Privacy notice
Last updated: 12 October 2026
This notice explains how JOOM handles personal data connected with this website at byjoom.com (the Website) and with enquiries to us. It is written to meet the UK GDPR and the Data Protection Act 2018, and it also covers, where they apply, the EU General Data Protection Regulation (EU GDPR), the Egyptian Personal Data Protection Law No. 151 of 2020 and its executive regulations (the Egyptian PDPL), the Jordanian Personal Data Protection Law No. 24 of 2023 (the Jordanian PDPL), the Saudi Personal Data Protection Law (the Saudi PDPL), the UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021 (the UAE PDPL), and, where they apply, the privacy laws of individual US states.
Who is responsible
- The controller of personal data collected through the Website and by email to the addresses in the Legal notice is SAMADROCK LTD, trading as byJOOM ("JOOM", "we", "us"). Its company information is in the Legal notice.
- If responsibility for this data passes to another entity (for example a successor or related company), we will name that controller in this notice. For a particular project, the controller or joint controller of project data may be the contracting entity named in the engagement agreement, which will tell you.
- Privacy contact: legal@byjoom.com, subject "Privacy request". There is no separate form and no account.
What this Website collects, and what it does not
The Website is deliberately simple. It has no accounts, forms, comments, newsletter, payments, analytics, advertising, social-media plug-ins or third-party scripts or fonts. Pages, fonts and images are served from the Website itself. The Website itself therefore receives personal data in two ways only: through technical logs when a page is requested, and through preferences stored on your own device (see Cookies and similar technologies). If you contact us, we receive what you send.
Personal data we process
| Category | Examples | Where it comes from |
|---|---|---|
| Enquiry data | Your name, email address, organisation, role, phone number if you give it, the content of your message and any attachments, and our replies | You |
| Project and engagement data | Contact and billing details, the site, brief, ownership and funding information, drawings and correspondence, identification and due-diligence information that sanctions and anti-money-laundering law or our insurers require | You, your advisers, public registers |
| Technical data | IP address, date and time, pages requested, response code, browser and device type, and referring page, held in server and network logs | Your browser, our hosting and network providers |
| Preference data | Your chosen language, stored on your own device only | You (when you use the language toggle) |
| Applicant data | CV, portfolio, contact details, education and work history, and our notes on your application | You |
| Business-contact data | Names and business details of consultants, suppliers, contractors, collaborators and the public bodies we deal with | Them, public sources |
We do not intentionally collect special-category data (for example health, religion or political opinions) or criminal-offence data. Please do not send it unless a project requires it, and tell us if you do.
Why we use it, and our legal bases
| Purpose | Legal basis (UK GDPR / EU GDPR) | Law of Egypt, Jordan, Saudi Arabia and the UAE |
|---|---|---|
| Reading and answering your enquiry and discussing a possible project | Legitimate interests in running a design practice, and taking steps at your request before a contract (Art. 6(1)(f) and (b)) | Your consent, given by contacting us, and the legitimate purpose of answering you |
| Making and performing an agreement, invoicing and collecting payment | Contract (Art. 6(1)(b)) | Performance of the contract; legal obligation |
| Keeping accounts and tax records, handling regulatory, insurance and legal obligations, sanctions and anti-money-laundering checks | Legal obligation (Art. 6(1)(c)) and legitimate interests | Legal obligation |
| Keeping the Website secure, preventing misuse and diagnosing faults | Legitimate interests (Art. 6(1)(f)) | Legitimate interest and security duty |
| Remembering your language choice | Strictly necessary or functional preference at your request (see the cookies page) | Your consent by using the toggle |
| Establishing, exercising or defending legal claims, including building-defect claims | Legitimate interests (Art. 6(1)(f)) | Legal claims |
| Marketing | We do not send marketing email. If we ever do, we will ask for your consent first where the law requires it, and you can withdraw it at any time | Express consent as the PDPL requires |
Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can object (see "Your rights").
Who we share it with
We share personal data only where needed and only with:
- Technology providers that act on our instructions: email and domain-routing, hosting, network and security providers, and the mailbox provider that receives our email. These providers process IP addresses, email content and logs for us. They include Cloudflare, Inc. for domain and email routing and, once chosen, our hosting provider;
- Project participants: the Egyptian entities, related companies and other collaborators, consultants and contractors named in a project agreement, and the Client, where needed for the project;
- Professional advisers: lawyers, accountants, auditors, insurers and brokers;
- Public authorities and regulators: planning, building-control, tax, company-registration, professional and data-protection authorities, courts and law enforcement, where the law requires or allows;
- A buyer or successor of our business, under confidentiality, if we reorganise or sell the business.
We do not sell personal data or share it for advertising.
