Last updated: 24 October 2026
This privacy notice explains how EVA (Event Visitor Analytics) uses personal data when we offer this website or the EVA product to people in the United Arab Emirates, and how the EVA product is designed to handle activity at exhibitions and live events in the UAE.
It is written for two different situations. If you fill in a form or browse this website, the sections about the website apply. If you visit an exhibition stand in the UAE where EVA is deployed, the sections about the product apply. Customers who use EVA at an event remain responsible for their own visitor notices and for deciding the legal basis for that deployment under UAE law.
This notice is intended to meet the transparency requirements of Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL) and its Executive Regulations. If you are outside the UAE, see our UK privacy notice.
Who we are
This website is operated by EVA, trading as Event Visitor Analytics. In this notice, "we", "us" and "our" mean EVA.
For personal data collected through this website from people in the UAE, EVA is the controller. For visitor analytics generated when a customer uses the EVA product at an event, the customer is typically the controller and EVA provides the platform as a processor, according to the contract with that customer.
If a deployment takes place in a UAE financial free zone, the DIFC Data Protection Law or the ADGM Data Protection Regulations may also apply to that customer. Those laws sit alongside, and in some cases instead of, the federal PDPL. The customer remains responsible for deciding which regime applies to their event.
What this website collects
You can browse most of this site without giving us your name. We collect personal data when you choose to contact us, and limited technical data when you use the site.
Demo enquiries
The Book a Demo form asks for first name, last name, work email and company. You may also give a job title, telephone number, a message, and optional details about an upcoming event (name, location, date and approximate stand size). You can submit an enquiry without event details.
We use this information to respond to your request, to understand whether you have an event in mind, and to keep a record of the enquiry. We process this data because it is necessary to take steps at your request toward a possible contract, and because you asked us to reply. Where UAE law requires consent for a particular use, we will ask for it.
Enquiries are stored as records on our systems. Where email notifications are configured, a copy is sent to our team using our email provider so we can reply. We keep enquiry records for as long as we need them to handle the request and any follow-up, then delete or anonymise them when they are no longer required.
Technical and usage data
Our hosting and security systems may process IP address, browser type, device information, pages viewed and the date and time of a visit. We use this to operate, secure and diagnose the website. This processing is necessary to provide the website you asked to use and to keep it secure.
Cookies
Essential cookies are needed for the site to work, including security, network management and remembering your cookie choice. They cannot be switched off through our banner.
Analytics cookies (for example Google Analytics, Google Tag Manager or Microsoft Clarity) load only if you allow them. They help us understand how the website is used.
Marketing cookies (for example LinkedIn Insight) load only if you allow them. They help us measure campaign performance.
You can accept optional cookies, choose essential only, or change your choice later through Cookie settings. Changing your choice withdraws consent for optional cookies from that point onward. See the cookie notice for more detail.
Who we share website data with
We share website personal data only where needed to run the site and respond to you. That may include hosting, security, email delivery and, if you have consented, analytics or marketing measurement providers. We do not sell your details.
We may disclose information if required by UAE law or another applicable law, or to protect our legal rights.
International transfers
This website and our supporting systems may process personal data outside the United Arab Emirates, including in the United Kingdom and in other countries where our hosting, security, email and (if you have consented) analytics or marketing providers operate.
Where the PDPL restricts a transfer, we rely on an available condition such as your consent, necessity to perform a contract or to take steps at your request, a transfer to a destination recognised by the UAE Data Office, contractual safeguards, or another condition permitted by the PDPL and its Executive Regulations.
Your rights under the PDPL
Depending on the circumstances, you may have the right to obtain information about the processing of your personal data, to access it, to have it corrected or erased, to restrict processing, to request transfer of your data, to object to processing, and to object to decisions based solely on automated processing that produce legal or similarly significant effects. Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that already took place.
To exercise these rights for data collected through this website, send a message through the Book a Demo form and start your message with "Privacy request". We may need to confirm who you are before we can act. We will respond within the period required by the PDPL.
You can also complain to the UAE Data Office, the federal supervisory authority for the PDPL. Information about data protection in the UAE is published on the official UAE government portal at u.ae.
