Meet the studio, understand our process and discover how we move from first conversation to finished space.
Privacy Policy
When you use bellainteriordesign.com, Bella collects the information you choose to send through an enquiry and a limited set of first-party technical and interaction data used to run the site, protect forms, understand which enquiry routes are useful and attribute visits to campaign links. The current website does not embed Google Analytics, Meta Pixel or Microsoft Advertising tracking scripts, does not try to discover the email address or identity of an account signed into your browser, and does not sell website visitor data. By default, the application stores an anonymised version of your IP address plus a one-way IP hash for first-party event records; optional interaction analytics can be disabled from this page, and the updated tracker also respects Global Privacy Control and Do Not Track signals.
This policy describes the current website and enquiry-processing code supplied for Bella Interior Design. It does not replace project contracts, supplier privacy terms or separate notices that may apply when you later become a client, employee, supplier or business contact. Where a third-party website, social platform, external image host or other service is opened or loaded, that provider handles its own processing under its own terms.
Plain-Language Summary
We want you to know what happens before you submit a project brief or click a tracked enquiry link. The website is designed as a first-party lead and attribution system, not a covert identity system.
The enquiry form can store your name, phone, email, WhatsApp number, message, requested service, project location, property type, project stage, scope, budget range and preferred contact method. At least one contact method is required when the form is submitted.
When optional first-party interaction analytics are active, the browser creates a random Bella visitor ID in localStorage and a random session ID plus landing-page value in sessionStorage. These are Bella-created identifiers; they are not Google, Apple, Microsoft or social-network account IDs.
The tracker records clicks on elements marked as enquiry CTAs and start/submit events for forms specifically marked for enquiry tracking. It also records page/referrer and campaign-attribution context. The code does not contain a general mouse-movement recorder, keystroke logger, session replay tool or cross-site cookie scraper.
The application is configured to anonymise IPv4 by zeroing the last octet and IPv6 after the first 48 bits unless the server is deliberately configured to store full IP addresses. A one-way HMAC hash of the source IP is also stored for event correlation and abuse/security purposes.
The supplied code does not load Google Analytics, Meta Pixel or Microsoft Advertising scripts. It can preserve advertising click identifiers such as gclid, fbclid or msclkid when those values are already present in the page URL, but the current first-party tracking endpoint does not itself send those identifiers back to those advertising platforms.
Use the controls on this page. The tracker will also treat Global Privacy Control and an enabled Do Not Track signal as an opt-out for optional first-party interaction analytics. Essential form-security sessions and records created when you deliberately submit an enquiry still operate because they are needed to provide and protect the service you requested.
Who Is Responsible
For the processing described on this website, Bella Interior Design is the organisation deciding why the website collects enquiry and interaction data and how that data is used. The business is published on this website as an Abu Dhabi-based interior design company established in 2022.
The website does not currently publish a separate Data Protection Officer or dedicated privacy inbox in the database. Until a separate privacy contact is published, privacy requests can be sent to Bella through the active contact record shown on this page. We do not label that person as a DPO or privacy officer unless Bella formally appoints and publishes one.
What the Website Collects
The tables below reflect the fields actually present in the current code and database rather than a generic list copied from another company's policy.
The server validates email format when an email is provided and requires at least one contact method. The updated endpoint also requires the privacy-consent flag before storing a genuine enquiry.
The tracker does not attempt to read passwords, authentication headers, browser-account email addresses or another website's cookies.
Full IP storage is not the default. The code only stores the full source IP if the server administrator explicitly enables the BELLA_STORE_FULL_IP configuration option.
Cookies, Local Storage & Session Storage
bella_session
Browser cookieBrowser session
PHP session cookie used to support server-side session state and the CSRF token that protects enquiry form submissions. It is configured HttpOnly, SameSite=Lax and Secure when the request is HTTPS.
bella_visitor_id
localStoragePersists until cleared or you disable optional interaction analytics
Random first-party identifier used to recognise repeat website visits for Bella's own interaction attribution.
bella_session_id
sessionStorageCurrent browser-tab/session storage lifecycle
Random first-party identifier used to group enquiry-related interaction events during a browsing session.
bella_landing_page
sessionStorageCurrent browser-tab/session storage lifecycle
Stores the first page URL in the session so an eventual enquiry can be understood in its original visit context.
bella_analytics_opt_out
localStoragePersists until you change the choice or clear browser storage
Stores your choice to disable optional first-party interaction analytics.
