This policy explains how Nuvai Solutions W.L.L ("Nuvai", "we") handles personal data when you use this website or contact us through it. We collect as little as we can, use it only to reply to you and to keep the site running safely, and never sell it.
Who we are
Nuvai Solutions W.L.L is the controller of the personal data described here. We are based in Doha, Qatar. Commercial registration: [to confirm: commercial registration number]. Registered address: [to confirm: registered postal address].
For anything about your data, email mohammad.ashraf@nuvai.qa.
What we collect
When you contact us. Your name, email address and message, plus anything you choose to add: company, budget range, timeline, and which service or product you're asking about. If you email us directly, we receive whatever you include.
When you browse. Like any website, our hosting provider processes technical data to deliver pages and protect the site: your IP address, browser and device type, and the pages requested. We use your IP address briefly to limit repeated form submissions. Our own logs record that a message was sent, but not your name, email or message.
Bot protection. On the contact page, Cloudflare Turnstile checks that submissions come from a person. It processes signals from your browser for that purpose only.
Visit statistics. Cloudflare Web Analytics counts page views and measures how fast pages load, so we know which pages are useful. It sets no cookies, stores nothing on your device and doesn't follow you to other sites. We see totals, not individual visitors.
Cookies and local storage. Only what's necessary unless you choose otherwise. See our cookie policy.
If you allow marketing cookies. Meta's pixel records the pages you visit here, technical data about your browser and device, your IP address and a random identifier (the _fbp cookie), so we can see when visits come from our posts or ads on Facebook and Instagram. If you're logged in to Facebook or Instagram, Meta may link this to your account and use it under its own privacy policy (opens in a new tab). Without your consent, none of this loads.
We don't knowingly collect sensitive personal data through this website. Please don't send it to us in the contact form.
Why we use it
| Purpose | Data | Basis |
|---|---|---|
| Replying to your enquiry and discussing possible work | Contact details and message | Taking steps at your request before a possible contract, and our legitimate interest in answering enquiries |
| Sending you a confirmation that we received your message | Name and email address | Taking steps at your request |
| Keeping the site secure and preventing abuse | IP address and technical data | Our legitimate interest in protecting the site and our inbox |
| Counting visits and page speed (Cloudflare Web Analytics, cookieless) | Pages viewed, referrer, browser and device type, page-load timings | Our legitimate interest in understanding which pages are useful |
| Remembering your cookie and theme choices | Your choices | Necessary to provide the site as you asked |
| Measuring visits from our Facebook and Instagram posts and ads (Meta Pixel) | Pages visited, device data, IP address, _fbp identifier | Your consent (marketing cookies), which you can withdraw at any time [to confirm: lawyer to confirm joint-controller arrangement with Meta and the PDPPL basis] |
| Optional features you switch on (for example embedded booking) | As described when you switch them on | Your consent, which you can withdraw at any time |
Under Qatar's Personal Data Privacy Protection Law (Law No. 13 of 2016), we process personal data for these legitimate purposes and, where the law requires it, with your consent. [to confirm: lawyer to confirm the PDPPL basis for each purpose]
We don't sell your data. We use it for advertising measurement only through the Meta Pixel and only if you allow marketing cookies. We don't make automated decisions about you that have legal or similarly significant effects.
Who processes it for us
We use a small number of service providers to run the site and handle email. They process personal data only on our instructions.
| Provider | What they do for us | Data involved | Where |
|---|---|---|---|
| Cloudflare, Inc. (privacy policy, opens in a new tab) | Hosting and delivering this website, security, rate limiting and bot protection (Turnstile) on the contact form, cookieless visit statistics (Web Analytics). | IP address, browser and device information, request details; contact-form security signals. | Global network; Cloudflare is headquartered in the United States. |
| Resend (Plus Five Five, Inc.) (privacy policy, opens in a new tab) | Delivering contact-form messages to us and the confirmation email to you. | Your name, email address, company and the contents of your message. | United States. |
| Microsoft Corporation (Microsoft 365) (privacy policy, opens in a new tab) | Our business email, where your enquiry and our correspondence with you are kept. | Your name, email address, and anything you write to us. | Microsoft data centres; region to be confirmed in legal review. |
| Meta Platforms Ireland Ltd / Meta Platforms, Inc. (privacy policy, opens in a new tab) | Measuring visits that come from our posts and ads on Facebook and Instagram, only if you allow marketing cookies. | Pages you visit here, browser and device information, IP address and the _fbp identifier. If you're logged in to Facebook or Instagram, Meta may link this to your account. | Ireland and the United States. |
We may also disclose information if the law requires it, or to protect our rights, our users or the public.
Where it's processed
Some of our providers process data outside Qatar, including in the United States. Where the law requires safeguards for these transfers, we rely on [to confirm: transfer safeguards per jurisdiction (e.g. contractual clauses, provider DPAs)].
How long we keep it
- Enquiries and correspondence: [to confirm: retention period (proposed: 24 months after our last contact, unless we start working together)]
- If we start working together: as set out in our contract with you.
- Security and technical logs: kept by our hosting provider for a short period for security purposes. [to confirm: log retention period]
- Your cookie choice: 6 months, then we ask again.
How we protect it
Encrypted connections (HTTPS) everywhere, a minimal set of trusted providers, access limited to the people who need it, and logs that exclude the contents of your messages. More on our security page.
Your rights
Under Qatar's Personal Data Privacy Protection Law you have the right to:
- have your data processed lawfully and protected
- be told how your personal data is processed
- access your personal data
- ask us to correct it
- ask us to erase it
- object to its processing
- withdraw consent you've given, at any time
- be told if your data is disclosed inaccurately
If UK or EU data protection law applies to you, you also have the right to restrict processing and to data portability, in addition to the rights above. [to confirm: lawyer to confirm UK/EU applicability]
To exercise any right, email mohammad.ashraf@nuvai.qa. We may need to confirm your identity first. We'll respond within 30 days, or within one month where UK or EU law applies, and tell you if we need longer and why.
Complaints
We'd like the chance to fix any concern first, so please contact us. You can also complain to a regulator:
- Qatar: the National Cyber Security Agency (NCSA), which oversees the Personal Data Privacy Protection Law
- United Kingdom: the Information Commissioner's Office (ico.org.uk (opens in a new tab))
- European Union: the data protection authority in the country where you live or work
Children
This website is for businesses and isn't directed at children. We don't knowingly collect personal data from anyone under 18.
Changes
If we change this policy, we'll update the version and date at the top of this page. Significant changes will also be highlighted here.
Contact
Nuvai Solutions W.L.L · Doha, Qatar · mohammad.ashraf@nuvai.qa