How we handle your data.

The short version

We collect the information you give us through forms on this site: your name, work email, company, role, and whatever you choose to tell us in the message field. We use product analytics (PostHog) to understand which pages people read and which forms get filled. Once you submit a form, we link your previous browsing on this site to your email address, so the team you talk to has the full picture of what you were looking at.

We do not sell your data. We do not buy data about you from third parties. We do not use cookies for advertising. We are a B2B engineering services firm. We collect this data to talk to potential clients, not to build profiles for sale.

If you want your data deleted, email privacy@jesbim.com with the email address you submitted a form with. We will purge it from our CRM, our analytics, and our backups within 30 days.

What we collect

Information you give us directly

When you submit a form on this site (contact form, discovery call request, pilot programme enquiry, case study walkthrough request, lead magnet download), we capture:

• Your name
• Your work email address
• Your company name
• Your phone number (where you choose to share it)
• Your role (where you choose to share it)
• The message or context you write in free-text fields
• Which form you submitted, and which page or case study you were on when you submitted it

Information collected automatically

When you browse the site, we record:

• Pages you visit, and the order you visit them in
• Approximate country (resolved from your IP address by Cloudflare's edge; we never store the IP itself)
• Your browser and operating system (user-agent string)
• The site or search that referred you here (if any)
• UTM campaign parameters in the URL, if present
• An anonymous identifier (a random ID) that lets us join up the pages you viewed in a single visit

Why we use it

We use the information you give us for three things, and only these three things:

• To reply to you. Form submissions become leads in our CRM. The Sales Manager replies to the email you provided within one business day. Where relevant we route the conversation to a colleague closer to your industry, geography, or project type.
• To improve the site. We look at which pages get read, which forms get filled, and which forms get abandoned. We do not look at individual sessions unless we are debugging a reported issue. We do not record screen activity or keystrokes.
• To follow up appropriately. If you ask for a discovery call, our team needs to know that you previously downloaded the ISO 19650 pack and read three case studies, so they can have a useful conversation, not start from zero.

We do not use your data for retargeting ads, lookalike audiences, or any advertising activity. We do not share your data with third parties for their marketing.

Who we share it with

The following service providers process your data on our behalf, strictly for the purposes described above:

• Supabase (database hosting, EU region): stores form submissions, CRM records, and engagement history.
• Cloudflare (hosting, content delivery, security): serves this website, verifies form submissions are from humans (Turnstile), records edge analytics.
• PostHog (product analytics, US region): records page views and form events. Pricing tier: identified-only mode, meaning anonymous visitors do not generate persistent profiles.
• Resend (transactional email): sends notification emails to our internal team when a new form is submitted.
• Rackspace Email (email hosting): receives and stores the email correspondence we have with you.

We have data processing agreements with each of these providers. We do not share your data with any other third parties. We do not sell, rent, or trade your data.

If JES is acquired, merges with another company, or sells a business unit, your data may transfer to the new entity. We will notify you by email if this happens and your data is part of the transfer.

Cookies and analytics

We use a small number of first-party cookies and local storage entries, all functional rather than advertising:

• PostHog cookies: store the anonymous visitor identifier described above. Expires after 12 months of inactivity.
• Cloudflare cookies: bot mitigation and routing. Required for the site to function.
• Turnstile cookies: anti-spam verification for form submissions. Required for forms to work.

We do not use third-party advertising cookies. We do not run Google Analytics, Meta Pixel, LinkedIn Insight Tag, or any other ad-tech tracker on this site.

How long we keep it

• Form submissions and CRM records: retained while you remain an active prospect or client, and for 3 years after our last interaction. Then archived for a further 4 years for legal and tax record-keeping, after which they are deleted.
• Analytics events: retained for 12 months at the event level. Aggregated metrics (e.g. weekly visitor counts) may be retained indefinitely as they cannot be tied back to an individual.
• Email correspondence: retained for 7 years per UAE record-keeping norms.

You can request deletion at any time. See Your rights.

Your rights

Regardless of where you are based, you have the right to:

• Access the personal data we hold about you. We will respond within 30 days with a structured export.
• Correct any data that is inaccurate.
• Delete your data ("right to be forgotten"). We will purge it from our CRM, analytics, and backups within 30 days. Note: we may retain a minimal record (your email, the fact that deletion was requested, and the date) to ensure we do not re-contact you in future.
• Object to specific uses, or restrict processing.
• Withdraw consent at any time. Unsubscribe links are included in every commercial email we send.
• Lodge a complaint with your local data protection authority. For UAE residents this is the UAE Data Office; for EU/UK residents, your national supervisory authority.

To exercise any of these rights, email privacy@jesbim.com from the address you used to submit the form, or attach proof of identity if using a different address.

Security

Your data is transmitted over HTTPS (TLS 1.3) and stored in databases protected by row-level security. Access to the CRM is restricted to authenticated JES staff over single sign-on with mandatory multi-factor authentication. Backups are encrypted at rest. We follow standard practice for vulnerability patching and access review.

No system is perfectly secure. If we ever discover a breach affecting your data, we will notify you within 72 hours and report it to the relevant regulator within the legal timeframe applicable in your jurisdiction.

Changes to this policy

We will update this policy if our practices change. Material changes (new categories of data, new processors, longer retention) will be announced by email to anyone whose data we hold. Cosmetic changes (typos, clarifications) just update the "Last updated" date at the top of this page.

Contact us

For any question about this policy or about how we handle your data:

• Email: privacy@jesbim.com
• Post: Joseph Engineering Services LLC, Dubai, United Arab Emirates

We aim to respond to all privacy enquiries within 7 business days, and to formal data subject requests within 30 days.