Privacy Policy

Who we are

This website is operated by Namu Space Marketing Management - FZCO, a free zone company licensed by the Dubai Integrated Economic Zones Authority under trade licence no. 88374, at IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates. We are the data controller for the personal information described in this policy.

Which laws this policy follows

There is no single global privacy law — what applies depends on where the people we collect data from are located, not only on where we're based. Because we market to audiences in the EU (our site is available in French, Spanish, and German), the EU's General Data Protection Regulation (GDPR) applies to us regardless of where our company is registered, and this policy is written to meet its standard. As a company registered in Dubai, we also follow the UAE's Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Because the site is also offered in Portuguese for audiences in Brazil, we also follow Brazil's General Personal Data Protection Law (LGPD, Law No. 13,709/2018). Where these and other regimes differ, we apply whichever gives you stronger protection.

Scope of this policy

namuspace.com is a company information website. It does not sell products online, process payments, or collect any financial information — every order is arranged directly with our team through the contact form or messaging channels listed on this site. Because we don't operate an online store, we don't publish a separate Terms of Service; this Privacy Policy covers everything we collect.

Information we collect

When you submit an inquiry through our contact form, we collect:

• Name (required)
• WhatsApp number (required)
• Country (required)
• Your message (required)
• Company name (optional)
• Email address (optional)
• Brand you're interested in (optional)

How we use your information

We use the information you submit only to respond to your inquiry — for example, to send pricing, product details, minimum order quantities, and delivery information, or to follow up by WhatsApp or email. We do not use your contact form submission for unrelated marketing without your separate consent, and we do not use it for automated decision-making or profiling.

Legal basis for processing

Under the GDPR, we rely on Article 6(1)(b) — processing necessary to take steps at your request before entering into a contract. When you ask us for pricing or product details, handling your inquiry is exactly that step. Separately, we rely on Article 6(1)(f), our legitimate interest in keeping this site secure, for the anti-spam and technical measures described under "Technical data and security" below. If we ever want to send you marketing that isn't a reply to your own inquiry, we will ask for your consent first and rely on that consent instead. Analytics cookies, if you accept them, rely on your consent under Article 6(1)(a).

How we store and share your information

Form submissions are sent to a Google Apps Script web app and stored in a Google Sheet on our Google Workspace account, and a notification email is sent to our own inbox so we can respond promptly (internal handling only, not automated marketing). Google acts as our processor for this data under its data processing terms. The site itself is hosted by Vercel Inc., which also acts as our processor. To prepare a quotation or fulfil an order you ask for, we may pass the relevant details (such as your name, company, country and the delivery details you give us) to the manufacturer or supply partner of those products, who may be located outside the UAE and the EEA, including in South Korea; they may use it only for that purpose. If you contact us over WhatsApp instead, that conversation is carried over WhatsApp's infrastructure (operated by Meta) and is subject to its privacy terms as well as ours. Apart from these recipients, we do not share your information with anyone, and we never sell or rent it.

Cookies

We use one essential cookie: NEXT_LOCALE, a first-party cookie that stores which language version of the site you should see, for up to one year. It is set either when you pick a language yourself, or automatically on your first visit based on the country your connection appears to come from (see below). It is strictly functional — it holds only a language code, and does not track you across sites — so under GDPR / ePrivacy rules it does not require a cookie consent banner. Analytics cookies are optional. If you accept them in the banner, we use Google Analytics 4, which sets the cookies _ga and _ga_<ID> (up to two years) to count visits and understand how the site is used; Google processes this data on our behalf. Nothing from Google loads, and no analytics cookie is set, unless you accept. Your choice is stored in your browser (key ns_consent) and you can change it at any time through "Cookie settings" in the footer. We do not use advertising cookies.

Technical data and security

Some technical processing happens on every visit, even if you never submit the contact form:

• Language routing: on your first visit, we read a country code that our hosting platform derives from your IP address, so we can send you to the right language version of the site. We use only the country code, we do not store your IP address for this, and we do not build a profile from it.
• Spam and abuse protection: when a contact form is submitted, our server briefly holds the sending IP address in memory to limit how many submissions can come from one source in a short period. It is not written to a database and is discarded automatically.
• Hosting logs: like virtually every website, our hosting provider automatically records basic request information — such as IP address, browser type, and timestamps — for security and reliability. These are standard infrastructure records that we do not use for marketing, analytics, or profiling.
• Country-based access restriction: access to the site is not available from some countries. This check uses the same country code derived from your IP address and is not stored.

Data retention

We keep inquiry data for up to 24 months after our last communication with you, so we can follow up on your request and keep ordinary business records, and then delete or anonymise it. You can ask us to delete it sooner. We may keep specific records longer where the law requires it (for example, for tax or accounting purposes).

Your rights

If you are located in the European Economic Area, Brazil or another jurisdiction with similar protections, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Restrict how we process your data
• Object to processing we carry out on the basis of our legitimate interests
• Request a copy of your data in a portable format
• Withdraw your consent, where we asked for consent and you gave it — for example for marketing messages (this does not affect anything processed before you withdrew it)
• Lodge a complaint with your local data protection authority (in the UAE, the UAE Data Office; in Brazil, the ANPD)

International data transfers

We are based in Dubai, United Arab Emirates, which is not covered by an EU adequacy decision. If you write to us from the European Economic Area, you are sending your details directly to us here — and because we target the EU market, we remain subject to the GDPR for that data wherever we sit. Our service providers, Google and Vercel, process data on their own international infrastructure under their own transfer safeguards, and any manufacturer or supply partner we pass your inquiry to (see above) receives it only so that you can be answered. We keep this chain as short as we can. If you would prefer not to send your details through the form, contact us by WhatsApp or email and share only what you are comfortable sharing.

Children's privacy

This website is intended for business use by clinics, distributors, and aesthetic professionals. It is not directed at children, and we do not knowingly collect personal information from anyone under 18.

Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page always reflects the most recent version. If we make a material change to how we use your data, we will say so clearly on this page.

Contact us

For any privacy-related questions, or to request access to, correction of, or deletion of your data, use the contact form on this website. We will reply within 30 days, and may first ask you to confirm your identity so that we do not disclose data to the wrong person. You can also reach us directly at admin@namuspace.com.