Privacy Policy

1. Who we are

Zafre Media is the trading name of AL UMA ALRAQAMI COMPUTER SYSTEMS DESIGN, a sole establishment licensed by the Department of Economy and Tourism, Dubai, under trade licence no. 1183327, owned by Seyed Reza Mirhossein Movahedi, with its address at Plot 13-S1, Dubai Investment Park 1, Dubai, United Arab Emirates ("Zafre", "we", "us", "our").

We design and build websites and booking systems for local service businesses in a small number of selected industries. This policy explains what personal data we collect, why we collect it, who we share it with, and the choices you have.

For anything in this policy, write to us at hello@zafremedia.com.

We are the data controller for the personal data described in this policy, except where section 6 says we act as a processor on a client's behalf.

2. Who this policy covers

This policy applies to:

• visitors to zafremedia.com and any page or landing page we publish on it;
• business owners and representatives who contact us, book a call, or request a free homepage preview;
• businesses we contact as part of our own outreach;
• our clients and their nominated contacts during and after a project.

It does not cover the websites of other companies we link to, or the sites we build for clients once those clients operate them. Each of those has its own privacy policy.

3. The personal data we collect

3.1 Information you give us

When you submit a form on our site, email us, message us on a social platform, or book a call, we collect:

• your name and the name of your business;
• your email address and, if you give it, your phone number;
• your website address and the city or area your business serves;
• the industry you work in and what you tell us about your current website, enquiries and goals;
• anything else you choose to write in a message or say on a call.

If you book a meeting through our scheduling tool, that tool also records the date and time you chose, your time zone, and any answers you give to its booking questions.

3.2 Information we collect to prepare a free homepage preview

Our main offer is a redesigned homepage prepared at no cost, built from material your business has already published. To prepare it, we look at information that is publicly available about your business, including:

• your existing website, including its text, images, logo and contact details;
• your public business listing (for example your Google Business Profile), including public reviews, photographs, opening hours and the address shown there;
• your public social media or directory profiles.

Some of this material contains personal data — for example the name of an owner or practitioner, a staff photograph, or the first name of a person who left a public review. We use it only to show you how your own homepage could look, and we do not add it to a marketing list of individuals.

If you ask us to stop using your business's material or to delete a preview we prepared, we will do so. Write to hello@zafremedia.com.

3.3 Information we collect for outreach

We approach businesses directly rather than waiting for them to find us. To do that we collect business contact information from public sources, including public professional profiles, business websites, and public business directories and listings. The records we keep are limited to what we need in order to make a relevant business approach:

• business name, website, industry and service area;
• the name and job title of the owner or decision-maker;
• a business email address, business phone number or public profile link;
• publicly observable notes about the business's website and online presence;
• a record of our contact with that business and its response.

We keep these records in our own working files on Google Workspace. We do not buy or sell lists of personal data, and we do not collect special or sensitive categories of personal data for outreach.

If you would rather we did not contact you again, reply to any message and tell us, or write to hello@zafremedia.com. We will remove you from our outreach records and keep a minimal suppression entry so that you are not contacted again by mistake.

3.4 Information we collect during a project

If you become a client, we also handle:

• the content you send us for your site — text, photographs, logos, documents, pricing and service information;
• names and contact details of the people at your business we work with;
• access to the accounts a project needs, such as your website hosting, domain registrar, Google Business Profile, analytics and review accounts;
• billing details and a record of payments, invoices and refunds;
• project correspondence, approvals and meeting notes;
• the measurements we report to you — form submissions, calls, bookings and other enquiries your site produces during the tracking period.

We never ask for or want your customers' medical records, patient notes, payment card data or any other sensitive records, and you should not send them to us.

3.5 Information we collect automatically

When you visit zafremedia.com, we and the providers named in our Cookie Policy may collect:

• your IP address, approximate location derived from it, and time zone;
• your browser and device type, operating system and screen size;
• the pages you view, the links you click, how long you stay and where you arrived from;
• a cookie or similar identifier used to recognise your browser on later visits.

Analytics and advertising technologies are only loaded where we have the consent required for them. Our Cookie Policy lists each one, what it does and how to turn it off.

