Privacy Policy

Darwin Corp is a brand, web and AI creative studio based in Dubai, United Arab Emirates, working with clients worldwide. Dubaiography is a Darwin Corp product and is covered by this policy.

This policy explains what personal data we collect through thedarwin.co, through enquiries and through client projects, why we collect it, and what you can ask us to do with it. We are the controller of that data, and you can reach us at hello@thedarwin.co.

We only collect what we need to answer you and run a project.

• Enquiry details. Your name, email address, phone number, the service you are interested in and whatever you write in your message — submitted through our contact form, a campaign landing page, email, WhatsApp or social media.
• Newsletter details. The email address you give us if you subscribe to studio notes.
• Client and project data. Billing and contact details for the people we work with, plus any material you share with us to do the work — brand assets, copy, imagery, research, access to accounts or analytics, and feedback on drafts.
• Technical data. Standard server and security logs kept by our hosting provider, such as IP address, browser type, referring page and timestamps. We use a short-lived record of your IP address to rate-limit our lead form against spam.
• Cookie data. Only what is described in our Cookie Policy.

We do not ask for special category data (health, religion, biometrics and the like), and we ask you not to send it to us. We do not buy contact lists.

• To reply to your enquiry and prepare a proposal or estimate.
• To deliver, manage and support the work you have engaged us for, and to communicate with you about it.
• To issue invoices and keep the accounting records the law requires.
• To send studio notes and occasional updates, where you have asked for them or are an existing client. Every email has an unsubscribe link.
• To keep the site secure and working — spam prevention, error monitoring and abuse protection.
• To understand, in aggregate, which pages and services people find useful, so we can improve the site.

We process personal data under the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Where a visitor or client is in the EU or UK, we also apply the equivalent GDPR grounds:

• Your consent — for the newsletter and for any optional cookies. You can withdraw it at any time.
• Performance of a contract — to scope, deliver and invoice a project.
• Legitimate interests — to answer enquiries, protect the site and improve what we offer, balanced against your rights.
• Legal obligation — to retain tax, accounting and corporate records.

We do not sell personal data, and we do not share it for anyone else's advertising. We do rely on a small set of service providers who process data on our behalf, under contract and only on our instructions:

• Website hosting and content delivery.
• Our content database and media storage for this site.
• Transactional email delivery, for form submissions sent to our inbox.
• Email, file storage, project management and accounting tools.
• Payment processors and banks, which handle their own payment data directly — we never store full card details.

We may also disclose data where we are legally required to, or to establish or defend a legal claim. If our business is ever restructured or acquired, data may transfer with it, subject to this policy.

We are based in the UAE and work with clients and suppliers worldwide, so your data may be processed outside the country you are in — typically in the UAE, the EU or the United States. Where we transfer data internationally, we use providers that commit to appropriate safeguards, such as standard contractual clauses or an equivalent adequacy mechanism.

• Enquiries that do not become projects — up to 24 months, then deleted.
• Client and project records — for the life of the engagement and then as long as we may need them for warranty, dispute or portfolio purposes.
• Invoices and accounting records — for the period UAE law requires, currently at least five years.
• Newsletter subscriptions — until you unsubscribe.
• Server and security logs — a short rolling window, typically no more than 90 days.

You can ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct anything inaccurate or incomplete;
• delete data we no longer have a reason to keep;
• restrict or object to a particular use, including direct marketing;
• transfer your data to another provider in a portable format;
• withdraw consent you previously gave.

Email hello@thedarwin.co and we will respond within 30 days. We may need to confirm your identity first. If you are not satisfied with our answer, you can complain to the UAE Data Office or, if you are in the EU or UK, to your local supervisory authority.

The site is served over HTTPS, our admin tools are password-protected, and access to client material is limited to the people working on the project. We use reputable providers with their own security programmes. No system is perfectly secure, so we cannot guarantee absolute security, but if a breach ever affects your data we will notify you and the relevant authority as the law requires.

Our services are aimed at businesses, and the site is not directed at children under 18. We do not knowingly collect their data. If you believe a child has sent us personal data, contact us and we will delete it.

Our site and our work link out to other places — Instagram, LinkedIn, Facebook, WhatsApp, client sites and the projects in our portfolio. Once you follow a link, that site's own privacy policy applies. We are not responsible for their content or their handling of your data.

We update this policy when our practices or the law change. The date at the top always reflects the current version. If a change is significant we will make it obvious on the site before it takes effect.