SLO Space Restaurant L.L.C.
License No. 1555370 | office@slo.space
22nd St – Al Quoz Industrial Area 2 – Dubai, UAE
Last updated: August 30, 2026
Controller: SLO Space Restaurant L.L.C., License No. 1555370, office@slo.space
1. About this notice
SLO Space Restaurant L.L.C. ("SLO", "we", "us", "our") is the controller of the personal data described in this notice. We operate a functional-food restaurant in Dubai, an online store at slo.space, and catering, events and corporate wellness services.
This Data Protection Notice explains what personal data we collect, why we use it, who we share it with, where we send it, how long we keep it, and what rights you have. It is issued under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "UAE PDPL").
It applies to everyone whose personal data we handle: website visitors, online-store customers, restaurant guests, people who contact us through our forms, catering and corporate clients, and the representatives of our suppliers and partners.
This notice supplements our Privacy Policy. Where the two differ on a data protection matter, this notice prevails.
2. Personal data we process
| Category | Examples | Source |
|---|---|---|
| Identity and contact | First and last name, company name, job title, email address, phone number (including WhatsApp) | You |
| Order and transaction | Items ordered, order value, order history, delivery address and instructions, dietary and allergen preferences, invoices | You; our point-of-sale and online store |
| Payment | Payment method, card type, last four digits, authorisation result, billing address. We do not store full card numbers. | Our payment providers |
| Enquiry and correspondence | Content of contact forms (tastings, partnerships, events, consultations), emails, WhatsApp and phone messages | You |
| Marketing | Subscription status, consent records, opens and clicks, stated preferences | You; our marketing tools |
| Website and device | IP address, device and browser type, operating system, pages viewed, referring URL, timestamps, cookie and similar identifiers | Collected automatically |
| Premises | CCTV footage when you visit our premises | Our security systems |
| Supplier and partner | Contact details of representatives, bank and payment details, contract records | Your organisation |
Health-related information. Dietary requirements and allergen information may reveal information about your health. We collect this only where you choose to give it to us, and we use it solely to prepare your food safely and to advise you on what is suitable. We do not use it for marketing, profiling or any other purpose.
Children. Our services are directed at adults. We do not knowingly collect personal data from anyone under 18.
3. Why we process personal data, and on what legal basis
Under the UAE PDPL, processing requires your consent unless one of the grounds set out in the law applies. The table below sets out, for each purpose, the ground we rely on.
| Purpose | Data used | Legal basis under the UAE PDPL |
|---|---|---|
| Taking, preparing, delivering and invoicing your orders; managing your account on slo.space | Identity, contact, order, payment | Necessary to perform a contract with you, or to take steps at your request before entering into one |
| Responding to enquiries about tastings, partnerships, catering, events and corporate wellness | Identity, contact, enquiry | Steps prior to a contract; otherwise our legitimate interests in responding to you |
| Preparing food safely and managing allergens and dietary requirements | Identity, order, health-related preferences | Your consent (you choose to tell us), together with our legal obligations on food safety |
| Customer service, complaints, refunds and returns | Identity, contact, order, correspondence | Contract performance; our legitimate interests in resolving issues; legal obligation under applicable consumer rules |
| Sending marketing emails, newsletters and WhatsApp messages about our products, offers and events | Identity, contact, marketing | Your consent, which you may withdraw at any time |
| Operating, securing and improving the website and online store, including analytics | Website and device data | Your consent for non-essential cookies and analytics; our legitimate interests in the security and integrity of our systems |
| Accounting, invoicing, tax, VAT, audit and statutory record-keeping | Identity, order, payment, supplier | Compliance with our legal obligations in the UAE |
| Security and safety of our premises; investigating incidents | CCTV | Our legitimate interests in protecting people and property, and compliance with applicable Dubai security requirements |
| Establishing, exercising or defending legal claims; responding to lawful requests from authorities | Any of the above, as relevant | Our legitimate interests and compliance with legal obligations |
| Managing supplier, partner and corporate client relationships | Supplier and partner data | Contract performance and our legitimate interests |
Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights and freedoms. You may ask us for a summary of that assessment.
Where we rely on consent, you may withdraw it at any time (see section 8). Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
4. Who we share personal data with
We do not sell personal data. We share it only where necessary, with:
- Payment service providers and acquiring banks - to take payment and prevent fraud
- Shopify Inc. - the e-commerce platform on which slo.space is hosted
- Delivery, logistics and courier partners - to fulfil your orders
- IT, hosting, cloud, email and cyber-security providers - to run and protect our systems
- Marketing, messaging and analytics providers - to send communications you have subscribed to and to understand how our website is used
- Catering, events and corporate wellness partners - where needed to deliver a booked event
- Professional advisers - lawyers, accountants, auditors and insurers, bound by duties of confidentiality
- Government authorities, regulators, courts and law enforcement - where required by UAE law, or to establish, exercise or defend legal claims
- A purchaser or successor - in connection with a sale, merger or reorganisation of our business
Every provider acting as a processor on our behalf is bound by a written agreement requiring it to process personal data only on our documented instructions, to keep it confidential, and to apply appropriate technical and organisational security measures, as the UAE PDPL requires.
