Legal
Privacy Policy
Last updated: 19 July 2026
This policy explains what personal data Mich Agency collects through this website, why we collect it, who we share it with, and the rights you have over it.
1. Who we are
The controller responsible for your personal data is:
- Mich Agency LLC
- Registered in Sharjah, United Arab Emirates
- Registered address: City Media Sharjah, Sharjah, United Arab Emirates
- Email: [email protected]
"We", "us", and "our" refer to Mich Agency LLC throughout this policy.
2. Scope
This policy covers the website at michagency.com and its subdomains. It applies to visitors anywhere in the world. Where you are in the European Economic Area (EEA) or the United Kingdom, we handle your data in line with the General Data Protection Regulation (GDPR) and the UK GDPR. We also comply with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).
3. What we collect and why
Information you give us
When you submit a contact form on this site, we collect the name, email address, and any company details or message content you choose to enter. We use this solely to respond to your enquiry and, if it leads somewhere, to discuss working together.
Information collected automatically
If you consent to analytics cookies, we collect aggregated usage data: pages viewed, approximate region, referring site, device and browser type. IP addresses are anonymised before storage. We do not use this data to build advertising profiles, and we do not sell it.
Our hosting and security providers also process your IP address transiently in order to serve the site and to filter automated abuse. This happens for every visitor and cannot be switched off, because the site cannot be delivered securely without it.
What we do not collect
We do not knowingly collect special-category data (health, biometrics, political or religious beliefs, and similar), and we do not knowingly collect data from children under 16. Please do not submit such information through our forms.
4. Legal bases for processing
Under the GDPR we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Responding to a contact-form enquiry | Steps taken at your request prior to entering a contract (Art. 6(1)(b)), or our legitimate interest in answering business enquiries (Art. 6(1)(f)) |
| Analytics cookies | Your consent (Art. 6(1)(a)), which you may withdraw at any time |
| Spam and bot filtering on forms; site security | Our legitimate interest in protecting the site from abuse (Art. 6(1)(f)) |
| Keeping records of enquiries and agreements | Our legitimate interest in managing the business, and compliance with legal obligations (Art. 6(1)(c)) |
5. Who we share data with
We do not sell personal data. We share it only with service providers who process it on our behalf, under contract, and only as needed to run this site:
| Provider | What it does | Data involved |
|---|---|---|
| Cloudflare, Inc. | Website hosting (Cloudflare Pages), CDN, and Turnstile bot protection on forms | IP address, request metadata |
| Google LLC (Apps Script & Sheets) | Receives and stores contact-form submissions | Everything you enter in the form |
| Google LLC (Google Analytics 4) | Website analytics, only if you consent | Anonymised IP, usage events |
We may also disclose data where we are legally required to, or to establish or defend legal claims.
6. International transfers
We are based in the United Arab Emirates, and the providers above process data in the United States and elsewhere. Where personal data is transferred out of the EEA or the UK, that transfer is covered by the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an applicable adequacy decision. You can request a copy of the safeguards we rely on by emailing us.
7. How long we keep it
- Contact-form enquiries: up to 24 months from our last exchange with you, then deleted.
- Client records: for the life of the engagement plus the retention period required by applicable tax and commercial law.
- Analytics data: retained by Google for a maximum of 14 months.
- Your cookie choice: stored for 6 months, after which we ask again.
8. Your rights
Subject to the conditions in applicable law, you have the right to:
- access the personal data we hold about you, and receive a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to our processing, including processing based on legitimate interests;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time, without affecting processing carried out before withdrawal.
To exercise any of these, email [email protected]. We respond within one month. You will not be charged, and we will not treat you differently for asking.
If you are in the EEA or the UK and are unhappy with how we have handled your data, you may lodge a complaint with your local supervisory authority. In the UK, that is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address it first.
9. Cookie Policy
Cookies are small files stored on your device. Similar technologies, such as local storage and pixels, are covered by this section too.
We ask for your consent before setting any cookie that is not strictly necessary. Analytics cookies stay off until you accept them, and rejecting them has no effect on how the site works for you.
Strictly necessary (always active)
| Cookie | Provider | Purpose | Expiry |
|---|---|---|---|
| cc_cookie | michagency.com | Remembers your cookie preferences | 6 months |
| __cf_bm | Cloudflare | Distinguishes humans from bots | 30 minutes |
| cf_clearance | Cloudflare | Records that a Turnstile challenge was passed | Up to 1 year |
Analytics (only with your consent)
| Cookie | Provider | Purpose | Expiry |
|---|---|---|---|
| _ga | Distinguishes visitors | 2 years | |
| _ga_WWKJ5EYHX1 | Maintains session state | 2 years |
Changing your mind
You can review or change your choice at any time: . You can also block or delete cookies in your browser settings, though blocking strictly necessary cookies may stop parts of the site working.
10. Security
The site is served over HTTPS, and form submissions are encrypted in transit and protected by bot filtering. Access to enquiry data is limited to people who need it. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data, and we will notify you and the relevant authority of a breach where the law requires it.
11. Changes to this policy
We may update this policy as the site or the law changes. The "last updated" date at the top always reflects the current version. If a change materially affects your rights, we will ask for your consent again through the cookie banner or tell you directly.
12. Contact
Questions, requests, or complaints about this policy: [email protected].