Privacy Policy.

Stephanie Herela Production FZ-LLC, trading as Herela Productions ('we', 'us'), operates herelaproductions.com from the United Arab Emirates. This Privacy Policy explains how we handle information when you visit the website, complete the contact form, or choose to contact us by other means.

We use Google Analytics 4 ("GA4") to measure website usage only where a visitor has explicitly consented to analytics tracking. We do not sell personal data.

Contact form: When you complete and submit the Start Project form, we receive your name, email address, selected project type, project stage, budget range, and any optional message you choose to include. This data is transmitted from our server to the Web3Forms delivery service, which forwards it to our inbox. Your submission is used only to respond to your inquiry.

Email and social inquiries: If you contact us by email or Instagram, we receive the information you include, such as your name, contact details, message, attachments, and related communication metadata.

Hosting logs: Our hosting provider may automatically record technical information such as your IP address, request time, requested URL, referring page, browser or user-agent details, and error information. These logs support website delivery, security, diagnostics, and abuse prevention.

Rate-limiting record: To prevent abuse of the contact form, our server temporarily records a hashed version of the submitting IP address alongside submission timestamps. This record is used only to enforce a per-hour submission limit and is overwritten automatically; it contains no name, email address, message, or other inquiry content.

Locally hosted fonts: The website's font files are stored on our own hosting and are delivered with the rest of the website. Loading a page does not send a font request to Google.

We use inquiry information to reply, discuss services, and prepare work you have asked about. Where the GDPR applies and you inquire for yourself, processing necessary to respond or take requested steps before a contract relies on Article 6(1)(b). For business inquiries made on behalf of an organisation, and follow-up not necessary for a contract with you personally, we rely on Article 6(1)(f): our legitimate interests in answering business inquiries and managing prospective client relationships.

We process hosting logs under GDPR Article 6(1)(f), based on our legitimate interests in operating, securing, diagnosing, and protecting the website. Under the UAE PDPL, we process inquiry information where necessary to take steps at your request to conclude or perform a contract. Where another UAE PDPL exception does not apply, we rely on consent where consent is required.

Providing inquiry information is not a statutory requirement. It is necessary only to the extent required for us to answer your inquiry or take requested pre-contractual steps; without contact details and enough project information, we cannot respond.

We do not use inquiry content for automated decisions producing legal or similarly significant effects.

We use GA4 under measurement ID G-E49G9TB4VQ. After analytics consent is granted, GA4 may place first-party analytics cookies and collect information such as page views and interactions, session statistics, pseudonymous client identifiers, approximate location, referring pages, and browser and device information.

GA4 is implemented using the basic form of Google Consent Mode v2. The GA4 tag is blocked unless and until the visitor explicitly accepts analytics through the consent banner. If analytics consent is declined or no choice is made, the tag does not load and no analytics data or consent signal is sent to Google. Visitors may withdraw or change their consent at any time through the website's consent settings; withdrawal applies to subsequent processing.

Website hosting: Namecheap, Inc., 4600 E Washington St, Suite 305, Phoenix, AZ 85034, United States, processes server-log and technical data to deliver and secure the website. Our PHP contact form proxy runs on the same Namecheap infrastructure; form data passes through it before being forwarded and is not stored there.

Form delivery: Web3Forms (web3forms.com) acts as a data processor to deliver contact form submissions to our inbox. When you submit the Start Project form, the submission data is sent from our server to Web3Forms, which forwards it by email and does not retain it for purposes beyond delivery. Their privacy practices are described at web3forms.com/privacy. Web3Forms may process data outside the UAE or EEA; their service is governed by applicable data-transfer safeguards described in their privacy policy.

Analytics: Google Analytics 4, provided by Google (analytics.google.com), acts as a data processor to provide website usage measurement after analytics consent is granted. GA4 may process page and interaction data, session statistics, pseudonymous client identifiers, approximate location derived from IP address, referring-page information, and browser and device information. Google's privacy practices are described at policies.google.com/privacy. Google may process data outside the UAE or EEA; its service is governed by applicable contractual and data-transfer safeguards described in Google's data processing terms.

Email services: Namecheap Private Email, provided by Namecheap, Inc. in the United States, processes messages and related metadata when you email us. Your own email provider also processes the communication under its terms.

International transfers: Website and email data processed by Namecheap in the United States is subject to Namecheap's Data Processing Agreement and applicable Standard Contractual Clauses. You may request information about these safeguards by emailing contact@herelaproductions.com.

