Privacy policy

Who we are

Project Station is operated by Project Station FZCO, Dubai, United Arab Emirates ("we", "us"). We are the controller of the personal data described in this policy. For anything privacy related, email hello@projectstation.com and a founder will reply within one working day.

We work with clients worldwide, so this policy is written to meet the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the EU and UK General Data Protection Regulation, Canada's PIPEDA and the California Consumer Privacy Act. Where those laws give you more rights than this policy describes, you have them.

What we collect

When you contact us. The details you type into a form: name, email, and where you choose to give them your phone number, company, website, market, budget, timeline, the package or offer you are interested in and your message. We also record the page you sent it from and, where present in the link you followed, campaign tags (utm parameters).

When you apply for a job. Your name, email, phone, LinkedIn or portfolio link, your message and the CV you upload.

When you subscribe. Your email address and where you signed up.

When you browse. Our servers log your IP address, browser type and the pages requested, which we use to keep the site secure and working. If you allow analytics, Google Analytics records how the site is used (see Analytics below).

We do not ask for, and ask you not to send, sensitive data such as health information, religious beliefs or payment card numbers through our forms.

How we use it, and why we are allowed to

• To answer you and prepare an audit, quote or proposal, because you asked us to (steps before a contract).
• To deliver the work once we are engaged (performance of a contract).
• To assess a job application (steps before an employment contract, and our legitimate interest in hiring well).
• To send our monthly growth notes, only with your consent. Every email has a one-click unsubscribe link.
• To measure how the site is used, only with your consent through the cookie banner.
• To keep the site and our systems secure and to prevent spam and abuse (legitimate interest).
• To meet legal obligations such as tax and accounting records.

We do not sell your personal data, we do not share it for cross-context behavioural advertising, and we do not make decisions about you by automated means alone.

Analytics

If Google Analytics is switched on for this site, it only loads after you click Allow in the cookie banner. Until then Google's consent mode keeps analytics storage denied. IP addresses are anonymised. You can change your choice at any time from the cookie policy.

Who we share it with

Only the people and providers we need to do the job, under contracts that require them to protect it:

• our hosting provider, which runs the servers this site and its database live on;
• our email provider, which delivers the confirmation and notification emails;
• Google, for analytics, only if you consent;
• specialist partners working on your project, such as an engineering or CRM partner, only for an engagement you have agreed and only what they need;
• professional advisers such as accountants and lawyers, and authorities where the law requires it.

Clicking the WhatsApp button opens WhatsApp, which is operated by Meta under its own privacy policy.

International transfers

We are based in Dubai and our team also works from Germany, and some providers process data in other countries. Where personal data from the EU, UK or another country with transfer rules leaves that country, we use the safeguards the law requires, such as standard contractual clauses, and we only use providers that commit to protecting it to the same standard.

How long we keep it

• Enquiries that do not become a client: deleted 24 months after our last contact.
• Clients: for the length of the engagement, then for as long as tax and commercial law require (in the UAE this is at least five years for financial records).
• Job applications: 12 months after the role is filled, CV included, unless you ask us to keep it for future roles.
• Newsletter: until you unsubscribe.
• Security logs: IP addresses are removed from our audit log after 12 months.

These periods are enforced automatically by our systems, not left to memory.

How we protect it

The site runs on HTTPS only. Admin access is restricted by role, protected by strong passwords that are stored as salted hashes, optional two-factor authentication, rate limiting and an audit log. Uploaded CVs are stored outside the public website. No system is perfectly secure, but we take reasonable technical and organisational measures and will tell you and the relevant authority without undue delay if a breach puts your data at risk.

Your rights

You can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct anything that is wrong;
• delete it, where we have no legal reason to keep it;
• restrict or object to how we use it;
• send it to you or another provider in a portable format;
• withdraw your consent at any time, without affecting what we did before.

Email hello@projectstation.com. We reply within 30 days, usually much sooner, and we will never charge you or treat you differently for using these rights. If you are not happy with our answer you can complain to your data protection authority, for example the UAE Data Office, your EU supervisory authority, the UK Information Commissioner's Office or the Office of the Privacy Commissioner of Canada. California residents can also use an authorised agent.

Children

This site and our services are for businesses. We do not knowingly collect personal data from anyone under 18.

Changes to this policy

If we change how we handle personal data we will update this page and the date at the top. Significant changes will also be flagged on the site.

Contact

Project Station FZCO, Dubai, United Arab Emirates. Email hello@projectstation.com.