Privacy Policy

Lenawa Solutions ("Lenawa Solutions," "we," "us," or "our") is a global digital agency specializing in web development, SEO, PPC advertising, e-commerce solutions, mobile app development, and full-service digital marketing. We operate from offices in Dubai (UAE), São Paulo (Brazil), and Panama, serving clients across 11+ countries worldwide.

We are committed to protecting your privacy and handling your personal data with transparency, integrity, and in compliance with applicable data protection laws including the EU General Data Protection Regulation (GDPR), the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), and Brazil's Lei Geral de Proteção de Dados (LGPD).

This Privacy Policy describes the types of personal information we collect, why we collect it, how we use it, and what choices you have regarding your data. By using our website (lenawa.com) or engaging our services, you acknowledge that you have read and understood this policy.

2.1 Information You Provide Directly

• Contact form submissions: Name, email address, phone number, company name, and your message or inquiry details.
• Service inquiries and consultations: Project requirements, budget information, business goals, and any supporting materials you share.
• Client onboarding data: Business name, website URLs, access credentials for marketing platforms (provided securely), billing details, and contact information for key stakeholders.
• Email subscriptions: Email address and communication preferences when you subscribe to our newsletter or updates.

2.2 Information Collected Automatically

• Analytics data: Pages visited, time spent on pages, bounce rate, referral sources, and user journey through our website.
• Device information: Browser type and version, operating system, screen resolution, and device type (desktop, tablet, mobile).
• Network data: IP address (anonymized where required), approximate geographic location (country/city level), and internet service provider.
• Cookie data: Information collected through cookies and similar tracking technologies (see Section 6 for details).

2.3 Information from Third Parties

• Google Analytics and Google Ads: Aggregated and anonymized website performance data, ad click data, and conversion tracking.
• Social media platforms: When you interact with our social profiles or share our content, we may receive basic profile information.
• Business partners and referrals: Contact information shared by mutual business contacts or partners with your knowledge.

We use the information we collect for the following purposes:

• Service delivery: To provide, manage, and improve our digital marketing, web development, SEO, PPC, and related services.
• Communication: To respond to your inquiries, send project updates, share relevant resources, and provide customer support.
• Marketing: To send you information about our services, case studies, and industry insights — only with your explicit consent or where we have a legitimate interest.
• Website improvement: To analyze how visitors use our website and optimize content, design, and user experience.
• Legal compliance: To fulfill our legal and regulatory obligations, including tax reporting and record-keeping requirements.
• Security: To detect, prevent, and address technical issues, fraud, or unauthorized access to our systems.
• Business operations: To manage contracts, billing, invoicing, and internal administration.

Under the GDPR and similar regulations, we process your personal data based on one or more of the following legal grounds:

• Contractual necessity: Processing is necessary for the performance of a contract with you — for example, delivering agreed-upon SEO, PPC, web development, or other digital services.
• Consent: Where you have given explicit consent — for example, when you opt in to receive our newsletter, marketing emails, or agree to non-essential cookies.
• Legitimate interests: Processing is necessary for our legitimate business interests, such as improving our services, understanding our audience, and protecting our business — provided these interests do not override your fundamental rights and freedoms.
• Legal obligation: Processing is required to comply with laws and regulations, including financial reporting and data retention requirements in the UAE, Brazil, and Panama.

You may withdraw your consent at any time without affecting the lawfulness of processing that occurred before withdrawal. To withdraw consent, contact us at privacy@lenawa.com.

We use trusted third-party tools and platforms to deliver our services and operate our website. These include:

• Google Analytics: For website traffic analysis and user behavior insights. Google may collect data according to its own privacy policy.
• Google Ads: For managing paid search campaigns and conversion tracking on behalf of our clients.
• Google Tag Manager: For managing and deploying marketing tags on our website without modifying code.
• Payment processors: For secure processing of client invoices and payments. We do not store credit card numbers on our servers.
• Cloud hosting providers: For secure hosting of our website and client applications on enterprise-grade infrastructure.
• Email service providers: For sending newsletters, transactional emails, and project communications.
• CRM and project management tools: For managing client relationships, project timelines, and internal collaboration.

Each third-party service has its own privacy policy governing how it handles data. We select partners that maintain appropriate data protection standards and, where applicable, have signed Data Processing Agreements (DPAs) with us.

Our website uses cookies — small text files placed on your device — to enhance your browsing experience and help us understand how our site is used.

6.1 Essential Cookies

Required for the website to function properly. These include session management, security features, and region preferences. You cannot opt out of essential cookies.

6.2 Analytics Cookies

Used to collect anonymous data about how visitors interact with our website — including pages visited, time on site, and navigation patterns. We use this data to improve our content and user experience. Powered by Google Analytics with IP anonymization enabled.

6.3 Marketing Cookies

Used to deliver relevant advertising and measure the effectiveness of our ad campaigns. These cookies may track your browsing activity across different websites. You can opt out of marketing cookies at any time through your browser settings or our cookie preferences.

