Last updated: 4 July 2026
Privacy & Cookies
JMJ Consultancy ("JMJ", "we") is the controller of the personal data described here and processes it under the UAE federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the "PDPL"). This notice explains what we collect through jmjconsultancy.services, why, who processes it, and your rights. We build privacy-first systems for our clients, and we hold this site to the same standard.
1. What we collect
- Enquiry details: when you use the "Aria" intake chat you provide your name, email, phone/WhatsApp number, company website (optional), and a short description of what you want to automate, so we can reply and prepare a free audit.
- Email verification: we email a one-time 6-digit code to confirm the address is yours. The code is short-lived and used only for verification.
- IP address: when you submit the form or request a verification code, our server briefly records your IP address to rate-limit abuse. This happens server-side regardless of your cookie choice and is kept only as long as needed to prevent spam.
- Technical metadata: each submission also includes the page URL, a timestamp, and a source tag, to give context to your enquiry.
- Usage analytics: if you accept cookies, Google Analytics measures how the site is used (pages viewed, approximate region, device type). We configure it to minimise identifiability (IP anonymisation, ad data redacted). See section 4.
- Anti-spam signals: submission timing and a hidden "honeypot" field are checked both in your browser and re-checked on our server to block automated submissions. The timing and honeypot values are not used to identify you; the IP-based rate-limiting above is.
2. How we use it, and our legal basis
We use your data to respond to your enquiry and prepare your free audit, to verify your email, to keep the site secure, and (with consent) to understand site usage in aggregate. We do not sell your data or use it for advertising or profiling. Under Article 4 of the PDPL our legal bases are:
- Enquiry details & email verification: your consent, given when you submit the intake form, and to take steps at your request before any engagement.
- IP-based rate-limiting, anti-spam checks and necessary storage: our legitimate interest in securing the site and preventing abuse.
- Usage analytics: your consent, which you can withdraw at any time.
3. Who processes your data
Your enquiry is delivered and handled through our own self-hosted automation on infrastructure we control, and by the trusted providers below acting on our instructions:
| Provider | Purpose | Data |
|---|---|---|
| Self-hosted automation (n8n) | Receiving and routing your enquiry; anti-spam rate-limiting | Enquiry details, IP address |
| Our mail server (SMTP) | Sending your email verification code | Email address |
| Google (Sheets & Gmail) | Logging and notifying our team of new enquiries | Enquiry details |
| Google Analytics (Google LLC) | Aggregate usage analytics, only after you consent | Usage & device data |
International transfers. Some providers (e.g. Google) process data outside the UAE, mainly in the United States. Where that happens we transfer it in line with Articles 22-23 of the PDPL, either to a country the UAE Data Office recognises as adequate, or under contractual data-protection clauses that require the provider to protect your data to a standard equivalent to the PDPL. You can request a copy of the relevant safeguards by emailing us. Our automation and application layer run on self-hosted infrastructure.
4. Cookies & similar technologies
We load Google Analytics using Google Consent Mode v2. Before you choose, the tag sends only cookieless, non-identifying signals to Google (a processor outside the UAE), no analytics cookies are set until you press "Accept." IP addresses are anonymised for analytics and ad-related data is redacted.
| Name | Type | Purpose |
|---|---|---|
| jmj_consent | Local storage (necessary) | Remembers your cookie choice |
| jmj_intake_last | Local storage (necessary) | Rate-limits repeat form submissions |
| jmj_audit_seen | Session storage (necessary) | Stops the intake popup re-opening in the same tab (cleared when the tab closes) |
| jmj_runner_hi | Local storage (necessary) | Remembers the high score for the small footer animation |
| _ga, _ga_<id>, _gid, _gat | Analytics cookie (only after consent) | Google Analytics, distinguishes visitors and measures usage |
You can change or withdraw your choice at any time via (also in the footer of the main site). Declining, or switching back to declined, stops analytics and clears its cookies.
5. How long we keep it
- Enquiry details: held in an internal spreadsheet and inbox. If we don't end up working together, we delete or anonymise them on request and periodically clear enquiries older than about 24 months. If we engage, we keep them for the engagement plus any period required to meet contractual, tax and audit obligations, then delete them.
- Verification codes: expire within minutes and are not retained.
- IP / anti-spam records: kept only briefly (hours) for rate-limiting, then rotated out.
- Analytics: retained per Google Analytics' configured period (currently up to 14 months), then automatically deleted by Google.
- Necessary storage items: kept on your device until you clear them or change your choice.
6. Security & data breaches
We apply appropriate technical and organisational measures, access controls, encryption in transit, and hosting on infrastructure we control, to protect your data, as required by Article 20 of the PDPL. No system is perfectly secure, but if a personal-data breach occurs that poses a risk to your privacy, we will notify the UAE Data Office and, where required, affected individuals, in line with Article 9 of the PDPL.
7. Your rights
Under Articles 13-16 of the PDPL you may: be informed about our processing; access your data; have it corrected or erased; restrict or object to processing (including any automated processing); receive a copy of the data you gave us in a structured, machine-readable format and have it transferred where technically feasible; and withdraw consent at any time. We may need to verify your identity first. To exercise any of these, email hello@jmjconsultancy.services; we aim to respond within 30 days and will tell you if a complex request needs longer.
8. Complaints
If you're unhappy with how we've handled your data, you can complain to the UAE Data Office (the federal data-protection regulator). We'd appreciate the chance to put things right first, please contact us at hello@jmjconsultancy.services.
9. Scope
This site and our services are intended for businesses and professionals. We do not target children or knowingly collect the personal data of anyone under 18; if you believe a child has provided us data, contact us and we will delete it. "Aria" is an automated intake assistant that only collects the details you type - it makes no automated decisions about you.
10. Contact
JMJ Consultancy, Dubai, UAE
hello@jmjconsultancy.services