Privacy Policy

1. Who is responsible for your data

Gavan Tech, the operating brand of Gavan Group Co. in Kuwait, is responsible for the personal information described in this policy. You can contact us using the details at the end of this page.

2. Information we collect

We collect information you provide directly and limited technical information generated when you use our services.

• Contact and project information, such as your name, company, email address, telephone number, project brief, budget, and preferred service.
• Communications, including website forms, WhatsApp messages, call details made available by our communication provider, and CRM notes created while assisting you.
• Website and device data, such as pages visited, approximate location, browser, device type, IP address, cookie identifiers, and security logs.
• Advertising and attribution data, including UTM parameters, GCLID, GBRAID, WBRAID, FBCLID, CTWA click identifiers, campaign codes, and conversion outcomes where available.
• Commercial records needed to prepare proposals, deliver projects, invoice clients, provide support, and meet legal obligations.

3. How we use information

• Respond to enquiries, prepare proposals, and provide requested services.
• Create and manage leads, projects, support requests, and client relationships in our CRM.
• Operate, secure, diagnose, and improve our website and business systems.
• Measure advertising performance and distinguish initial contacts from qualified leads and completed deals.
• Send service communications and, where permitted, relevant marketing communications.
• Prevent fraud, protect our rights, and comply with applicable laws and lawful requests.

4. Legal reasons for processing

Depending on the context, we process information with your consent, to take steps before or perform a contract, for our legitimate interests in operating and improving our business, or to meet legal obligations. You may withdraw consent where consent is the applicable basis, without affecting earlier lawful processing.

5. Service providers and platforms

We may share only the information needed with service providers that help us host, communicate, measure, advertise, secure, and operate our business. These may include cloud hosting, CRM and support systems, Meta and WhatsApp Business Platform, Google Analytics, Google Ads, email, telecommunications, and professional advisers. Their own terms and privacy policies may also apply when you use their services.

We do not sell personal information. We do not permit service providers to use it for unrelated purposes merely because they process it for us.

6. International processing

Some providers process information outside Kuwait. Where this occurs, we use reasonable contractual, technical, and organisational safeguards appropriate to the information and the service involved.

7. Retention and security

We retain information only for as long as reasonably necessary for the purposes above, including client support, attribution, accounting, dispute resolution, security, and legal requirements. Ordinary enquiry and attribution records are normally reviewed for deletion or anonymisation within 24 months when no active relationship or legal need remains.

We use access controls, encryption where appropriate, signed webhook validation, logging, backups, and staff access restrictions. No internet service can guarantee absolute security, but we work to reduce risk and respond to incidents responsibly.

8. Cookies and measurement choices

Our site may use essential storage and analytics or advertising technologies from providers such as Google and Meta. Browser settings and provider controls can limit non-essential cookies, but some measurement or site features may then be unavailable. Advertising identifiers are used for attribution and are not a substitute for a verified customer identity.

9. Your choices and rights

Subject to applicable law and appropriate identity verification, you may ask what information we hold about you, request correction, object to or restrict certain uses, withdraw consent, or request deletion. We may retain limited information where required for legal, security, accounting, or dispute purposes.

For deletion instructions, use the dedicated Data Deletion page linked below. Do not send passwords, one-time codes, or unnecessary identity documents with your request.

10. Children and policy updates

Our business services are not directed to children, and we do not knowingly seek personal information from children. We may update this policy when our services or legal obligations change. The current version and update date will always appear on this page.