Privacy Policy

1. Who we are

BAROUDI LABS LTD is a private limited company registered in England & Wales (Company No. 17190393). Our registered office is 124 City Road, London, EC1V 2NX, United Kingdom. For all data protection matters, you can contact us at [email protected]. We are the data controller for any personal data collected via baroudilabs.com.

2. Information we collect

We collect only the personal data we need to operate this website and respond to enquiries. This includes:

• Information you provide directly — name, email address, and message content when you fill in our contact form or email us.
• Technical information collected automatically — IP address, browser type, device, pages visited, and referring website. This is used for security and basic site analytics.
• Information from cookies — currently limited to a locale preference cookie set by next-intl. We do not use third-party advertising or tracking cookies on this site.

3. Lawful bases for processing

Under UK GDPR Article 6, we rely on the following lawful bases:

• Consent (Article 6(1)(a)) — when you submit our contact form or sign up to be notified.
• Legitimate interests (Article 6(1)(f)) — to operate, secure, and improve our website, and to respond to legitimate business enquiries.
• Legal obligation (Article 6(1)(c)) — where we are required by law to retain or disclose information.

4. How we use your information

We use the personal data we collect to: respond to your enquiries; send you information you have requested; operate, maintain, and secure baroudilabs.com; comply with legal obligations; and protect our rights. We do not use your data for automated decision-making or profiling.

5. Sharing your information

We do not sell your personal data. We share it only with:

• Service providers who process data on our behalf (for example, our hosting and email providers), under written contracts that require appropriate confidentiality and security.
• Meta Platforms, Inc. — only when you interact with merchants through software we provide on WhatsApp, Instagram, or Facebook, and only to the extent necessary to deliver that service in compliance with the Meta Platform Terms.
• Authorities, regulators, or law enforcement where we are legally required to do so.

6. International transfers

Some of our service providers may be located outside the UK or EEA. Where personal data is transferred internationally, we use appropriate safeguards under UK GDPR Article 46, including UK adequacy regulations, the UK International Data Transfer Agreement, or Standard Contractual Clauses. For data subjects in the UAE and other GCC jurisdictions, we comply with the cross-border transfer requirements of the applicable local law.

7. Your rights

Under UK GDPR and the UAE PDPL, you have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request deletion of your data (the "right to be forgotten");
• Restrict or object to processing in certain circumstances;
• Receive your data in a portable format;
• Withdraw consent at any time, where consent is the lawful basis;
• Lodge a complaint with the relevant supervisory authority.
• To exercise any of these rights, email [email protected]. We will respond within one calendar month.

8. Data retention

We retain personal data only for as long as necessary for the purposes set out in this policy. Contact form submissions are retained for up to 2 years from your last interaction with us. Data we are legally required to retain (for example, for tax or audit purposes) is kept for the period required by law. When data is no longer needed, it is securely deleted.

9. Cookies

baroudilabs.com uses a single functional cookie set by next-intl to remember your language preference (English or Arabic). We do not use advertising, tracking, or analytics cookies that require consent under PECR. If we add any non-essential cookies in the future, we will request your consent first.

10. Meta Platform compliance

When users interact with merchants on Meta platforms — WhatsApp, Facebook, or Instagram — through software provided by Baroudi Labs, we process limited data as a Business Solution Provider in accordance with the Meta Platform Terms, the WhatsApp Business Solution Terms, and Meta's Developer Policies. We do not store WhatsApp message content beyond what is operationally necessary, do not use it for advertising, and provide a documented data deletion process at baroudilabs.com/data-deletion.

11. Security

We use appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration, or disclosure. These include encryption in transit (HTTPS), access controls, and reasonable security testing. No system is perfectly secure, but we work to industry standards.

12. Complaints

If you believe we have not handled your personal data lawfully, you can complain to:

• The UK Information Commissioner's Office (ICO) — https://ico.org.uk — if you are in the UK or your data was processed in the UK.
• The UAE Data Office — https://www.uaedataoffice.gov.ae — if you are in the UAE.
• Your local supervisory authority in any other jurisdiction.
• We would appreciate the chance to address any concerns first — please contact us at [email protected].

13. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest revision. Material changes will be communicated via the website or by email where appropriate.

14. Contact

Questions about this policy or about how we handle your data? Email [email protected] or write to us at our registered office: BAROUDI LABS LTD, 124 City Road, London, EC1V 2NX, United Kingdom.