Privacy Policy

Last updated: 15 October 2026

Degalo Digital FZ-LLC, trading as Degalo Digital. Business number: 0000004096888.

Registered business address: Unit CWEP1134, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates. Email: [email protected].

1. Who is responsible for your information

This policy explains how we handle personal information through degalodigital.com, enquiries, marketing, client services and Degalo Creative Packs. We act as controller when we decide why and how information is used for our own business, such as prospecting, contracts, billing and security.

When we process a client's leads, customer records or campaign information solely on the client's documented instructions, the client is normally the controller and we act as processor or service provider. The client's privacy notice also applies. A suitable data processing agreement must cover that work; this policy does not replace it. Advertising and communication platforms may have their own independent responsibilities.

2. Information we collect and where it comes from

Contact and business information: names, job roles, company details, business addresses, telephone numbers, email addresses, enquiries and preferences.

Service and account information: proposals, orders, invoices, payment status, support correspondence, authorised account identifiers and access permissions. Payment providers may separately process payment credentials.

Creative and campaign information: supplied logos, photographs, video, audio, briefs, people appearing in media, advertising copy, lead forms, campaign audiences, results and client feedback relevant to the service.

Workflow information: message identifiers, pack links, assignments, timestamps, deadlines, approval and revision records, delivery and troubleshooting records.

Technical and preference information: IP address, browser and device information, website interactions, security events and cookie or similar identifiers where those technologies are used.

Marketing records: the source of a contact, consent wording and choices, date and method of collection, objections, unsubscribe requests and limited suppression records.

We receive information directly from you; from clients, authorised team members and people making referrals; from connected services you authorise; and, for some business prospecting, from purchased contact lists. A purchased entry is not treated as evidence of marketing consent. Ask us which supplier supplied your contact details and what information we hold about you. If information is obtained indirectly, we provide the required privacy information within the applicable time limit, including at first contact where required.

Please do not send unnecessary identity documents, payment credentials, health information or other sensitive information through ordinary forms or creative packs. If a project needs sensitive information or children's images, its purpose, permissions and safeguards must be agreed first.

3. Why we use information

We use relevant information to answer enquiries; prepare and deliver agreed websites, advertising, creative content and automation; organise client assets; administer accounts and billing; support and secure our services; measure campaign results; resolve complaints; meet legal duties; and conduct marketing where permitted.

Where the EU or UK GDPR applies, the applicable basis depends on the purpose:

Contract or steps you request before a contract: where you personally are the contracting party, to provide the requested service.

Legitimate interests: proportionate business administration, communications with corporate client contacts, fraud prevention, security, service improvement and business prospecting where lawful. We assess necessity, reasonable expectations and effects on individuals. This basis does not override rules that require marketing or tracking consent.

Consent: where required for particular marketing channels, optional tracking or another optional use. Consent can be withdrawn without affecting earlier lawful processing.

Legal obligations: applicable accounting, tax, regulatory and legally required disclosures.

Required information is identified in the relevant form or agreement. Without information needed for a requested service, we may be unable to provide it. Optional marketing consent is not a condition of buying our services.

4. Business outreach and your right to object

We may contact businesses whose activities appear relevant to our services, including contacts obtained from purchased business lists, only where the particular channel, recipient and location permit that contact. A public number, purchased list entry, relevance to our services, or this policy does not itself provide consent.

For an unsolicited business SMS that is legally permitted, our outreach policy is a maximum of one initial promotional SMS per business, unless the recipient subsequently requests a conversation or separately opts into further messages. This limit applies across our campaign lists and sending numbers. It is an additional frequency limit and does not authorise a message that otherwise requires consent.

Where consent is required, we obtain valid consent before sending. Where a specific business-to-business or existing-customer exception is available, it must actually apply; we do not assume that every business number belongs to a company. Sole traders and personal or mixed-use mobiles may have individual protections. We identify the sender and provide an accessible way to object. A reply or ordinary enquiry is not automatically consent to an ongoing marketing programme.

You can object at any time to our use of your personal information for direct marketing, including related profiling. Use the unsubscribe instructions in the message, reply STOP to a reply-capable marketing SMS, or contact [email protected]. Tell us if you want all marketing channels stopped. We honour objections and retain only the minimum suppression information needed to avoid contacting you again. We do not require a login, purchase or explanation to unsubscribe. Service communications are kept separate from promotions.

5. Degalo Creative Packs and Google user data

With the Google account owner's permission, Creative Packs uses Google Drive to read and organise client pack files and folders, upload supplied media, create creative briefs, and manage explicitly authorised folder sharing. This can include file contents, names, identifiers, links, sharing details and the connected account's email address.

Google Drive stores the assets. Make processes authorised Drive actions and stores workflow records. WhatsApp and HighLevel handle incoming media and instructions. Telegram receives relevant pack links, assignments and completion updates for the account owner and authorised collaborators. Client assets remain subject to their Drive sharing permissions. A link sent to a collaborator does not itself make a restricted Drive folder public.

