Privacy Policy

This Privacy Policy explains how Morrow Studio collects, uses, shares and protects personal data when you visit madebymorrow.com, enquire about our services, engage us on a project, or otherwise interact with us.

We have written this policy to be read, not skimmed past. If anything here is unclear, contact us and we will explain it in plain terms.

1. Who we are

Morrow Studio L.L.C-FZ ("Morrow Studio", "we", "us", "our") is a brand and digital agency incorporated in the Meydan Free Zone, Dubai, United Arab Emirates.

Legal entity: Morrow Studio L.L.C-FZ
Registered address: Meydan Grandstand, 6th floor, Meydan Road, Dubai, United Arab Emirates
Commercial licence number: 2541596.01
Website: madebymorrow.com
Privacy contact: hello@madebymorrow.com

For personal data we collect through our own website and business operations, Morrow Studio is the data controller — we decide why and how that data is processed.

2. Which laws apply

We process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL"), which has been in force since 2 January 2022 and is supervised by the UAE Data Office.

Because we work with clients and receive website visitors outside the UAE, we also apply the standards of the EU General Data Protection Regulation (GDPR) and the UK GDPR where those laws apply to a given individual or engagement. Where the two regimes differ, we apply the higher standard.

Where we process personal data on behalf of a client — for example, data held in a website, CRM or database we build or maintain for them — that client is the controller and we act as a processor. Section 12 explains how that works.

3. What personal data we collect

3.1 Information you give us

Enquiry and contact data: name, email address, phone number, company name, job title, country, project description, budget range, timeline, and anything else you choose to include in a form, email, WhatsApp message or call.
Client and engagement data: billing contact details, business address, tax registration details, purchase order references, signed agreements, and project correspondence.
Account and access data: credentials or access you grant us to your systems (hosting, domain registrar, CMS, analytics, ad accounts, social profiles) for the purpose of delivering a project.
Content you supply: brand assets, copy, imagery, customer lists, product data and any other material you provide for use in a deliverable.
Recruitment data: CV, portfolio, work history, references and right-to-work information if you apply for a role or freelance placement with us.
Marketing preferences: your subscription status and interests if you sign up for updates.

3.2 Information we collect automatically

Technical data: IP address (often truncated or anonymised), browser type and version, operating system, device type, screen resolution, and language settings.
Usage data: pages viewed, time on page, scroll depth, referring URL, exit pages, and the search terms or campaign that brought you to us.
Security and delivery logs: server logs, firewall and CDN records, and bot-mitigation data used to keep the site available and secure.

3.3 Information from third parties

Referrals and introductions from existing clients or partners.
Publicly available professional sources such as company websites and LinkedIn, where we are researching a prospective client or verifying a business contact.
Analytics, advertising and lead-form platforms (for example Google, Meta or LinkedIn) where you have interacted with one of our campaigns and the platform's own terms permit the transfer.
Payment providers and banks, which confirm that a payment has been made and give us the associated reference data. We do not receive or store your full card number.

3.4 Sensitive personal data

We do not seek sensitive personal data — data revealing racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, criminal records, biometric or genetic data, or data concerning health or sex life. Please do not send it to us. If you do, we will delete it unless we are legally required to retain it.

4. Why we process your data, and on what legal basis

Purpose	Data used	Legal basis
Responding to enquiries and preparing proposals	Enquiry and contact data	Steps taken at your request prior to entering a contract; our legitimate interest in running a business
Delivering a project and managing the engagement	Client, engagement, access and content data	Performance of a contract
Invoicing, payment collection and accounting	Billing and transaction data	Performance of a contract; compliance with UAE tax, VAT and corporate record-keeping obligations
Operating, securing and improving our website	Technical, usage and security data	Legitimate interest in a functional, secure, well-performing site; consent for non-essential analytics cookies
Marketing our services and sending updates	Contact data and marketing preferences	Consent, or legitimate interest in marketing to existing business clients — withdrawable at any time
Measuring and attributing advertising performance	Usage, campaign and cookie data	Consent
Recruitment	Application data	Steps taken at your request prior to a contract; legitimate interest in assessing candidates
Showcasing completed work in our portfolio	Project deliverables and client brand identifiers	Legitimate interest in demonstrating our work, subject to any confidentiality terms agreed with the client
Establishing, exercising or defending legal claims	Any relevant data	Legitimate interest and legal obligation

Under the PDPL, processing generally requires your consent unless one of the statutory exceptions applies — including where processing is necessary to perform a contract to which you are a party, to comply with a legal obligation, to protect the public interest, or to safeguard our legitimate interests without prejudicing your rights. We rely on those exceptions where indicated above, and on consent where indicated.

5. Artificial intelligence and automated processing

We use AI tools in parts of our work — including research, content drafting, code assistance, image processing and SEO/AEO analysis. This matters to your privacy, so we are explicit about it:

We do not enter personal data belonging to you or your customers into public or consumer AI tools.
Where a project genuinely requires AI processing of personal data, we use enterprise or API tiers that contractually exclude the use of submitted data for model training, and we agree this with the client in advance.
We do not make decisions producing legal effects, or similarly significant effects, about you based solely on automated processing. Human judgement is applied to every commercial and project decision we take.
AI-assisted output in deliverables is reviewed by a person before it reaches you.

You have the right to object to automated processing, including profiling, as set out in Section 10.

6. Who we share your data with

We do not sell personal data. We share it only where necessary, and only with parties bound to protect it.

