Our fonts and images come from our own site.

To send you a page, our hosting provider receives your IP address and the details every browser sends, such as its type and language, as with any website. Our own server does not keep a log of the pages you visit.

Our calculators work in your browser. What you type into them is not sent to us.

The website sets no cookies. It keeps at most two small items in your browser’s session storage. Our Cookie and Storage Notice lists them.

Cookie and Storage Notice

3. When you contact us

When you send our contact form, we receive what you enter: your name, your work email, your company, who you are (a company, a partner or a person moving to the UAE), the service you need, your answers about the hire, such as the job title, nationality, salary, start date and emirate, and your message.

We store it in our database so our team can answer you. Only our team can see it.

We don’t store your IP address. We store a scrambled version of it, only to stop one address sending more than 5 messages in 10 minutes.

If you email us or message us on WhatsApp instead, we receive what you send. WhatsApp also handles messages sent through it, under its own terms.

4. When you use the Moha chat

The Moha chat is an automated assistant. It answers from the content of this website, inside your browser. What you type is not sent to us or to anyone else, and no one at Moha reads it.

Your conversation stays in your browser’s session storage, so it is still there when you open another page. It is deleted when you close the tab.

If a message looks like it has a passport or ID number in it, the chat hides the number. Please don’t share passport, Emirates ID or bank details in the chat.

When you choose to talk to a person, the chat opens our contact form or WhatsApp. It passes on only the service your question was about, to fill in the form. Nothing else from the conversation goes with it.

5. When you use our platform

Our platform is for our client companies, the people we employ for them, and our own team. To create and run your account, we hold:

Your name, your work email and your company. Your password is stored only as a one-way hash, so no one can read it, our team included.
Your role, and what you do in the platform: who did what and when.
For each acceptance of our terms: the date and time, your IP address, your browser, the version and a fingerprint of the exact text.
When a company signs up on its own: its legal name, country, registration number, address and website, and the name, job title and signing authority of the person signing up. We check every company before it can hire through us, including against the UAE Local Terrorist List and the UN Security Council Consolidated List.
The files you upload. Files that are never added to anything are deleted after a day.
A personal email, if an employee adds one to keep access after their job ends.
If you connect an AI assistant to your account, or create an API key: a record of the connection, a one-way hash of its key, and when it was last used. You can remove it at any time in the platform.

To protect accounts, we count sign-ups from each IP address, in memory, for up to an hour.

Two-step sign-in is being added. With it, we will also keep your authenticator secret, encrypted, your backup codes, as one-way hashes, and the type of browser and device you sign in from, and we will limit failed sign-ins for each email and each IP address.

The platform writes emails, such as invitations, reminders and confirmations. No email provider is connected yet, so today these emails stay in the platform, where our team can see them. We will name our email provider in this policy before we send emails through one.

6. When an AI assistant prepares a hire for you

You can ask an AI assistant to price a hire with us, or to prepare one for you to check and confirm. Pricing needs no personal data.

To prepare a hire, the assistant sends us what you gave it, such as the person’s name, job title, nationality and salary, and your name, email and company. We keep it with the IP address and the name of the tool that sent it, to stop misuse. The link to it works for 14 days. If no one confirms it, we delete it within 30 days after that.

The assistant is run by another company, under its own terms. We don’t control what it does with what you tell it.

Our tools for AI assistants

7. Candidates and employees

When we employ or recruit someone, we hold what the law and the job need: passport, visa, Emirates ID, salary, bank account, the medical fitness result and, for family visas, their family members’ details.

When a client company sends us details of its candidates, we use them only for that company’s hiring, on its instructions.

Our Employee and Candidate Privacy Notice explains this in full, in a few minutes’ reading.

Employee and Candidate Privacy Notice

8. Why we use it, and on what basis

The PDPL lets us use personal data with your consent, or without it in the cases its Article 4 lists. We rely on these:

To answer your enquiry and prepare a quote, because you asked us to before a possible contract (Article 4, item 9).
To give you a platform account and run it, under the Platform Terms of Use you accept and our client agreement (Article 4, item 9).
To employ and pay people, as their employer under the Labour Law and other UAE laws (Article 4, items 8 and 10) and under their employment contract (item 9).
To check a company before we work with it, keep the records the law requires and answer authorities (Article 4, item 10), and to establish or defend legal claims (item 3).
To keep the website and the platform secure, for example by limiting how many messages or sign-ups come from one address, as part of the service you ask for (Article 4, item 9).

