PRIVACY POLICY

Who we are

This website is owned and run by LIMAH. LIMAH Design Services LLC is the parent company, with its head office in Dubai, United Arab Emirates. We operate through LIMAH Design Services LLC, LIMAH Group, LIMAH Limited and LIMAH Design (together "LIMAH", "we", "us" or "our").

LIMAH Design Services LLC is the data controller for personal data collected through this website, wherever you are. Its address is Studio 511, 893 Sheikh Zayed Road, Al Barsha 1, Dubai, United Arab Emirates.

You can contact us about privacy at our company number or our email.

ABOUT THIS POLICY

This policy explains what personal data we collect through our website (the "Sites") and services, why we collect it, who we share it with, and what rights you have. It is written to meet the data protection laws that apply to our main markets: the UAE, Saudi Arabia, the UK, Oman and Kuwait.

Our collection of your personal data may be subject to other privacy policies, such as:

• Our Recruitment Privacy Statement covers job applications and careers enquiries.
• Our Cookie Policy cover cookies and similar technologies.

We may update this policy from time to time. We will post the new version here and change the date at the top. If a change is significant, we may also tell you by email or a notice on our home page. If the law requires your consent to a change, we will ask for it.

This Privacy Policy covers the following topics:

• Personal Data We Collect
• Why We Use Your Data, and Our Legal Basis
• Cookies and Similar Technologies
• Google Analytics
• Who We Share Your Data With
• How Long We Keep Your Data
• International Transfers
• Security
• Your Rights
• Your Rights: Region Considerations
• Complaints
• Marketing
• Children
• Third-party Links and Embedded Content
• Do Not Track and Browser Signals
• Accessibility

Personal data we collect

"Personal data" means any information that relates to an identified or identifiable person.

ENQUIRIES

When you use our contact form or email us, we collect your first name, last name, email address, the type of enquiry, and your message. We also keep anything else you choose to send us.

Job applications

If you apply by email, we collect the documents you send (such as your CV, cover letter and portfolio). See our Recruitment Privacy Statement.

Information collected automatically

When you visit our Sites, some information is collected through cookies and similar technologies. This includes your browser type and language, device and operating system, approximate location (from your IP address), date and time of visit, pages viewed, links clicked, how you reached the Sites, and whether you are a new or returning visitor. Optional analytics information is only collected if you accept analytics cookies (see 'Cookies and Similar Technologies').

Information about other people

If you give us someone else's personal data, you must have the right to do so, and you should tell them how we will use it.

Sensitive data

We do not ask for sensitive data (such as health, religion or ethnicity) through our Sites. Please do not send it to us in an enquiry.

Why we use your data, and our legal basis

We only use your personal data when we have a valid legal reason. Where local law requires your consent, we ask for it. Where local law allows another basis, we rely on it.

• To answer your enquiry and discuss work with you. Basis: our legitimate interests in running our business and responding to you, or steps you ask us to take before entering a contract. Where the local law of your country requires consent for this, we treat your submission of the form as your request and ask for consent where needed.
• To run and secure our sites (for example necessary cookies, fraud prevention and keeping the Sites working). Basis: legitimate interests.
• To understand how our Sites are used (analytics). Basis: your consent, which you give through our cookie banner.
• To meet legal duties and handle legal claims (for example accounting, tax and responding to lawful requests). Basis: legal obligation, or our legitimate interests in defending our rights.
• For a business sale or restructuring. Basis: legitimate interests.

Withdrawing consent

Where we rely on consent, you can withdraw it at any time. This does not affect anything we did before you withdrew. You can change your cookie choices through your 'Cookie Preferences', or email us to withdraw consent for anything else.

Automated decisions

We do not make decisions about you using fully automated processing or profiling that has legal or similarly significant effects.

Cookies and similar technologies

Cookies are small files placed on your device. We use CookieYes to ask for your choice when you first visit.

Necessary cookies are always on. They keep the Sites secure and remember your cookie choice. You can change your choice at any time through the 'Cookie Preferences'. For full details, see our Cookie Policy.

The cookies currently in use are:

• cookieyes-consent (CookieYes): remembers your cookie choices. Necessary. Lasts 1 year.
• _cfuvid (Cloudflare): used for security and to manage traffic. Necessary. Lasts for your browsing session.
• _ga and _ga_NGTN6FK19P (Google Analytics): tell us how visitors use the Sites. Analytics, set only if you accept. Last about 13 months.

GOOGLE ANALYTICS

If you accept analytics cookies, we use Google Analytics (provided by Google) to understand how people use our Sites and to improve them. Google Analytics collects pseudonymous information such as a device or browser identifier, pages viewed, approximate location, and the device and browser you use. Although we do not use it to identify you, this information can relate to an identifiable person, so we treat it as personal data.

The information is sent to Google, which may store and process it outside your country, including in the United States. Google's own privacy policy applies to its use of the data. We keep analytics data for 2 months. You can stop analytics at any time by changing your choice in 'Cookie Preferences', or by using Google's opt-out tools.

Who we share your data with

We do not sell your personal data. We share it only as needed with:

Service providers

We use trusted providers to help us run the Sites and our business. These include website hosting and forms (Webflow), analytics and tag management (Google), cookie consent (CookieYes), security and performance (Cloudflare), and email, file storage and IT providers. They may only use your data on our instructions.

