Privacy policy

Who we are and what this policy covers

This privacy policy explains how we handle personal data in connection with our website, arcmedia.me. The website is operated by Arc Media, a trading name of Selim Bah, operating as a sole trader. In this policy, "we", "us" and "our" refer to Arc Media. We are the controller of the personal data described here, which means we decide why and how it is used.

Arc Media builds growth systems for barbershops and grooming studios, and we work with clients in Dubai, United Arab Emirates and Austin, Texas, United States. This policy covers the website only: the home page and the pages at /privacy/, /terms/ and /cookies/. Client engagements are governed by a separate signed agreement, and any data we handle while delivering services to a client is dealt with under that agreement, not this policy.

We have written this policy to meet the expectations of the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where it applies to you, the EU and UK GDPR. If you are reading this from the EU or the UK, the rights described below apply to you in full.

What data we collect and why

The website is a simple informational site. It has no contact form, no user accounts and no payment collection. We receive personal data through it in only three situations.

• Correspondence data. If you email us at hello@arcmedia.me, call us, or message us on WhatsApp at +971 52 281 9662, we receive your name, your contact details and the content of your message. We use this to reply to you and to keep a record of the conversation.
• Booking data. The "Book a call" buttons on the site open a WhatsApp chat with us, with a short message already written for you. WhatsApp is operated by Meta and handles your messages under its own terms and privacy policy as well as this one. When you message us there, we receive your WhatsApp profile name, your phone number and the content of your message, and we use them to arrange the call and prepare for it.
• Technical data. Our hosting provider processes technical request data, such as your IP address, browser user agent and request logs, in order to deliver the site and keep it secure. We do not use this data to identify visitors.

If you never contact us and never book a call, the technical data above is the only data connected with your visit, and it stays with our hosting provider.

What we do not collect

It is worth stating plainly what this site does not do, because most websites do all of it.

• We run no analytics of any kind. We do not measure visits, track sessions or build profiles of visitors.
• We use no advertising trackers, pixels or similar technologies.
• The site itself sets no cookies. Our hosting provider may set strictly necessary cookies in limited security situations, such as bot protection. There is no cookie banner because none is needed today.

You can read more in our cookie policy. If any of this changes, we will update this policy and the cookie policy before the change takes effect.

Purposes and lawful bases

We process personal data only for the purposes below, and only where the law allows it. The UAE PDPL and the GDPR describe lawful bases in slightly different terms. The bases listed here are intended to satisfy both.

• Responding to inquiries. When you contact us, we process your correspondence data to reply and to keep a record of what was discussed. We rely on our legitimate interest in responding to people who reach out to us and, where the law requires it, on your consent, which you give by contacting us.
• Scheduling and preparing for calls. When you book a call, we process your booking data to hold the call and prepare for it. This is a step taken at your request toward entering a contract with us.
• Site security and delivery. Technical data is processed under our legitimate interest in running a secure and reliable website.
• Legal obligations. We may process or retain data where we need to comply with a legal obligation that applies to us, such as record keeping or responding to a valid request from an authority.

Third party processors

We use a small number of service providers to run the website and handle correspondence. Each one processes personal data either on our behalf or as an independent controller under its own privacy policy, and each is bound by contractual terms that require it to protect your data.

• Cloudflare hosts the website and provides content delivery and security. Cloudflare processes technical request data such as IP addresses, user agents and request logs.
• WhatsApp, operated by Meta, carries the messages between you and us when you book a call or message us directly. WhatsApp processes your data under its own terms and privacy policy.
• Our email provider stores and transmits our email correspondence.

We never sell personal data, and we never share it with anyone for advertising purposes. We disclose data outside this list only if the law requires it, for example in response to a valid legal request from a court or regulator.

International transfers

Because we operate across the UAE and the US, and because our providers run global infrastructure, your personal data may be processed in the United Arab Emirates, the United States, and the European Union or United Kingdom.

Where data moves between these places, we rely on appropriate safeguards. For transfers out of the UAE, we follow the cross border transfer requirements of the UAE PDPL. For data covered by the EU or UK GDPR, we rely on recognized mechanisms such as adequacy decisions or standard contractual clauses where applicable. Our providers publish their own transfer commitments, and we take those commitments into account when we choose to work with them.

Data retention

We keep personal data only for as long as we need it for the purposes described in this policy.

• Correspondence data. We keep emails, call notes and WhatsApp messages for up to 24 months after the last exchange. If a client relationship follows, the records connected to that relationship are kept under the terms of the signed agreement instead.
• Booking data. WhatsApp messages about booking a call are kept with the rest of our correspondence, up to 24 months after the last exchange. We keep the resulting appointments in our own calendar records.
• Technical data. Server and security logs are kept briefly by our hosting provider and rotate automatically.

When a retention period ends, we delete the data or anonymize it so that it no longer identifies you.

Your rights

You have rights over your personal data. Under the UAE PDPL and, where they apply, the EU and UK GDPR, you can ask us to:

• give you access to the personal data we hold about you, and a copy of it;
• correct data that is inaccurate or incomplete;
• delete your data;
• object to processing that is based on our legitimate interests;
• restrict processing while a question about the data is resolved;
• provide your data in a portable format, where processing is based on consent or contract;
• withdraw consent at any time, without affecting processing that happened before you withdrew it.

To exercise any of these rights, email us at hello@arcmedia.me. We may ask you to verify your identity so that we do not release data to the wrong person. We respond within 30 days. If a request is unusually complex, we will tell you within that period and explain when to expect a full answer. Exercising these rights is free of charge.

You can also complain to a supervisory authority. In the UAE, that is the UAE Data Office. If you are in the EU or the UK, you can complain to the supervisory authority in your country. We would appreciate the chance to resolve your concern first, but you are not required to contact us before making a complaint.

Children

The website and our services are directed to business owners and managers. They are not directed to individuals under 18, and we do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has given us personal data, contact us at hello@arcmedia.me and we will delete it.

Security

We take proportionate measures to protect the small amount of personal data we handle. The website is served over encrypted connections. Correspondence and booking data sit with reputable providers that maintain their own security programs, and access to that data is limited to the people who need it to respond to you.

No method of transmission or storage is completely secure, so we cannot promise absolute security. If a breach ever put your rights at real risk, we would notify you and the relevant authority as the law requires.

Automated decision making

We do not use automated decision making or profiling. No decision that affects you is made by a computer without a person involved, and nothing on the website scores, categorizes or profiles visitors.

Changes to this policy

We may update this policy as the website, our practices or the law changes. The current version is always published at /privacy/, and the date of the latest update is shown on this page. If we make a material change, for example if we ever add analytics or a contact form, we will update this policy before the change goes live. We encourage you to check back whenever you interact with us.

How to contact us

Questions, requests and complaints about this policy or your personal data can be sent to:

• Email: hello@arcmedia.me
• Phone and WhatsApp: +971 52 281 9662

We aim to answer every message about personal data within 30 days.