Fonts: Font files are hosted on the website's own Namecheap infrastructure. No separate request is made to Google Fonts when a page loads.

Instagram and Meta: If you choose to contact or visit us through Instagram, Meta processes information under its own privacy policy.

Professional advisers, authorities, or courts may receive relevant information where required by law or reasonably necessary to establish, exercise, or defend legal claims.

No other cross-border transfer is currently initiated by the website. If you follow an external link or contact us through a third-party platform, that provider processes information under its own privacy terms.

Depending on the law that applies, you may ask us to show you, correct, delete, restrict, or provide a copy of your personal information. You may object to certain uses, ask us to stop direct marketing, request human review of a qualifying automated decision, or withdraw consent. Withdrawing consent does not affect processing that was lawful before withdrawal.

Where the GDPR applies, these rights include access under Article 15, correction under Article 16, erasure under Article 17, restriction under Article 18, information about notified recipients under Article 19, portability where Article 20 applies, objection under Article 21, and the protections for automated decisions in Article 22.

To exercise a right, email contact@herelaproductions.com and describe your request. We may ask for enough information to confirm your identity. Requests are normally free. Where the GDPR applies, we respond without undue delay and within one month. If a request is complex or numerous, we may extend this by up to two further months and will explain the extension within the first month.

You may complain to the UAE Data Office about processing covered by the UAE PDPL. Where the GDPR applies, you may also complain to the supervisory authority in the EEA country where you live, work, or believe a violation occurred.

You may request deletion through any clear communication to contact@herelaproductions.com; no particular subject line is required.

After verifying a valid request, we will search relevant email, communication, and business systems and complete deletion within 90 days. We retain information after a valid request only where an applicable legal exception requires or permits it, and we will explain that ground. Residual copies may remain temporarily in protected backups until they are overwritten or a documented legal hold ends.

Where analytics consent has been granted, GA4 may retain event data associated with pseudonymous identifiers. GA4 is not configured to collect names, email addresses, or contact-form content, so analytics records generally cannot be located using those details alone. Where a request provides sufficient information to identify relevant records, we will use the deletion controls reasonably available to us. Temporary rate-limiting logs containing hashed IP addresses are overwritten automatically within one hour and are not included in deletion searches.

Contact form submissions: Once Web3Forms delivers a submission to our inbox, the email is subject to our standard inquiry retention period: the duration of the prospective or active business relationship, or deleted within 90 days of a valid erasure request unless a legal exception applies.

Contact and inquiry emails are retained for the duration of the prospective or active business relationship. Following a valid deletion request, they are deleted within 90 days unless an applicable legal exception requires or permits continued retention.

Rate-limiting logs: Hashed IP address records written during form submission are stored in a server-side temporary file and are overwritten automatically after one hour. They are not subject to manual retention and are excluded from deletion searches.

Namecheap server logs are generally retained for approximately 30 days. Protected backups follow Namecheap's operational backup schedule and are overwritten in the ordinary course of service.

The website and services are intended for business users and adults and are not offered directly to children. Children should not submit inquiries or sensitive personal information.

We do not knowingly use children's personal data for commercial profiling, targeted advertising, or tracking. If you believe a child has provided personal data, contact us so we can investigate and delete it where required.

We use reasonable technical and organisational measures appropriate to the nature of the website and communications, including HTTPS encryption in transit, restricted administrative access, server-side rate limiting on form submissions to prevent automated abuse, and a honeypot mechanism to filter spam. The Web3Forms API key used to process form submissions is stored on the server only and is never included in code delivered to your browser.

No online service or communication method is completely secure. If a personal-data breach may affect the privacy, confidentiality, or security of personal data, we will investigate, contain, document, and address it. We will notify the UAE Data Office, other competent authorities, and affected people when applicable law requires it.

Controller: Stephanie Herela Production FZ-LLC, a Free Zone Limited Liability Company trading as Herela Productions. Licence number: 17008281. Licensed activity: Production Consultancy Management.

Jurisdiction: Ras Al Khaimah Economic Zone (RAKEZ), United Arab Emirates.

For privacy and data-related requests, including access, correction, deletion, restriction, objection, or portability requests, contact:

Email: contact@herelaproductions.com

Registered address: VUET2411, Compass Building, Al Hulaila Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates.