Privacy policy

1. Who we are

Rubikal ("Rubikal", "we", "us") is a software development and team augmentation studio with studios in Dubai, United Arab Emirates, and Alexandria, Egypt. Rubikal is the controller of the personal data described in this policy, which means we decide why and how it is processed.

• Dubai: Palm Strip Mall, 40 Jumeirah Street, Dubai, United Arab Emirates
• Alexandria: 696 El Horreya Road, Alexandria, Egypt

You can reach us about anything in this policy at sales@rubikal.com.

2. What this policy covers

This policy applies to rubikal.com, in English and Arabic, and to the ways you contact us through it: the enquiry forms, the project planner, call bookings, WhatsApp and email. It does not cover the products we build for clients, which are governed by the agreements we sign with them, or the third-party sites we link to.

We wrote it to meet the standards of the EU and UK General Data Protection Regulation (GDPR), the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the Egyptian Personal Data Protection Law (Law No. 151 of 2020) and the Saudi Personal Data Protection Law (PDPL). Where a local law gives you more protection than this policy describes, the law applies.

3. The data we collect

We collect only what you give us, plus a small amount of technical data needed to run the site.

Enquiry forms

When you use the contact form on this site, including the one on our Saudi Arabia page, we receive the name, email address, company and message you enter, and the service you say you are interested in. The form is relayed to our inbox by Web3Forms, a form-delivery service, and includes a hidden anti-spam field that stays empty for real visitors.

Project planner

The planner on our homepage asks three questions about your product and shows a suggested plan. Your answers are processed in your browser and are not sent to us unless you choose one of the follow-up routes. If you ask us to email you the plan, we receive your name and email address together with your three answers and the plan's name. If you open WhatsApp or book a call from the planner, the plan name travels with that message or booking link.

Booking a call

Call bookings are handled by Cal.com. When you pick a slot you give Cal.com your name, email address and any notes, under Cal.com's own privacy policy, and Cal.com passes the booking details to us. The booking link also carries a tag telling us which part of the site you booked from.

WhatsApp

The WhatsApp buttons open a chat with our Dubai number, sometimes with a prefilled message. Anything you send there is processed by WhatsApp (Meta) under its own terms and reaches our team the same way any WhatsApp message would.

Job applications

If you apply for a role by emailing careers@rubikal.com, we receive whatever you include: typically your name, contact details, CV, portfolio links and the role you are applying for.

Analytics

With your consent, we use Google Analytics 4 through Google Tag Manager to understand how the site is used: pages viewed, buttons clicked, forms submitted and where visitors come from. Analytics cookies are set only after you accept them in the cookie banner. Until then, Google Consent Mode keeps analytics and advertising storage switched off. Google Analytics 4 does not store IP addresses.

Technical data

Our hosting provider, Cloudflare, processes the IP address, browser type, requested page and time of each request in order to deliver the site and protect it against abuse. On the root address only, the country code Cloudflare derives from your connection decides whether you land on the English or the Arabic homepage. We do not store this country code.

4. How we use your data, and on what basis

• Answering your enquiry and preparing a proposal. Steps you ask us to take before entering a contract, and our legitimate interest in responding to business enquiries.
• Sending the planner output you request. Your explicit request, which is a step before any contract.
• Scheduling and holding calls. Pre-contract steps, and our legitimate interest in talking to prospective clients.
• Considering your job application. Steps before an employment contract, our legitimate interest in recruiting, and your consent where local law requires it.
• Measuring and improving the site. Your consent, given through the cookie banner and withdrawable at any time.
• Keeping the site secure and available. Our legitimate interest in protecting our services.
• Meeting legal obligations, such as accounting and tax records for client contracts. A legal obligation.

We do not sell personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.

5. Cookies and similar technologies

The site uses very little storage on your device. This is all of it:

The consent and language entries are strictly necessary and hold only your own choices, so they run without a banner. You can change your analytics decision at any time with the Cookie settings button, here or in the footer of every page.

Cookie settings

6. Who we share data with

We share personal data only with the service providers that help us run the site and respond to you:

• Web3Forms: relays form submissions to our inbox.
• Cal.com: call scheduling.
• Google: Tag Manager and Analytics 4, after consent.
• Cloudflare: hosting, content delivery and security.
• Meta (WhatsApp): messaging, when you choose it.
• Our email and workplace tools, where your enquiries land.

Each provider processes data for the purpose described here under its own security and contractual commitments. We may also disclose data when the law requires it, to protect our rights, or as part of a merger or acquisition, with notice to you where the law requires.

7. International transfers

Our team works from the United Arab Emirates and Egypt, so your data may be stored or accessed there. The providers listed above may process data in the European Union, the United States or other countries. Where data leaves a jurisdiction that restricts transfers, we rely on the safeguards that law provides, such as standard contractual clauses or the provider's certifications.

8. How long we keep data

• Enquiries and planner requests: up to 24 months after our last exchange, unless we go on to work together, in which case they become part of the client record and are kept for the life of the engagement plus any statutory retention period.
• Job applications: up to 12 months after the role closes, so we can contact you about similar roles, unless you ask us to delete them sooner.
• Analytics data: up to 14 months in Google Analytics, then only in aggregate.
• Server logs: kept by Cloudflare for a short period under its own retention policy.

9. Security

The site is served over encrypted HTTPS connections and hosted on Cloudflare's network. Access to the inboxes and tools where your data lands is limited to the team members who need it. No transmission over the internet is completely secure. If we learn of a breach that affects your data, we will notify you and the relevant authority as the law requires.

10. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct data that is inaccurate or incomplete;
• have your data deleted, unless we have a legal reason to keep it;
• restrict or object to processing, including processing based on legitimate interest;
• receive the data you gave us in a structured, commonly used format;
• withdraw consent at any time: for analytics cookies through Cookie settings, and for anything else by email.

To exercise any of these rights, email sales@rubikal.com. We respond within 30 days and may ask you to confirm your identity before acting. You also have the right to complain to the data protection authority where you live, such as the UAE Data Office, Egypt's Personal Data Protection Centre, the Saudi Data and AI Authority (SDAIA), or your supervisory authority in the EU or UK.

11. Children

This site is aimed at businesses. It is not directed at anyone under 18 and we do not knowingly collect data about children. If you believe a child has given us personal data, contact us and we will delete it.

12. Third-party links

The site links to LinkedIn, X, Facebook, Instagram, YouTube, Clutch and Google Maps. Each has its own privacy policy, and we are not responsible for their practices.

13. Changes to this policy

We will update this page whenever our practices or the law change, and update the date at the top. If a change is material, we will highlight it here for a reasonable period.

14. Contact