Privacy policy

Effective date: 29 October 2026

This policy explains how Swaed UAE Association For Culture and Community Empowerment (“the Association”, “we”, “us”) collects, uses, shares and protects personal data when you use the website swaeduae.ae, its subdomains and the SwaedUAE mobile apps for Android and iOS (together, the “Platform”).

We process personal data under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its executive regulations, and we keep the volunteering records required by Federal Law No. 13 of 2018 on volunteer work and Federal Decree-Law No. 50 of 2023 on public-benefit institutions. Children’s data is handled in line with Federal Law No. 3 of 2016 (Wadeema’s Law) and Federal Decree-Law No. 26 of 2025 on child digital safety.

Who we are

• Controller: Swaed UAE Association For Culture and Community Empowerment, a public-benefit association licensed by the Ministry of Community Empowerment (NPO licence 784-7-01-190143), Fujairah, United Arab Emirates.
• Address: Sheikh Hamad Bin Abdullah St, Mraisheed, Fujairah — P.O. Box 3686.
• Data-protection contact: [email protected] (subject “Data protection”) · +971 50 346 8636. The Association is not required to appoint a data protection officer; the Secretary of the Board answers data-protection requests.

What this policy covers

The website, the mobile apps and the services around them: browsing and joining opportunities, volunteer and organisation accounts, GPS and QR attendance, volunteering hours, certificates and hours letters, post-event reports, membership, contact forms, notifications and institutional pages.

Data we collect

Volunteers

• Account and profile — name, email address, mobile number, password (stored hashed), preferred language, emirate, nationality, languages, date of birth, gender, profile photo, bio and emergency contact. Your date of birth comes from your verified Emirates ID or passport and is used for events with age rules and for under-18 consent. The bio and emergency contact are optional; you may give an emergency contact when you register for an event.
• Emirates ID — a verified Emirates ID is required to register for events, request missing hours or apply for membership: it comes from UAE PASS, or you upload your Emirates ID card (a photo or the PDF from ICP / UAE PASS), which our own server reads and Association staff check before marking it verified. The number is stored encrypted and never shown in full; it is used only to prevent duplicate accounts, to link your account with UAE PASS and to identify you on official records. The images of your card are kept privately by the Association as part of its records; only authorised staff can see them.
• Passport (visitors without an Emirates ID) — a visitor who does not hold an Emirates ID may upload the photo page of their passport, with the passport number, issuing country and expiry date. Association staff check it the same way as an Emirates ID card. The number is stored encrypted; the image is kept privately as part of the Association's records and only authorised staff can see it.
• Guardian data (volunteers under 18) — your parent or guardian’s name, e-mail and mobile number, so we can send them a link; the parent confirms from their own SwaedUAE account with a verified identity. We keep the link, its status and the photo-consent choice, as required by Federal Law No. 13 of 2018.
• Family members — a guardian whose identity is verified may add a child under 18 as a family member: the child’s name, date of birth, photo and Emirates ID. The child receives their own volunteer number and SwaedUAE card; the guardian manages the child’s registrations, and the child takes part in an event only while the guardian is checked in.
• SwaedUAE card and card photo — every volunteer has a SwaedUAE card (name, number, type, expiry date for members, and a QR code). You take the card photo with the camera in the app or on the website (in the app, the camera also checks that a real person is in front of it), or you upload a recent photo of your face. No biometric template is kept. Association staff compare the photo with the photo on your Emirates ID before the card is issued. The photo is stored privately, appears on your card and is shown to the organiser who checks you in at an event.
• Sign-in providers — if you sign in with Google or Apple we receive your name and email address (Apple may give a relay address). If you sign in with UAE PASS we receive the identifier, user type (verified or unverified), full name in English and Arabic, email, mobile number, nationality and, for verified accounts, the Emirates ID number, under the TDRA UAE PASS terms.
• Participation — opportunities you view, save, apply to, join or leave; waitlist position; answers to the organiser’s applicant question; attendance; verified hours; disputes you open; certificates and hours letters issued to you.
• Skills — skills you tick on your profile. Only if you also tick “Organisers may contact me about my skills” and your identity is verified, approved organisations can find you by skill and see your name, Swaed number, emirate, skills, languages, e-mail and mobile number. You can untick it at any time.
• Leaderboard — only if you tick “Show me on the leaderboard” (off by default), are 18 or over and your identity is verified, your name, recognition level, verified hours and number of events appear on the public leaderboard. Your own place is shown only to you.
• Experts — if you offer your expertise, we keep your field, bio, topics, qualifications and the documents you upload (CV, certificates, licence). After staff approval, your name, field, bio, topics, courses, services and average rating (from 3 answers) appear on your public expert page; qualifications and documents stay with staff. People who request a session give their name, e-mail, mobile number and message.
• Courses and paid workshops — when you register for a paid course or workshop, we keep the payment record (amount, date, reference). Payment is made on Foloosi’s page as for membership. Course attendance gives a certificate of attendance, not volunteer hours.
• Online sessions — an online event opens a video room on our website. Your camera and microphone are off when you join and you switch them on yourself. Others in the room see your name; your Swaed number identifies you to the video service. We record the times you join and leave to count your attendance, which the organiser confirms. Sessions are not recorded.
• Location — see “Location and attendance” below.
• Camera — used to scan event QR codes for attendance (the scan is not stored), to take your card photo, and to photograph your Emirates ID card for verification.
• Device and technical data — device model, operating system, app version, IP address, security and error logs.
• Push token — if you enable notifications, a device token for Firebase Cloud Messaging / Apple Push Notification service.
• WhatsApp — if you opt in, your mobile number, first name and the event title are sent to Meta’s WhatsApp Business Platform to deliver reminders and updates. Opt-in is off by default and can be switched off in your profile at any time.
• Communications — contact-form and support messages and email exchanged with us.
• Internal messages — messages sent inside the Platform (for example with a course trainer) are monitored by the Association.
• Membership and payments — if you apply for membership, the data on the membership form, your membership type and period, and your payment record (amount, date, reference and receipt). Online payments are processed by Foloosi, a UAE payment provider: your card details are entered on Foloosi’s secure page and never reach our servers. If an application is not approved after payment, the full amount is refunded to the card.
• Photographs — images taken at activities in which you appear (see “Photographs and media at events”).

