Privacy Policy

We For Design ("we", "us"), a web design and digital marketing agency based at Times Square Center, behind 6A Street, Al Quoz Industrial Area 1, Al Quoz, Dubai, United Arab Emirates, is responsible for the personal data described in this policy. For any question about your data, or to use any of your rights, contact us at contact@wefordesign.com or +971 50 165 3123.

We handle personal data in line with the UAE's Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL) and its implementing rules as they are issued; the UAE government's page on UAE data protection laws summarises the framework. Where you are in another country whose law gives you further rights, such as the EU or the UK, we respect those rights too.

Only what you give us, plus a little technical information needed to run and protect the site:

• Free audit form: your name, company (optional), phone or WhatsApp number, email, preferred way to be contacted, your website address, industry, goal, timeline, any note you write, and any brief files you attach (up to three files, 10 MB each).
• Page context: the page you sent the form from, the website that referred you and campaign tags in the link (for example utm_source), so we know which page or advert brought you.
• Messages: what you send us by WhatsApp, email or phone, and the number or address you use.
• Technical data: your IP address, browser type and the time of your visit, processed by our hosting provider to deliver the pages and by our spam protection to check the form is sent by a person.

We do not ask for sensitive data such as health, religion or financial account details. Please do not include them in notes or files; if you do, we use them only to prepare your audit.

• To prepare and send your free audit and proposal, and to contact you about it in the way you chose: steps you asked us to take before a possible contract.
• To reply to your messages and calls: your request.
• To deliver a project or retainer if you become a client: our contract with you.
• To understand which pages and campaigns bring enquiries, using the page context above, and to keep the site and form secure against spam and misuse: our legitimate interest in running the business safely.
• To keep business, tax and accounting records where UAE law requires it.

We will only send you marketing messages, such as newsletters or WhatsApp offers, if you have agreed to receive them, and you can stop them at any time.

We do not sell or rent personal data. We share it only with service providers who process it on our behalf, under contracts that require them to protect it, and only as far as each one needs:

• Cloudflare: hosts the website, receives the audit form, stores your request and files, routes our email and runs the spam check (Turnstile).
• Meta (WhatsApp): when you message us on WhatsApp, and for internal alerts to our team about new requests.
• Our email and CRM providers, where we use them to manage enquiries and client work.

We may also disclose data where UAE law, a court or a competent authority requires it, or to protect our rights. If the business is ever reorganised or sold, data may pass to the new owner under the same protections.

Some of our providers, including Cloudflare and Meta, operate global networks, so your data may be stored or processed outside the UAE. Where that happens we rely on the safeguards the PDPL allows for cross-border transfers, such as the provider's contractual data protection commitments, and we choose providers with recognised security standards.

• Audit requests and messages that do not lead to work: up to 24 months after our last contact, so we can answer follow-up questions, then deleted.
• Brief files you attach: kept with your request in private storage. Links our team uses to open them expire after 30 days, and the files are deleted with the request.
• Client records: for the length of our work together and afterwards for as long as UAE commercial and tax laws require us to keep business records.

You can ask us to delete your data sooner at any time, as explained below.

The site is served over HTTPS, the form checks each request for spam, and requests and files are kept in private storage that is not publicly accessible. Only the team members who need your request can open it. No system is completely secure, but if a breach ever puts your data at risk we will act quickly and inform you and the authorities where the law requires.

We do not use advertising or tracking cookies, and we do not show cookie banners because none are needed today. The site stores two small things in your own browser: where your visit started (the referring site and campaign tags, kept only for the browser session so the audit form can tell us which page brought you) and a few preferences that make pages work. Our hosting and spam protection may use strictly necessary technologies to keep the site secure.

If we add analytics or advertising tools in future, we will update this policy first and ask for your consent where the law requires it.

Subject to the conditions in the PDPL, you can ask us to:

• tell you what personal data we hold about you and how we use it, and give you a copy;
• correct data that is wrong or incomplete;
• delete your data, or stop or restrict how we use it;
• stop sending you marketing messages;
• send your data to you or another organisation in a structured format, where technically possible.

Email contact@wefordesign.com from the address you used with us, or tell us by WhatsApp. We will reply within 30 days and may ask you to confirm your identity first. If you are not satisfied, you can complain to the UAE Data Office, the authority for personal data protection in the UAE.

We publish client reviews word for word, showing only the first name, the initial of the family name and the type of business, unless the client has agreed to more. Case studies name a client only with their written permission; otherwise they describe the business, for example "a Business Bay brokerage". To change or remove a review or case study about you, contact us.

No. Our services are for businesses, and the site is not meant for anyone under 18. If you believe a child has sent us personal data, contact us and we will delete it.

Our pages link to official sources and platforms, such as government authorities, Google, Meta and the platforms we build on. Their privacy practices are their own; please read their policies when you visit them.

We will update this policy when the way we handle data changes, for example if we add analytics or a new form, and show the new date at the top of the page. Significant changes will be highlighted on the site.