Privacy Policy

Zaurah ("we", "our", or "us") is a water engineering consultancy committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, engage our consultancy services, or interact with us in any capacity.

We process personal data in accordance with the General Data Protection Regulation (GDPR), applicable data protection laws in the jurisdictions where we operate, and industry best practices for information security.

1. Information We Collect

1.1 Information You Provide Directly

• Contact Information: Name, email address, phone number, postal address, and organization name when you submit inquiries, request proposals, or engage our services.
• Professional Information: Job title, department, area of expertise, and professional qualifications relevant to project engagements.
• Project Data: Technical specifications, site locations, engineering data, and other information you provide in connection with water engineering projects.
• Employment Applications: CV/resume, cover letter, qualifications, work history, and references when you apply for positions through our careers portal.
• Contractual Information: Billing details, payment information, and contractual documentation required for service delivery.
• Communications: Records of correspondence, meeting notes, and feedback you provide to us.

1.2 Information Collected Automatically

• Device and Browser Data: IP address, browser type and version, operating system, device identifiers, and screen resolution.
• Usage Data: Pages visited, time spent on pages, referral source, click patterns, and navigation paths through our website.
• Location Data: Approximate geographic location derived from your IP address.
• Log Data: Server logs including access times, error logs, and request details.

1.3 Information from Third Parties

• Professional references and background verification data (for employment applicants, with consent).
• Publicly available business information from professional directories and registries.
• Information from partner organizations and development agencies in connection with joint projects.

2. How We Use Your Information

We use personal data for the following purposes:

• Service Delivery: To provide water engineering consultancy services, including hydraulic modeling, flood risk assessments, irrigation design, and infrastructure planning.
• Communication: To respond to inquiries, send project updates, deliver proposals, and maintain professional relationships.
• Contract Management: To administer contracts, process invoices, and manage project documentation.
• Recruitment: To evaluate job applications, schedule interviews, and manage the hiring process.
• Website Improvement: To analyze usage patterns, optimize website performance, and enhance user experience.
• Legal Compliance: To comply with applicable laws, regulations, and professional engineering standards.
• Security: To detect, prevent, and address technical issues, fraud, or security threats.
• Marketing: To send newsletters and updates about our services, with your explicit consent where required.

3. Legal Basis for Processing

We process your personal data on the following legal bases under the GDPR:

• Consent (Article 6(1)(a)): Where you have given explicit consent, such as subscribing to our newsletter or submitting a contact form.
• Contractual Necessity (Article 6(1)(b)): Where processing is necessary to perform a contract with you or to take pre-contractual steps at your request, such as preparing a project proposal.
• Legal Obligation (Article 6(1)(c)): Where we are required to process data to comply with legal or regulatory obligations, including engineering standards and reporting requirements.
• Legitimate Interests (Article 6(1)(f)): Where processing is necessary for our legitimate business interests, provided these are not overridden by your rights. This includes improving our services, maintaining security, and conducting business analytics.

4. Data Sharing and Disclosure

We do not sell your personal data. We may share your information with:

• Project Partners: Other engineering firms, subcontractors, and technical specialists collaborating on your project, only to the extent necessary for service delivery.
• Development Organizations: International development agencies (e.g., World Bank, ADB, UNDP) when required for funded project reporting and compliance.
• Service Providers: Trusted third-party vendors who assist with hosting, email services, analytics, and IT infrastructure, bound by data processing agreements.
• Professional Bodies: Engineering regulatory authorities and professional accreditation bodies where required.
• Legal Requirements: Government authorities or law enforcement agencies where disclosure is required by law or to protect our legal rights.

5. International Data Transfers

As a consultancy with offices across multiple jurisdictions, your personal data may be transferred to and processed in countries outside your country of residence, including but not limited to Afghanistan, the United Arab Emirates, the Netherlands, and Pakistan.

Where data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Adequacy decisions where the destination country provides an adequate level of data protection.
• Binding corporate rules and organizational security measures.

6. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Client Project Data: For the duration of the engagement plus 10 years, in accordance with professional engineering standards and statutory limitation periods.
• Contact Inquiries: For up to 2 years from the date of last interaction, unless a business relationship is established.
• Job Applications: For up to 12 months after the recruitment process concludes, unless you consent to longer retention for future opportunities.
• Newsletter Subscriptions: Until you unsubscribe or withdraw consent.
• Website Analytics: Aggregated and anonymized data may be retained indefinitely for statistical analysis.

7. Your Rights

Under applicable data protection legislation, you have the following rights:

To exercise any of these rights, please contact us using the details provided in Section 11 below. We will respond to your request within 30 days.

8. Cookie Policy

Our website uses cookies and similar tracking technologies to enhance your browsing experience:

• Essential Cookies: Required for the website to function properly, including session management, security tokens, and load balancing. These cannot be disabled.
• Analytical Cookies: Help us understand how visitors interact with our website by collecting aggregated, anonymous usage data.
• Functional Cookies: Remember your preferences such as language settings and display options.

You can control cookie preferences through your browser settings. Disabling certain cookies may affect website functionality.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (TLS/SSL) and at rest.
• Access controls and role-based authentication for all systems.
• Regular security assessments and vulnerability scanning.
• Employee training on data protection and information security.
• Incident response procedures for data breach management.
• Secure backup and disaster recovery protocols.

While we strive to protect your personal data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security but are committed to continuous improvement of our security posture.

10. Children's Privacy

Our services are directed at businesses, government agencies, and development organizations. We do not knowingly collect personal data from individuals under the age of 16. If we become aware that we have collected data from a child without appropriate consent, we will take steps to delete that information promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Material changes will be communicated through a prominent notice on our website. We encourage you to review this policy periodically.

12. Contact Information

For questions about this Privacy Policy, to exercise your data protection rights, or to raise any concerns about our data practices, please contact us:

We aim to resolve all complaints and inquiries promptly. If you are not satisfied with our response, you have the right to escalate your concern to the relevant supervisory authority in your jurisdiction.