Privacy Policy

1. Scope of this policy

This policy explains what happens to personal data when you use the website at lariel.io. It covers the website only. Data processed under a signed services agreement is governed by that agreement and by any data processing addendum attached to it, not by this page.

Lariel is established in Dubai, United Arab Emirates, and processes personal data in line with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the UAE PDPL). Where we offer services to, or monitor the behaviour of, individuals in the European Economic Area, Regulation (EU) 2016/679 (the GDPR) also applies, and we apply its standards to that data.

2. What this site collects

2.1 The contact form

If you submit the enquiry form, we receive the information you type into it: your name, your company (optional), your email address and your message. Our server also records the IP address the submission came from and the time it was sent, as part of the anti-spam and rate-limiting measures described in section 6.

The form requires you to confirm that you have read this policy before it can be sent. That confirmation is recorded in the enquiry we receive.

2.2 Server logs

Our hosting provider keeps standard web server access logs. These typically record the IP address, the time of the request, the page requested, the referring page and the browser user-agent string. These logs are created by the hosting infrastructure, not by us, and we cannot switch them off. They are retained for a limited period set by the provider and are overwritten in the ordinary course. If you want to know who hosts this site and the retention period currently applied, email us and we will tell you.

2.3 Cookies and tracking

This website sets no cookies. It uses no analytics, no advertising pixels, no session storage and no local storage. Because nothing is stored on your device, there is no cookie banner and no consent mechanism to manage.

3. Third parties this site contacts

We want to be precise about this, because "we do not share your data" is rarely the whole truth for any website.

• Google Fonts. The pages load two typefaces from Google's font service (fonts.googleapis.com and fonts.gstatic.com). To deliver those files, your browser connects to Google, which means Google receives your IP address and basic request information. This is the only request this site makes to a third party. Google is based in the United States; its handling of that data is governed by its own privacy terms.
• Our hosting and email providers. The server that stores and serves this site, and the mail service that delivers enquiries to us, process data on our behalf as service providers under contract. They may not use it for their own purposes. We will identify them by name, and tell you which country the server is in, on request.

We do not sell personal data, do not share it for advertising, and do not transfer enquiry contents to any party other than the providers above.

4. Why we process it, and on what basis

• To answer your enquiry. Under the GDPR this rests on our legitimate interest in responding to business correspondence, and on taking steps at your request prior to entering into a contract. Under the UAE PDPL it rests on your consent and on the necessity of the processing for pre-contractual steps.
• To protect the site from abuse. The IP address and timestamp recorded with a submission are used to block automated spam and to rate-limit repeated sending. This rests on our legitimate interest in keeping the service available and usable.
• To keep records of business correspondence where an enquiry leads to a commercial relationship, on the basis of our legitimate interest and any applicable record-keeping obligation.

We do not use your data for automated decision-making or profiling, and we do not send marketing email to addresses collected through this form.

5. How long we keep it

• Enquiries that do not lead anywhere are deleted from our mailbox within 12 months of the last message exchanged.
• Enquiries that lead to an engagement are retained for the duration of that engagement and for five years afterwards, in line with our record-keeping obligations and the limitation periods that may apply to the work.
• Spam rate-limiting records hold no message content and expire automatically within minutes.

One technical detail worth stating plainly: if our mail service is unavailable at the moment you submit the form, the enquiry is written to a file on the server so it is not lost, and we are shown an error. That file is not reachable from the web, and its contents are moved to our mailbox and deleted once delivery is restored.

6. Security

The site is served over HTTPS. Submissions are validated and length-limited on the server, protected against mail header injection, and rate-limited per IP address. Access to the mailbox that receives enquiries is restricted to the people at Lariel who need it.

No transmission over the internet is completely secure. Please do not send credentials, identity documents or confidential client material through the contact form; we will agree a secure channel with you first.

7. Your rights

Subject to the conditions and exceptions in the applicable law, you may:

• ask what personal data we hold about you and receive a copy of it;
• have inaccurate data corrected;
• ask for your data to be deleted;
• ask us to restrict how we use it, or object to our use of it;
• receive the data you gave us in a portable, machine-readable form;
• withdraw consent where our processing relies on it, without affecting what was done before you withdrew it.

To exercise any of these, email contact@lariel.io. We will respond within the period required by the applicable law, and we may ask you to confirm your identity before acting on a request.

If you believe we have handled your data improperly, you may complain to the UAE Data Office, and, if the GDPR applies to the processing, to the supervisory authority in your country of residence or place of work.

8. International transfers

We are established in the United Arab Emirates. If you contact us from the European Economic Area, your data is transferred outside the EEA when it reaches us. Where such a transfer is subject to the GDPR, we rely on the European Commission's Standard Contractual Clauses, together with the technical and organisational measures described in section 6, as the safeguard for it. A copy of the clauses we use is available on request.

9. Children

This site is addressed to businesses. It is not directed at children and we do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, contact us and we will delete it.

10. Changes to this policy

If we change how this site handles personal data, we update this page and change the date at the top. Material changes will be described here rather than made silently.

11. Contact

contact@lariel.io

Questions about this policy, and requests to exercise the rights in section 7, should go to that address and will be handled by the person responsible for data protection within Lariel.

← Back to the site