For anything else, we ask for your consent first. You can withdraw it at any time, as easily as you gave it. That doesn’t affect what we did before (Article 6).

We collect only what each purpose needs, and keep it no longer than it needs (Article 5). We never sell personal data, and we don’t use it for advertising.

No decision that has a legal effect on you, or affects you seriously, is made by automated means alone. Where the platform takes a step automatically, such as approving an expense claim nobody decided by the cut-off, it follows a rule in our client agreement, and you can ask a person to review it (Article 18).

10. Where your data is kept

Today, our website, our platform and our database are hosted by Render, in its Frankfurt region in Germany. The files you upload are kept there too. So personal data you give us is stored outside the UAE.

Your connection reaches our server through Render’s content delivery network, which may handle it in or near the country you connect from. It is encrypted on the way.

The PDPL lets personal data go outside the UAE to a country with adequate data protection law, in the cases the UAE Data Office approves (Article 22), or in the cases Article 23 lists, such as when the transfer is needed to carry out a contract with you, or a contract made in your interest. Germany is bound by the European Union’s data protection law, and we send data there only as Articles 22 and 23 allow.

If we move the data to another country, or bring it to the UAE, we will update this policy first.

11. How long we keep it

Enquiries from the contact form: up to 2 years after our last contact with you, unless you become a client.
The chat: nothing on our side. The conversation stays in your browser until you close the tab.
Platform accounts: while you have access. The record of what you did stays as long as the records it belongs to, because it shows who decided what.
Sign-in sessions: 30 days, or until you sign out.
Files uploaded but never added to anything: one day.
Hires prepared by an AI assistant that no one confirms: deleted within 30 days after the link expires.
Employees: while they work with us, then at least 2 years after they leave, as Article 13 of the Labour Law requires, and longer where tax records must be kept.
Candidates who are not hired: 12 months, then deleted.

When we no longer need data, we delete it or make it anonymous (Article 5).

12. How we protect it

We protect personal data as Article 20 of the PDPL requires. Each person sees only what their role needs. Connections to our website and platform are encrypted (HTTPS). Passwords are stored as one-way hashes. The platform records every change with who made it and when. Two-step sign-in is being added for every account.

If a breach puts your data at risk, we tell the UAE Data Office and you, as Article 9 of the PDPL requires.

Security and Confidentiality

13. Your rights

Under Articles 13 to 18 of the PDPL, you can ask us:

What data we hold about you, why, who we share it with in and outside the UAE, how long we keep it, how we protect it when it leaves the UAE, and how to complain. This is free (Article 13).
For a copy of the data you gave us, in a structured, machine-readable form, or to send it to another organisation where that is technically possible (Article 14).
To correct data that is wrong, or complete it (Article 15).
To delete it when we no longer need it, when you withdraw your consent or object, or when it was used unlawfully (Article 15). Where another law makes us keep it, such as an employee’s file for 2 years after they leave, we tell you.
To restrict its use while you challenge its accuracy, or when it is used for a purpose you did not agree to, or unlawfully (Article 16).
To stop its use for direct marketing or statistical surveys, or where it breaks the rules in Article 5 (Article 17).
To object to a decision made by automated means alone that has a legal effect on you or affects you seriously, and to have a person review it (Article 18).

How to ask: email contact@employerofrecord.ae from the address we know you by, and say what you want. We may ask you to confirm who you are. We reply within 30 days. If we can’t do all you ask, we tell you why.

If your request is about data we hold for a client company, such as its candidates, we pass it to that company and help it answer.

14. Complaints

If you are unhappy with how we handle your data, tell us first at contact@employerofrecord.ae, and we will try to put it right.

You can also complain to the UAE Data Office, the federal data regulator, under Article 24 of the PDPL.

The UAE Data Office, the federal data regulator (u.ae)

15. Children

Our website and platform are for businesses and adults. They are not aimed at children, and we don’t knowingly collect data through them from anyone under 18.

When we sponsor an employee’s children for family visas, we receive their details from the parent, and use them only for the visa and the insurance.

16. Changes to this policy

We update this policy when what we do changes. The version and the date at the top show which one you are reading. If a change affects how we use data you have already given us, we tell platform users in the platform before it applies.