SANTRIL Website Launch — Privacy Notice

This notice explains how personal information is handled by an individual trading as SANTRIL, based in Dubai, United Arab Emirates ("SANTRIL", "we", "us"). Privacy and legal contact: legal@santrilgroup.com General customer contact: sales@santrilgroup.com SANTRIL is the controller of the personal information described in this notice where SANTRIL decides why and how that information is used. 1. Information we collect Enquiries and leads We may collect: • name; • business name; • email address; • phone number; • business type; • whether there is an existing website; • whether there is an existing domain; and • information the person chooses to include in an enquiry. Customers and website projects If an enquiry becomes a project, we may also collect: • project contact details; • business/service information; • service areas; • address and opening hours; • social links; • website text and calls to action; • logos, photographs and other supplied assets; • testimonials and accreditation information; • domain and email status; • account invitation/access information; • approvals and revision requests; • support communications; • payment status, transaction references and invoice/receipt information; and • records of the work SANTRIL performs. SANTRIL does not ask customers to send payment-card details directly. Payments are handled by Whop and its payment partners. 2. Where the information comes from Most information is collected directly from the person or customer through: • SANTRIL website/lead forms; • Meta/Facebook/Instagram lead forms; • email or other direct communications; • customer intake/onboarding forms; • Whop order/payment records; and • account invitations or project systems used to provide the service. A customer may also provide contact details or website material relating to its staff, customers or other people. The customer is responsible for ensuring it is permitted to provide that material to SANTRIL for the project. 3. Why we use personal information We use personal information to: • respond to enquiries; • determine whether the fixed website package is suitable; • take requested steps before entering a contract; • administer orders and payments; • onboard customers; • build, deploy, revise, launch and hand over websites; • configure customer-owned infrastructure where authorised; • provide Website Care or other agreed support; • communicate about the project and service; • keep accounting, transaction and service records; • prevent fraud, abuse and security incidents; • protect and enforce legal rights; and • comply with applicable legal obligations. SANTRIL does not treat a normal website enquiry as automatic consent to an unrelated marketing newsletter. 4. Legal grounds for processing UAE personal-data law Where the UAE Federal Personal Data Protection Law applies, SANTRIL may process information without separate consent where an applicable legal ground permits it. For this V1 service, the main grounds are expected to include processing necessary: • to take steps requested by a person before a contract or to perform a contract with that person; • to comply with specific legal obligations; and • to establish, exercise or defend legal rights or claims. Where consent is required for a particular activity, SANTRIL will request it in a clear way and the person may withdraw it as permitted by law. UK data-protection law, where applicable Where UK GDPR applies, the main lawful bases are expected to be: • contract — where processing is necessary to take requested pre-contract steps or perform a contract with the individual; • legal obligation — where information must be kept or used to comply with applicable law; • legitimate interests — for proportionate business administration, information security, fraud prevention, handling business contacts and protecting legal rights where those interests are not overridden by the individual’s rights; and • consent — where consent is the appropriate basis for a specific optional activity. Where SANTRIL relies on legitimate interests, the specific interest is to operate and secure the website-service business, communicate with relevant business contacts, prevent misuse, maintain necessary service records and protect legal rights. 5. Marketing A person may choose whether to receive promotional or marketing communications where applicable law requires that choice. SANTRIL will not sell personal information or add ordinary service enquiries to an unrelated mass-marketing list merely because they submitted an enquiry. A person may object to or unsubscribe from direct marketing at any time using the contact details in the message or by emailing legal@santrilgroup.com. 6. Service providers and recipients Depending on the stage of an enquiry or project, personal information may be processed using providers such as: • Meta, when a Facebook or Instagram lead form is used; • Whop, for payment processing, order records and subscription administration; • Google Workspace/Gmail, for business communications and customer mailbox setup; • Lovable, as SANTRIL’s production/build environment; • GitHub, for website source-code repositories; • Cloudflare, for deployment, DNS, SSL, website infrastructure and server-side contact-form processing; • Resend, for transactional delivery of website contact-form enquiries; and • professional advisers, regulators, authorities or dispute-resolution bodies where reasonably necessary or legally required. Customer infrastructure is set up in customer-owned accounts wherever practical. Providers may act as processors, independent controllers or other recipients depending on the service and circumstances, and their own privacy terms may also apply. 7. International processing and transfers SANTRIL is based in the UAE and uses service providers that may process information in other countries. Before processing begins, SANTRIL will make available the categories of recipients and the fact that cross-border processing may occur. Where applicable law requires a specific safeguard or transfer mechanism, SANTRIL will use a legally available mechanism appropriate to that transfer. Under UAE law, this may include contractual safeguards or transfers necessary to enter into or perform a contract, where the statutory conditions are met. Where UK GDPR applies and a transfer is restricted, SANTRIL will use an applicable adequacy arrangement, appropriate safeguard, or a permitted exception only where the legal conditions for that mechanism are met. 8. Retention SANTRIL keeps personal information only for as long as reasonably needed for the purpose for which it was collected and for applicable legal, tax, accounting, dispute and security requirements. V1 working retention rules are: • unsuccessful enquiries are normally reviewed for deletion after 12 months, unless there is a reason to keep them longer; • temporary project/build material is removed or reduced after project closure when it is no longer operationally needed; • contract, payment, invoice and accounting records are retained for the period required by applicable law; and • records needed for Website Care are kept while the service is active and for an appropriate period afterwards. Where information must be kept longer for a legal claim, dispute, regulatory request or legal obligation, SANTRIL may retain the relevant information for that purpose. 9. Security and access SANTRIL uses reasonable technical and organisational measures appropriate to the V1 service, including: • customer-owned accounts wherever practical; • delegated/invited access instead of retained passwords where supported; • restricted access to project information; • keeping service/API secrets out of public front-end code; and • removing access that is no longer needed after handover or support ends. No internet-based system can be guaranteed completely secure, but SANTRIL will take reasonable steps to reduce avoidable risk and respond to suspected personal-data incidents in accordance with applicable law. 10. Your rights Rights depend on the law that applies to the person and processing. Under UAE personal-data law, rights may include rights to: • receive information about processing; • obtain certain personal data in a portable format and request transfer where legally available; • correct inaccurate information; • request erasure in qualifying circumstances; • request restriction of processing; • object to direct marketing and certain other processing; and • object to certain significant automated decisions. Where UK GDPR applies, rights may include access, correction, erasure, restriction, portability, objection and rights relating to automated decision-making, subject to the conditions and exemptions in that law. To make a privacy request, email legal@santrilgroup.com. SANTRIL may need to verify identity before releasing or changing personal information. 11. Complaints Please contact legal@santrilgroup.com first so SANTRIL can investigate a privacy concern. Where UAE personal-data law applies, a person may also have a right to complain to the competent UAE data-protection authority/Bureau in accordance with applicable procedures. Where UK data-protection law applies, a person may have the right to complain to the UK Information Commissioner’s Office (ICO). 12. Cookies and tracking on the SANTRIL launch page The V1 launch position is to avoid non-essential advertising or analytics cookies/pixels unless the required consent and notice controls are implemented first. Strictly necessary technology may be used to operate the website and forms. If SANTRIL later enables Meta Pixel, non-essential analytics or similar tracking, the cookie/privacy implementation must be reviewed before that technology goes live. 13. Automated decision-making SANTRIL does not currently intend to use solely automated decision-making that produces legal or similarly significant effects on leads or customers as part of the V1 website service. 14. Changes to this notice SANTRIL may update this notice when the service, providers or legal requirements change. The current version will show its effective date.