Privacy Notice
Effective version — in force from 8 September 2026 (v1.0).
The short version
- We collect your name, email and payment details when you buy — and whatever you send us through the enquiry form, by email or on WhatsApp.
- We never see or store your card number. Stripe handles the card.
- We use your details to build your website, send your Stripe invoice and receipt, and talk to you. Nothing else.
- We do not sell your data. We do not advertise to you. We do not track you around the internet.
- Because this site sells in several currencies, we set one cookie — the currency you picked — and we look up your country to choose a sensible default. Both are explained in full below.
- Our visitor counter is cookieless and collects no personal data.
- You can ask us for your data or ask us to delete it, any time: Hello@orralislab.com.
Who is responsible for your data
Orralis For Design Services (“Orralis”) is the data controller for the personal data described here. We are registered in Dubai, United Arab Emirates, and we sell internationally.
- Address: Azizi Candace, Al Awir First, Dubai, UAE
- Trade licence No. 1558211 · Sole Establishment · issued by the Dubai Department of Economy and Tourism (DET), November 2025 · Verify on Invest in Dubai
- Email for anything about privacy: Hello@orralislab.com
- WhatsApp: +971 56 184 8081
This notice covers orralislab.com. Our UAE edition, orralis.ae, is covered by the same notice published there.
Orralis holds a Dubai mainland licence from the Dubai Department of Economy and Tourism (DET), not a free-zone licence with a data protection regime of its own, so the federal UAE Personal Data Protection Law — Federal Decree-Law No. 45 of 2021 — is the law that applies to the processing described here.
What we collect
When you buy a package, through Stripe’s secure checkout page:
- your name,
- your email address,
- your billing address and country, where the card networks require it,
- your card details — these go straight to Stripe and never reach us or our servers,
- the package you bought, the amount, the currency, the date and a payment reference.
When you contact us through the enquiry form on this site, by email or on WhatsApp: your name, company name, WhatsApp number, email address if you give one, your trade, whether you already have a website, and whatever you choose to tell us about your business.
When you become a client: the content you send us for your website — logos, text, photographs, project details, staff names — plus your domain, hosting and email account details.
Technically, when you visit the site: our hosting provider keeps standard server logs (IP address, browser type, pages requested, timestamps) for security and troubleshooting. We also read your IP address to work out which country you are in, so the pricing page can open in a sensible currency — see “Cookies, tracking and country detection” below.
We do not collect anything sensitive: no health data, no financial account data, no ID or passport numbers. Please do not send us those.
Why we use it, and on what basis
We use your personal data for these purposes and no others (PDPL Art. 13(2)(b); GDPR Art. 6):
| What we do | Why | Our basis |
|---|---|---|
| Take your payment | So you can buy a package | Performing our contract with you |
| Send your Stripe invoice and receipt by email | You need proof of payment (no VAT is charged; Orralis is not VAT-registered) | Performing our contract; and our legal obligation to issue records |
| Contact you within 1 business day to start your project | You paid for a website and we need your content | Performing our contract |
| Build, launch and support your website | It is what you bought | Performing our contract |
| Answer your enquiry, email or WhatsApp message | You asked us something | Your request; our legitimate interest in responding |
| Show prices in your own currency | You should not have to convert a price in your head before you can judge it | Our legitimate interest in presenting the offer clearly; your choice, once you use the selector |
| Keep accounting and tax records | The law requires it | Legal obligation |
| Detect and prevent fraud and card disputes | Protecting both of us | Legitimate interest |
| Show your finished website in our portfolio | It is how we win work | Legitimate interest — and you can tell us not to, any time |
We do not use your data for advertising, profiling or automated decision-making, and we do not send marketing emails unless you have asked us to.
Card payments — how they work
Payments on this site are handled by Stripe, on a Stripe-hosted checkout page.
When you click a buy button, our server creates a checkout session and sends you to Stripe. You enter your card details on Stripe’s page, not ours. Your card number, expiry date and security code never touch an Orralis server and are never stored by us.