The essential session cookie is separate from optional interaction analytics. Disabling optional analytics does not remove the server session needed to secure forms.
Why We Use the Data
Use your contact details, project brief and preferences to understand the request, respond, ask follow-up questions and prepare the next project conversation.
After the enquiry is stored in the database, the site builds an email notification containing the submitted project details and sends it to the configured Bella enquiry recipient. The database save can succeed even if the email notification itself fails.
Use first-party visitor/session identifiers, referrer, landing page, CTA events, UTM values and advertising click identifiers to understand which pages, campaigns and enquiry routes lead to project conversations.
Use CSRF session tokens, an anti-spam honeypot, IP-derived security data, event identifiers and technical request information to reduce abuse, troubleshoot issues and maintain system integrity.
Keep appropriate enquiry and operational records where reasonably necessary for business administration, dispute handling, compliance or the establishment, exercise or defence of legal rights.
Review aggregated interaction patterns to decide whether enquiry buttons, page routes and forms are understandable and useful. The current tracker is event-focused and does not perform session replay.
Applicable UAE Privacy Framework
The UAE's Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data forms the federal framework for personal-data protection. The UAE Government describes the law as covering electronic processing inside or outside the country, setting controls for companies that process personal data, protecting confidentiality and providing rights including correction and restriction or stopping of processing. It also addresses cross-border transfers.
Depending on the activity, processing may be based on your consent, on steps you ask us to take when you contact Bella, on legal or security requirements, or on another processing ground permitted by applicable law. We do not use this policy to claim a legal basis that does not fit the actual activity.
The Telecommunications and Digital Government Regulatory Authority also publishes guidance to website operators encouraging a clear privacy policy, collection of only necessary information, confidentiality and appropriate security, and explicit consent before making user information available to another party.
This section explains the framework Bella considered when drafting the website policy. It is not legal advice and does not determine the applicability of every rule to every future Bella activity.
Who May Receive Data
The project-enquiries contact and other authorised Bella personnel may access enquiry details where needed to respond, quote, coordinate or administer the relationship.
The site necessarily relies on technical service infrastructure to host the website, store database records and deliver the enquiry-notification email. Those providers can process technical data as part of providing infrastructure to Bella.
If a matter requires legal, technical, security or professional support, information may be shared to the extent reasonably needed and subject to appropriate confidentiality or contractual controls.
Information may be disclosed where Bella is legally required to do so or where necessary to establish, exercise or defend legal rights.
If you become a client and ask Bella to coordinate consultants, contractors, suppliers or other project participants, project information may be shared under the relevant project relationship. That later project processing is not created merely by visiting this website.
Third-Party Resources & External Links
The current site loads Plus Jakarta Sans and Parisienne through Google Fonts. Your browser therefore makes requests to Google-hosted font resources, which can expose normal web-request information such as IP address and user-agent data to Google under its own privacy terms.
Some service, location and style pages currently use temporary external image URLs. When such an image is displayed, your browser may request the image directly from that external host. Bella is progressively able to replace those references with owned/local assets, but this policy discloses the current possibility.
The header, footer and policy page link to Bella profiles on external platforms. A platform does not receive the contents of Bella's enquiry database simply because a link exists, but once you click through, that platform can process your visit under its own privacy terms.
The supplied website code does not contain those third-party analytics or advertising pixel libraries. If Bella adds them later, the policy and consent controls should be updated before or when those tools go live.
Your Privacy Choices
The controls below affect Bella's optional click/form interaction tracker on this browser. They do not prevent the essential session used for form security, and they do not prevent Bella from storing an enquiry you deliberately submit.
Essential operation remains active: the site can still use the `bella_session` cookie for CSRF protection, and submitting an enquiry creates the enquiry record plus a server-side `form_success` operational event tied to that submission. Disabling optional analytics stops future optional interaction events on this browser; it does not automatically erase event records already stored on the server, so use the privacy-request section if you want existing records reviewed or deleted.
How Long We Keep Data
Enquiry records may be kept while Bella is responding to the request, considering or delivering a project, maintaining reasonable business records, resolving disputes or meeting legal obligations. Interaction data may be kept while it remains useful for first-party attribution, security, troubleshooting and website improvement.
The supplied application does not currently contain an automated task that deletes `enquiries` or `enquiry_track` rows after a fixed number of days. Retention is therefore managed administratively rather than by a code-enforced time-to-live. We do not state an automatic deletion period that the system does not currently enforce.
