1. Purpose and Scope
This Privacy Policy (the "Policy") explains how Peer Creators FZ-LLC (the "Company", "we", "us") processes Personal Data when you use the Peer Creators platform (the "Platform"). It is issued under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and its implementing regulations, and forms part of the Terms of Use (see Clauses 1.2, 14, 16 and 22.1).
The Platform is a technology intermediary. The Company facilitates connections between Clients, Hosts, and Creator Pros; it does not itself provide the underlying spaces, services, or productions. The Company acts as the Controller of Personal Data it collects to operate the Platform, and as a Processor only where expressly agreed in writing.
Controller identity: Peer Creators FZ-LLC, Free Zone Limited Liability Company licensed by the Dubai Development Authority, Commercial Licence No. 107476, Premises HD05A, First Floor, In5 Tech, Dubai Internet City, Dubai, UAE.
2. Categories of Personal Data Processed
The Company processes the following categories of Personal Data, depending on your role on the Platform and how you use it:
Identity and account data
Your name, email address, phone number, account credentials, profile photo, city, and preferred language.
Verification and KYC data
Government-issued ID, Emirates ID number, selfie for liveness checks, business documents for Hosts and Creator Pros, and the results of sanctions and PEP screening.
Listing and Booking data
Listings you publish or view, bookings you request or accept, dates, locations, party details, activity type, messages tied to bookings, and reviews you leave or receive.
Payment and financial data
Amounts, currency, transaction IDs, payout account details for Hosts and Creators, invoices, and tax data. Full payment card numbers are NOT stored by the Company — they are handled directly by Paymob, our Payment Services Provider.
Communications and Content
On-website messages, dispute submissions, support requests, uploaded photos and videos for listings or claims, and any content you submit to the Platform.
Device, log, and technical data
IP address, device identifiers, browser type and version, operating system, referring URLs, pages viewed, timestamps, crash logs, and approximate location derived from IP.
Cookies and similar technologies
Cookies, local storage, pixels, and SDKs used for session management, security, analytics, and (with consent) marketing. See Section 6 below.
Marketing data
Your marketing preferences, campaign engagement (opens, clicks), and unsubscribe status.
2.2 Sensitive Personal Data
The Company does not intentionally collect Sensitive Personal Data (as defined in the PDPL — data revealing racial or ethnic origin, political opinions, religious beliefs, criminal records, health, genetic, or biometric data). Please do not upload such data to the Platform unless strictly necessary. Where the Company must process it (for example, biometric selfies used only for identity verification), it will do so on the narrowest lawful basis available and with appropriate safeguards.
2.3 Minors
The Platform is not directed to children under 18. The Company does not knowingly collect Personal Data from minors. If a minor appears in content submitted by a Client (for example, a shoot involving a child model), the Client is responsible for obtaining lawful guardian consent and ensuring compliance with UAE child protection rules.
3. Purposes and Lawful Bases
The Company processes Personal Data for the purposes below, each under a specific PDPL lawful basis:
| Purpose | Lawful basis (PDPL Article) |
|---|---|
| Operating the Platform, providing your account, and enabling listings and bookings. | Performance of a contract with you (PDPL Art. 4(2)). |
| Facilitating payments, payouts, refunds, and chargebacks through Paymob. | Performance of a contract with you (PDPL Art. 4(2)). |
| Issuing tax invoices and VAT-compliant records. | Compliance with a legal obligation (PDPL Art. 4(4)). |
| KYC, sanctions screening, and AML/CTF checks for Hosts, Creators, and higher-value bookings. | Compliance with a legal obligation (PDPL Art. 4(4)). |
| Administering disputes, damage claims, and refund adjudication. | Legitimate interests of the Company and other Users (PDPL Art. 4(7)), balanced against your rights. |
| Trust and safety enforcement (warnings, suspensions, delistings, permanent bans). | Legitimate interests of the Company and its Users (PDPL Art. 4(7)); compliance with legal obligations where reporting is required (PDPL Art. 4(4)). |
| Fraud prevention, account security, and abuse detection. | Legitimate interests of the Company (PDPL Art. 4(7)). |
| Marketing communications, newsletters, and promotional offers. | Your consent (PDPL Art. 4(1)) — you may withdraw at any time. |
| Analytics, product improvement, and aggregated reporting. | Legitimate interests of the Company (PDPL Art. 4(7)); consent where required for non-essential cookies. |
| Responding to lawful requests from courts, regulators, or law enforcement. | Compliance with a legal obligation (PDPL Art. 4(4)). |
4. Recipients and Categories of Third Parties
The Company shares Personal Data only with the following categories of recipients, and only to the extent necessary:
- Payment Services Provider — Paymob: to process payments, payouts, refunds, and chargebacks. Paymob processes card data as an independent controller under its own privacy terms.
- Infrastructure and technology providers: cloud hosting, email delivery, analytics, customer support tooling, and identity verification vendors, all engaged under written data-processing agreements.
- Other Users: we share the minimum data needed for a booking — for example, a Host receives a Client's name, booking details, and contact channel; a Creator sees the brief a Client has submitted.
- Professional advisors: lawyers, auditors, insurers, and accountants under a duty of confidence.
