PRIVACY POLICY

Who we are

Last updated: 19 October 2026

This policy explains how Sandwich Sandwich UAE (as defined below) collects, uses, shares and protects your personal data when you visit our website sandwichsandwich.ae (the “Website“), sign up to our emails, enter our competitions or promotions, visit or order from our outlets, use any loyalty scheme, gift card or mobile app we offer, give feedback or otherwise contact us, and how we use cookies.

The Website and the Sandwich Sandwich business in the UAE are operated by The Sandwich Group L.L.C-FZ, a limited liability company licensed by Meydan Free Zone, Dubai, under licence number 2527111.01, with its registered address at Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates (“Sandwich Sandwich“, “we“, “us” or “our“). We operate the Sandwich Sandwich brand in the UAE (“Sandwich Sandwich UAE“) as franchisee by virtue of a franchise arrangement. We are the controller of the personal data described in this policy, except where this policy explains that the franchisor or third-party service providers of Sandwich Sandwich UAE as a controller in its own right.

We process personal data in line with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”), any executive regulations and decisions issued under it, and other applicable UAE laws (together, “UAE Data Protection Law”).

If you have any questions about this policy or your data, or wish to exercise your rights, contact us at info@sandwichsandwich.ae or write to us at the address provided for Sandwich Sandwich above.

2. The personal data we collect

We aim to keep the data we collect to what is needed for the purposes described in this policy in clause 3 below. Depending on how you interact with us, this may include:

• When you sign up to our emails: your email address and, if you choose to give it, your first name. We also record the date, time and IP address of your sign-up and confirmation, so we can show that you agreed to receive our emails.
• When you open or click our emails: whether an email was delivered, opened and which links were clicked, along with basic device and location information (country or city level).
• When you enter a competition or promotion: your name, contact details, and any entry content you submit, such as a photo, comment or social media handle.
• When you browse our website: technical information collected through cookies and similar technologies, such as your IP address, browser type, device type, referring website, pages visited, and time spent on the site. See clause 7 for details.
• When you use social media features on our site: embedded features such as Instagram or TikTok feeds may collect information about your interaction with them. This is governed by those platforms’ own privacy policies.
• When you visit or order from our outlets, or use our loyalty scheme, gift cards or app: your name, contact details, order and purchase history, preferences, loyalty or gift card details, and app account information.
• When you contact us or give feedback: your name, contact details, and anything you choose to include in your message.

We do not ask for, and ask you not to send us, sensitive personal data (such as information about your health, religious beliefs or family, as defined in the PDPL) or payment card details through the website. If you choose to tell us about a food allergy or dietary requirement, we will use it only to deal with your request. If you send us other sensitive personal data, we may delete it.

Your email address is never displayed publicly on our website and is not visible to other visitors.

3. How we use your data and why

We may use your data for purposes that are similar or closely related to those described above, as permitted by UAE Data Protection Law. We will not use your data for a new purpose that is not compatible with these without telling you first and, where required, asking for your consent.

We do not sell your personal data, and we do not make decisions about you based solely on automated processing (including profiling) that have legal consequences for you or otherwise seriously affect you. We do use limited automated processing, such as email engagement data and marketing cookies, to tailor our marketing to your interests. You can object to this at any time, as explained in clause 6 below.

4. Our email service and who we share data with

Our email sign-up form and newsletters are run through Mailchimp, an email marketing service provided by Intuit Inc. When you sign up, your details are sent directly to Mailchimp and stored on its servers. Mailchimp acts on our instructions as our service provider (data processor) and may not use your data for its own marketing. You can read how Mailchimp handles data in the Intuit Mailchimp privacy statement at https://www.intuit.com/privacy/statement/. We are not responsible for the content of third-party privacy statements.

We may also share personal data, only as far as needed for the purposes in clause 3, with:

• our website hosting provider, Tasjeel;
• analytics and advertising providers [e.g. Google, Meta], only where you have accepted the relevant cookies;
• the franchisor, for the purposes described in clause 3 (including the brand-wide customer database, loyalty schemes, apps, promotions, quality control, complaints handling and protection of the brand). The franchisor may use this data as a controller in its own right, in which case its own privacy notice and the data protection laws applicable to it (including UK Data Protection Act 2018 and GDPR 2016/679) will also apply, or it may process data on our behalf as our service provider;
• other service providers who help us run our business, such as IT, cloud storage, point-of-sale, online ordering, loyalty, app, customer feedback and payment providers, some of which are based in the United Kingdom [or other countries outside the UAE];
• professional advisers, such as lawyers and auditors, under a duty of confidentiality;
• a buyer or successor, if our business or its assets are sold, merged or transferred, and the franchisor or a replacement franchisee if our franchise ends, in each case to continue serving customers in line with this policy;
• government authorities, courts, regulators or law enforcement bodies, where UAE law requires or permits it, or where needed to establish, exercise or defend legal claims.

Service providers that process personal data on our behalf (processors) are bound by contract to keep your data secure, to act only on our instructions and to use it only for the services they provide to us.