Contact form enquiries are stored in our website form tool (Webflow) and sent to our company email.

Our group companies

We may share your data with other LIMAH companies where this is needed to handle your enquiry.

Professional advisers

We may share your data with professional advisers, such as lawyers, auditors and insurers, where they need it to advise or support us.

Authorities and other partieS

We may share your data where the law requires it, or where we need to protect our rights, property or safety, or to prevent fraud.

A buyer or successor

If all or part of our business is sold, merged or restructured, your data may be passed to the new owner. They must continue to protect it under this policy.

How long we keep your data

We keep personal data only as long as we need it for the purpose it was collected, and to meet legal, tax and accounting duties.

• Enquiries that do not lead to work: 24 months after our last contact.
• Enquiries that lead to a contract: for the length of the contract, then for the period required by law, normally 6 years.
• Analytics data: 2 months.
• Job applications: as set out in our Recruitment Privacy Statement.

When we no longer need data, we securely delete or anonymise it.

International transfers

LIMAH operates in several countries, and some of our providers (such as Google) are based outside your country, including in the United States. This means your personal data may be sent to and handled in other countries, including countries whose data protection laws differ from yours.

We only transfer personal data when the law allows it, and we put safeguards in place where they are required. Depending on where you are, these may include:

• UK: transfers from the UK follow the UK GDPR. Where the destination country is not recognised as providing adequate protection, we use safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
• UAE: we follow the transfer rules in Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and any related regulations.
• Saudi Arabia: we transfer personal data of people in the Kingdom outside the Kingdom only as permitted by the Saudi Personal Data Protection Law, its Implementing Regulations and the Regulations on Personal Data Transfer outside the Kingdom.
• Oman: we follow the transfer rules in the Omani Personal Data Protection Law and its Executive Regulations.
• Kuwait: we follow the Kuwaiti rules that apply to us, including CITRA's Data Privacy Protection Regulation where it applies.

You can ask us for more detail about the safeguards we use.

SECURITY

We use reasonable technical and organisational measures to protect personal data from loss, misuse and unauthorised access. No system is completely secure, so we cannot guarantee absolute security. If a personal data breach affects you and the law requires it, we will tell you and the relevant authority within the required time.

YOUR RIGHTS

You can ask us to:

• tell you whether we use your data, and give you access to it and a copy
• correct data that is wrong or incomplete
• delete your data, where we no longer need it or have no legal basis to keep it
• restrict how we use it, in certain situations
• stop using it, where you object to our use
• withdraw your consent, where we rely on it
• move your data to another provider in a usable format, where it applies
• stop sending you marketing

YOUR RIGHTS: REGION CONSIDERATIONS

Depending on where you are, you have rights over your personal data. In summary, you can ask us to:

UK

You have the rights under the UK GDPR and the Data Protection Act 2018, including the right not to be subject to solely automated decisions with legal or similar effects.

UAE

You have the rights under Federal Decree-Law No. 45 of 2021, which include access, correction, erasure, restriction, data portability, the right to stop processing, and the right to object to automated processing.

Saudi Arabia

You have the rights under the Saudi Personal Data Protection Law, which include the right to be informed, access, obtain a copy, correction, destruction, and to withdraw consent.

OMAN

You have the rights under the Omani Personal Data Protection Law and its Executive Regulations, including access, correction, erasure or blocking, and withdrawal of consent.

Kuwait

Kuwait does not currently have a single general data protection law. We apply the rights above to Kuwait visitors as a matter of good practice, and follow the Kuwaiti rules that apply to us.

Elsewhere

You have the rights your local law gives you, and we will honour them.

How to use your rightS

Reach out to us at our email. We may ask you to confirm who you are. We will reply without undue delay, and generally within one month (UK) or the period your local law sets, which can be as short as 30 days. Some rights have limits, for example where we must keep data to meet a legal duty. If we refuse a request, we will explain why.

COMPLAINTS

Please contact us first, so we can try to fix the problem. You also have the right to complain to the data protection authority where you live or work:

• UK: the Information Commissioner's Office (ICO), ico.org.uk
• UAE: the UAE Data Office
• Saudi Arabia: the Saudi Data and AI Authority (SDAIA)
• Oman: the Ministry of Transport, Communications and Information Technology
• Kuwait: the Communication and Information Technology Regulatory Authority (CITRA), where it applies

MARKETING

We do not currently run a newsletter. If we send you marketing messages, we will only do so if you have asked for them or the law allows it. You can opt out at any time by emailing us or using any unsubscribe link we include. If we phone you, you can tell us you do not want further contact.

Children

Our Sites and services are for businesses and adults. They are not intended for anyone under 18, and we do not knowingly collect personal data from children. If you think a child has sent us personal data, please tell us and we will delete it.

Third-party links and embedded content

Our Sites may link to other websites (such as LinkedIn, Instagram and Pinterest) and may include content from other services, such as video. Those third parties have their own privacy policies and we are not responsible for them. Please read them before you use those sites.

Do Not Track and browser signals

Browsers do not agree on a standard "Do Not Track" signal, so our Sites do not respond to it. You can control cookies through your 'Cookie Preferences' and your browser settings.

ACCESSIBILITY

We are committed to ensuring that this Privacy Policy is accessible to individuals with disabilities. If you wish to access this Privacy Policy in an alternative format or need any assistance regarding accessibility, please contact us.