Privacy Policy

This privacy policy explains how The Headless Web FZE LLC ("Headless Web", "we", "us", "our") collects and uses personal data through the website headless-web.com and any subdomains (the "Site").

We are a company registered in the United Arab Emirates under Licence No. 2628310983888, with a registered office at 26th Floor, Amber Gem Tower, Ajman, United Arab Emirates.

For any questions about this policy or how we handle your personal data, contact us at hello@headless-web.com.

We are the controller of the personal data we collect through the Site. We have not appointed a Data Protection Officer as we are not required to do so under UK GDPR or EU GDPR.

Our UK GDPR Article 27 representative

Because we are established outside the United Kingdom, we have appointed a representative in the UK under Article 27 of the UK GDPR. Data subjects in the UK and the UK Information Commissioner's Office may contact our representative in relation to any matter under UK data-protection law:

Sircol Media Ltd (Company No. 11940403) 124 City Road, London, England, EC1V 2NX, United Kingdom Email: GDPR@sircoldigital.com

You can still contact us directly at hello@headless-web.com for the same purposes. Appointing a representative does not affect our own responsibility or liability as controller.

We currently focus on the United Kingdom market and have not appointed an EU GDPR Article 27 representative. If we begin to actively target visitors in the European Economic Area, we will update this policy accordingly.

This policy applies to personal data we process when you:

• visit or interact with the Site;
• submit an enquiry via our contact form or a landing-page lead form;
• correspond with us by email or other electronic means;
• receive services from us as a prospective or current client.

This policy does not apply to third-party websites that we link to. Please read the privacy notices on those sites when you visit them.

We collect and process the following categories of personal data:

Data you provide to us - Contact form: name, email address, website URL (optional) and the free-text summary of your enquiry. - Landing page lead forms: fields vary by campaign but typically include your name, work email, company/website, role, region, phone/WhatsApp (optional) and the details you submit about your project or requirements. - Correspondence: any information contained in emails or other messages you send us, including attachments.

Data collected automatically - Technical data: IP address, approximate location derived from your IP address, browser type and version, operating system, device type, screen size, referrer URL, pages visited, time spent on pages, and clickstream data. - Cookies and similar technologies: see our Cookie Policy for the full list and how to manage your choices. - Server and application logs held by our hosting and infrastructure providers.

We do not knowingly collect any special category personal data (for example data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or data concerning sex life or sexual orientation).

We use your personal data for the following purposes, and rely on the following lawful bases under UK GDPR Article 6 (and, where applicable, EU GDPR Article 6):

Responding to enquiries - Purpose: to reply to your contact form or lead form submission, answer your questions, and discuss a possible engagement. - Data used: name, email, website, message content, and any other information you provide. - Lawful basis: (a) our legitimate interests in responding to prospective clients who have contacted us, and (b) steps taken at your request prior to entering into a contract.

Providing our services - Purpose: to deliver the services set out in a separate statement of work or engagement letter. - Data used: contact details and any information reasonably necessary to perform the services. - Lawful basis: performance of a contract to which you (or the organisation you represent) are party.

Site operation, security and abuse prevention - Purpose: to keep the Site working, protect it from fraud, spam and unauthorised access, and diagnose technical issues. - Data used: technical data, server logs, honeypot form fields. - Lawful basis: our legitimate interests in operating and securing the Site.

Analytics and Site improvement - Purpose: to understand how visitors use the Site and to improve content, performance and conversion. - Data used: cookie identifiers, technical data, pages visited, campaign parameters (UTM tags, gclid). - Lawful basis: your consent, given via our cookie banner (you can withdraw at any time).

Advertising and campaign measurement - Purpose: to measure the performance of Google Ads campaigns that bring visitors to landing pages, and to attribute enquiries to campaigns. - Data used: gclid, UTM parameters, cookie identifiers, IP-derived region. - Lawful basis: your consent, given via our cookie banner.

Compliance with legal obligations - Purpose: complying with law, regulation, court orders or lawful requests from authorities. - Data used: any data reasonably required. - Lawful basis: legal obligation and our legitimate interests in defending our rights.

We do not sell your personal data, and we do not use it for automated decision-making or profiling that produces legal or similarly significant effects on you. Contact form data is used only to reply to your enquiry — we do not add you to marketing lists without your separate consent.

We share personal data only with service providers who help us operate the Site and our business. These providers act as processors on our behalf under written data-processing agreements. We do not sell your personal data.