Stripe sends back to us only: your name, your email address, the amount, the currency, the date, and a payment reference. That is all we ever see.
Stripe is a payment processor with its own privacy policy at stripe.com/privacy. Stripe processes your data as an independent controller for its own compliance and fraud-prevention purposes.
Who we share your data with
We share your personal data only with the service providers we need to run the business (PDPL Art. 13(2)(d)). Here is the complete list:
| Who | What they get | What they do with it | Where they process it |
|---|---|---|---|
| Stripe | Name, email, card details, billing address, amount, currency | Take the payment, prevent fraud | United States and Ireland |
| Resend | Your name and email address, package, amount, payment reference | Send your invoice and receipt email | United States |
| ipapi.co | Your IP address, transiently | Return a two-letter country code so the pricing page opens in a sensible currency. Your IP is not logged or stored by us | United States |
| Hostinger | Server logs, and your website content | Host our website and yours | Hostinger’s Europe (United Kingdom) data centre, with backups stored in Germany |
| Hostinger (Titan business email) | Anything in your emails to us | Our business mailboxes | Outside the UAE, under Hostinger’s terms |
| Your domain registrar | Your company name and contact details | Register the domain in your name, as registry rules require | Varies by registry |
| Web3Forms | Everything you type into the enquiry form — name, company, WhatsApp number, email, trade and your brief | Deliver the enquiry to our inbox. It is a form-delivery service, not a marketing tool. Web3Forms keeps a copy of the submission for up to 3 years unless it is deleted sooner | Operated from India, on Amazon Web Services infrastructure that may process data in several regions |
| Umami Software (Umami Cloud) | No personal data and nothing stored on your device — an anonymous page view, the page you came from and your country | Count visits so we can tell whether the website is working | European Union |
We do not sell your data. We do not share it with advertisers, data brokers or anyone else. We will disclose data to a court or authority only where the law requires it.
Sending data outside the UAE
Every one of our providers is outside the United Arab Emirates. Between them they process personal data in the United States, Ireland, the United Kingdom, Germany, the European Union and India, as the table above sets out. That means your personal data is transferred and processed outside the UAE (PDPL Art. 13(2)(g)). If you are in the UK or the EU, your data also reaches us in the UAE, which is a transfer out of your own jurisdiction (GDPR Chapter V).
We make those transfers only where the receiving country has an adequate level of protection recognised for these purposes, or under a written contract with the provider that requires it to protect your data to the standard the law requires.
Each of these providers processes personal data under its own data-processing terms, which form part of the service agreement we have accepted with it, including standard contractual safeguards for transfers outside the UAE.
If you want to know more about the safeguards for a specific provider, email Hello@orralislab.com and we will send you the detail.
Cookies, tracking and country detection
We keep this deliberately minimal. Because this site sells in several currencies, two things happen that would not happen on a single-currency site:
- One cookie. If you choose a currency from the selector, we save that choice in a first-party cookie named
og_currency. It stores nothing but a three-letter currency code, lasts 12 months, and exists only so the site does not forget your choice. It is not used to identify or track you. We also keep the same code in your browser’s session storage so the page loads faster on the next view. That cookie is strictly necessary for the preference you asked for, which is why there is no banner asking you to accept it — and it is set only once you use the selector. - Country detection. To show you a sensible currency before you have chosen one, our server checks your country. It first looks for a country code that our hosting or CDN already supplies. If there is none, it sends your IP address to ipapi.co, which returns a two-letter country code. Your IP address is used for that lookup and nothing else — we do not log it and we do not store it. We keep the answer for up to 6 hours against a one-way hash of your IP, so repeat visits do not repeat the lookup. If you would rather this did not happen, use the currency selector; once you have chosen, the cookie takes over and no lookup is made.
Beyond those two, we set nothing on your device: no advertising cookies, no tracking pixels, no session recording, no cross-site identifiers.