5. Transfers outside the UAE
Some of our providers are located outside the United Arab Emirates, including in the European Union, the United Kingdom, the United States and Canada. Personal data may therefore be transferred to, stored in, or accessed from those countries.
We transfer personal data outside the UAE only where the PDPL permits it, namely:
- to a country or territory that the UAE Data Office has determined provides an adequate level of protection for personal data; or
- where no such determination applies, on the basis of a contract or binding agreement with the recipient that imposes protection equivalent to the standards required by the UAE PDPL; or
- where the transfer is necessary to perform a contract with you, or a contract concluded in your interest; or
- where you have given your explicit consent to the transfer, provided it does not conflict with the public and security interests of the UAE; or
- where the transfer is necessary to establish, exercise or defend a legal claim, to protect vital interests, or is required under an international agreement to which the UAE is a party.
You can ask us about the safeguards applied to a specific transfer by writing to office@slo.space.
6. How long we keep personal data
We keep personal data only for as long as we need it for the purpose it was collected for, or for as long as the law requires.
| Records | Retention period |
|---|---|
| Order, invoice, payment and accounting records | 5 years from the end of the relevant financial year or tax period, to meet UAE commercial, VAT and corporate tax record-keeping obligations |
| Online store account | While your account is active, then 24 months after your last order or sign-in, unless a longer period is required for accounting |
| Contact form submissions and general enquiries that do not lead to an order | 24 months from our last contact with you |
| Catering, events and corporate contracts | The term of the contract plus 5 years |
| Marketing subscriptions and consent records | Until you unsubscribe or withdraw consent, plus 24 months to evidence the consent and to honour your opt-out |
| Complaints, refunds and returns | 5 years from resolution |
| CCTV footage | 30 days, unless retained longer for an ongoing investigation, incident or legal claim |
| Website analytics and cookie data | As set out in our cookie settings; in any event no longer than 26 months |
| Anything needed for a legal claim, investigation or regulatory request | Until the matter, and any appeal period, is finally concluded |
When a retention period ends, we securely delete the data or irreversibly anonymise it so that it can no longer identify you.
7. How we protect personal data
We apply technical and organisational measures appropriate to the risk, including encryption of data in transit (TLS) across our website and store, role-based access limited to staff who need the data to do their job, secured payment processing through certified providers so that full card details never reach our systems, due diligence and written contracts with our providers, and staff confidentiality obligations and training.
If a personal data breach occurs that would prejudice the privacy, confidentiality or security of your data, we will notify the UAE Data Office, and you where required, without undue delay, in accordance with the UAE PDPL.
No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.
8. Your rights
Under the UAE PDPL you have the right to:
- Be informed and to access - obtain confirmation of whether we process your personal data, information about how and why we process it, and a copy of the data we hold about you
- Data portability - receive the personal data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible
- Rectification - have inaccurate data corrected and incomplete data completed
- Erasure - ask us to delete your personal data where it is no longer needed for the purpose it was collected for, where you withdraw consent and no other basis applies, or where the processing is unlawful
- Restrict processing - ask us to limit how we use your data, for example while we verify its accuracy or consider an objection you have raised
- Stop processing - ask us to cease processing your personal data, including for direct marketing, which we will always act on
- Object to automated processing - object to decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. We do not currently make such decisions.
- Withdraw consent at any time where our processing is based on consent
How to exercise your rights
Email office@slo.space with "Data protection request" in the subject line, telling us which right you wish to exercise and giving us enough information to identify you. We may ask you to verify your identity, so that we do not disclose personal data to the wrong person.
We will respond within one month of receiving your request. If the request is complex, or you have made several requests, we may extend that period by up to two further months; we will tell you within the first month and explain why.
9. Complaints
If you are unhappy with how we have handled your personal data or your request, please contact us first at office@slo.space. We would like the opportunity to put it right.
You also have the right to lodge a complaint with the UAE Data Office - the federal supervisory authority established under Federal Decree-Law No. 44 of 2021, responsible for supervising the application of the UAE PDPL. While the Data Office continues to build out its operations, the Telecommunications and Digital Government Regulatory Authority (TDRA) acts as the practical point of contact for data protection enquiries in the UAE. Current contact channels are published at u.ae and tdra.gov.ae.
10. Data protection contact
We have assessed our processing activities and are not required to appoint a Data Protection Officer under the UAE PDPL. All data protection matters are handled by our management team.
SLO Space Restaurant L.L.C.
22nd St – Al Quoz Industrial Area 2 – Dubai, United Arab Emirates
office@slo.space