6.4 Managing Cookies

You can control cookies through your browser settings. Most browsers allow you to block or delete cookies. Please note that disabling certain cookies may affect the functionality of our website. For detailed instructions, consult your browser's help documentation.

We never sell your personal data. Period.

We may share your information only in the following limited circumstances:

• Service providers: Trusted third-party vendors who assist us in delivering our services (hosting, analytics, payment processing). These providers are contractually obligated to protect your data and use it solely for the purposes we specify.
• Legal requirements: When required by law, court order, or governmental regulation, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred as part of the business transaction. You will be notified of any such change.
• With your consent: We may share your information with third parties when you explicitly authorize us to do so.

As a global company with offices in Dubai (UAE), São Paulo (Brazil), and Panama, your personal data may be transferred and processed in countries outside your country of residence.

When transferring data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs): We use EU-approved contractual frameworks when transferring data from the European Economic Area to countries without an adequacy decision.
• Data Processing Agreements: We maintain agreements with all third-party service providers that process personal data on our behalf.
• Encryption: Data in transit is protected using TLS/SSL encryption. Data at rest is encrypted on our servers.
• Regional compliance: We comply with the data protection requirements of each jurisdiction where we operate, including GDPR (EU/EEA), PDPL (UAE), and LGPD (Brazil).

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law.

• Client project data: Retained for the duration of the business relationship plus 3 years for reference and legal purposes.
• Financial and billing records: Retained for 7 years in compliance with tax and accounting regulations in the UAE, Brazil, and Panama.
• Marketing communications: Contact data is retained until you unsubscribe or request deletion. Unsubscribe requests are processed within 48 hours.
• Website analytics: Aggregated analytics data is retained for up to 26 months. Individual session data is anonymized after 14 months.
• Contact form submissions: Retained for up to 2 years, or shorter if the inquiry is resolved and no business relationship is established.

When retention periods expire, we securely delete or anonymize your personal data using industry-standard methods.

Depending on your location and applicable law, you may have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten"): Request deletion of your personal data, subject to certain legal exceptions.
• Right to restrict processing: Request that we limit how we use your data in certain circumstances.
• Right to data portability: Receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Right to object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Withdraw consent at any time where processing is based on your consent.
• Right to lodge a complaint: File a complaint with a supervisory authority if you believe your data protection rights have been violated.

To exercise any of these rights, contact us at privacy@lenawa.com. We will respond to your request within 30 days.

We take the security of your personal data seriously and implement appropriate technical and organizational measures to protect it against unauthorized access, alteration, disclosure, or destruction.

• Encryption: All data transmitted between your browser and our servers is encrypted using TLS 1.3. Sensitive data at rest is encrypted using AES-256.
• Secure infrastructure: Our website and applications are hosted on enterprise-grade cloud infrastructure with 24/7 monitoring, DDoS protection, and automated backup systems.
• Access controls: Access to personal data is restricted to authorized personnel on a need-to-know basis. We use multi-factor authentication and role-based access controls.
• Staff training: All team members receive regular training on data protection best practices, phishing awareness, and secure data handling procedures.
• Incident response: We maintain a data breach response plan and will notify affected individuals and relevant authorities within 72 hours of becoming aware of a qualifying breach, as required by GDPR.

Our services are designed for businesses and professionals. We do not knowingly collect personal data from children under the age of 16.

If we learn that we have inadvertently collected personal information from a child under 16, we will take immediate steps to delete that data from our systems. If you believe we may have collected data from a child, please contact us at privacy@lenawa.com.

We may send you marketing communications about our services, case studies, industry insights, and special offers — but only when:

• You have given us explicit opt-in consent (such as subscribing to our newsletter).
• You are an existing client and the communications relate to services similar to those you have previously engaged us for (soft opt-in under applicable law).

Every marketing email includes a clear unsubscribe link. You can opt out at any time, and we will process your request within 48 hours. Opting out of marketing will not affect service-related communications (such as project updates and invoices).

If you have questions, concerns, or requests related to this Privacy Policy or how we handle your personal data, please reach out to us:

For individuals and businesses in the United Arab Emirates, we comply with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its implementing regulations.

• We process personal data lawfully, fairly, and transparently as required under the PDPL.
• We collect only data that is adequate, relevant, and limited to what is necessary for the stated purposes.
• Cross-border data transfers from the UAE are conducted in accordance with PDPL requirements, including ensuring adequate protection in the receiving country or obtaining your consent.
• We maintain records of processing activities and conduct data protection impact assessments where required.
• UAE residents may exercise their data protection rights by contacting us at privacy@lenawa.com.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or business operations.

When we make significant changes, we will:

• Update the "Last Updated" date at the top of this page.
• Post a notice on our website highlighting the changes.
• Where required by law, notify you directly via email.

We encourage you to review this page periodically to stay informed about how we protect your data. Your continued use of our website and services after any changes constitutes your acceptance of the updated policy.