5. International transfers, retention and security

Transfers outside the UAE. Some of the recipients described in clause 4 are located outside the UAE, including the franchisor and certain service providers in the United Kingdom, Mailchimp and other providers that store data in the United States and other countries. We only transfer personal data outside the UAE in accordance with Articles 22 and 23 of the PDPL, for example where: (a) the destination country has data protection legislation offering an adequate level of protection, as approved by the UAE Data Office (i.e. UK Data Protection Act 2018 and UK GDPR, in the UK); (b) the recipient is bound by a contract requiring it to apply the protections required by the PDPL; (c) you have given your express consent to the transfer, which you give when you tick the relevant box at sign-up or registration; or (d) the transfer is necessary to perform a contract with you or in your interest, or to establish, exercise or defend legal claims. You can ask us for information about the safeguards we use.

How long we keep it. We keep personal data only for as long as needed for the purposes described in this policy, after which we delete it or anonymise it. As a guide:

• email sign-up details are kept until you unsubscribe or withdraw consent;
• competition entries are kept for [12] months after the competition closes;
• messages and feedback are kept for [24] months after we have dealt with them; and
• loyalty and order data are kept for as long as your account is active and [24] months afterwards.

We may keep data for longer where required by UAE law or where we need to establish, exercise or defend legal claims. If you unsubscribe from our emails, we keep your email address on a suppression list so we do not email you again by mistake. Cookies stay on your device for the period set by each cookie, and you can clear them at any time through your browser settings.

Security. We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS) on our website and access controls on our systems and email account. No online service or method of transmission is completely secure, and we cannot guarantee the security of data sent to us over the internet. If we become aware of a breach that would prejudice the privacy, confidentiality or security of your personal data, we will report it to the UAE Data Office and notify you, in each case as required by UAE Data Protection Law.

6. Your rights

Under UAE Data Protection Law, and subject to the conditions and exceptions it sets out, you have the right to:

• obtain information about the personal data we process about you, why we process it, who we share it with (inside or outside the UAE), how long we keep it, the safeguards for transfers outside the UAE, and how to complain to the UAE Data Office;
• receive the personal data you provided to us in a structured, machine-readable format, or ask us to transfer it to another controller where technically feasible, where our processing is based on your consent or a contract and is carried out by automated means;
• ask us to correct data that is inaccurate or incomplete;
• ask us to delete your data where it is no longer needed, you withdraw your consent, you object and there is no legitimate reason for us to continue, or it has been processed unlawfully;
• ask us to restrict or stop using your data in certain circumstances;
• object to your data being used for direct marketing (including related profiling), at any time;
• withdraw your consent at any time, without affecting anything we did before you withdrew it.

To unsubscribe from our emails, click the “unsubscribe” link at the bottom of any email we send you. It takes effect immediately.

To use any other right, email info@sandwichsandwich.ae with your request. We may ask you to confirm your identity before we act. We will respond without undue delay and within any period required by UAE Data Protection Law, and in any event aim to respond within [30] days. We will not charge you. We may refuse or limit a request where UAE Data Protection Law allows, for example where a request is excessively repetitive, conflicts with an investigation or legal proceedings, would affect information security, or would affect the privacy of others. Where your data is held by the franchisor as a controller in its own right, we will pass on your request or tell you how to contact the franchisor.

If you are unhappy with how we have handled your data, please contact us first so we can try to resolve it. You also have the right to complain to the UAE Data Office in accordance with its procedures.

7. Cookies policy

Cookies are small text files placed on your device when you visit a website. We use them to make our website work, to understand how it is used and, with your permission, to show you relevant ads.

When you first visit our website, a banner lets you accept or reject non-essential cookies. Strictly necessary cookies are always on, because the website cannot work without them. You can change your choice at any time through the “Cookie settings” link in the website footer.

We use three types of cookies:

• Strictly necessary cookies keep the website working and secure, and remember your cookie choices.
• Analytics cookies help us count visits and understand how visitors use the website, so we can improve it.
• Marketing cookies help us measure our advertising and show you relevant Sandwich Sandwich ads on social media and other platforms.

Some cookies are set by third parties, such as analytics and social media providers, which may act as controllers in their own right. Their use of this information is governed by their own privacy policies, and we are not responsible for their practices.

You can also block or delete cookies through your browser settings. Blocking strictly necessary cookies may stop parts of the website from working. Rejecting analytics or marketing cookies does not affect your ability to use the site.

8. Children, changes and contact

Children. Our emails and website are intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you are a parent or guardian and believe your child has given us their details, contact us and we will delete them. You can also ask to see what we hold about your child before it is deleted.

Links to other websites. Our website may link to delivery platforms, social media, the franchisor’s website and other sites. They have their own privacy policies, and we are not responsible for their content or for how they handle your data.

Changes to this policy. We may update this policy from time to time, including to reflect changes in law, executive regulations or guidance under the PDPL, or in our business or franchise arrangements. The latest version will always be on this page with its “last updated” date. If we make significant changes, we will tell our email subscribers and, where required by law, ask for your consent.

Our responsibility. Nothing in this policy limits or excludes any liability or any right you have that cannot be limited or excluded under UAE law. Subject to that, we are not responsible for any loss arising from the acts or omissions of third-party websites, platforms or controllers that we do not control, or from events beyond our reasonable control.

Governing law and language. This policy is governed by the laws of the United Arab Emirates as applied in the Emirate of Dubai. [An Arabic version of this policy is available on request. If there is any conflict between the English and Arabic versions, the [Arabic] version will prevail.]

Contact us.

The Sandwich Group L.L.C-FZ

Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates

Email: info@sandwichsandwich.ae