- Public authorities: courts, regulators, tax authorities, and law-enforcement agencies, when we are legally required to disclose or when necessary to protect our rights or the safety of Users (see the Trust, Safety and Enforcement Policy).
The Company does not sell Personal Data.
5. Cross-Border Transfers
Some of our processors are located outside the UAE. Where Personal Data is transferred outside the UAE, the Company relies on one or more of the transfer grounds set out in PDPL Article 22, including transfers to jurisdictions recognised by the UAE Data Office as providing an adequate level of protection, transfers made under appropriate contractual safeguards (including standard data-protection clauses), and, where applicable, transfers made with your explicit consent.
7. Marketing Communications
Marketing emails, SMS, or push notifications are sent only where you have opted in. Every marketing message includes an unsubscribe link, and you can also update your preferences in your account settings at any time. Withdrawing consent to marketing does not affect processing that is necessary to run your account or bookings.
8. Data Subject Rights
Subject to the conditions and exceptions in the PDPL, you have the following rights:
Right of access
Obtain confirmation of whether we process your data and a copy of it.
Right to correction
Ask us to correct inaccurate or incomplete data.
Right to erasure
Ask us to delete your data, subject to retention obligations.
Right to restrict processing
Ask us to pause certain processing while a query is resolved.
Right to object
Object to processing based on legitimate interests, including profiling.
Right to withdraw consent
Withdraw consent at any time where processing relies on consent.
Right to data portability
Receive your data in a structured, commonly used, machine-readable format.
Right to stop automated processing
Ask that decisions with significant effects not be made solely by automated means.
Right to complain
Lodge a complaint with the UAE Data Office if you believe your rights have been infringed.
How to exercise a right
- On the website: use Settings → Privacy to download, correct, or delete your data for most requests.
- By email: write to dpo@peercreators.com with the subject line "Data Subject Request" and enough information for us to verify your identity.
- By post: Peer Creators FZ-LLC, Premises HD05A, First Floor, In5 Tech, Dubai Internet City, Dubai, UAE.
We will acknowledge your request within 5 Business Days and respond substantively within 30 calendar days. Where a request is complex or high-volume, we may extend the response period by a further period, permissible under the PDPL, and will tell you why.
9. Retention
The Company retains Personal Data only for as long as necessary for the purposes for which it was collected, or as required by law or to resolve disputes. Indicative retention periods:
Account and transaction records
Retained for the life of the account and for 7 years after closure, to meet UAE commercial and tax record-keeping requirements.
KYC and AML records
Retained for at least 5 years after the end of the customer relationship or the completion of the transaction, as required by UAE AML/CTF law.
Tax records (VAT invoices, payout statements)
Retained for at least 5 years from the end of the relevant tax period, in line with UAE Federal Tax Authority rules.
Content, messages, and dispute records
Retained for the duration of the booking plus 3 years, or longer if a dispute or claim is open.
Damage claim files and evidence
Retained for 3 years after the claim is closed, or longer if litigation, arbitration, or insurance recovery is ongoing.
Enforcement records (warnings, suspensions, bans)
Retained for as long as necessary to enforce our Trust, Safety and Enforcement Policy, and for a reasonable period afterwards to detect repeat offenders.
Marketing consent records
Retained for as long as you remain subscribed, plus a short period after unsubscribe to evidence compliance.
Log and technical data
Typically retained for no more than 12 months, unless required longer for security or fraud investigations.
Retention periods for damage claims, prohibited activity, and enforcement records are also governed by the Damage Deposit Policy and the Prohibited Activities Schedule.
10. Complaints
Complaints are handled in two steps:
- Step 1 — Contact our DPO. Email dpo@peercreators.com. We will acknowledge your complaint within 5 Business Days and provide a substantive response within 30 calendar days.
- Step 2 — UAE Data Office. If you remain dissatisfied, you may complain to the UAE Data Office, the national supervisory authority established under the PDPL. Details are published on the UAE Government portal.
11. Security and Personal Data Breaches
The Company implements technical and organisational measures appropriate to the risk, including encryption in transit, access controls, least-privilege administration, secure engineering practices, vendor due diligence, and staff training. No system is perfectly secure, and you should also take care to protect your account credentials.
Where a Personal Data breach is likely to result in a risk to the rights of Data Subjects, the Company will notify the UAE Data Office without undue delay and, where the risk is high, will also notify affected Data Subjects, in line with PDPL requirements.
Report a suspected security issue or account compromise to dpo@peercreators.com. For safety incidents involving other Users, see the Trust, Safety and Enforcement Policy.
12. Data Protection Officer and Contact
Data Protection Officer
Email: dpo@peercreators.com
Post: Peer Creators FZ-LLC, Premises HD05A, First Floor, In5 Tech, Dubai Internet City, Dubai, UAE.
13. Amendments and Integration
The Company may amend this Policy from time to time. Amendments apply prospectively from the effective date stated in the updated Policy; Personal Data collected before an amendment continues to be processed under the version of this Policy in force at the time of collection, unless a change is required by law. Where an amendment materially affects your rights, we will give you reasonable prior notice through the Platform or by email.
This Policy is incorporated into the Terms of Use and should be read together with Clauses 1.2, 9.4, 14, 16 and 22.1 of those Terms.