Our current sub-processors are:

• Vercel Inc. (United States) — website hosting, edge functions and content delivery.
• Supabase, Inc. (United States, with regional data hosting) — database used to store contact form submissions.
• Sanity.io / Sanity AS (European Economic Area / United States) — content management system.
• Twilio SendGrid (United States) — transactional email delivery for enquiry confirmations and internal notifications.
• Google Ireland Limited / Google LLC (Ireland / United States) — Google Tag Manager, Google Analytics 4 and Google Ads conversion tracking. We use Google Consent Mode v2, so the tags that set analytics and advertising cookies only activate after you provide consent through our cookie banner.

We may also share personal data with:

• professional advisers (accountants, lawyers) where necessary and under confidentiality;
• law enforcement, courts or regulators, where we are required to do so by law;
• a buyer or successor in the event of a merger, acquisition or asset sale, subject to appropriate protections.

We keep the list of sub-processors up to date. If you would like a current copy or details of any newly-appointed provider, please email hello@headless-web.com.

We are established in the United Arab Emirates, and several of our sub-processors are located in the United States or process data across multiple regions. When we transfer personal data outside the United Kingdom or the European Economic Area, we rely on one or more of the following safeguards:

• the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses;
• the EU Standard Contractual Clauses (SCCs) approved by the European Commission;
• adequacy decisions where they apply.

You can request a copy of the safeguards we rely on by emailing hello@headless-web.com.

We keep personal data only for as long as we need it for the purposes described in this policy, and in line with the following retention periods:

• Contact form and lead form submissions: 12 months from the date of your last contact with us, after which we delete or anonymise the record. If your enquiry becomes a paid engagement, the retention period is extended for the duration of the engagement plus any period we are required to keep records for tax, accounting or legal-defence purposes.
• Email correspondence: typically 24 months, unless the correspondence relates to an ongoing engagement or a legal matter.
• Server, application and security logs: typically up to 30 days, or longer where required to investigate an incident.
• Cookie identifiers: as set out in the Cookie Policy.

We may keep certain records for longer periods where required by applicable law (for example accounting records) or to establish, exercise or defend legal claims.

We use organisational and technical measures designed to protect your personal data against unauthorised access, loss, misuse, alteration or disclosure. These measures include:

• encryption in transit (HTTPS/TLS) for all Site traffic;
• database access controls and role-based permissions;
• least-privilege access for staff and contractors, with confidentiality obligations;
• reliance on reputable infrastructure providers with recognised security certifications.

No online service is completely secure. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected individuals in line with applicable law.

Depending on where you live and the law that applies, you may have the following rights in relation to your personal data:

• Right of access — to obtain a copy of the personal data we hold about you.
• Right to rectification — to have inaccurate or incomplete personal data corrected.
• Right to erasure ("right to be forgotten") — to have your personal data deleted in certain circumstances.
• Right to restrict processing — to limit how we use your personal data in certain circumstances.
• Right to object — to object to processing based on our legitimate interests, or to direct-marketing processing.
• Right to data portability — to receive certain personal data in a structured, commonly used, machine-readable format.
• Right to withdraw consent — where we rely on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right not to be subject to automated decision-making — we do not carry out automated decision-making that produces legal or similarly significant effects on you.
• Right to lodge a complaint — with a data-protection supervisory authority.

To exercise any of these rights, email us at hello@headless-web.com. We will respond within one month, and may extend that period by up to two further months where necessary and permitted by law. We may need to verify your identity before acting on your request.

If you are based in the United Kingdom and are unhappy with how we have handled your personal data, you can contact the Information Commissioner's Office (ICO) at ico.org.uk.

If you are based in the European Economic Area, you can contact your local supervisory authority. A list is available on the European Data Protection Board website.

The Site is intended for business users and is not directed at children. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

The Site may contain links to third-party websites, services or resources that we do not operate. Following those links may allow those third parties to collect data about you. This policy does not cover their practices. Please review their privacy notices before providing any personal data.

We may update this policy from time to time to reflect changes to our practices, technology, legal requirements and other factors. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you through the Site or by email. Please check this page periodically for updates.

If you have questions about this privacy policy or want to exercise any of your rights, contact us at:

The Headless Web FZE LLC 26th Floor, Amber Gem Tower Ajman, United Arab Emirates Email: hello@headless-web.com