Service providers and sub-processors who support our operations, such as website hosting and CDN providers, email and productivity platforms, project management and CRM tools, accounting and invoicing software, analytics providers, payment processors, and cloud storage providers.
Trusted contractors and specialists — for example freelance developers, illustrators, photographers or copywriters — engaged under confidentiality obligations to deliver part of a project.
Advertising and social platforms, where you have consented to marketing cookies and tags.
Professional advisers including lawyers, auditors and insurers, where reasonably required.
Authorities and regulators, where we are required to disclose data by applicable law, court order or a lawful request from a competent authority.
A successor entity, in the event of a merger, acquisition or restructuring of our business, subject to this policy continuing to apply.

A current list of our sub-processors is available on request from [PRIVACY EMAIL].

7. International transfers

We are based in the UAE and work with clients and suppliers internationally. Your data may therefore be transferred to, and processed in, countries other than your own — including the European Economic Area, the United Kingdom and the United States.

Under the PDPL, personal data may be transferred outside the UAE where the destination has an adequate level of protection, or where appropriate safeguards are in place — such as a contract containing the required protective clauses, your explicit consent, or where the transfer is necessary to perform a contract.

For transfers from the EEA or UK, we rely on adequacy decisions where they exist, and otherwise on Standard Contractual Clauses or the UK International Data Transfer Addendum, supported by a transfer risk assessment. You may request a copy of the relevant safeguards from [PRIVACY EMAIL].

8. How long we keep your data

Category	Retention period
Enquiries that do not become projects	Up to 24 months from last contact
Client project records and correspondence	Duration of the engagement plus 5 years
Invoices, accounting and tax records	Minimum 5 years from the end of the relevant tax period, in line with UAE tax and corporate record-keeping requirements
Contracts and signed agreements	6 years from expiry or termination
Marketing list data	Until you unsubscribe, plus a suppression record to honour your opt-out
Website analytics data	Up to 26 months, or the shorter period configured in the relevant platform
Server and security logs	Up to 12 months
Unsuccessful job applications	12 months, unless you ask us to keep your details on file

When a retention period ends, we delete the data or irreversibly anonymise it. Where deletion is not immediately possible — for example in backups — we isolate the data and delete it on the next backup cycle.

9. How we protect your data

We apply technical and organisational measures proportionate to the risk, including:

Encryption in transit via TLS across our website and client-facing systems, and encryption at rest on our primary storage platforms.
Access control on a least-privilege basis, with multi-factor authentication enforced on business-critical accounts.
Password management through a dedicated vault rather than shared documents or messages.
Confidentiality obligations in every contractor and employment agreement.
Regular software patching, backups, and monitoring of the systems we control.
An internal process for assessing, containing and reporting personal data breaches.

No system is entirely immune to compromise. If a personal data breach occurs that is likely to prejudice your privacy, confidentiality or security, we will notify the UAE Data Office and, where required, affected individuals — without undue delay and in accordance with applicable law.

10. Your rights

Subject to the conditions and exemptions in applicable law, you have the right to:

Be informed about how your personal data is processed, and to request access to the data we hold about you.
Request correction of inaccurate or incomplete data.
Request erasure of your data where there is no continuing lawful basis for us to hold it.
Request restriction of processing in defined circumstances, such as while a dispute about accuracy is resolved.
Object to processing carried out on the basis of legitimate interests, and to object to direct marketing at any time.
Request data portability — a copy of the data you provided to us, in a structured, commonly used, machine-readable format.
Object to decisions based solely on automated processing that produce legal or similarly significant effects.
Withdraw consent at any time, where processing is based on consent. Withdrawal does not affect processing carried out before withdrawal.
Lodge a complaint with a supervisory authority.

How to exercise your rights

Email with the request and enough information for us to identify you. We may ask for verification before acting, to ensure we do not disclose data to the wrong person.

We will respond within 30 days. If your request is complex or you have made several requests, we may extend this and will tell you why. Exercising your rights is free; we may charge a reasonable fee, or decline, only where a request is manifestly unfounded or excessive.

11. Complaints

If you are unhappy with how we have handled your personal data, please raise it with us first — we would rather fix it directly. You also have the right to complain to:

The UAE Data Office, the federal supervisory authority for personal data protection in the UAE.
Your local data protection supervisory authority, if you are in the EEA.
The Information Commissioner's Office (ICO), if you are in the UK.

12. When we act as a processor for our clients

When we build, host or maintain a website, application or marketing system for a client, personal data belonging to that client's customers, users or employees may pass through systems we operate. In that situation:

The client is the controller and determines the purposes and means of processing.
We act only on the client's documented instructions.
We enter into a data processing agreement where required, covering confidentiality, security measures, sub-processor approval, assistance with data subject requests, breach notification and deletion or return of data at the end of the engagement.
We do not use that data for our own purposes.

If you are an end user of a website or system we built for one of our clients, please direct privacy requests to that client in the first instance. We will support them in responding.

13. Third-party websites

Our website links to external sites, including client work, social platforms and partner tools. We are not responsible for the privacy practices or content of those sites. Review their policies before providing personal data.

14. Children

Our website and services are directed at businesses and professionals, not children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

15. Changes to this policy

We review this policy periodically and update it when our practices, our tools or the applicable law change. The date at the top reflects the most recent revision. Where a change is material, we will give notice on the website or by email before it takes effect. Continued use of the site after that point constitutes acceptance of the revised policy.

16. Contact

Morrow Studio L.L.C-FZ
Meydan Grandstand, 6th floor, Meydan Road, Meydan Free Zone
Dubai, United Arab Emirates

General enquiries: hello@madebymorrow.com
Website: madebymorrow.com