Privacy policy

1. Who we are

Yannex Projects LLC, Al Quoz Creative Zone, Dubai, UAE, is responsible for your personal information (the "data controller"). This policy follows the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). Contact: info@yannexprojects.com.

2. What we collect

Information you give us:

• Workshop bookings: your name, email, phone, the number of places and the session, and anything you tell us about participants (for example allergies or access needs).
• Orders: your name, email, phone, delivery address and any note to us. Card details are entered directly into Stripe's secure form; we only see the payment result and limited details such as the card brand and last four digits.
• Studio visits and messages: your name, email, phone, the date and time you choose and your message.
• Newsletter: your email, name (optional) and language, once you confirm your subscription.
• Waiting lists, reviews and gift cards: the details you enter, including a gift recipient's name and email if you add them.
• Unfinished checkouts: if you enter your email at checkout but don't pay, we keep it with your basket so we can send up to two reminders.

Information collected automatically: our hosting provider records technical data such as your IP address and browser for security. We measure visits with Cloudflare Web Analytics, which doesn't use cookies or track you across other websites. We don't use advertising pixels.

3. Why we use it

• To provide what you asked for: confirm bookings and orders, take payment, arrange delivery, send reminders before your workshop or visit, and answer your messages (to perform our contract with you).
• To send cart reminders, waiting-list alerts and a request to review a workshop you attended (our legitimate interest in serving you well; every one of these emails has an unsubscribe link).
• To send our newsletter, only if you subscribed and confirmed (your consent, which you can withdraw at any time).
• To keep accounting and VAT records and meet other legal duties (legal obligation).
• To keep the website secure and prevent fraud (legitimate interest).

4. Who we share it with

We never sell your personal information or share it for advertising. We use a small number of service providers, who may only use it to provide their service to us:

• Stripe: card payments, refunds and fraud prevention.
• Cloudflare: website hosting, database, image storage and visitor statistics.
• Resend: sending our emails.
• Twilio (WhatsApp): instant alerts to our own team about new bookings and orders.
• Couriers: your name, phone and address, to deliver your order.

We may also share information with our accountants and auditors, or when the law requires it.

Some of these providers process data outside the UAE (for example in the EU or the US). They protect it with contractual safeguards and security measures.

5. Cookies

We only use cookies that the website needs to work, so we don't ask for consent:

• yp_cart, yp_cart_note and yp_cart_id: remember what's in your basket and your note to us (deleted when you order, or after 30 days).
• yp_admin: keeps our own staff signed in to the admin area.
• Stripe sets its own cookies on the checkout page to prevent fraud.

You can delete cookies in your browser settings; your basket will then be emptied.

6. How long we keep it

• Orders, bookings and invoices: 5 years, as UAE tax law requires.
• Unfinished baskets and checkout emails: up to 90 days.
• Newsletter: until you unsubscribe.
• Waiting lists and appointment requests: until the event or visit has passed, then up to 12 months.
• Records of emails we've sent: 12 months.

7. Children

Children's workshops are booked by a parent or guardian. We only ask for what we need to run the workshop safely. This website is not meant for children to send us personal information; if you think a child has done so, contact us and we'll delete it.

8. Security

The website is served over an encrypted connection (HTTPS). Only our authorised staff can see bookings and orders, staff passwords are stored encrypted, and payments are handled by Stripe, which meets the PCI DSS card-security standard. No system is perfectly secure, so please don't send card details or other sensitive information by email or WhatsApp.

9. Your rights

You can ask us to:

• give you a copy of the personal information we hold about you;
• correct it if it is wrong;
• delete it, unless we must keep it by law (for example invoices);
• stop or limit how we use it, or object to a use based on our legitimate interests;
• send it to you or another organisation in a common format.

You can withdraw consent or unsubscribe at any time using the link in our emails. Receipts and booking emails are still sent, because you need them.

To use your rights, email info@yannexprojects.com. We may ask you to confirm your identity and will reply within 30 days. If you're not happy with our answer, you can complain to the UAE Data Office.

10. Changes

We'll update this policy when our practices change and show the new date at the top. For important changes we'll tell newsletter subscribers.