Privacy Notice

1. Who we are

IRONMARK Projects & Trading FZC LLC is a project sourcing and trading company registered in the United Arab Emirates.

For the purposes of applicable data protection law, IRONMARK is the controller of the personal data described in this Privacy Notice.

Please use the subject line Privacy Request when contacting us about your personal data.

2. Personal data we collect

The personal data we collect depends on how you interact with us.

Information you provide

When you submit a project brief, send us an email or communicate with us, we may collect:

• Your name
• Company or organisation name
• Job title or business role
• Email address
• Telephone number
• Country or project location
• Project category
• Product requirements
• Quantities
• Specifications
• Dimensions and finishes
• Target budget
• Required delivery date
• Delivery location
• Project description
• Drawings, bills of quantities, reference images and other files you provide
• Records of correspondence, quotations, approvals and commercial discussions
• Email address and optional marketing preference when you request a downloadable project resource

Please do not submit sensitive personal data through the website or project brief form.

Technical information

When you use the website, our website infrastructure and service providers may automatically process limited technical information, including:

• Internet Protocol address
• Browser and device type
• Operating system
• Referring page
• Pages requested
• Date and time of access
• Security, diagnostic and server-log information
• Cookie identifiers and consent preferences
• Selected website interactions and enquiry-funnel events, where you allow analytics cookies
• Campaign source, medium and campaign name from recognised campaign links, where available

We use this information to operate, protect and troubleshoot the website and, where you consent, to understand and improve the enquiry journey.

3. How we use personal data

We may use personal data to:

• Receive, assess and respond to enquiries
• Understand project requirements
• Contact you regarding an enquiry or project
• Identify potentially suitable products, manufacturers and suppliers
• Prepare or coordinate technical and commercial options
• Request quotations, samples, drawings or supporting documents
• Coordinate agreed order, supply, inspection, logistics or delivery arrangements
• Create and manage quotations, purchase orders, invoices and commercial records
• Provide customer and project support
• Verify and protect the security of the website, forms and communications
• Prevent spam, misuse, fraud and unauthorised activity
• Deliver project resources that you request
• Comply with accounting, tax, regulatory and legal obligations
• Establish, exercise or defend legal rights
• Improve our services and website using aggregated or non-identifying information
• Measure how visitors move from project information to a submitted enquiry, where analytics consent has been provided
• Send business updates or marketing communications where you have requested them or where otherwise permitted by applicable law

We do not use personal data for automated decision-making that produces legal or similarly significant effects.

4. Basis for processing

Depending on the circumstances, we process personal data where:

• You have provided consent
• Processing is necessary to respond to your request or take steps toward entering into a contract
• Processing is necessary to perform a contract with you or your organisation
• Processing is necessary to comply with applicable legal or regulatory obligations
• Processing is necessary to establish, exercise or defend legal rights
• Processing is otherwise permitted under applicable law

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that occurred lawfully before the consent was withdrawn.

5. How we share personal data

We disclose personal data only when reasonably necessary for the purposes described in this notice.

International manufacturers and suppliers

We may share relevant contact and project information with manufacturers, suppliers and specialist partners when necessary to obtain quotations, clarify requirements, prepare samples or drawings, or coordinate an agreed order.

Where practical, we limit the personal information shared and provide suppliers only with the information required for the relevant enquiry.

Logistics and project-service providers

Where required by the agreed scope, we may share relevant information with freight forwarders, inspection companies, insurers, customs-clearance providers, delivery providers and other project-support parties.

Technology and service providers

We use third-party providers to operate our website, forms, communications and business systems. These currently include:

• Formspree, for receiving, filtering, storing and forwarding website form submissions
• Microsoft 365, for business email, communications and related document handling
• PostHog Cloud EU, for consent-based website analytics and conversion measurement
• Supabase, for secure lead-request processing, consent records and short-lived abuse-prevention records
• Resend, for delivering requested resources by email and managing optional marketing preferences
• Cloudflare Turnstile, for privacy-focused bot and abuse prevention on protected forms
• Cloudflare, for website hosting, security, content delivery and privacy-focused aggregate web analytics
• Technical consultants who support or maintain our website and systems

These providers may process personal data only to provide their services to us and subject to their applicable contractual, confidentiality and security obligations.

Professional advisers and authorities

We may disclose information to accountants, auditors, legal advisers, insurers, banks, payment providers, tax advisers or competent authorities where reasonably necessary or legally required.

Corporate transactions

If IRONMARK is involved in a merger, restructuring, acquisition, financing or sale of all or part of its business, relevant data may be disclosed subject to appropriate confidentiality protections.

We do not sell or rent personal data to third parties.

6. International data transfers

IRONMARK is based in the United Arab Emirates and works with international manufacturers and service providers.

Your personal data may therefore be processed or accessed in countries outside the UAE, including countries whose data protection laws may differ from those of the UAE.

