Compliant with UAE Data Protection Laws
This Privacy Policy explains how The Orange Code ("we," "us," or "our") collects, uses, processes, and protects your personal data in compliance with:
Your privacy and data protection rights are our priority. This policy is transparent, clear, and explains your rights under applicable data protection laws.
We collect information you provide directly to us, such as when you create an account, book services, purchase ebooks, or contact us. We also automatically collect certain information when you visit our website.
When you visit our website, we automatically collect basic information to improve our services and understand how visitors use our site:
Note: This information is used for analytics and service improvement only. We do not attempt to identify individual visitors, and all data is aggregated and anonymized where possible.
Payment Processing: All payment card information is securely processed by Stripe. We do not store or have access to your full payment card details.
Ebook Delivery & Security: For ebook purchases, we use a secure token-based download system. Upon purchase completion, you will receive an email with a time-limited download link (valid for 48 hours). All downloaded ebooks are watermarked with your email address for security and copyright protection. This watermark is embedded in the PDF file and cannot be removed.
We use your information for the following legitimate business purposes:
Under GDPR, we process your personal data based on the following legal grounds:
Your Right to Withdraw Consent: Where we rely on consent, you have the right to withdraw it at any time. This will not affect the lawfulness of processing based on consent before its withdrawal. Contact us at legal@theorangecode.com to withdraw consent.
We do not sell, trade, or rent your personal information. We may share information only in the following circumstances:
We use trusted third-party services to operate our website and provide services. These services may process your personal information on our behalf. All third-party services are GDPR-compliant and bound by strict data processing agreements:
Purpose: Website analytics, user behavior tracking, conversion measurement, and performance monitoring.
Data Collected: IP address (anonymized), page views, clicks, scroll depth, time on page, device type, browser information, referrer, UTM parameters, and custom events.
Data Processing: Google LLC (USA) - Data is processed with appropriate safeguards including Standard Contractual Clauses (SCCs) for EU data transfers.
Purpose: Secure payment processing for masterclass bookings, course purchases, and ebook sales.
Data Collected: Payment card information (encrypted), billing address, email, phone number, transaction details, and fraud prevention data.
Data Processing: Stripe, Inc. (USA) - PCI DSS Level 1 certified, GDPR compliant with Data Processing Agreement (DPA).
Purpose: Sending transactional emails, contact form notifications, booking confirmations, and service communications.
Data Collected: Email address, name, message content, and email engagement metrics (opens, clicks).
Data Processing: Resend, Inc. (USA) - GDPR compliant with appropriate data processing safeguards.
Purpose: Email marketing, newsletter management, subscriber segmentation, and marketing automation.
Data Collected: Email address, name, subscription preferences, email engagement data, and subscriber tags.
Data Processing: MailerLite UAB (Lithuania/EU) - GDPR compliant, EU-based data processing.
Purpose: Website hosting, content delivery network (CDN), serverless functions, and performance monitoring.
Data Collected: IP addresses, request logs, error logs, performance metrics, and visitor analytics.
Data Processing: Vercel, Inc. (USA) - GDPR compliant with DPA, data stored in multiple regions including EU.
Purpose: Data storage for visitor tracking, session management, and application state.
Data Collected: Visitor session data, tracking information, and temporary application data.
Data Processing: Upstash, Inc. (USA) - GDPR compliant with appropriate safeguards.
Purpose: Internal notifications for business operations including contact form submissions, newsletter signups, and payment notifications.
Data Collected: Basic contact information and transaction notifications for internal use only.
Data Processing: Slack Technologies, LLC (USA) - GDPR compliant with Data Processing Agreement (DPA).
All third-party service providers are required to:
We implement comprehensive security measures to protect your personal information:
Under GDPR and UAE Federal Decree-Law No. 45 of 2021, you have the following data protection rights:
Right to Access (Art. 15)
Request copies of your personal data and information about processing
Right to Rectification (Art. 16)
Correct inaccurate or incomplete data without undue delay
Right to Erasure (Art. 17)
Request deletion of your data ("Right to be Forgotten")
Right to Restriction (Art. 18)
Limit processing of your data under certain conditions
Right to Data Portability (Art. 20)
Receive your data in a structured, machine-readable format
Right to Object (Art. 21)
Object to processing based on legitimate interests or direct marketing
Right to Withdraw Consent
Withdraw consent at any time where processing is based on consent
Right to Lodge a Complaint
File a complaint with a supervisory authority (see Section 11)
To exercise any of these rights, please contact our Data Protection Officer at legal@theorangecode.com or call +971 56 878 6106.
We use cookies and similar technologies to enhance your experience. You can control cookie preferences through our cookie banner or browser settings. For detailed information about our use of cookies, please see our Cookie Policy.
Required for basic website functionality and security
Help us understand website usage and performance (Google Analytics)
Remember your preferences and settings
Used for targeted advertising (with consent)
We retain your personal information only as long as necessary for the purposes outlined in this policy:
Duration of service + 3 years for business records
Until consent is withdrawn or 2 years of inactivity
As required by UAE law (typically 7 years)
Retained for analytics purposes as per standard industry practices
Permanently retained for business records and copyright protection
Time-limited for security purposes
Your data is primarily stored and processed within the UAE and EU. When we transfer personal data outside the UAE or EU, we ensure adequate protection through:
Data Transfer Countries: USA (Google, Stripe, Vercel, Resend), Lithuania/EU (MailerLite). All transfers are protected by SCCs and appropriate safeguards.
If you are located in the EU/EEA or UAE, you have the right to lodge a complaint with a supervisory authority:
You may lodge a complaint with your local data protection authority. Find your authority at:
European Data Protection Board - Member ListUAE Data Office
Telecommunications and Digital Government Regulatory Authority (TDRA)
Email: dataoffice@tdra.gov.ae
Website: tdra.gov.ae
For privacy related questions feel free to contact us.
Legal Team
The Orange Code
Email: legal@theorangecode.com
Phone: +971 56 878 6106
Business Address
Etihad Towers
Tower 3, Floor 36
Abu Dhabi, United Arab Emirates
Response Time: Within 30 days
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. When we make material changes, we will:
We encourage you to review this Privacy Policy periodically. Continued use of our services after changes constitutes acceptance of the updated policy, unless your consent is required by law.
Last Updated: August 27, 2026
Effective Date: August 27, 2026
Version: 2.0
This Privacy Policy complies with:
The Orange Code is committed to maintaining the highest standards of data protection and privacy. This policy reflects our commitment to transparency, accountability, and respect for individual privacy rights under international and local laws.