Qiwam · Legal

Privacy Policy

Last updated: 2026-09-09

Draft for review. This policy was written to match what the website currently does. Have a Bahrain-qualified lawyer review it before the site goes live.

1. Who we are

This website, qiwam.studio (“the Site”), is operated by Qiwam W.L.L. (“Qiwam”, “we”, “us”), a branding and creative studio in the Kingdom of Bahrain.

  • Registered name: Qiwam W.L.L.
  • Commercial Registration: 198586-1
  • Registered address: Jurdab, 729, Bahrain
  • Contact for privacy matters: Hala@qiwam.studio

We are the data controller for personal data processed through the Site.

2. What this policy covers

It covers personal data we process when you visit the Site or contact us through it. It does not cover other companies’ websites we link to, or work we carry out for clients under a separate agreement.

3. What we collect, and why

a. Information you send us through a form

The contact form and the newsletter form on the Site do not submit to a server. When you press send, your browser opens your own email application with a message pre-filled to Hala@qiwam.studio; you choose whether to send it. If you do, we receive whatever you included:

  • Contact form: your name, email address, phone number (optional), the type of help you are after, an optional budget range, and your message.
  • Newsletter form: your email address.

We ask only for what we need to reply to you or to add you to the mailing list. Please do not send us sensitive information (health, religion, political views, and similar) through these forms.

Purpose: to respond to your enquiry, to provide a proposal if you ask for one, and—for the newsletter—to send you occasional updates about the studio.

Legal basis: your consent (which you give by ticking the box and sending the message), and our legitimate interest in answering people who contact us.

b. Server logs

Our hosting provider, Hostinger, automatically records standard technical data for every request: IP address, date and time, the page requested, the referring page, and browser/device type. These logs are used to run the Site, keep it secure, and diagnose faults.

Legal basis: our legitimate interest in operating and securing the Site.

c. What we do not collect

  • No analytics or measurement tools (no Google Analytics, no Plausible, no Meta Pixel, nothing equivalent).
  • No advertising or tracking cookies, and no cross-site tracking.
  • No profiling and no automated decision-making.
  • No fingerprinting, and no data brokers.

See the Cookie Policy for the one small piece of functional storage the Site uses.

4. Fonts, video and other content

Fonts, images and video on the Site are served from our own domain. No Google Fonts, Adobe Fonts, YouTube, Vimeo, maps or social widgets are embedded, so visiting the Site does not send your data to those companies.

5. Who we share data with

We do not sell personal data. We share it only with:

  • Our hosting provider, Hostinger, which processes server logs on our behalf.
  • Our email provider, Hostinger (email hosting), which stores the emails you send us.
  • Professional advisers or authorities, where the law requires it.

6. International transfers

Hostinger stores data in data centres outside the Kingdom of Bahrain (its infrastructure is primarily in the EU, and it may use other regions). Where personal data is transferred outside Bahrain we rely on Hostinger’s contractual safeguards (such as standard contractual clauses) and its own compliance certifications.

7. How long we keep it

  • Enquiry emails: kept while we are in contact and for up to 24 months afterwards, then deleted, unless they become part of a signed client engagement.
  • Newsletter list: kept until you unsubscribe or ask us to remove you.
  • Server logs: retained by the host for a short period (typically 14–90 days) and then rotated out.

8. Your rights

You can ask us to:

  • tell you what personal data we hold about you and give you a copy;
  • correct anything inaccurate;
  • delete your data;
  • restrict or object to how we use it;
  • withdraw consent at any time (this does not undo processing already done);
  • unsubscribe from the newsletter — every issue includes a one-click way to do so, or email us.

To exercise any of these, email Hala@qiwam.studio. We respond within 30 days.

Bahrain: you may complain to the Personal Data Protection Authority (PDPA) if you think we have mishandled your data.
EU / EEA visitors: the GDPR applies to this processing; you may complain to your local supervisory authority.
UK visitors: the UK GDPR applies; you may complain to the Information Commissioner’s Office (ICO).
Saudi Arabia / UAE visitors: the KSA PDPL and UAE PDPL respectively give you similar rights; contact us and we will honour them.

9. Children

The Site is aimed at businesses and is not directed at children under 18. We do not knowingly collect their data.

10. Security

The Site is served over HTTPS. Access to the mailbox that receives enquiries is limited to Qiwam staff and protected by strong passwords and two-factor authentication. No method of transmission is perfectly secure, so we cannot guarantee absolute security.

11. Changes

If we change how we handle data — for example if we add analytics — we will update this policy and the “last updated” date, and, where the law requires it, ask for your consent.

12. Contact

Qiwam W.L.L.
Jurdab, 729, Bahrain
Hala@qiwam.studio