Privacy Policy

01 / Who is responsible

SINISTER CONSULTING & DEVELOPMENT - FZCO, trading as Sinister Consulting, is responsible for personal information collected through sinisterconsulting.com and enquiries sent to us. Our trade licence number is 78885, issued by Dubai Integrated Economic Zones Authority (DIEZA). Our registered address is DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates. Contact us at info@sinisterconsulting.com for privacy questions or requests.

This policy covers our marketing website and business enquiries, not personal information processed inside a client's product. Client projects that involve personal information require separate instructions and, where appropriate, a data processing agreement.

02 / Information we collect

We collect information you provide and limited technical information needed to deliver the website.

• Enquiries: your name, email address, message, optional phone number and selected service. Information you include about your organisation or project is also part of the enquiry.
• Business correspondence: replies, proposals and information needed to discuss or carry out an engagement.
• Portfolio and testimonials: professional names, roles, organisations and statements featured in case studies or reviews, which may be provided by clients or business contacts. These are separate from the information you submit in the enquiry form.
• Technical information: the hosting and delivery infrastructure receives connection information such as IP address, request time, requested URL and browser information. Infrastructure providers may keep security and service logs.
• Website analytics: enabled by default on a new visit unless disabled, Google Analytics receives page visits, device/browser information, approximate location and interactions such as service-link clicks or a successful enquiry submission. Our custom analytics events do not include your name, email, phone number or message.
• Preference storage: we save your analytics choice, version and timestamp in your browser's local storage, separately from analytics cookies.

03 / Why we use it

We use enquiry information to answer your request, discuss a potential project and manage related correspondence. The contact form asks for specific permission to use your details for that purpose. It does not subscribe you to marketing or accept a service contract.

Where an applicable law permits it, information needed to prepare or perform a contract, comply with a legal obligation, or establish, exercise or defend legal claims may be processed on that basis instead of consent. Website delivery and security information is used to operate and protect the service under the basis available under the applicable law. We do not rely on a generic 'legitimate interests' basis where local law does not provide one.

Website analytics is enabled by default on a new visit. An existing saved refusal is respected. Disabling analytics does not prevent browsing, contacting us or requesting a proposal. A default setting is not a record of consent and does not replace consent where applicable law requires it. We do not use this website to make automated decisions with legal or similarly significant effects about you.

We obtain written client permission before presenting completed work as a Sinister case study, and separate written author permissions for published testimonial quotes, names and roles. Those permissions cover the authorised material, not unrelated personal information or third-party assets. Contact us to query, correct or request removal of information attributed to you. A client's case-study approval does not replace an individual author's permission.

04 / Cookies and analytics choices

Google Analytics scripts and custom events run by default when there is no stored setting and browser storage is accessible. They remain blocked when a refusal, invalid or expired setting is present, or storage cannot be read. Advertising storage, advertising user data, advertising personalisation and Google signals are disabled in the website's tag configuration.

There is no analytics permission dialog, strip or settings switch. The Contact card contains links to privacy_policy.md and public_offer.md between contact methods and region labels; the contact form separately links to this policy beside its enquiry consent.

Previously saved preferences use the local-storage record sinister-privacy-choice-v1. It contains an analytics setting, version and timestamp, not contact details. A setting is validated for 180 days. An expired or invalid record keeps analytics off; it does not restore the default or open a prompt. A new visit with no record starts with analytics on. If browser storage is unavailable, analytics remains off. Clearing site storage removes the setting and restores the default on a later visit.

While analytics is enabled, Google Analytics may set _ga and _ga_* first-party cookies to distinguish visitors and sessions. Google's documented default expiry is two years, although property settings can shorten it. Browser-cookie expiry is different from Google's server-side retention settings, which must be confirmed separately.

You can use your browser's tracking protection or content-blocking controls to limit analytics requests. These controls depend on your browser and are separate from the website's previously saved preference. Blocking future requests does not undo information already collected; contact us to request deletion where possible and legally required.

