This site belongs to ZAHI and operates in the Sultanate of Oman. This notice explains what is collected from you when you use it, why, where it is kept, and who sees it.
What is collected
What is collected is what you type and attach yourself in the site’s forms, along with a few things the site needs in order to work and to protect its forms, every one of them named on this page. There is no advertising tracking on this site, no marketing cookies, and no attempt to work out who you are before you tell us.
- Contact form: your name, email address, phone number if you give one, the subject and the message itself.
- Project request: the services you selected, your name, email address and phone number, what you write about your project, and the appointment you book with its meeting type. If you choose real-estate development, also your answers to its optional questions: what you are looking for, the budget and the location.
- Files you optionally attach to a request: plans, technical drawings and 3D models, photographs, video clips, and PDF, Word and Excel documents.
And alongside that, automatically:
- When you send any form, the network address (IP) it was sent from is kept, and on some forms so is a code derived from your email address that does not reveal the address itself, so that repeated sending from the same source within a short time can be spotted and stopped at a set limit.
- The language of the page you sent the form from, so that we reply to you in it.
- On the contact page and the project request page: Cloudflare’s Turnstile check, described below.
- On the public pages: Cloudflare’s visit count, described below.
- One cookie that remembers the language of the pages you are reading.
The plans of your home
Files attached to a project request deserve their own paragraph, because they are not ordinary data: the plan of your home shows how it is built and where its entrances are. These files are treated as confidential. They are not published, not shown in our work, not handed to anyone to make use of, and not used in any marketing material without your written permission.
These files are kept with Cloudflare R2, in a private store closed to the public and set to Western Europe, and ZAHI’s team opens them from the site’s admin through a temporary link. A file goes from your browser straight to that store without passing through the site’s servers; the site then checks it automatically before accepting it, and keeps nothing from that check but its result. We say so plainly because “not shared” has to mean what it says: nobody outside the ZAHI team opens these files.
Why it is collected
What you type and attach: to reply to you, to study what you are asking for, and to arrange the meeting. The network address and the Turnstile check: to protect the forms from automated and repeated sending. The visit count: to know which pages are read and how long they take to appear. We use none of it for anything else. We do not sell it, rent it, or build an advertising profile of you from it.
Who sees it
Only the ZAHI team reads what you send. The services named in the next section run the site, keep its data and send its emails on ZAHI’s behalf, and your data is not given to anyone for marketing purposes.
The services that run the site for ZAHI
- DigitalOcean: runs the site and keeps its database in Frankfurt, Germany, where everything you send through the forms is held.
- Cloudflare: manages the site’s domain (DNS), keeps the files you attach in Cloudflare R2, and runs the Turnstile check and the visit count.
- Resend: sends the emails. You receive your appointment’s confirmation and, if it is cancelled, word of that; ZAHI receives a copy of your request or message, and a notice if you cancel your appointment. The emails are sent from Ireland, and Resend keeps a record of them in the United States for 30 days. Your files are never attached to any email.
- Google Workspace: ZAHI’s mailbox, where those emails arrive.
Your data is therefore kept and processed outside the Sultanate of Oman: in Germany and Western Europe, with the email record in the United States, while Cloudflare’s and Google’s services run across their global networks.
The Turnstile check
On the contact page and the project request page, Cloudflare’s Turnstile check runs to tell a person from an automated program, and most of the time you will not see it. If it needs you to confirm, a small box appears above the send button. To work, Cloudflare receives the network address (IP) and the information your browser normally sends about its type and its secure connection. It uses them to protect the forms, and also to improve its ability to detect automated programs, as its Turnstile privacy addendum states.
Counting visits
On the public pages, Cloudflare’s visit count (Cloudflare Web Analytics) runs. It counts the pages that are opened and measures how quickly they appear, recording the page’s address without anything after the question mark, the site you came from, your country, and your type of browser, device and operating system. Cloudflare states that this count uses no cookies and stores nothing in your browser, does not identify individuals by their network address or browser, and does not collect visitors’ personal data. It does not run in ZAHI’s admin, or on pages opened from a private link, such as the link to cancel an appointment.
Tracking and cookies
This site uses no advertising or marketing cookies. It sets one cookie that remembers the language of the pages you are reading, and it is used for nothing else. The project request form keeps your answers in your own browser until you send the request or close the page, so that they are not lost if you switch language, and none of them reaches us before you send.
The fonts, images and video clips come from ZAHI’s own domain. Beyond the site itself, your browser connects to outside services in three cases only, all of them Cloudflare’s: the visit count when you open the public pages, the Turnstile check when you open the contact page or the project request page, and the upload of a file straight to Cloudflare R2 when you attach it yourself to a project request.
How long it is kept
It is kept for as long as it takes to follow up on your request and to refer back to it while we work together. You may ask at any time for your data and your uploaded files to be deleted, and that will be done unless a contractual or legal obligation prevents it.
A file that does not pass the check is deleted at once, and a file that is uploaded but never sent with a request is deleted automatically, usually within a day or two. Resend keeps its record of the emails for 30 days, as stated above.
Jurisdiction
ZAHI is an Omani company and this site’s audience is in Oman, so this notice is governed by the regulations in force in the Sultanate of Oman.
Contacting us about your data
To ask about your data or request its deletion, contact us through the contact page.
See also the other page, or contact us with any question.