People may view Google user data only with the user's affirmative permission for the specific files or information needed for the authorised work, where necessary for security or investigating a bug or abuse, or where necessary to comply with law. We do not sell Google user data, use it for advertising profiles, or use it to train general-purpose AI models. Degalo Creative Packs' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

The account owner can revoke future access through their Google Account's third-party connections. Revocation does not automatically delete files already in Drive, workflow records or copies of messages already delivered. Contact us for a deletion or access request and to coordinate removal from systems under our control.

6. Who receives information

We disclose information as necessary for the agreed purpose to authorised employees and contractors; clients and their authorised recipients; hosting, CRM, messaging, automation, advertising, analytics and payment providers used for the relevant service; professional advisers; and public authorities where legally required. Relevant providers can include Google, Make, HighLevel, Telegram and Meta services such as WhatsApp and advertising platforms. We do not give every provider every category of information.

Providers acting for us must have appropriate instructions and confidentiality and data-protection obligations. Client media is shared only as needed for the authorised work. We seek separate authorisation before public portfolio use where it is not already specifically agreed. If a business sale or restructuring affects personal information, we apply the legal safeguards and notice requirements relevant to that transfer.

We do not sell mobile subscriber information or SMS opt-in records, or share them with third parties or affiliates for their own marketing. Necessary messaging providers may process those details to deliver and administer the programme under appropriate restrictions. This does not prevent us from delivering client leads to the client clearly identified when a person submits a lead form.

7. Advertising, audiences and cookies

Where commissioned and lawfully configured, advertising services can involve lead forms, audience selection, performance measurement, conversion events, retargeting and customer-list audiences. Such processing must reflect the relevant client's privacy notice, platform requirements, lawful basis and any required consent. Google user data obtained by Creative Packs is not used for advertising audiences or profiling.

Websites may use essential technologies for delivery and security and optional technologies for analytics, advertising or embedded content. Where consent is legally required, optional technologies must remain off until you choose to enable them, and withdrawing consent must be as easy as giving it. Browser controls can remove or block stored cookies, although some features may then stop working. A privacy-policy link or continued browsing alone is not consent.

You can contact us about tracking and advertising choices. Where a US privacy law applies and a use of advertising technology constitutes a sale, sharing for cross-context behavioural advertising or targeted advertising, the applicable opt-out rights and recognised preference signals must be honoured. This policy does not substitute for the technical controls a website needs.

8. International processing

Our business is based in the United Arab Emirates. Authorised creative work may be carried out in Uzbekistan. Service providers may process information in the EEA, the United Kingdom, the United States and other countries identified in their relevant processing terms. Privacy protections differ between countries.

Where a transfer is restricted by applicable law, an appropriate transfer mechanism and any required assessment or supplementary safeguards must be in place before the transfer. Depending on the transfer, this can include an applicable adequacy decision, approved contractual clauses or another lawful mechanism. Contact us for information about the destination and safeguards relevant to your information, including a copy where legally available. Merely using our services does not waive transfer protections.

9. Retention and security

We keep information for the period reasonably needed for its purpose, considering the active project or account, client instructions, support needs, consent and complaint evidence, required financial records, legal claims and applicable retention duties. We delete or anonymise information when it is no longer needed, subject to lawful exceptions and normal backup cycles. Suppression records may be kept longer so an unsubscribe is not undone by a later list import. Ask us about the retention criteria or period for a particular record.

We use risk-appropriate organisational and technical safeguards and restrict access to authorised people. No internet transmission or storage system can be guaranteed completely secure. Where an incident requires regulatory or individual notification, we follow the applicable legal requirements.

10. Your rights and complaints

Depending on the law that applies, you may have rights to access or obtain a copy, correct or delete information, restrict processing, object, receive portable information, withdraw consent, and complain to a regulator. Some US laws also provide rights concerning sale, sharing, targeted advertising and certain profiling, an appeal route, and protection against unlawful discrimination for exercising rights. These rights depend on the law's scope and lawful exceptions.

Send requests or a data-protection complaint to [email protected], or write to our registered address. We ask for proportionate verification when needed, not unnecessary sensitive documents. Authorised agents may act where the law permits. EU and UK rights requests are normally answered within one month, with a lawful extension and explanation where permitted. Other applicable legal deadlines also apply.

We acknowledge UK data-protection complaints within 30 days, investigate appropriately and communicate the outcome. For an Australian privacy complaint, we aim to respond within 30 days. You can also complain to the Irish Data Protection Commission, the UK Information Commissioner's Office, the Australian Information Commissioner, or your competent local authority, as applicable. An internal complaint is not a waiver of regulatory or court rights.

11. Children, automation and changes

Our business services are not directed to children. Clients must have appropriate authority and permissions for media featuring children and must avoid unnecessary personal information in creative packs. Contact us if a child's information has been supplied without appropriate authority.

Creative Packs automates routing, deadlines, reminders and reports. A recorded completion is an administrative record; it does not itself authorise a payment. The owner decides approvals and payment. Any separate use of AI, recording or automated decision-making that requires additional information or consent must have that notice or consent before use.

We update this policy when our activities or legal requirements change. Material new purposes receive any additional notice or consent required by law. Publishing an update does not retrospectively create consent.