05 / Who receives information

Our enquiry endpoint uses Resend to deliver your name, email, message, optional phone number and service interest to info@sinisterconsulting.com. Our founders manage this mailbox and store correspondence in Gmail through Google Workspace, provided by Google. Enquiries are not currently routed to a CRM or business automation system. Resend and Google still process information needed to deliver and store correspondence. Our hosting and infrastructure providers process requests needed to deliver and secure the website. Google Analytics receives website analytics when enabled, including by default without a stored setting; this is separate from Google's provision of Google Workspace.

Our founders access enquiries to handle your request. Service providers may process information needed to provide their services, subject to appropriate confidentiality and data protection arrangements. We may disclose information when lawfully required, to protect legal rights, or in connection with a business reorganisation subject to applicable safeguards. We do not sell enquiry information or send contact-form contents to advertising platforms.

External links are not embedded tracking permissions. If you choose to open another website, its own privacy terms apply. Website fonts and case screenshots are served through our website rather than an external font service.

06 / International processing

Some providers operate outside the UAE. Resend states that its primary processing operations take place in the United States; Google and infrastructure providers may also process information in other countries. Sending regions are not necessarily storage locations.

International transfers must meet the applicable legal requirements, including an available adequacy basis, contractual safeguards or another permitted transfer mechanism. Analytics permission or submission of an enquiry is not a blanket waiver of those requirements. These requirements apply to provider contracts, processing locations and any required transfer assessments. We do not represent that every provider stores information in the UAE.

07 / Retention and security

Enquiry correspondence is stored in Gmail. We have adopted a retention rule for inactive enquiries that have not become a contract: 12 calendar months after the last substantive contact, followed by a monthly manual review for deletion. Contracts, invoices, accounting records and disputes are excluded from this rule and follow their applicable retention requirements. This is not automatic deletion on the anniversary date. Our founders also handle deletion requests, subject to lawful retention requirements and provider backup cycles. Provider logs and backups follow their own retention schedules and are not covered by the mailbox deletion timetable.

We use HTTPS for the website and limit the information requested by the contact form. Please do not send passwords, payment-card details, patient records or other sensitive production data. No online system can guarantee absolute security. Any personal data incident must be assessed and notified to the relevant authority and affected people where required by applicable law.

08 / Your rights and requests

Email info@sinisterconsulting.com with the subject 'Privacy request'. Anastasia Cheypesh is responsible for handling these requests, with Mikhail Tarasov as backup. These are operational contacts, not a statement that a statutory data protection officer has been appointed. Describe the request and the email address used to contact us. You may request information about processing, access or a copy, correction, deletion, restriction, portability or an objection where the applicable law provides those rights. You can withdraw consent without affecting the lawfulness of earlier processing. Some information may need to be retained for legal obligations or claims; deleting mailbox copies does not by itself establish deletion from every provider's logs or backups.

We may ask for proportionate information to verify identity and protect someone else's data; do not send identity documents unless we explain why they are necessary. We will respond within the period required by the applicable law and explain any permitted limitation or extension. Where GDPR applies, the normal response period is one month, with a permitted extension for complex or numerous requests if explained within that month.

The UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data is the relevant federal framework, subject to its scope and exclusions. EU/EEA GDPR and UK data protection rules apply only where their territorial criteria are met; visiting from those locations alone does not establish every obligation. Where applicable, you may complain to the competent UAE data protection authority, an EU/EEA supervisory authority or the UK's Information Commissioner's Office. You do not have to contact us first before exercising a statutory complaint right.

09 / Children and sensitive data

The website is directed to people enquiring about professional IT services, not children. We do not knowingly seek children's personal information. If you believe a child has provided information, contact us so we can assess and remove it where appropriate. Client projects involving health data or other regulated information require a separate legal and security assessment before access is granted.

10 / Changes and contact

The date and version above identify this copy. Material changes to processing must be explained here and, where required, notified directly or supported by fresh consent. New wording does not retrospectively authorise a new purpose. Contact details and company registration information are set out in section 01.