Privacy Notice
Effective version — in force from 8 September 2026 (v1.0).
The short version
- We collect your name, email and payment details when you buy — and whatever you send us in an email or WhatsApp message.
- We never see or store your card number. Stripe handles the card.
- We use your details to build your website, send your Stripe invoice and receipt, and talk to you. Nothing else.
- We do not sell your data. We do not advertise to you. We do not track you around the internet.
- On orralis.ae we set no cookies at all, and our visitor counter is cookieless and collects no personal data.
- On orralislab.com we set one cookie — the currency you picked — and we look up your country to show the right currency. Details below.
- You can ask us for your data or ask us to delete it, any time: Hello@orralis.ae.
Who is responsible for your data
Orralis For Design Services (“Orralis”) is the data controller for the personal data described here. We are registered in Dubai, United Arab Emirates.
- Registered address: Azizi Candace, Al Awir First, Dubai, UAE
- Trade licence: No. 1558211 · Sole Establishment · issued by the Dubai Department of Economy and Tourism (DET), November 2025 · Verify on Invest in Dubai
- Email for anything about privacy: Hello@orralis.ae
- WhatsApp: +971 56 184 8081
This notice covers orralis.ae (including the Arabic edition at orralis.ae/ar/) and orralislab.com.
Orralis For Design Services is licensed on the Dubai mainland by the Department of Economy and Tourism (DET), not in a free zone with its own data protection regime. The law that applies to us is therefore the federal UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).
What we collect
When you buy a package, through Stripe’s secure checkout page:
- your name,
- your email address,
- your billing address and country, where the card networks require it,
- your card details — these go straight to Stripe and never reach us or our servers,
- the package you bought, the amount, the currency, the date and a payment reference.
When you contact us by email, WhatsApp or the enquiry form on this site: your name, email address, phone number, company name, and whatever you choose to tell us about your business.
When you become a client: the content you send us for your website — logos, text, photographs, project details, staff names — plus your domain, hosting and email account details.
Technically, when you visit the site: our hosting provider keeps standard server logs (IP address, browser type, pages requested, timestamps) for security and troubleshooting. On orralislab.com only, we also read your IP address to work out your country — see “Cookies, tracking and country detection” below.
We do not collect anything sensitive: no health data, no financial account data, no ID or passport numbers. Please do not send us those.
Why we use it, and on what basis
We use your personal data for these purposes and no others (PDPL Art. 13(2)(b)):
| What we do | Why | Our basis |
|---|---|---|
| Take your payment | So you can buy a package | Performing our contract with you |
| Send your Stripe invoice and receipt by email | You need proof of payment (no VAT is charged; Orralis is not VAT-registered) | Performing our contract; and our legal obligation to issue records |
| Contact you within 1 business day to start your project | You paid for a website and we need your content | Performing our contract |
| Build, launch and support your website | It is what you bought | Performing our contract |
| Answer your email or WhatsApp message | You asked us something | Your request; our legitimate interest in responding |
| Keep accounting and tax records | UAE law requires it | Legal obligation |
| Detect and prevent fraud and card disputes | Protecting both of us | Legitimate interest |
| Show your finished website in our portfolio | It is how we win work | Legitimate interest — and you can tell us not to, any time |
We do not use your data for advertising, profiling or automated decision-making, and we do not send marketing emails unless you have asked us to.
Card payments — how they work
Payments on our sites are handled by Stripe, on a Stripe-hosted checkout page.
When you click a buy button, our server creates a checkout session and sends you to Stripe. You enter your card details on Stripe’s page, not ours. Your card number, expiry date and security code never touch an Orralis server and are never stored by us.
Stripe sends back to us only: your name, your email address, the amount, the currency, the date, and a payment reference. That is all we ever see.
Stripe is a payment processor with its own privacy policy at stripe.com/privacy. Stripe processes your data as an independent controller for its own compliance and fraud-prevention purposes.
Who we share your data with
We share your personal data only with the service providers we need to run the business (PDPL Art. 13(2)(d)). Here is the complete list:
| Who | What they get | What they do with it | Where they process it |
|---|---|---|---|
| Stripe | Name, email, card details, billing address, amount | Take the payment, prevent fraud | United States and Ireland |
| Resend | Your name and email address, package, amount, payment reference | Send your invoice and receipt email | United States |
| Hostinger | Server logs, and your website content | Host our website and yours | United Kingdom — Hostinger’s Europe data centre. Backups are stored in Germany |
| Hostinger email (Titan) | Anything in your emails to us | Our business inbox (Hello@orralis.ae) | Outside the UAE, under Hostinger’s terms |
| Web3Forms | Whatever you type into the enquiry form on this site — your name, email, phone, company and message | Deliver the enquiry form to our inbox. Web3Forms keeps a copy of the submission for up to 3 years unless it is deleted sooner | Operated from India, on Amazon Web Services infrastructure that may process the data in more than one region |
| ipapi.co | Your IP address, transiently | Return a two-letter country code so orralislab.com shows the right currency. Used only on orralislab.com. Your IP is not logged or stored by us | United States |
| Your domain registrar | Your company name and contact details | Register the domain in your name, as registry rules require | Varies by registry |
| Umami Cloud (Umami Software) | No personal data and nothing stored on your device — an anonymous page view, the page you came from and your country | Count visits so we can tell whether the website is working | European Union |
We do not sell your data. We do not share it with advertisers, data brokers or anyone else. We will disclose data to a court or authority only where UAE law requires it.
