Privacy PolicyPrivacy Policy

1. Who we are and how to contact us

This Privacy Policy explains how Selecta Agency, a brand of Elite Consulting FZC-LLC, a company licensed in the Sharjah Publishing City Free Zone, United Arab Emirates (trade licence no. 4306207.01, TRN 104062296900003), with registered office at Sharjah Publishing City, Sharjah, United Arab Emirates (“Selecta”, “we”, “us”), collects and uses personal data. We are the controller of the personal data described in this policy.

For any question about your personal data, or to exercise your rights, write to ….

2. Scope

This policy applies to the website selectaagency.com, to the client area, to our communications by email, WhatsApp and social media, to our advertising and to the Services we provide. It concerns visitors, prospects, clients and the people who appear in the content we produce.

We process personal data in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, for people in the European Union and the United Kingdom, with the General Data Protection Regulation (GDPR). Our use of cookies and similar technologies is explained in detail in our Cookie Policy.

3. Data we collect

Data you give us: name, email address, phone or WhatsApp number, the content of your messages and requests, social media handles, company name, tax registration number (TRN), billing address, and the information, briefs, photos, videos and other materials you send us for the Services.

Client area: email address, name and login data managed by our authentication provider, and the documents, payments and deliveries linked to your account.

Payments: amount, currency, Service purchased, payment status, billing details and, from the payment processor, partial card information such as the brand and the last four digits. At the moment of payment we also record your IP address, browser and device information and the date and time, to prevent fraud and to defend chargebacks.

Technical data: IP address, browser type, device, operating system, pages visited, referring page, date and time of access and error logs, collected by our hosting provider to run and protect the website.

Advertising data: identifiers set by the Meta, TikTok and Reddit pixels, the advertising click identifiers contained in the links you followed, the actions you take on the website (such as page views, contact requests and payments), your IP address and browser information. For European visitors, only with consent (see the section on advertising pixels).

Analytics data: through Google Analytics, loaded with Google Tag Manager, we collect the pages you view, the time spent on them, your approximate location, device and browser, and the identifiers stored in the _ga cookies. For European visitors, only with consent. Google Analytics 4 does not log or store IP addresses.

Campaign data: the UTM parameters of the link that brought you to the website (for example source, medium and campaign name), the landing page and the date, kept in your browser for 30 days.

Click data: when you press a WhatsApp button or any other link or button of the website, we record the page and the element, the language, your IP address, the approximate location derived from it (country, region, city and network, through IPinfo), and your browser, device, screen size and browser languages. For European visitors, clicks other than on WhatsApp buttons are recorded only with consent.

Content data: the image, voice and likeness of the people who appear in the photos and videos we produce, and the information about their social media accounts needed for the Services.

4. How we use your data and on what legal basis

To answer your requests and prepare proposals sent through the contact form, WhatsApp, email or social media: steps taken at your request before a contract, and our legitimate interest in answering.

To provide the Services, manage the client area, deliver files, plan shoots and manage social accounts: performance of the contract.

To process payments, issue invoices and keep accounting and tax records, including for UAE VAT: performance of the contract and compliance with legal obligations.

To prevent fraud, protect payments and defend ourselves against chargebacks, disputes and legal claims, including by keeping the IP address and technical data of each payment: our legitimate interest and compliance with legal obligations.

To measure our advertising on Meta (Facebook and Instagram), TikTok and Reddit, to show our ads to people who visited the website and to build similar audiences, through pixels in the browser and server-side Conversions APIs: for European visitors, your consent, which you can withdraw at any time; for other visitors, our legitimate interest in promoting our Services, to which you can object at any time.

To measure how the website is used and to improve it, through Google Analytics: for European visitors, your consent; for other visitors, our legitimate interest in improving the website, to which you can object at any time.

To understand which campaigns bring us contacts, through UTM parameters: our legitimate interest in measuring our marketing with campaign data that does not identify you.

To know which pages and buttons bring us contacts and how the website is used, by recording clicks: our legitimate interest in measuring the contacts we receive and the use of the website; for the clicks of European visitors other than on WhatsApp buttons, your consent.

To keep the website secure and working, prevent abuse and fix errors: our legitimate interest.

To show the work we produced in our portfolio and on our social channels: the contract and, where required, your consent, as set out in our Terms and Conditions.

To send you news and offers about our Services: your consent or, for existing clients, our legitimate interest in promoting similar Services. You can unsubscribe at any time.

5. Advertising pixels and Conversions API

Visitors in the European Economic Area, the United Kingdom and Switzerland (“European visitors”) see a cookie banner: the Meta Pixel, the TikTok Pixel, the Reddit Pixel and Google Tag Manager are loaded only if they accept. For visitors in other countries these tools are active from the first visit, and they can refuse them at any time with the cookie settings link at the bottom of every page. We identify the country from the network address of the request; when it is unknown, we ask for consent. The pixels record the pages viewed and actions such as contact requests and payments, and allow the platforms to link those events to your account on their services, to measure and optimise our advertising.