How the EVA product handles visitor activity
The EVA product is an event visitor analytics platform. It is designed around Privacy by Design and Privacy by Default. It is not a traditional video surveillance archive, and it does not identify visitors.
EVA has no feature that identifies who a person is. Counts, dwell, journeys, heatmaps and repeat-visit measures are anonymous visit analytics. They are not linked to a name, contact details or any other real-world identity. The customer who deploys EVA at an event is typically the controller for that deployment and remains responsible for telling visitors how the stand is measured.
What the product is built to measure
Depending on configuration, EVA can produce anonymous analytics such as visitor counts, occupancy, dwell time, heatmaps, stand zones, visitor journeys, engagement, hour-by-hour activity and repeat-visit analysis. Cloud services receive this kind of analytical information. They do not receive images, video or facial representations.
Local processing and no video archive
Cameras on a stand stream live video to an EVA processing environment at the event. Analysis happens there. Video is processed in real time and is not recorded or archived. Images exist only temporarily in memory during analysis. Video is not uploaded to the EVA cloud platform.
Anonymous visitor identifiers
Where the product tracks activity across a visit, it uses an anonymous internal identifier. That identifier contains no name, no contact details and no real-world identity. It exists to calculate measures such as dwell, movement, engagement, occupancy and repeat visits within a single exhibition. Marketing demonstrations on this website use labels such as Visitor 0284 in the same way: they are visit identifiers, not people.
Optional anonymous facial comparison
EVA does not use facial recognition to identify who a visitor is. Repeat-visitor analysis, where a customer enables it, may use anonymous facial comparison so the platform can tell whether the same unidentified person has returned to the stand during that exhibition.
In that mode, mathematical features are taken from a live image, the original image is discarded, and a temporary anonymous biometric template is held locally. The template is numerical only. It cannot be viewed as a photograph, it is not matched to a name, and it is compared only with templates from the same exhibition. Templates are deleted when the exhibition ends. This feature can be switched off so a deployment counts visitors without that comparison.
Biometric data is treated as sensitive personal data under the PDPL. A customer must not enable this feature in the UAE unless they have a valid PDPL basis, typically explicit consent or another condition that the PDPL allows for sensitive data, and unless they have given visitors a clear notice. EVA supplies the platform. It does not decide that basis for the customer.
Optional staff recognition
Staff recognition is separate from visitor analytics and is optional. Where a customer enables it, staff photographs stay on the local processing environment and are not sent to the cloud. They are removed when the customer removes them or when the exhibition ends. The customer is responsible for telling staff and for having a valid PDPL basis, which will often be employment necessity or consent.
What is stored, and for how long
- Live video: processed, not stored.
- Temporary anonymous biometric templates (if repeat-visitor comparison is enabled): kept locally for the exhibition only, then deleted.
- Optional staff photographs: local only, until removed or the exhibition ends.
- Anonymous analytics in the cloud: retained according to the customer's subscription. No images, video or biometric templates are retained in the cloud.
After an exhibition, local processing databases are securely erased.
Event visitors and your rights
Because visitor analytics are designed to be anonymous, most event records cannot be linked back to a named person. If you visited a stand in the UAE and want to raise a privacy request, contact the exhibitor or organiser who deployed EVA as well as us. We will help where we can, but we often cannot match a request to an anonymous analytics record because no identity exists in the system.
Customer responsibilities
Customers who deploy EVA in the UAE remain responsible for telling visitors how the stand is measured, for any signage the venue or authority requires, for deciding the PDPL legal basis for their use of the product, for any extra conditions that apply to sensitive personal data, and for a data protection impact assessment where one is required. EVA supplies a privacy-first platform. It does not replace the customer's own governance.
Children
This website and the EVA product are aimed at businesses and at adult visitors to trade and consumer exhibitions. We do not knowingly use this website to collect personal data from children. If you believe we have collected a child's personal data through the website, contact us using the details below and we will delete it.
How to contact us
For questions about this notice or about personal data collected through this website, use the Book a Demo form and start your message with "Privacy request".
This notice is provided in English. If you need it in Arabic, say so in your message and we will help.
Changes
We may update this notice when the website, the product or the law changes. The date at the top of this page will change when we do.