Where personal data is transferred internationally, we take reasonable steps to use an appropriate lawful basis and safeguards. These may include:

• Contractual data-protection obligations
• Confidentiality and security requirements
• Transfers necessary to respond to your request or perform an agreed contract
• Your explicit consent where required
• Other safeguards or transfer mechanisms permitted under applicable law

7. Data retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, tax, accounting, contractual and dispute-resolution requirements.

Our standard retention periods are:

Incomplete, duplicate or spam submissions

Up to 90 days, unless required for security investigation or abuse prevention.

Enquiries that do not proceed to an order

Up to 24 months after the last meaningful communication, so that we can respond to follow-up questions and maintain reasonable business records.

Active projects and orders

For the duration of the enquiry, project or commercial relationship.

Contracts, orders and transaction records

Relevant quotations, contracts, purchase orders, invoices, payment records, supply records, delivery documents and related correspondence may be retained for at least seven years after the end of the relevant tax period or commercial relationship, or longer where required by law or necessary for a legal claim.

Website and security logs

Normally up to 90 days, unless a longer period is required to investigate a security incident, fraud or misuse.

Lead-magnet abuse-prevention records

Salted, non-reversible network and email identifiers used for rate limiting are retained for no more than 48 hours. Raw Internet Protocol addresses are not stored in IRONMARK's lead-magnet database.

Website analytics

PostHog analytics event data is retained for up to 12 months. The analytics consent cookie is retained for up to 12 months unless you change your privacy choice or clear browser cookies sooner.

Marketing preferences

Until you unsubscribe, withdraw consent or remain inactive for 24 months. We may retain a limited suppression record to ensure that an opt-out request continues to be respected.

When a retention period expires, information is deleted, anonymised or securely isolated unless continued retention is legally required. Residual copies may remain temporarily in secure backups until they are removed through the relevant provider's normal backup cycle.

8. Cookies and similar technologies

The website uses essential cookies or similar technical storage required for:

• Website functionality
• Form operation
• Security
• Fraud and spam prevention
• Remembering your privacy choice

Analytics cookies

If you select Allow analytics, we use first-party PostHog cookies to distinguish visits and measure selected interactions, including project brief calls to action, form starts, completed form steps, successful submissions and capability views.

We do not send names, email addresses, company names, telephone numbers, project locations, project descriptions or other form-field values to PostHog. Autocapture, session replay, heatmaps, user profiles and automatic error capture are disabled.

PostHog analytics is hosted in its European Union cloud region. Analytics cookies are optional and are not set unless you allow them. You may reject them by selecting Necessary only or withdraw consent at any time using the Privacy choices control on the website.

We do not use cookies to sell personal data.

We do not currently use advertising cookies or behavioural advertising technologies.

You may also restrict or delete cookies through your browser settings. Disabling essential technologies may affect parts of the website.

9. Data security

We use reasonable technical and organisational measures designed to protect personal data from:

• Unauthorised access
• Accidental loss
• Misuse
• Alteration
• Disclosure
• Destruction

These measures may include access controls, password protection, encrypted communications, restricted administrative access, reputable service providers and periodic account and system reviews.

No website, email system or method of electronic transmission can be guaranteed to be completely secure. You should therefore avoid sending highly sensitive or unnecessary personal information by email or through the project brief form.

10. Your rights

Subject to applicable law and any relevant exceptions, you may request to:

• Receive information about the personal data we process
• Access a copy of your personal data
• Correct inaccurate or incomplete information
• Delete personal data that is no longer required
• Restrict or stop certain processing
• Withdraw consent where processing is based on consent
• Object to direct marketing
• Receive eligible personal data in a structured, machine-readable format
• Request transfer of eligible personal data where technically feasible
• Object to certain automated decisions
• Obtain information about recipients and international transfers

To exercise a right, email info@ironmark.ae with the subject line Privacy Request.

We may ask you to verify your identity before acting on a request. We may also retain information where required by law or where necessary to establish, exercise or defend legal rights.

We will respond within the period required by applicable law.

If you believe your personal data has been handled unlawfully, you may also submit a complaint to the competent data protection authority.

11. Marketing communications

We may send you marketing communications only where you have requested them or where permitted under applicable law.

You may stop receiving marketing communications at any time by:

• Using the unsubscribe option included in the communication, where available
• Emailing info@ironmark.ae

Opting out of marketing does not prevent us from sending necessary communications about an active enquiry, quotation, order or contractual relationship.

12. Third-party websites

The website may link to external websites or platforms that IRONMARK does not operate.

This Privacy Notice does not govern those third parties. You should review the privacy information provided by the relevant third-party website before submitting personal information.

13. Children's data

The website and IRONMARK's services are intended for business and professional users.

We do not knowingly solicit or collect personal data from children. If you believe a child has submitted personal data to us, contact info@ironmark.ae so that we can review and, where appropriate, delete it.

14. Changes to this Privacy Notice

We may update this Privacy Notice when our services, technology, providers or legal obligations change.

The current version will be published on this page with an updated effective date. Material changes may also be communicated through the website or by another appropriate method.

15. Contact us