The same events may also be sent from our server to the Meta Conversions API, the TikTok Events API and the Reddit Conversions API, under the same rules as the pixels. Server-side events make measurement more reliable when browsers block scripts. They carry an event identifier so that each event is counted only once, and they may include your IP address, browser information, advertising cookies and click identifiers. If you gave us your email address or phone number, we transform them with a one-way hash (SHA-256) before sending them, so that the platform can only match them with data it already holds.

If you refuse or withdraw consent, no pixel or tag is loaded and no advertising event is sent from our server.

For the collection and transmission of data through the Meta Pixel and the Conversions API, we and Meta Platforms Ireland Limited are joint controllers; Meta is responsible for its subsequent processing under its own privacy policy. TikTok and Reddit process the data they receive as independent controllers under their own privacy policies.

6. Payment processors

Payments are processed by Stripe and Whop. When you pay, you enter your card or payment details directly on their secure pages: we never see or store your full card number. Stripe and Whop process payment data under their own terms and privacy policies, including to prevent fraud and to comply with financial regulations, and they send us the confirmation of the payment.

In case of a chargeback or payment dispute, we share with the payment processor the evidence needed to contest it, such as the order details, your acceptance of our Terms, our communications, delivery records and the IP address recorded at the time of payment.

7. Who receives your data

We share personal data only with those who need it to provide the Services or to comply with legal obligations, and only to the extent necessary:

• hosting and infrastructure: Netlify (website hosting) and Google Firebase (database and file storage);

• location of IP addresses: IPinfo;

• client area login: Clerk (authentication);

• email: Brevo (sending of service and transactional emails);

• invoicing and accounting: Zoho Books, and our accountants and tax advisers;

• file delivery and communication: Google Drive and WhatsApp;

• payments: Stripe and Whop;

• advertising, with your consent: Meta, TikTok and Reddit;

• analytics, with your consent: Google (Google Analytics);

• collaborators who work on your Services, such as photographers, assistants, editors and developers, bound by confidentiality;

• companies of the Elite Consulting group, for administrative purposes;

• lawyers, debt collection agencies, courts and authorities, when needed to defend our rights or when required by law.

We do not sell your personal data.

8. International transfers

We are based in the United Arab Emirates and some of our providers process data in other countries, including the European Union and the United States. Where data protection law requires it, transfers rely on adequacy decisions, the EU Standard Contractual Clauses, the EU-US Data Privacy Framework or other safeguards provided by law.

9. How long we keep your data

We keep personal data only for as long as needed for the purposes described above:

• contact requests that do not lead to a contract: 24 months from the last contact;

• client, contract, invoicing and accounting data: for the duration of the relationship and then for the period required by tax and accounting law, currently up to 7 years;

• IP address and technical data recorded at payment: 24 months from the payment, or longer while a dispute or legal claim is open, until it is closed;

• click records: 24 months;

• client area account: until you close it; afterwards we delete it within 90 days, except data we must keep by law;

• campaign data (UTM) in your browser: 30 days;

• advertising cookies: as indicated in our Cookie Policy; data received by Meta, TikTok and Reddit is kept by them under their own policies;

• Google Analytics data: up to 14 months, according to the retention set in Google Analytics;

• server and security logs: normally no more than 90 days;

• content produced for you and portfolio material: for as long as it is used for the purposes agreed.

10. Your rights

Depending on the law that applies to you, you have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, including processing based on legitimate interest and direct marketing, to receive it in a portable format, and to withdraw your consent at any time without affecting the lawfulness of the processing carried out before.

To exercise these rights, write to …. We may ask you to confirm your identity, and we answer within 30 days. Some requests may be refused where the law allows it, for example when we must keep data for tax purposes or to defend a legal claim.

You can also lodge a complaint with a data protection authority: in the United Arab Emirates the UAE Data Office, and in the European Union the authority of your country of residence (in Italy, the Garante per la protezione dei dati personali).

11. Security

We protect personal data with technical and organisational measures appropriate to the risk, including encrypted connections, access limited to the people who need it, two-factor authentication on our tools, and providers that meet recognised security standards. We do not store the passwords of your social accounts in plain text.

No system is completely secure. If a breach affects your data, we will inform you and the competent authorities where the law requires it.

12. Access to your social accounts

When a Service requires access to your social accounts, we use it only to perform that Service. We do not read private messages and we do not collect personal data of your followers beyond what the Platforms show in their statistics.

13. Minors

Our Services are reserved for adults. We do not knowingly collect personal data of people under 18, except the image of minors who appear in content with the written consent of their parents or guardians.

14. Automated decisions

We do not take decisions based solely on automated processing that produce legal or similarly significant effects on you. Advertising platforms may use the data they receive to select the ads they show, under their own responsibility.

15. Changes to this policy

We may update this Privacy Policy. The version published on the website, with its date of last update, applies. If the changes are significant, we will inform you through the website or by email.

16. Contact

For any question about this policy or about your personal data, write to ….