This policy explains what personal data we collect when you visit teaandkey.com, why we collect it, who we share it with and what rights you have. It covers this website only. Data that hotels and restaurants put into the Tea & Key service is handled under the customer agreement and data processing terms we sign with each customer.
Who we are
Tea & Key is a product of NetValidity FZCO, IFZA Business Park, Dubai Silicon Oasis, Dubai, United Arab Emirates (IFZA licence No. 53452). NetValidity FZCO is the controller of the personal data described here.
For any privacy question or request, write to info@netvalidity.com.
What we collect
When you browse the site
- Technical data. Our hosting and delivery network (Amazon Web Services) receives your IP address, browser and device type, the page requested, the referring page and the time of the request, because it needs them to deliver the page and protect the site from attacks. We do not keep access logs of visits.
- Your privacy choices. Your browser stores whether you accepted or rejected analytics, so we do not ask again on every page.
Anonymous statistics, for everyone
To learn which parts of the site people actually read, we count, for each page view: which blocks of the page were on screen and for how many seconds, how far the page was scrolled, which buttons and links were clicked, the total time on the page, the screen type (phone, tablet or desktop) and the website you came from, if any (its name only).
This is deliberately anonymous:
- no cookies, and nothing is stored in your browser;
- no identifier of any kind, so two visits by the same person cannot be connected;
- your IP address and browser details are not stored;
- nothing you type is collected, and no recordings are made;
- each page view is kept as a separate anonymous record for up to 3 months, and we look at them only as totals (for example, “60% of visitors to this page reached the pricing block”).
Because none of this identifies you, it runs without asking for consent. You can still switch it off in Cookie settings, and it stays off automatically if your browser sends Global Privacy Control or Do Not Track.
Only if you accept analytics
- Google Analytics tells us how many people visit, which pages they read, how they arrived, and their device, browser, language and approximate location (country or city). Google Analytics 4 does not store your full IP address. Google signals and advertising features are switched off.
- Microsoft Clarity records how you interact with pages: clicks, taps, scrolling and mouse movement. It turns these into heatmaps and session replays that help us find confusing or broken parts of the site. Text you type into fields is hidden before it leaves your browser.
Both tools are off until you accept them. You can change your mind at any time with Cookie settings at the bottom of every page. The cookie policy lists every cookie they set.
When you contact us
If you use the contact form, write to us by email or open the live chat, we receive what you send: usually your name, email address, company, country, type of business and message. We use it to reply, arrange a demo and, if you become a customer, to set up your account.
The contact form is protected against spam by Cloudflare Turnstile, which checks signals from your browser (such as your IP address and browser characteristics) to tell people from bots. It does not use cookies for this. The live chat loads only when you click Chat with us.
We do not collect sensitive data such as health or financial details through this site, and we ask you not to send any.
Why we use your data, and on what basis
| Purpose | Data | Legal basis |
|---|---|---|
| Delivering the site and keeping it secure | Technical data | Our legitimate interest in running a secure website |
| Understanding how the site is used (Google Analytics, Microsoft Clarity) | Analytics data | Your consent |
| Anonymous statistics of what is read | Page, blocks seen, scroll depth, clicks, screen type | Our legitimate interest in improving the site; no personal data is kept |
| Answering your enquiry and arranging a demo | What you send us | Steps you asked for before a possible contract, or our legitimate interest in replying |
| Keeping the contact form free of spam | Browser signals checked by Turnstile | Our legitimate interest in preventing abuse |
| Meeting legal obligations | Records we must keep | Legal obligation |
Where a law in your country (for example the UAE or Saudi Arabia personal data protection laws) relies mainly on consent, we ask for it before any non-essential processing, and the other processing above falls under the exceptions those laws allow for providing a requested service, security and legal obligations.
We do not use your data for automated decisions that have legal or similarly significant effects on you.
Who we share it with
We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We use these service providers, who process data on our behalf and under contract:
- Amazon Web Services: hosting and content delivery.
- Google (Google Ireland Limited and Google LLC): Google Analytics, only with your consent.
- Microsoft (Microsoft Ireland Operations Limited and Microsoft Corporation): Microsoft Clarity, only with your consent.
- Cloudflare (Cloudflare, Inc.): receiving the contact form, protecting it from spam (Turnstile) and counting the anonymous statistics.
- Crisp (Crisp IM SAS, France, data hosted in the EU): live chat, only if you open it.
Email sent to us or through the contact form is delivered to our own mail servers.
We may also disclose data where the law requires it, or to protect our rights or the safety of others.
International transfers
Our providers may process data outside your country, including in the United States and the European Union. When data from the European Economic Area, the United Kingdom or Switzerland is transferred, we rely on the EU–US Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, and on Standard Contractual Clauses otherwise. For transfers from the UAE, Saudi Arabia and other GCC countries, we follow the conditions their laws set for transfers abroad.
How long we keep it
- Anonymous statistics: up to 3 months.
- Google Analytics: 2 months for user-level data; reports show only totals.
- Microsoft Clarity: session replays for up to 30 days, heatmaps and totals for up to 13 months.
- Enquiries: as long as we are in contact, then up to 24 months if you do not become a customer. Customer records are kept for the length of the contract and as long as tax and commercial law requires afterwards.
- Your privacy choices: until you change them or clear your browser storage.
Your rights
Wherever you are, you can ask us to tell you what data we hold about you, to correct it, to delete it, and to stop analytics at any time. Write to info@netvalidity.com. We may ask you to confirm your identity before acting, and we reply within one month (45 days for California requests).
European Economic Area, United Kingdom and Switzerland
You have the right of access, rectification, erasure, restriction of processing, data portability and objection to processing based on our legitimate interests. Where we rely on consent you may withdraw it at any time, without affecting what was done before. You may complain to your local data protection authority.
California and other US states
You have the right to know what personal information we collect, use and disclose; to delete it; to correct it; and not to be discriminated against for using these rights. We do not sell or share personal information and do not use sensitive personal information, so there is nothing to opt out of; analytics stays off unless you turn it on. In the last 12 months we have collected the categories described above (identifiers, internet activity and, if you contact us, professional information) for the purposes described above. An authorised agent may make a request on your behalf.
United Arab Emirates, Saudi Arabia and other GCC countries
You have the right to be informed, to access your data, to have it corrected or completed, to have it deleted when it is no longer needed, to withdraw consent and to object to processing. You may complain to the competent authority, such as the UAE Data Office or the Saudi Data and Artificial Intelligence Authority (SDAIA).
Privacy signals
This site honours Global Privacy Control and Do Not Track. If your browser sends either signal, analytics and the anonymous statistics stay off and we do not show the cookie banner; you can still switch analytics on yourself in Cookie settings.
Children
This site is meant for businesses and is not directed to children. We do not knowingly collect data from anyone under 16.
Security
The site is served only over encrypted connections (HTTPS). Access to the data we hold is limited to the people who need it, and our providers are bound to protect it.
Changes to this policy
When this policy changes we update the date at the top. If a change affects the analytics you agreed to, we ask for your consent again.
Contact
NetValidity FZCO, IFZA Business Park, Dubai Silicon Oasis, Dubai, United Arab Emirates. Email: info@netvalidity.com.