2. What this policy covers

This policy applies to personal information handled through our website, enquiries, bookings, business communications, marketing and relationships with prospective clients, clients, suppliers and collaborators.

Personal information means information that identifies a person or can reasonably be linked to them. Business contact details can also be personal information.

When we process personal information solely on a client’s instructions while delivering a project, our role and responsibilities are governed by the relevant client agreement and applicable law. The client’s privacy notice may apply to that processing. We will direct requests to the appropriate client where necessary.

This policy explains our practices. Visiting our website or accepting our Terms of Use does not, by itself, give consent to processing that requires a separate choice.

3. Information we collect and its sources

The information we handle depends on your interaction with us.

Contact and professional information. Your name, email address, telephone number, organisation, role, business website and other details you provide when contacting us or discussing work.

Enquiry, booking and project information. Messages, meeting details, briefs, proposals, feedback, shared files and information needed to understand or manage a potential or existing engagement.

Commercial and transaction information. Contract details, billing information, invoices, payment status and related correspondence. Payment providers may collect payment credentials directly under their own privacy notices.

Technical and usage information. IP address, browser and device information, approximate location inferred from technical data, referring pages, pages viewed, interactions, timestamps, campaign information and online identifiers. The information collected depends on the technologies used and relevant settings or choices.

Preferences and correspondence. Marketing preferences, consent records, objections, privacy requests and communications needed to respond to them.

We receive information directly from you, through website technologies and service providers, and where relevant from business contacts, referrals, clients, collaborators, public professional sources or platforms through which you communicate with us.

Please provide only information reasonably needed for your interaction. Avoid sending sensitive personal information unless we have specifically agreed an appropriate purpose and method of sharing it.

Where information is required to respond to an enquiry, enter an agreement or meet a legal obligation, we will identify that requirement where relevant. If you do not provide it, we may be unable to complete the requested action. Optional information is not required.

4. Why we use information and our legal grounds

We use personal information for the purposes below. The legal ground for processing depends on the activity and the law that applies. A legal ground recognised in one jurisdiction does not automatically apply in another.

Where EU or UK data protection law applies, our purposes and grounds are:

• Responding to enquiries and preparing proposals. We use contact, professional and enquiry information to understand your request and communicate with you. The ground is taking steps at your request before entering a contract with you, or our legitimate interest in responding to business enquiries where you represent an organisation.

• Delivering and managing engagements. We use relevant contact, project and commercial information to provide agreed services, coordinate work and administer the relationship. The ground is performing a contract with you, or our legitimate interest in managing a contract with the organisation you represent.

• Payments and business records. We use billing, transaction and contract information to invoice, reconcile payments and maintain records. The grounds are contract performance, our legitimate interest in business administration, and compliance with legal obligations recognised under the applicable law.

• Website operation and security. We use technical information to deliver the website, troubleshoot problems, prevent misuse and investigate security incidents. The ground is our legitimate interest in maintaining a functional and secure website, with consent obtained separately where required for device access or storage technologies.

• Analytics and advertising measurement. We use usage, campaign and event information to understand website activity and measure or improve campaigns. We rely on consent where required. Where a limited form of measurement can lawfully operate without consent, the ground may be our legitimate interest in understanding website performance, subject to applicable safeguards.

• Marketing communications. We use contact details and preferences to send relevant news or information about our work. The ground is consent, or a legitimate interest where the applicable rules permit that communication without consent.

• Legal matters and privacy requests. We use relevant records to respond to rights requests, comply with applicable duties and establish, exercise or defend legal claims. The grounds are applicable legal obligations or our legitimate interest in protecting legal rights.

Where we rely on legitimate interests, we consider the necessity of the processing, your reasonable expectations and the effect on your rights. We do not rely on that ground where your rights and interests override it.

Where the UAE federal personal data protection law applies, processing must rely on consent or a specific exception recognised by that law. References above to legitimate interests do not create an independent ground under UAE law. Processing subject to Lebanese or other applicable laws must likewise meet those laws’ requirements.

Where processing depends on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before withdrawal.

Before using information for a materially different purpose, we will provide further information and obtain any consent or other authorisation required by law.

5. Cookies, analytics and advertising technologies

Our website uses technologies that support its operation, measure activity and help us understand advertising performance. These include cookies, pixels, scripts and similar technologies.

Framer. Framer hosts our website and provides functionality and built-in analytics. Additional analytics and advertising tools used on the website operate separately and may collect personal information or use cookies.

Google Analytics. Google Analytics helps measure website visits, interactions, traffic sources and campaign performance. Depending on configuration and consent requirements, it may process online identifiers, technical information and usage events.

Meta. Meta Pixel supports advertising measurement and campaign optimisation. It may send Meta information about page views and interactions, together with technical information and identifiers. Where enabled, server integrations may also send event information associated with an enquiry or booking. Meta may connect information it receives with information it holds under its own privacy arrangements.

Technologies necessary to provide a requested function or maintain security are distinguished from optional analytics and advertising technologies. Where applicable law requires consent, optional technologies require your consent before use. Browsing the website, submitting an enquiry or accepting the Terms of Use does not provide that consent.

You can use any consent controls presented on the website to make or change relevant choices. You can also contact hello@voydgroup.com to withdraw consent, object to relevant processing or obtain help with your preferences.

Browser settings can block or delete stored cookies, and advertising platforms offer additional account controls. These controls have different effects: deleting a cookie does not automatically delete information already received by a provider, and contacting us does not itself remove cookies from your device.

6. Marketing communications

Submitting an enquiry or booking a call does not automatically subscribe you to a newsletter.

Where we send marketing, we do so in accordance with the applicable rules. You can stop marketing emails by using their unsubscribe link or contacting us. We may retain limited suppression information so that we can respect your choice.