If you want Bella to review, correct or delete information linked to your enquiry, contact us using the privacy-request details below. Deletion may be limited where retention is required by law, necessary for legal claims, or another lawful reason applies.
Security Measures in the Current Website
The current enquiry and tracking endpoints use prepared PDO statements rather than building SQL directly from visitor input.
Forms use a server-side session token and `hash_equals` verification before a genuine enquiry is processed.
The PHP session cookie is configured HttpOnly and SameSite=Lax, and is marked Secure when the site is accessed over HTTPS.
The enquiry endpoint removes control characters, applies length limits and validates email format before saving.
The source IP is reduced before storage unless full-IP storage is deliberately enabled by server configuration.
The tracking design expressly avoids collecting browser passwords, authentication headers, cross-site cookies or hidden browser-account identities.
Security also depends on hosting, server configuration, credentials, database access, backups and operational practices outside the PHP files. If you believe data submitted through the site has been compromised, contact Bella promptly.
Your Personal-Data Rights
The UAE Government's explanation of the federal Personal Data Protection Law includes rights to correct inaccurate personal data and to restrict or stop processing in relevant circumstances. The law itself contains further data-subject rights and conditions.
To protect your information, Bella may ask for enough information to verify that the person making a request is the person connected to the enquiry. Do not send passwords, payment-card data or unnecessary identity documents in the first privacy-request email.
Children & Sensitive Information
The website is not designed for children to submit their own personal information. If a project concerns a child's bedroom or family home, an adult should submit the enquiry.
Please do not place passport numbers, Emirates ID copies, passwords, card details, medical information or other sensitive personal data into the general project-message field unless Bella has specifically asked for that information through an appropriate secure process.
Cross-Border Processing
Some hosting, email, font-delivery, external-image or social-platform providers may process technical information in locations outside the UAE. Where cross-border personal-data transfer rules apply, Bella should use the transfer mechanism or safeguard required for the relevant provider and processing activity.
The federal Personal Data Protection Law includes requirements relating to cross-border transfer and sharing of personal data. Because infrastructure providers can change independently of the page design, this policy describes the category of transfer rather than promising that every technical request remains inside one country.
Policy Updates
Bella may update this policy when the website adds or removes forms, analytics tools, advertising pixels, CRM integrations, hosting providers, social embeds or other processing activities. The effective / last-reviewed date at the top of the policy should be updated when a material change is published.
If a future change materially affects how previously collected personal data is used, Bella should provide any additional notice or consent required by applicable law rather than relying only on a silent page edit.
Privacy Requests
Use the active contact details pulled from Bella's team database. For an email request, include 'Privacy Request' in the subject and enough information to identify the relevant enquiry, such as your name, approximate submission date and the contact detail you used.
Please do not send passwords, full payment-card details or unnecessary identity documents. Bella may ask for proportionate verification if needed before disclosing or deleting personal data.
Privacy FAQs
No. The current website and this policy do not provide for selling website visitor or enquiry data.
Not in the supplied current code. The site loads Google Fonts, but it does not include the Google Analytics JavaScript library. If Bella adds Google Analytics or another analytics platform later, the policy and privacy controls should be updated.
Not in the supplied current code. The first-party tracker can store fbclid, gclid or msclkid values if those click identifiers are already present in the page URL, but the current tracking endpoint does not itself send those values back to Meta, Google or Microsoft.
The updated first-party tracker stops sending optional CTA and tracked-form interaction events and removes Bella's visitor/session attribution identifiers from browser storage. The essential session used for form security remains available, and a deliberate enquiry submission is still stored so Bella can respond.
Yes in this updated code package. When Global Privacy Control is true or the browser reports an enabled Do Not Track value, optional first-party interaction analytics are treated as disabled.
Not by default. The current PHP helper anonymises the IP before storing it unless the server environment is deliberately configured with full-IP storage enabled. The system also stores a one-way HMAC hash derived from the source IP.
No. The current code does not attempt hidden account discovery and a normal website does not receive that account email merely because you are signed in to a browser service. Bella receives an email or phone number only when you provide it through the website or another direct communication.
Use the Privacy Requests section and identify the enquiry with the minimum information needed for Bella to locate it. Bella will review the request and any legal or record-keeping reason that may require some information to be retained.
The `bella_session` cookie supports the server-side session and CSRF token used to protect form submissions. It is an essential security function and is separate from Bella's optional interaction analytics identifiers.
The current website does not send the contents of Bella's enquiry database to social platforms simply because profile links exist. If you click an external social link, that platform processes your visit under its own terms.