Privacy Policy

This Privacy Policy explains how personal data is handled when you visit ornyx.ae or contact Ornyx. The website is operated by:

Ornyx is responsible for the personal data described in this policy. Applicable data protection law, including the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data where it applies, may give you rights in relation to that data.

When you send an enquiry through a configured contact endpoint, we may receive:

• Your name and work email address.
• Your company or organisation name, if you choose to provide it.
• The message and any other information you include in the enquiry.

Where a deployment configures the same-origin /api/contact endpoint, nginx passes the enquiry to the Ornyx contact service for Turnstile verification, validation and delivery through email infrastructure. If a deployment has no contact endpoint configured, the form deliberately makes no submission and tells you that the message was not sent. This includes local and Pages preview deployments; you can email us directly instead.

Our hosting and security providers may also process technical connection data such as your IP address, requested URL, browser or device information, timestamps and security events. This data is used to deliver and protect the website.

Please do not include sensitive personal information, passwords or confidential third-party material in the website contact form.

We use the information described above to:

• Read, respond to and follow up on your enquiries.
• Discuss potential products, services, partnerships and business relationships.
• Operate, secure and troubleshoot the website and prevent automated abuse.
• Meet applicable legal, accounting and record-keeping obligations.

Depending on the context and applicable law, our basis for processing may be your request, your consent, our legitimate interests in responding and operating a secure website, or a legal obligation. Where processing relies on consent, you may withdraw it for future processing by contacting us.

The contact form uses Cloudflare Turnstile to help distinguish genuine visitors from automated abuse. When the form loads, Cloudflare may process your IP address, browser and device characteristics, request headers and interactions with the verification widget. The token produced by the widget is sent with a configured form submission so that it can be checked by the contact service.

This processing is used for website security, not for Ornyx advertising or customer profiling. Cloudflare handles data under its own privacy terms as an independent service provider. Turnstile does not remove the need to protect information that you choose to place in your message.

Ornyx includes a privacy-friendly analytics integration using a self-hosted Plausible Community Edition service rather than Plausible Cloud. Where analytics is enabled, the Plausible v2 tracker measures page views and homepage section navigation. A successful contact-form submission may also be counted as a Contact Form Submit event. The tracker is configured without cookies or local or session storage, and analytics events remain on the self-hosted service.

The integration supports direct delivery from the self-hosted service or same-origin delivery through /js/script.js and /api/event. The production nginx image includes the proxy plumbing; measurement occurs only when the build enables a tracker URL and the corresponding Ornyx site script is configured. Preview deployments do not enable Plausible, so their pages do not load the tracker. See our Cookies & Analytics notice for more detail.

We do not sell your personal data or share it with third parties for their marketing.

Information may be processed by providers that help us host and secure the website, verify form submissions, deliver email and store business communications. We share information only as needed for those functions, for legal or safety reasons, or with your direction. These providers may process information in countries other than your own; where required, we use safeguards appropriate to the transfer and applicable law.

We keep enquiries and related correspondence only for as long as reasonably needed to respond, manage a business relationship, maintain appropriate records, resolve disputes and meet legal obligations. Retention periods vary with the nature and outcome of the enquiry. Information is deleted or anonymised when it is no longer needed for those purposes, unless a longer retention period is required by law.

We use reasonable technical and organisational measures, including encrypted transport and access controls, to protect information against unauthorised access, loss and disclosure. No website, email system or internet transmission can be guaranteed to be completely secure.

Subject to the law that applies to you and any applicable exceptions, you may ask to access, correct, delete or receive a copy of your personal data, restrict or object to its processing, or withdraw consent. You may also have the right to complain to a data protection authority.

To make a request, email [email protected]. We may need to verify your identity and will respond within the period required by applicable law. You can also control cookies through your browser settings, although blocking essential security mechanisms may affect the contact form.

We may update this policy when the website, our providers or our data practices change. The date at the top identifies the latest revision. Material changes will be reflected on this page.

Questions and privacy requests can be sent to: