Privacy Policy
What we collect when you use this website, why we collect it, who else sees it, and how to ask us to delete it.
Last updated
Who we are
ebs Digital is a digital marketing agency registered in Dubai, United Arab Emirates, at Office 803, The Metropolis Tower, Burj Khalifa Street, Business Bay, Dubai, U.A.E. We run this website, ebsdigital.com.
For the purposes of UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL), and of the EU and UK General Data Protection Regulation where it applies to visitors in those regions, we are the data controller for the information described on this page. That means we decide what is collected and why, and we are the people to complain to.
What we collect
Only what you type, plus the ordinary technical information any web server records. We do not buy data about you, we do not enrich what you give us from third-party sources, and we do not build a profile of you across other websites.
- The enquiry formYour name, company name, email address, the services you selected, the budget range you selected and whatever you wrote in the brief. We also record which page you were on, the website that referred you and any campaign tags in the link you arrived through, so we know which of our own work is reaching people.
- The chatThe messages you send and the replies you get, and the page you opened the chat on. If you choose "Talk to a person", the details you type into its short form — your name, email, and if you give them your phone number, company, the services you need, a budget range and what you want to achieve — go to our team with the conversation so far, and a person from the team may then chat with you there. We keep a copy of every conversation, finished or not, so that we can see where the assistant's answers fall short and pick up where you left off.
- Visit statisticsWhich pages you view, which links and buttons you click, how far down each page you scroll, the website that sent you (its address only, never the full link) and any campaign tags in the link you arrived through. From the request itself we record your IP address, your browser's user-agent string — from which we note only whether you are on a phone, a tablet or a computer — and, where our host provides it, your country. We do not record what you type anywhere on the site as part of this.
- Server logsOur hosting provider records IP addresses, timestamps and requested URLs, as every web server does. These are used to keep the site running and to investigate abuse. We do not use them to identify individual visitors.
Why we collect it, and on what basis
We use what you send us to reply to you, to prepare a proposal or a scope if you ask for one, and to keep a record of the conversation so that whoever picks it up knows what was already discussed.
We use visit statistics only in aggregate, to see which of our pages are read, which are not, and where visitors arrive from. Where the GDPR applies, the basis is our legitimate interest in understanding how our own website is used; we honour your browser's Do Not Track and Global Privacy Control signals by not counting you at all.
Where the GDPR applies, our legal basis is your consent for the enquiry you chose to send, and our legitimate interest in running and securing a website and in responding to business enquiries. Where the PDPL applies, we rely on your consent and on the necessity of processing to take steps at your request before entering into a contract.
We do not use your enquiry to send you marketing you did not ask for. If we ever want to, we will ask first.
Who else sees it
We keep the list short on purpose, and every one of these is a processor acting on our instructions rather than a partner we sell data to. We do not sell personal data, and we never have.
Our visit statistics and our copy of chat conversations are not on this list because nobody else receives them — they are kept in our own database, on the same hosting described below.
- GoHighLevelOur CRM. Every enquiry from the form and every brief sent from the chat ("Talk to a person") is stored there, because that is where our team actually reads and replies to them. Hosted in the United States.
- Our AI providerThe chat's assistant sends your messages to a third-party language model to generate its replies — by default Google Gemini. It receives the text of the conversation. It does not receive your CRM record, and we do not permit the content to be used to train their models.
- HostingerOur hosting provider. It operates the servers this site runs on and holds the server logs described above.
- CloudflareServes the images and video on this site from its network. It sees the request for a file; it is not sent anything you type.
Where your information goes
We are in the UAE, and some of the services above are operated from the United States and the European Union. That means information you send us is transferred outside your country and outside ours.
Where the GDPR applies, those transfers rely on the standard contractual clauses in our agreements with those providers. Where the PDPL applies, we transfer on the basis of your consent and of the contractual protections we have in place. If you would rather not have your information leave a particular jurisdiction, do not use the form — email or call us instead, and tell us.
How long we keep it
Enquiries and briefs stay in our CRM for as long as you are a client or a live prospect, and for two years after our last contact, after which we delete them. Server logs are kept for a short operational period by our hosting provider and are not archived by us.
Visit statistics: your IP address is deleted after 90 days, leaving only a keyed one-way hash of it that lets us count returning visits without being able to recover the address. Everything else about a visit is deleted after two years.
Chat conversations are deleted two years after their last message.
If you ask us to delete your information sooner, we will, unless we are required to keep a record of a transaction for tax or legal reasons — in which case we will tell you what we are keeping and why.
Your rights
Under the PDPL, and under the GDPR where it applies to you, you can ask us to do all of the following, and you do not have to give a reason:
- Tell you what we hold about you, and give you a copy of it.
- Correct anything that is wrong.
- Delete it.
- Stop using it, or restrict what we do with it.
- Send it to you, or to someone else, in a portable format.
- Withdraw your consent, at any time, for anything you consented to.
How it is protected
The site is served over HTTPS. Credentials for our CRM and other services are held as server-side environment variables and are never sent to your browser. Access to the CRM is limited to the people at ebs Digital who need it.
No system is perfectly secure, and we would rather say that plainly than claim otherwise. If we ever discover a breach affecting your personal data, we will notify you and the relevant authority as the PDPL and the GDPR require.
Children
This is a business-to-business website and it is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us something, tell us and we will delete it.
Changes to this policy
When we change how we handle personal data, we change this page and move the date at the top of it. If a change is significant — new tracking, a new processor, a new purpose — we will say so here rather than leaving you to spot the difference.
Contact us
To exercise any of the rights above, or to ask a question about this policy, email hello@ebsdigital.com or call +971 52 264 6970. We aim to answer within one working day and, for a formal request, within the 30 days the law allows.
You can also write to us at Office 803, The Metropolis Tower, Burj Khalifa Street, Business Bay, Dubai, U.A.E.
If you are not satisfied with how we have handled your request, you can complain to the UAE Data Office. If you are in the EU or the UK, you can complain to your national data protection authority.