Privacy Policy

This policy explains what personal data Window Nine Ltd. (“we”, “us”) collects when you visit this website or work with us, why we collect it, who we share it with, and the rights you have over it. We serve clients in the United States, Canada, the United Kingdom, Europe, Australia, New Zealand and the UAE, so this policy addresses each of those regimes below.

Short version: we collect what we need to respond to you and run our business, we don’t sell your data, and you can ask us what we hold at any time by writing to hello@windownine.com.

1. Data we collect

Information you give us

• Contact forms and email. Name, email address, company, and whatever you write in your message when you get in touch or request a proposal.
• Client engagement data. Billing details, the contents of statements of work, and business contact information for the people we work with on your side.
• Job applications. CVs, work samples and interview notes, if you apply to join our team.

Information collected automatically

• Analytics data. Pages visited, time on page, referring site, approximate location (city level), browser and device type.
• Cookies and similar technologies. Small files that remember your preferences and, with your consent, support analytics and marketing. Details — including how to refuse them — live in our Cookie Policy.

2. Why we use it

• To respond to enquiries and prepare proposals.
• To deliver contracted services, invoice and keep accounts.
• To understand how the site is used and improve it.
• To market our services — measured, and only where permitted.
• To meet legal, tax and accounting obligations.
• To protect our systems, staff and clients against fraud and abuse.

3. Legal bases

Where a legal basis is required (for example under the GDPR), we rely on:

• Contract — to take steps you ask for before a contract and to perform one once signed.
• Legitimate interests — running and promoting our business, securing our systems, and answering people who write to us.
• Consent — analytics and marketing cookies, and marketing emails where consent is required. You can withdraw consent at any time.
• Legal obligation — tax, accounting and regulatory record-keeping.

4. Who we share data with

We never sell personal data. We share it with:

• Service providers — hosting, email, CRM, analytics, accounting and communication tools that process data on our instructions under contract.
• Advertising platforms— Meta, Google and TikTok, when we run campaigns for clients. In those campaigns we act on our client’s behalf; the client and the platform determine how audience data is used, under their own policies.
• Professional advisers — lawyers, accountants and insurers, where needed.
• Authorities — where the law requires it, and no further.

5. International transfers

We operate across several regions, so data may be processed outside the country where it was collected. When we transfer data out of the EU, UK or other regulated jurisdictions, we rely on adequacy decisions where available and otherwise on approved safeguards such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, plus supplementary measures where appropriate.

6. Retention

• Enquiry data: up to 24 months after our last contact.
• Client and contract records: 7 years after the engagement ends, for tax and legal purposes.
• Analytics data: up to 26 months, in aggregated or pseudonymised form where possible.
• Unsuccessful job applications: up to 12 months, unless you ask us to delete sooner.

When data is no longer needed, we delete or anonymise it.

7. Your rights, by region

Wherever you are, you can contact us at hello@windownine.com to exercise the rights below. We may ask you to verify your identity first, and we respond within the timeframe your local law sets.

European Union & United Kingdom — GDPR / UK GDPR

• Access your personal data and receive a copy.
• Correct inaccurate data and complete incomplete data.
• Have your data erased (“right to be forgotten”) where grounds apply.
• Restrict or object to processing, including processing based on legitimate interests.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time, without affecting prior processing.
• Complain to your supervisory authority — your national data protection authority in the EU, or the Information Commissioner’s Office (ICO) in the UK.

California — CCPA / CPRA

• Know what personal information we collect, use, disclose and share.
• Access your personal information and request deletion or correction.
• Opt out of the “sale” or “sharing” of personal information. We do not sell personal information; if cookie-based sharing for advertising ever applies, you can opt out via our Cookie Policy controls.
• Limit the use of sensitive personal information.
• Not be discriminated against for exercising any of these rights.

Canada — PIPEDA

• Access the personal information we hold about you and challenge its accuracy.
• Withdraw consent to collection, use or disclosure, subject to legal or contractual limits.
• Know how your information is used and to whom it has been disclosed.
• Complain to the Office of the Privacy Commissioner of Canada.

Australia — Privacy Act 1988

• Access and correct the personal information we hold about you, under the Australian Privacy Principles.
• Ask how your information is handled and whether it is disclosed overseas.
• Opt out of direct marketing at any time.
• Complain to us first, and then to the Office of the Australian Information Commissioner (OAIC).

New Zealand — Privacy Act 2020

• Access the personal information we hold about you.
• Request correction, or have a statement of correction attached if we decline.
• Expect notification of any privacy breach likely to cause serious harm.
• Complain to the Office of the Privacy Commissioner.

United Arab Emirates — PDPL

• Access your personal data and receive information about how it is processed, under Federal Decree-Law No. 45 of 2021.
• Request correction, erasure or restriction of processing.
• Object to processing for direct marketing and to automated decisions with legal effect.
• Request portability of your data in a structured, machine-readable format.
• Withdraw consent at any time and complain to the UAE Data Office.

8. Children

This site and our services are for businesses. They are not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, write to hello@windownine.com and we will delete it.

9. Security

We use access controls, encryption in transit, vendor due diligence and staff confidentiality obligations to protect personal data. No system is perfectly secure, but we treat yours the way we would want ours treated.

10. Changes to this policy

We update this policy as our practices or the law change. The date at the top tells you when it last moved. Material changes will be flagged on this page before they take effect.

11. Contact

Privacy questions, requests and complaints: hello@windownine.com. Please put “Privacy request” in the subject line so it reaches the right person quickly.