Privacy Policy

Last updated: May 2026

Applies to: ghmconsultancy.com and all GHM Consultancy services

This policy explains how GHM Consultancy LLC collects, uses, and protects your personal data. We are committed to handling your information responsibly and in compliance with applicable data protection laws, including the UAE Federal Decree Law No. 45 of 2021 on the Protection of Personal Data and, where applicable, the UK General Data Protection Regulation (UK GDPR).

1. Who we are

GHM Consultancy LLC is a marketing agency registered in Dubai, UAE, operating at Dubai Production City, Dubai. We provide growth systems, branding, and web design services for lifestyle and wellness brands across the GCC and UK.

For the purposes of data protection law, GHM Consultancy LLC is the data controller responsible for your personal data.

You can contact us at: hello@ghmconsultancy.com or +971 56 688 9908.

2. Data we collect

We collect personal data in the following ways:

Data you provide directly

Name, email address, phone number, and company name when you submit a contact or enquiry form
Name, email address, and payment information when you engage our services
Name, email, CV, and application details when you submit a speculative job application
Any other information you choose to include in messages or forms on our website

Data collected automatically

Data from third parties

3. How we use your data

We use your personal data for the following purposes:

To respond to enquiries and provide information about our services
To deliver the marketing, branding, and web design services you have engaged us for
To send service-related communications including project updates and reports
To process payments and manage our business relationship with you
To review and respond to job applications
To improve our website and services through anonymised analytics
To comply with legal obligations

We do not use your personal data for automated decision making or profiling.

4. Legal basis for processing

Where UK GDPR applies, we process your personal data on the following legal bases:

Contract: Where processing is necessary to perform a contract with you or to take steps at your request before entering into one
Legitimate interests: Where processing is necessary for our legitimate business interests, including responding to enquiries, improving our services, and managing our business, provided those interests are not overridden by your rights
Legal obligation: Where processing is necessary to comply with a legal obligation
Consent: Where you have given clear consent, for example when subscribing to marketing communications

5. Sharing your data

We do not sell your personal data. We share your data only in the following circumstances:

Service providers: We share data with trusted third-party providers who assist in delivering our services, including email and CRM platforms (such as Klaviyo and GoHighLevel), analytics tools (such as Google Analytics), scheduling tools (such as Calendly), and form processing services. These providers are contractually required to handle your data securely and only for the purposes we specify.
Advertising platforms: In the course of managing paid media campaigns for clients, we may share relevant data with platforms including Meta and Google in accordance with their data processing agreements.
Legal requirements: We may disclose your data where required by law, regulation, or a valid legal request from a competent authority.
Business transfers: In the event of a merger, acquisition, or sale of GHM Consultancy, your data may be transferred to the acquiring entity, subject to the same privacy protections.

6. Data retention

We retain your personal data only for as long as necessary for the purposes described in this policy or as required by law:

Enquiry and contact form data: up to 24 months from the date of enquiry
Client data: for the duration of the engagement and up to 7 years thereafter for accounting and legal purposes
Job application data: up to 12 months from the date of application
Website analytics data: as configured in our analytics tools, typically 26 months

When data is no longer required, we securely delete or anonymise it.

7. Your rights

Depending on your location and applicable law, you may have the following rights regarding your personal data:

Access: The right to request a copy of the personal data we hold about you
Rectification: The right to request correction of inaccurate or incomplete data
Erasure: The right to request deletion of your personal data, subject to legal obligations that require us to retain it
Restriction: The right to request that we restrict processing of your data in certain circumstances
Portability: The right to receive your data in a structured, commonly used format where processing is based on consent or contract
Objection: The right to object to processing based on legitimate interests
Withdraw consent: Where processing is based on consent, the right to withdraw that consent at any time

To exercise any of these rights, contact us at hello@ghmconsultancy.com. We will respond within 30 days. We may need to verify your identity before processing your request.

If you are located in the UK and are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

8. Cookies

Our website uses cookies small text files stored on your device to support website functionality and analytics. We use the following types of cookies:

Essential cookies: Required for the website to function. These cannot be disabled.
Analytics cookies: Used to understand how visitors interact with our site, including pages visited and time spent. We use Google Analytics for this purpose. Data is anonymised where possible.
Marketing cookies: Used to track visitors across websites for the purpose of delivering relevant advertising. These are set by third-party platforms including Meta and Google where tracking pixels are in use.

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the website. Where required by law, we obtain consent before setting non essential cookies.

9. Third-party links

Our website may contain links to third party websites. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies before providing any personal data.

10. Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted data transmission (HTTPS), access controls on systems containing personal data, and limited access to personal data on a need-to-know basis.

No method of transmission over the internet is entirely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The updated policy will be published on this page with a revised effective date. We encourage you to review this page periodically.

12. Contact us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us: