Privacy policy

Who we are

This website is run by Graphica Digital Agency Ltd, a company in the United Kingdom. We serve clients in 11 markets: Saudi Arabia, the UAE, Qatar, Kuwait, Oman, Jordan, Türkiye, the UK, Germany, Canada and the United States.

We are the controller of the personal data described in this policy, which means we decide why and how it is used. For any privacy question, email info@graphica-marketing.com or write to our UK office: Shelton Street, Covent Garden, London WC2H 9JQ.

The laws that apply to how we handle personal data include the UK GDPR and the Data Protection Act 2018 and, for visitors in Saudi Arabia, the Personal Data Protection Law (PDPL).

What we collect

Please leave sensitive details, such as health information, out of your message: we don't need them to answer a request. Depending on how you use the site, we collect:

• Your request: when you use the contact form, your organisation type, the service track you choose, your answers to that track's questions, your budget range and timeline, and your name, email address, phone number (optional), company and message.
• Where your visit came from, if you accept analytics: the first page you opened and the source of your visit, such as a search engine, a social network or a campaign tag in a link, and the page you send your request from. We receive this only with a request.
• Security data: when you use the form, Cloudflare Turnstile may process your IP address and signals from your device and browser, and our server keeps a one-way hash of your IP address for a short time.
• Analytics and advertising data, only if you accept them: information about your visit, such as the pages you view and the device and browser you use, collected by Google Analytics 4, Yandex Metrica and the advertising pixels of Google Ads, Meta, TikTok, Snapchat and OpenAI.
• Messages you send us directly: if you email us or chat with us on WhatsApp, we receive your email address or phone number and what you write.

Why we use it and on what basis

Every use of your data has a legal basis under the UK GDPR. For visitors in Saudi Arabia, we rely on the grounds the PDPL allows: your consent where it is required, the steps you ask us to take towards an agreement, and our legitimate interests where the law permits.

We use your data to:

• answer your request, prepare a proposal and follow up by email, or by phone or WhatsApp if you give us a number (steps you ask us to take before a possible contract, and our legitimate interest in replying to enquiries)
• see which pages and channels bring requests, using the visit source (our legitimate interest in understanding what works on our site)
• protect the form and the site from spam and abuse (our legitimate interest in keeping the site secure)
• measure visits and the results of our advertising with analytics and pixels (your consent, which you can withdraw at any time)
• keep records once you become a client (our contract with you and our legal obligations)

Where your visit came from

If you accept analytics in the cookie banner, the site remembers, so we know where requests come from, the first page you opened and the source of your visit, such as a search engine, a social network or a campaign tag in a link. It keeps this in your browser: your first visit in local storage and your current visit in session storage.

Nothing is sent to us while you browse. Only when you submit the form is this information attached to your request, so our team can see where it came from. You can delete it at any time by clearing this site's data in your browser.

Spam protection on the form

When you use the form, Cloudflare Turnstile checks that a person, not an automated program, is sending it. To do this, Cloudflare may process your IP address and signals from your device and browser.

The form also has a hidden field that people don't see. Requests that fill it in are treated as automated and are not delivered. To block repeated abuse, our server keeps a one-way hash of your IP address, not the address itself, for a short time and then discards it.

Cookies, analytics and advertising

Google Analytics 4, Yandex Metrica and the advertising pixels of Google Ads, Meta, TikTok, Snapchat and OpenAI load only after you accept them in the cookie banner, where you can accept or refuse analytics and advertising separately.

If you accept, these tools may store identifiers in your browser and collect information about your visit, such as the pages you view and the device you use. They help us understand how the site is used and measure our advertising, and the platforms may use them to show our ads to people who have visited the site. Each company handles this data under its own privacy policy.

Your choice is stored in your browser, and you can change it at any time from the link in the footer of every page. If you don't accept, no analytics or advertising tools load, and your browser holds only your choice, the visit-source record described above and anything the site strictly needs to work.

Who receives your data

We don't sell your personal data. We may disclose it if the law requires us to.

Depending on how you use the site, your data is shared with:

• Hostinger, which hosts the site and receives the technical data any website receives when you load a page, such as your IP address. Fonts and videos are served from the site itself; we don't use third-party font services.
• Our email provider, which delivers your request to our team and sends you an automatic confirmation.
• Our CRM and WhatsApp workflow, which receives a copy of your request through a secure webhook so our team can follow it up.
• Cloudflare, which runs the spam check on the form.
• Google, Yandex, Meta, TikTok, Snapchat and OpenAI, only if you accept analytics or advertising.
• WhatsApp, part of Meta, if you choose to chat with us there. Our WhatsApp buttons open wa.me with a message you can edit before sending, and the conversation is handled under WhatsApp's own terms.

Data processed outside your country

We are a UK company serving clients in 11 markets across the Gulf, the Middle East, Europe and North America, and our providers operate in several countries. Your data may therefore be processed outside the country where you live.

When it is, we rely on the safeguards the law requires, such as a decision that the destination country protects personal data adequately, or contract terms recognised for international transfers.

How long we keep your data

We keep personal data only for as long as we need it for the purposes in this policy:

• Requests that don't lead to work, and related messages: up to 24 months after our last contact, then deleted.
• Client records, such as proposals, contracts, invoices and project correspondence: for as long as the contract runs, then as long as the law requires.
• Visit source in your browser: the record of your first visit for up to six months, then replaced; the record of your current visit until you close the tab.
• The hash of your IP address used to block abuse: a short time only, then discarded.
• Your cookie choice: in your browser until you change it or clear your browser data.
• Analytics data tied to your browser: up to 14 months in Google Analytics. Yandex Metrica and the advertising platforms keep their data under their own policies.

Your rights

Depending on the law that applies to you and the reason we use your data, you have the right to:

• know what data we hold about you and get a copy of it
• have inaccurate or incomplete data corrected
• have your data deleted
• object to how we use your data, or ask us to restrict it
• receive the data you gave us in a commonly used format
• withdraw your consent at any time, without affecting anything done before
• complain to a data protection authority

How to use your rights or complain

Email info@graphica-marketing.com and tell us what you would like us to do. We may ask you to confirm your identity first, and we will reply within the time the law sets, free of charge in most cases. To withdraw your consent to cookies, use the link in the footer at any time.

If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You can also complain to the Information Commissioner's Office (ICO) in the UK, the Saudi Data and AI Authority (SDAIA) in Saudi Arabia, or the data protection authority where you live.

Changes to this policy

We update this policy when the site, our providers or the law change. The date at the top of the page shows the latest version. If you have a question about it, email info@graphica-marketing.com.