Privacy Policy

Lummah is a creative and digital marketing agency based at Office No. 504, Dubai National Insurance Building, Port Saeed, Deira, Dubai, UAE. In this policy, "Lummah", "we", "us" and "our" refer to that business.

PLACEHOLDER — Registered legal entity name, trade licence number and the name of the person responsible for privacy matters.

For any question about this policy or your personal data, contact us at info@lummah.ae or on +971 56 835 4044.

We collect information that you choose to provide. This includes:

• Contact form: your full name, email address, company name (optional), the service you are interested in, and the project details you write.
• Direct communication: emails, WhatsApp messages, call notes and meeting notes, including anything you share in them.
• Project materials: briefs, brand assets, product information, logins or files you share with us so that we can deliver work for you. Please only share what we need, and tell us if any of it contains sensitive personal data so that we can handle it appropriately.
• Preferences: whether you want to receive updates or marketing messages from us, and how you would like us to contact you.

When you visit the website, our hosting provider creates basic technical records (server logs). These typically include your IP address, the browser and device type, the pages you request, the time of each request and the address of the page that referred you. We use these records to keep the website running, to diagnose faults, to prevent misuse and to understand, in aggregate, which pages are useful.

We do not use third-party advertising trackers on the website at present. PLACEHOLDER — Confirm before publishing. If analytics, advertising pixels or social embeds are added, this section and the cookies section must be updated, and where required a consent mechanism must be provided.

A cookie is a small file stored on your device. At present the website does not set analytics or advertising cookies. The site may rely on your browser storage only for functions you use directly, such as remembering a closed notice. You can control or delete cookies through your browser settings. Blocking some cookies may affect how parts of the website work.

PLACEHOLDER — Confirm the final list of cookies and storage items after launch, and add a cookie table with names, purposes and durations.

We use personal information for the following purposes:

• to respond to your enquiry and arrange an introductory conversation;
• to prepare proposals, quotations and scopes of work, and to agree the terms of any engagement;
• to deliver the services you have engaged us for, including planning, creative production, publishing and reporting;
• to manage our client relationships, invoicing, accounts and records;
• to send service updates and, where you have agreed, marketing messages about our work;
• to operate, secure, maintain and improve the website and to prevent fraud, spam and misuse;
• to meet our legal, tax, accounting and regulatory obligations and to respond to lawful requests from authorities.

Depending on the activity, we rely on one or more of the following bases: your consent, which you give when you submit an enquiry or opt in to marketing and which you can withdraw at any time; steps taken at your request before entering into a contract, such as preparing a proposal; the performance of a contract with you; our legitimate interests in running and promoting our business, provided those interests are not overridden by your rights; and compliance with legal obligations.

Where UAE law applies, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and its implementing regulations, we handle personal data in line with its requirements. PLACEHOLDER — Legal review of this section and of the legal basis for each processing activity.

We will only send you marketing emails or messages where you have agreed to receive them, or where the law otherwise allows it. Every marketing message will tell you how to opt out, and you can opt out at any time by replying "unsubscribe" or emailing info@lummah.ae. Opting out of marketing does not affect service messages about an active project, and it does not affect our ability to reply to your enquiries.

We do not sell personal data. We share it only where necessary, with the following categories of recipients:

• Service providers who run the website and communicate with you on our behalf, such as hosting, domain, email-delivery and customer-messaging providers. They may only use the information to provide services to us, and they must keep it confidential.
• Professional advisers, such as lawyers, accountants and auditors, who need the information to advise us.
• Project partners, such as freelance producers, photographers or media vendors, but only the information needed for a specific project and only under confidentiality terms.
• Authorities and courts, where we are required to disclose information by law or to protect our legal rights.
• A prospective buyer or successor to our business, if the business is sold or restructured, subject to equivalent protections.

PLACEHOLDER — Name the hosting, email and CRM providers and their data-storage locations once confirmed. Where personal data is transferred or stored outside the UAE, we will do so only where the PDPL permits it and we will put appropriate safeguards in place, such as contractual commitments from the provider.

We keep personal information only for as long as it is needed for the purpose it was collected for, and then we delete it or anonymise it. As a guide:

• Enquiries that do not lead to a project: PLACEHOLDER — retention period (for example, 12 months from the last contact).
• Client records, contracts and invoices: for the period required by UAE tax and commercial record-keeping rules, which is PLACEHOLDER — to be confirmed.
• Project files and creative assets: for the duration of the engagement and a PLACEHOLDER — agreed period afterwards, unless the client asks for earlier deletion where the law allows it.
• Technical server logs: PLACEHOLDER — retention period set by the hosting provider.

Subject to the PDPL and any applicable exceptions, you have the right to:

• access the personal data we hold about you and receive a copy;
• ask us to correct inaccurate or incomplete data;
• ask us to delete your data, or restrict how we use it;
• object to processing based on our legitimate interests, or to direct marketing;
• ask for your data in a structured, commonly used format where the law gives you that right;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before you withdrew it;
• lodge a complaint with the relevant UAE data protection authority.

To make a request, email info@lummah.ae with the subject line "Data request" and tell us which right you want to use and what information it relates to. We may need to confirm your identity before we act, to make sure we do not disclose information to the wrong person. We aim to respond within PLACEHOLDER — response period (for example, 30 days), and we will tell you if we need longer. We do not usually charge for a request, but we may do so where the law allows if a request is clearly unfounded or excessive.

We use reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration and disclosure. These include access controls that limit who can see client information, secure hosting, and a requirement that our team and suppliers keep information confidential.

No method of transmitting information over the internet or of storing it electronically is completely secure, so we cannot guarantee absolute security. If we become aware of a personal data breach that is likely to affect your rights, we will notify you and the relevant authority as the law requires.

Our services are aimed at businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us information, contact us and we will delete it.

The website links to third-party services such as Instagram and WhatsApp, and may display content from social platforms. When you use those services, their own privacy policies apply, and the platform may collect information about you directly. We are not responsible for the privacy practices of third parties.

We may update this policy from time to time, for example when our services, suppliers or the law change. The date at the top of this page shows when it was last changed, and material changes will be highlighted on the website. Last updated: 6 October 2026.

Questions, requests or complaints about this policy can be sent to info@lummah.ae or by post to Office No. 504, Dubai National Insurance Building, Port Saeed, Deira, Dubai, UAE.