Service messages, such as responses to enquiries, project correspondence and invoices, are separate from marketing communications.

7. Who receives personal information

We share information where reasonably needed for the purposes described in this policy, including with:

• Providers supporting hosting, website operation, email, storage, communications, scheduling, project administration, payments and security, including Framer for hosting and Cal.com for bookings.

• Analytics and advertising providers, including Google and Meta, subject to applicable requirements and choices.

• Collaborators, contractors and professional advisers involved in an engagement or in supporting our business.

• Authorities, courts or other parties where disclosure is legally required or necessary to establish, exercise or defend legal rights.

• A prospective or actual successor, purchaser or adviser in a business transaction, subject to appropriate confidentiality and data protection arrangements.

• Other recipients when you request or authorise the disclosure.

We limit disclosures to what is relevant to their purpose. Providers acting on our behalf are subject to appropriate contractual requirements. Some recipients, including certain payment, advertising and professional service providers, may act as independent controllers for particular activities.

We do not sell personal information for money. Certain disclosures to advertising providers may nevertheless fall within broader legal definitions of “sale,” “sharing” or “targeted advertising.” Where those rules apply, the associated notice, consent or opt-out requirements also apply. See Section 11 for your rights.

8. International processing

Because we operate from Dubai and Lebanon and work internationally, information may be accessed or processed in the United Arab Emirates, Lebanon and other countries where our providers or authorised collaborators operate. Those countries may have different data protection laws from your own.

Transfers subject to legal restrictions require a mechanism recognised by the applicable law. Depending on the transfer, relevant mechanisms may include an adequacy decision, approved contractual safeguards with additional protections where necessary, or a specific lawful exception.

Consent to website cookies is not, by itself, consent to an international transfer that requires separate authorisation.

Contact us for information about destinations and safeguards relevant to your information, including a copy or explanation of applicable safeguards where you are entitled to receive one. We may redact confidential or unrelated information.

9. How long we keep information

We retain personal information for as long as reasonably necessary for its purpose, taking account of legal requirements and the need to establish, exercise or defend claims.

The criteria depend on the information:

• Enquiries and proposals: the time needed to respond, manage relevant follow-up and maintain a reasonable record of the discussion, considering our last meaningful contact and whether an engagement is likely or ongoing.

• Project and commercial records: the engagement’s duration and any subsequent period needed for administration, contractual obligations, accounting, taxation or legal claims.

• Marketing information: the duration of a valid subscription or other lawful marketing relationship, subject to withdrawal, objection and periodic review. Limited suppression records may be retained to prevent further unwanted contact.

• Technical and analytics information: the period needed for security investigations, website performance assessment or campaign measurement, taking account of the relevant technology and retention settings.

• Privacy and consent records: the period needed to handle a request, document a choice and demonstrate compliance with applicable obligations.

Information may be retained longer where a legal hold or another specific obligation applies. When it is no longer needed, we delete it or make it no longer identifiable. Information awaiting routine removal from backups is subject to continued protection and restricted use.

You may contact us for the retention period or criteria relevant to a particular category of your information.

10. Security

We use technical and organisational measures appropriate to the nature of the information and the risks involved. These include measures addressing access, handling and the use of service providers.

No method of transmission or storage is completely secure. If a personal information breach occurs, we will assess it and notify affected people or authorities where required by applicable law.

11. Your rights and choices

Depending on the law that applies and the circumstances, you may have the right to:

• Receive information about how your personal information is used.

• Access your information and obtain a copy.

• Correct inaccurate or incomplete information.

• Request deletion or restriction of processing.

• Receive certain information in a portable format and, where applicable, request its transfer.

• Object to processing based on legitimate interests and to direct marketing.

• Withdraw consent where processing relies on it.

• Opt out of targeted advertising or disclosures treated as a sale or sharing under applicable law.

• Request safeguards or human review in relation to qualifying solely automated decisions with legal or similarly significant effects.

• Appeal a decision about a privacy request where applicable law provides that right.

• Complain to a competent data protection authority or pursue another available legal remedy.

Where EU or UK law applies, you may object to direct marketing at any time. For other processing based on legitimate interests, you may object on grounds relating to your particular situation.

To make a request, email hello@voydgroup.com. Explain your request and how you interacted with us. We may request proportionate information to verify identity or an authorised representative’s authority.

We respond within the period required by applicable law. Under EU or UK data protection law, this is normally one month, subject to lawful extensions and any permitted requirements concerning verification or clarification. If we cannot fulfil a request, we will explain the reason and relevant options where required.

We do not impose a charge unless applicable law permits it, and we will not unlawfully discriminate or retaliate against you for exercising a privacy right.

Where applicable law recognises a browser or device opt-out signal, it must be handled according to that law and the scope of the signal. You may also contact us if you need help exercising an applicable advertising opt-out.

You do not have to contact us before complaining to a competent authority. Where EU or UK law applies, this may include the authority in your place of habitual residence, place of work or the place of an alleged infringement, as applicable.

12. External services and children

External websites, booking services, payment services, social platforms and embedded content may have their own privacy practices. Review the relevant provider’s notice when using those services. This does not remove our responsibility for processing that we control.

Our website and professional services are intended for business audiences and are not directed at children. If you believe a child has provided information to us, contact us so that we can assess the matter and take appropriate action.

13. Updates and contact

We may update this policy as our activities, technologies or legal requirements change. The date above identifies the latest revision. Where required, we will provide additional notice or obtain fresh consent before a relevant change takes effect.

For questions about this policy, our handling of information or your privacy rights, contact:

Voyd Group
hello@voydgroup.com
voydgroup.com