Sending data outside the UAE
Our providers are outside the United Arab Emirates — in the United States, Ireland, the United Kingdom, Germany, the European Union and India; your domain registrar depends on the registry. That means your personal data is transferred and processed outside the UAE (PDPL Art. 13(2)(g)).
We make those transfers only where the receiving country has an adequate level of protection recognised for these purposes, or under a written contract with the provider that requires it to protect your data to the standard the UAE PDPL requires — in practice, the provider’s standard data processing agreement and standard contractual clauses.
Each of these providers processes personal data under its own data-processing terms, which form part of the service agreement we have accepted with it, including standard contractual safeguards for transfers outside the UAE.
If you want to know more about the safeguards for a specific provider, email Hello@orralis.ae and we will send you the detail.
Cookies, tracking and country detection
We keep this deliberately minimal, and the two sites behave differently.
orralis.ae and orralis.ae/ar/ — we set no cookies at all, and we run no tracking pixels, no advertising tags and no session recording. We do measure how many people visit, using Umami Cloud (Umami Software, hosted in the European Union), which is cookieless: it stores nothing on your device, collects no personal data, does not follow you across websites and does not build a profile of you. It counts page views, referrers and a few anonymous events — which sections were read, which buttons were used. Because nothing is stored on your device and no personal data is collected, there is nothing to consent to, which is why you see no cookie banner. Our prices are in dirhams for everyone, so there is nothing to detect and nothing to remember.
orralislab.com — because this site sells in several currencies, two extra things happen:
- One cookie. If you choose a currency from the selector, we save that choice in a first-party cookie named
og_currency. It stores nothing but a three-letter currency code, lasts 12 months, and exists only so the site does not forget your choice. It is not used to identify or track you. We also keep the same code in your browser’s session storage so the page loads faster. - Country detection. To show you a sensible currency before you have chosen one, our server checks your country. It first looks for a country code that our hosting or CDN already supplies. If there is none, it sends your IP address to ipapi.co, which returns a two-letter country code. Your IP address is used for that lookup and nothing else — we do not log it and we do not store it. We keep the answer for up to 6 hours against a one-way hash of your IP, so repeat visits do not repeat the lookup. If you would rather this did not happen, use the currency selector; once you have chosen, the cookie takes over and no lookup is made.
How long we keep it
| What | How long |
|---|---|
| Payment and invoice records | 5 years, as UAE commercial record-keeping rules require |
| Client project files and website content | For as long as we host your site, plus 12 months after you leave |
| Emails and WhatsApp conversations | 24 months |
| Enquiries that did not become clients | 24 months, then deleted |
| Enquiry form submissions held by Web3Forms | Up to 3 years, unless we delete them sooner |
| Server logs | As set by our hosting provider, typically a few weeks |
| Currency cookie (orralislab.com) | 12 months, or until you clear it |
| Country lookup cache | 6 hours, against a hash of your IP, never the IP itself |
When the period ends we delete the data or make it anonymous.
Your rights
Under the UAE Personal Data Protection Law (Federal Decree-Law 45/2021) you can ask us to:
- tell you what we hold about you, and why,
- give you a copy of it in a usable format,
- correct anything that is wrong,
- delete it, where we do not need it for a contract or a legal obligation,
- stop or limit a particular use of it,
- stop using it for a purpose you object to, including our portfolio,
- withdraw consent where we relied on consent.
Email Hello@orralis.ae and say what you want. We will reply within 30 days. We do not charge for this.
If you are not satisfied with our answer, you can complain to the UAE Data Office.
If you are in the UK or the EU
orralislab.com is offered internationally, including to businesses and people in the United Kingdom and the European Union. That brings it within the UK GDPR and the EU GDPR (Art. 3(2)), which apply to a controller outside the UK or EU whose processing relates to offering goods or services to people there — whether or not they pay.
So if you are in the UK or the EU, you also have the GDPR rights: access, rectification, erasure, restriction, portability, objection, and the right not to be subject to automated decision-making (we do not do any). The list above already covers all of these; you exercise them the same way, by emailing Hello@orralis.ae.
We will respond within one month, as the GDPR requires.
You can also complain to your national data protection authority — the ICO in the United Kingdom, or your country’s supervisory authority in the EU.
Keeping your data safe
Our sites run over HTTPS, so everything you send is encrypted in transit. Payments go through Stripe, which is PCI-DSS compliant at the highest level. Our payment webhook verifies a cryptographic signature on every message before it acts on it, so a fake payment notification cannot trigger anything.
Access to client data is limited to the people who need it. Our accounts use strong, unique passwords and two-factor authentication.
No system is perfectly secure. If a breach ever affects your personal data, we will tell you and the UAE Data Office as the law requires.
Children
Our services are for businesses. We do not knowingly collect personal data from anyone under 18. If you think a child has sent us personal data, email Hello@orralis.ae and we will delete it.
Changes to this notice
If we change how we handle your data — a new provider, a new tool, analytics — we will update this page and change the date at the top. If the change is significant and affects existing clients, we will email you.
Contact
Questions, requests or complaints about privacy:
Orralis For Design Services, Azizi Candace, Al Awir First, Dubai, UAE, Dubai, United Arab Emirates.