3.6 Payment information

Payments are processed by Stripe, Inc. Your card or bank details go to Stripe, not to us. We receive only the information we need to reconcile a payment — the amount, the date, the currency, the outcome, and the name and billing details on the invoice.

4. Why we use your personal data, and on what basis

• Answering your enquiry and sending you a free homepage preview — Data involved: Sections 3.1, 3.2. Our basis: Your request, and our legitimate interest in responding to a business enquiry.
• Approaching businesses that fit the industries we work in — Data involved: Section 3.3. Our basis: Our legitimate interest in business-to-business marketing, balanced against your interests, and your consent where the law requires it.
• Delivering a project we have been engaged for, and supporting it afterwards — Data involved: Sections 3.1, 3.4. Our basis: Performance of our contract with you.
• Measuring the enquiries your new site produces and reporting them to you — Data involved: Section 3.4. Our basis: Performance of our contract with you.
• Taking payment, invoicing, accounting and tax records — Data involved: Sections 3.4, 3.6. Our basis: Performance of our contract, and our legal obligations.
• Running and securing our website, and preventing abuse — Data involved: Section 3.5. Our basis: Our legitimate interest in a working, secure site.
• Understanding how our site is used so we can improve it — Data involved: Section 3.5. Our basis: Your consent.
• Advertising our services and measuring those adverts — Data involved: Section 3.5. Our basis: Your consent.
• Showing work we have done, in a portfolio or case study — Data involved: Project material, within the limits in our Terms of Service. Our basis: Our legitimate interest in demonstrating our work, and our contract with the client.
• Handling a guarantee claim, a dispute or a legal requirement — Data involved: Any of the above, as relevant. Our basis: Our legal obligations and the establishment or defence of legal claims.

Where we rely on a legitimate interest, we have considered whether that interest is outweighed by your rights, and you can object at any time — see section 10.

Under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, we process personal data only for the purposes set out above, keep it accurate and secure, and do not use it for an unrelated purpose without telling you.

5. Marketing, and how to stop it

We send business-to-business messages about our services by email and through professional social platforms. Every message tells you who it is from and how to stop receiving them.

You can opt out at any time by replying to ask us to stop, using any unsubscribe link we include, or writing to hello@zafremedia.com. We will act on it promptly. Opting out of marketing does not stop messages we need to send about a live project or an invoice.

6. When we act for a client rather than for ourselves

The sites and booking systems we build collect enquiries from our client's own customers — names, contact details and whatever the customer writes in a form. That data belongs to our client, who decides how it is used. In relation to it, our client is the controller and we are a processor: we handle it only to build, run, fix and measure the system we were engaged to deliver, under instruction, and we do not use it for our own purposes.

If you are a customer of one of our clients and want to know how your data is used, contact that business. If you need a data processing agreement from us as a client, write to hello@zafremedia.com.

7. Who we share your personal data with

We do not sell your personal data. We share it only with the following, and only as far as each needs it:

• Website hosting and forms — Webflow, Inc. Hosts zafremedia.com and receives what you submit through a form on it.
• Email, files and working records — Google LLC (Google Workspace). Our email, documents and project and outreach records.
• Analytics — Google LLC (Google Analytics 4). Measures how our site is used, where consent allows.
• Advertising and measurement — Meta Platforms, Inc. and LinkedIn Corporation. Measure and target our advertising, where consent allows.
• Scheduling — our booking tool. Takes meeting bookings and the answers you give it.
• Payments — Stripe, Inc. Processes payments and keeps the transaction record.
• Professional advisers — accountants, auditors and lawyers, where they need it.
• Subcontractors and team members who work on a project under confidentiality obligations.
• Authorities and other parties, where we are legally required to disclose, or where disclosure is necessary to establish or defend a legal claim.
• A buyer or successor, if our business or part of it is sold or reorganised, under the same protections as this policy.

We ask each provider to handle personal data only on our instructions and to keep it secure.

8. Where your personal data goes

We are based in the United Arab Emirates and the providers listed above operate in other countries, including the United States and the European Union. That means your personal data may be transferred outside the country you are in.

Where a transfer needs a legal safeguard, we rely on one — an adequacy or equivalent determination where one exists, or contractual terms obliging the recipient to protect the data to the standard described in this policy, including the standard contractual clauses our providers offer. You can ask us which safeguard applies to a particular transfer.

9. How long we keep it

• An enquiry that does not become a project — How long: Up to 24 months from our last contact, then deleted.
• Outreach records for a business we did not work with — How long: Up to 24 months from our last contact; a minimal suppression entry is kept indefinitely if you asked not to be contacted.
• A free homepage preview we prepared — How long: Up to 12 months, or deleted sooner on request.
• Client project files, content and correspondence — How long: For the engagement and 3 years afterwards, so we can support the site and answer questions about it.
• Invoices, payments and accounting records — How long: For as long as UAE tax and company law requires, currently at least 5 years.
• Analytics data — How long: For the retention period set in the tool, up to 14 months.
• Records needed for a legal claim — How long: Until the claim and any appeal period ends.

When a period ends we delete the data or anonymise it so it can no longer identify anyone.

10. Your rights

Whatever country you are in, you can ask us to:

• tell you what personal data we hold about you and give you a copy of it;
• correct anything inaccurate or incomplete;
• delete it, where we have no overriding reason to keep it;
• stop or limit a particular use, including marketing and outreach;
• port data you gave us to another provider in a machine-readable format;
• withdraw consent you gave us, without affecting what we did before you withdrew it;
• object to a use we base on a legitimate interest.

To exercise any of these, write to hello@zafremedia.com. We will reply within 30 days and will not charge you or treat you differently for asking. We may need to confirm who you are first, and an authorised agent may act for you with written proof.

10.1 If you are in the EEA or the UK

Where the EU or UK General Data Protection Regulation applies to our processing, you have the rights above as set out in those regulations, and you can complain to your national data protection authority as well as to us.

10.2 If you are in the United States

State privacy laws, including the California Consumer Privacy Act as amended, give residents of a number of states the rights above, and a right not to be discriminated against for using them.

We do not sell personal information for money. The advertising and analytics technologies described in our Cookie Policy can, however, amount to "sharing" personal information for cross-context behavioural advertising, or to "targeted advertising", under some of those laws. To opt out:

• decline or withdraw advertising and analytics cookies in the consent control on our site; or
• send a Global Privacy Control signal from your browser or an extension that supports it, which we treat as a valid opt-out request for the browser that sends it; or
• write to hello@zafremedia.com and ask us to stop.

We do not knowingly process the sensitive personal information categories those laws define, and we do not use or disclose personal information for purposes other than those listed in section 4.

10.3 If you are in the UAE

You have the rights set out in Federal Decree-Law No. 45 of 2021, including the rights above and the right to complain to the competent UAE authority.

11. Cookies

Our site uses cookies and similar technologies. What they are, which ones we use, and how to control them are set out in our Cookie Policy.

12. How we protect it

We keep personal data on reputable business platforms with access controls, require multi-factor authentication on the accounts we use, limit access to the people who need it, and put confidentiality obligations on everyone who works on a project. Client access credentials are held only for as long as a project needs them and are handed back or revoked afterwards.

No system is perfectly secure. If a breach affects your personal data and is likely to cause you harm, we will notify you and the relevant authority as the law requires.

13. Children

Our services are sold to businesses and our site is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, write to hello@zafremedia.com and we will delete it.

14. Automated decisions

We do not make decisions about you by automated means alone that have a legal effect on you or similarly significant consequences for you. We do use tools to help us prioritise which businesses to approach, but a person always decides.

15. Other sites

Our site links to other websites and platforms we do not control. We are not responsible for their content or their privacy practices, and you should read their own policies.

16. Changes to this policy

We may update this policy as our services, our tools or the law change. The date at the top shows when it last changed. If a change materially affects how we use your personal data, we will take reasonable steps to tell you before it takes effect.

17. Contact us

Zafre Media
AL UMA ALRAQAMI COMPUTER SYSTEMS DESIGN — Trade Licence No. 1183327
Plot 13-S1, Dubai Investment Park 1
Dubai, United Arab Emirates
hello@zafremedia.com

If you are not satisfied with how we have handled a privacy question, tell us and we will look at it again. You can also complain to the data protection authority in your country.