International transfers
JOOM works in the United Kingdom, the Arab Republic of Egypt, Jordan, the Kingdom of Saudi Arabia, the United Arab Emirates, the United States, Europe and other countries, so personal data may be sent between those countries and to our providers' systems, including in the United States. Where UK GDPR or EU GDPR applies, we transfer personal data outside the UK or the EEA only: to a country that the UK or EU treats as adequate; or with appropriate safeguards (such as the UK International Data Transfer Agreement or Addendum, or EU Standard Contractual Clauses); or in the other cases that data-protection law allows (for example, to perform a contract with you or at your request). Where the Egyptian PDPL applies, we transfer personal data out of Egypt only with any licence, permit or consent that the Egyptian PDPL and its regulations require. Where the Jordanian PDPL applies, we transfer personal data out of Jordan only as that law permits. Where the Saudi PDPL or the UAE PDPL applies, we transfer personal data out of the Kingdom or the UAE only on the conditions that law sets, for example adequate protection, consent or another legal basis. You can ask us for details of the safeguards used.
How long we keep it
| Data | Kept for |
|---|---|
| Enquiries that do not lead to a project | Up to 24 months after the last contact, then deleted |
| Agreements, project files, drawings and correspondence | For the project and then as long as claims can be brought, which for building design and defective premises can be 15 years or more under the law of the country concerned; we review project files regularly |
| Accounting and tax records | The period the law requires (in the United Kingdom, at least six years) |
| Technical logs | Normally no more than 90 days, unless needed to investigate a security incident |
| Job, graduate and internship applications | Up to 12 months after the application, unless you ask us to delete them sooner or we hire you |
| Preference data | Stays on your device until you clear it |
We may keep data for longer where needed for a legal claim, an investigation or a legal duty, and we will keep only what we need.
Your rights
Depending on where you live and which law applies, you have the right to:
- be told about how we use your data (this notice);
- ask for a copy of your data and information about its use (access);
- ask us to correct data that is wrong or incomplete;
- ask us to erase your data in some cases;
- ask us to restrict our use of it in some cases;
- receive the data you gave us in a portable format, where we use it on the basis of consent or contract and by automated means;
- object to our use based on legitimate interests, and to any direct marketing, at any time;
- withdraw consent at any time, without affecting what we did before;
- not be subject to a decision based solely on automated processing that has a legal or similarly significant effect (we do not make any such decisions);
- under the Egyptian PDPL: know, access, correct and erase your data, restrict and object to its use, and withdraw consent, as that law provides; and
- under the Jordanian PDPL: the corresponding rights of information, access, correction, deletion, restriction, objection and consent withdrawal that law provides;
- under the Saudi PDPL and the UAE PDPL: the rights those laws give, including to be informed, to access, to correct, to have data erased and to object or withdraw consent; and
- in the United States, where a state privacy law applies: the rights it gives, such as to know, access, correct, delete and opt out of certain uses.
How to use your rights
Write to legal@byjoom.com with the subject "Privacy request". We may need to verify your identity. We will reply within one month (UK and EU law), or within the period the applicable law sets, and we may extend it for complex requests as the law allows. There is no fee, unless a request is manifestly unfounded or excessive, in which case the law allows a reasonable fee or a refusal.
Complaints to a regulator
We would like to deal with your concern first (see Contacting us and complaints), but you can complain at any time to:
- United Kingdom: the Information Commissioner's Office (ico.org.uk, helpline 0303 123 1113);
- Europe: the supervisory authority of the country where you live, work or where the matter happened;
- Egypt: the Personal Data Protection Centre, or the competent authority designated under the Egyptian PDPL;
- Jordan: the authority or council designated under the Jordanian PDPL, or the competent court;
- Saudi Arabia: the Saudi Data and Artificial Intelligence Authority;
- United Arab Emirates: the UAE Data Office or, in the DIFC and ADGM, the data-protection commissioner of that zone;
- United States: the attorney general of your state or, in California, the California Privacy Protection Agency.
Security
We use reasonable technical and organisational measures to protect personal data, including encrypted connections to the Website, access controls and limiting access to those who need it. No transmission over the internet is completely secure. We will report personal-data breaches to the regulators and to you where the law requires and within the time it requires (in the United Kingdom, to the ICO within 72 hours where a breach is likely to risk individuals' rights; under the Egyptian PDPL, to the competent authority as that law requires).
Children
The Website is not directed at children, and we do not knowingly collect their personal data. If you think a child has sent us personal data, tell us and we will delete it.
Artificial intelligence and automated decisions
We do not make decisions about you solely by automated means. We do not sell your personal data, and we do not use enquiry data to profile you for advertising or to train artificial-intelligence models. If we introduce an AI tool that handles personal data, we will update this notice and carry out any assessment the law requires first.
Changes to this notice
We will update this notice when our practice or the law changes and show the date at the top of the page. For a significant change, we will make it clear on the Website.