Organisations

• The entity’s name, type, licence or registration number and expiry, address, logo and description; the licence or registration documents uploaded for verification; the representative’s name, role, email and phone; staff invited to the organisation account; the opportunities, rosters, attendance reviews and post-event reports the organisation creates.

Visitors

• Server logs (IP address, pages requested, browser type) kept for security, and the strictly necessary cookies described in the Cookie policy. For visitor statistics we use Cloudflare Web Analytics, a privacy-first measurement that sets no cookies, stores no IP address and builds no visitor profile. To find and fix problems we also use Sentry, which receives technical error reports without names, e-mails, IP addresses or what you typed, and Microsoft Clarity, which, on our public pages and the sign-in and sign-up pages only, shows us how visitors use the site (clicks, scrolling): all text is hidden before it leaves your device, it sets no cookies and it never runs on your account pages. We run no advertising trackers.

Location and attendance

• When you check in or check out, the app records your GPS position, its accuracy and the time, and whether you were inside the venue radius set by the organiser.
• While you are checked in to an event, your location is used so that your hours are counted correctly and the organiser can confirm you are at the venue. On Android the app checks your position about every 30 minutes — also when the app is closed or the phone is locked — and a notification is shown while this runs. On iPhone the app reads your position only when you check in and check out and while the app is open; if you choose "Always", iOS tells the app when you leave or return to the event area (the app records only that leave or return, not a location trail), and the app does not run in the background to read your location. If you are outside the event area for about 30 minutes, you and the organiser are notified; after about 60 minutes outside you are checked out from the time you left. On Android, if the app stops reporting for about an hour, we send you a reminder.
• These checks start only when you check in and stop automatically at check-out, or at the latest 30 minutes after the event ends (the check-out window). We never collect location outside an event you are checked in to.
• Retention: raw positions (check-in, check-out and last-seen coordinates) are deleted 90 days after the opportunity ends. What remains is the attendance record — times, verified hours and the inside/outside result — which is part of the volunteering record.
• Attendance evidence: each check-in, check-out and location check is also written to a sealed attendance journal that cannot be changed afterwards: the time, the distance from the venue, the accuracy, the inside/outside result, how you were checked in, and the app version, device session and internet address. It is the Association's proof of attendance (for example for the Ministry), kept with the volunteering record; its exact coordinates follow the 90-day rule above. Any hours added or corrected by staff are recorded with the reason and the staff member.
• Organisers can see, for their own opportunity only, who is checked in and whether a volunteer is inside the venue area.

Why we use your data and on what basis (PDPL)

We do not sell personal data, profile anyone for advertising, or make automated decisions with legal effect about you.

Who we share data with

• Organisers — the organisation that runs an opportunity you join sees your name, contact details, age group (and guardian phone number if you are under 18), your answer to its applicant question, attendance and hours for that opportunity only. When an organiser checks you in at the venue — by scanning your SwaedUAE card, or by finding you by phone number or Swaed ID among the registered volunteers — it also sees your card photo, so that the person in front of it can be matched to the card. A check-in screen at the venue shows the same details to the organiser’s staff.
• The public — the volunteer name on a certificate verification page, and aggregated figures (hours, volunteer counts, photographs of activities). Profiles are not public.
• Ministry of Community Empowerment and competent authorities — the activities file (volunteers and hours per activity), when the law or the Ministry requires it, and to child-protection or law-enforcement bodies when required.
• Processors acting on our instructions:

Our application and database are hosted on the Association’s own servers in the United Arab Emirates.

Transfers outside the UAE

Some processors above handle data outside the UAE (United States, European Union). We transfer only what each service needs, under contracts that bind the provider to confidentiality and security, and we rely on the PDPL provisions for transfers that are necessary to perform the service you asked for or that are covered by adequate protection. You may ask us for details of the safeguards for any provider.

How long we keep data

Your rights (PDPL, Articles 13–18)

You may ask to access, correct, erase, restrict or object to processing of your personal data, to receive a copy in a portable format, and to withdraw consent where processing is based on consent.

• Self-service: in your profile (website or app) you can edit your data, download a copy of it, change notification and WhatsApp settings, and close your account.
• By email: [email protected], subject “Data protection”, or the Contact and support form, topic “Data protection and account data”. We reply within 30 days.
• Closing your account: your account stops: you can no longer sign in, your SwaedUAE card stops working, we stop sending you messages, registrations for upcoming events are cancelled and organizers no longer see you; family members you manage are closed with you. Nothing is erased: we keep your details and your volunteering record (attendance, hours, certificates) for 10 years, because the Association must keep this record for the Ministry; only Association staff can see a closed account, and certificates you already hold stay valid. You can still ask us to see, correct or restrict your data. This path is available from the app, the website and this page, as required by Google Play and the App Store. Your account closes 30 days after you ask; if you sign in before that date, it stays open.
• Complaints: if you are not satisfied with our answer you may complain to the UAE Data Office.

Children and young volunteers

• A child is anyone under 18 (Wadeema’s Law). A volunteer under 18 needs a parent’s or guardian’s consent, recorded in the profile, and may join only opportunities that admit minors. Organisers see that a volunteer is a minor and can contact the guardian.
• We do not knowingly open accounts for children under 13 or collect their data directly. If we learn that we have, we close the account and delete the data.
• We do not advertise to children or profile them, and we apply the Child Digital Safety Law principles of data minimisation and purpose limitation to minors’ data.

Photographs and media at events

The Association and organisers photograph and film activities to document the Association’s public-benefit work and may publish the images on the Platform, in reports and on the Association’s social channels. You are told this when you register and when you join an opportunity. If you do not want to appear, tell the organiser at the venue or write to [email protected] with the event and date; we will not publish, or will remove, images in which you are identifiable. Images of volunteers under 18 are published only with the guardian’s consent.

Security

HTTPS everywhere, hashed passwords, encrypted Emirates ID numbers, two-factor authentication for staff, role-based access, audit logs of staff actions and daily backups held in the UAE. No system is completely secure. If a breach is likely to harm you we notify the UAE Data Office and the affected persons as the PDPL requires.

Mobile app permissions

• Location — attendance check-in, and presence checks while you are checked in to an event: on Android a check about every 30 minutes, also when the app is closed; on iPhone only while the app is open, plus the optional “Always” area monitoring. They stop at check-out or 30 minutes after the event ends.
• Camera — QR check-in, your card photo and Emirates ID card photos; on the website, the camera and microphone in an online session when you switch them on
• Notifications — volunteering updates (optional)

You can withdraw a permission in your device settings; the related feature then stops working.

Changes

We change the effective date when this policy changes and announce material changes on the Platform or by email.

Contact

Swaed UAE Association For Culture and Community Empowerment Sheikh Hamad Bin Abdullah St, Mraisheed, Fujairah, United Arab Emirates — P.O. Box 3686 [email protected] · +971 50 346 8636