Payments happen on Stripe’s own page. When you buy a package you are sent to a Stripe-hosted checkout. Stripe sets its own cookies there, on its own domain, under its own privacy policy — we do not set or read them.
Analytics. We measure how many people visit, using Umami Cloud (Umami Software, EU-hosted), which is cookieless: it stores nothing on your device, collects no personal data, does not follow you across websites and does not build a profile of you. It counts page views, referrers and a few anonymous events — which sections were read, which buttons were used. Because nothing is stored on your device and no personal data is collected, there is nothing to consent to.
Our full Cookie notice repeats this in one page, if that is easier to point a compliance team at.
How long we keep it
| What | How long |
|---|---|
| Payment and invoice records | 5 years, as the UAE commercial record-keeping rules require |
| Client project files and website content | For as long as we host your site, plus 12 months after you leave |
| Enquiries, emails and WhatsApp conversations | 24 months |
| Enquiries that go nowhere | Deleted at the end of the period above |
| Enquiry-form submissions held by Web3Forms | Up to 3 years, unless deleted sooner |
| Server logs | As set by our hosting provider, typically a few weeks |
Currency cookie (og_currency) | 12 months, or until you clear it |
| Currency hint in session storage | Until you close the browser tab |
| Country lookup cache | 6 hours, against a hash of your IP, never the IP itself |
When the period ends we delete the data or make it anonymous.
Your rights
Under the UAE Personal Data Protection Law (Federal Decree-Law 45/2021) you can ask us to:
- tell you what we hold about you, and why,
- give you a copy of it in a usable format,
- correct anything that is wrong,
- delete it, where we do not need it for a contract or a legal obligation,
- stop or limit a particular use of it,
- stop using it for a purpose you object to, including our portfolio,
- withdraw consent where we relied on consent.
Email Hello@orralislab.com and say what you want. We will reply within 30 days. We do not charge for this.
If you are not satisfied with our answer, you can complain to the UAE Data Office.
If you are in the UK or the EU
orralislab.com is offered internationally, including to businesses and people in the United Kingdom and the European Union — the currency selector lists pounds and euros, and the prices are set for those markets. That brings this site within the UK GDPR and the EU GDPR (Art. 3(2)), which apply to a controller outside the UK or EU whose processing relates to offering goods or services to people there — whether or not they pay.
So if you are in the UK or the EU, you also have the GDPR rights: access, rectification, erasure, restriction, portability, objection, and the right not to be subject to automated decision-making (we do not do any). The list above already covers all of these; you exercise them the same way, by emailing Hello@orralislab.com.
We will respond within one month, as the GDPR requires.
On cookies specifically: the only cookie we set is the currency you chose, which is strictly necessary for a preference you asked for and therefore exempt from consent under the ePrivacy rules. If we ever add a cookie that is not, we will ask you first.
You can also complain to your national data protection authority — the ICO in the United Kingdom, or your country’s supervisory authority in the EU.
Keeping your data safe
This site runs over HTTPS, so everything you send is encrypted in transit. Payments go through Stripe, which is PCI-DSS compliant at the highest level. Our payment webhook verifies a cryptographic signature on every message before it acts on it, so a fake payment notification cannot trigger anything.
Access to client data is limited to the people who need it. Our accounts use strong, unique passwords and two-factor authentication.
No system is perfectly secure. If a breach ever affects your personal data, we will tell you and the relevant authority as the law requires — the UAE Data Office, and, if you are in the UK or the EU, within 72 hours as the GDPR requires.
Children
Our services are for businesses. We do not knowingly collect personal data from anyone under 18. If you think a child has sent us personal data, email Hello@orralislab.com and we will delete it.
Changes to this notice
If we change how we handle your data — a new provider, a new tool, analytics — we will update this page and change the date at the top. If the change is significant and affects existing clients, we will email you.
Contact
Questions, requests or complaints about privacy:
Orralis For Design Services, Azizi Candace, Al Awir First, Dubai, UAE.