Privacy Policy

1. Introduction

MangoEyes Infrastructure ("MangoEyes", "we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you visit our website at mangoeyes.co and interact with our services.

This policy applies solely to data collected through the mangoeyes.co website. Where we process data on behalf of our clients (such as medical and aesthetic clinics), that processing is governed by separate Data Processing Agreements between MangoEyes and each client.

This policy is provided in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU General Data Protection Regulation (EU GDPR) where applicable.

2. Data Controller

The data controller responsible for your personal data is:

MangoEyes is a registered entity in Dubai, United Arab Emirates. For data subjects located in the United Kingdom, our UK-registered company serves as our designated representative in accordance with Article 27 of the UK GDPR.

3. What Data We Collect

We may collect and process the following categories of personal data:

3.1 Information You Provide Directly

• Full name
• Email address
• Telephone number
• Clinic name and information
• Revenue and financial information related to your clinic
• Any other information submitted through our eligibility forms or contact forms

3.2 Information Collected Automatically

• Cookies and similar technologies: We use cookies to improve your experience and analyse site usage. Please refer to our Cookie Policy for full details.
• Analytics data: Including IP address, browser type, operating system, referring URLs, pages visited, and time spent on pages, collected via analytics tools.
• Video engagement tracking: Data about how you interact with video content on our site, including play, pause, and completion events, collected via our video hosting provider.

3.3 Scope of Data Collected

MangoEyes collects business enquiry and eligibility data only. We do not collect, store, or process any special category data as defined under the UK GDPR or UAE data protection law. The data we collect through this website relates solely to business enquiries from clinic owners and decision-makers evaluating our services.

4. Lawful Basis for Processing

We process your personal data on the following lawful bases:

• Consent (UK GDPR Article 6(1)(a)): When you submit information through our forms or accept non-essential cookies. You may withdraw your consent at any time by contacting us at privacy@mangoeyes.co.
• Legitimate interests (UK GDPR Article 6(1)(f)): For website analytics, improving our services, and business communications where we have a legitimate interest that does not override your rights and freedoms.
• Performance of a contract (UK GDPR Article 6(1)(b)): Where processing is necessary to provide our services to you following your enquiry or application.

5. How We Use Your Data

We use the personal data we collect for the following purposes:

• To assess your eligibility for our services
• To respond to your enquiries and communicate with you about our services
• To analyse website usage and improve our site performance
• To deliver and measure the effectiveness of advertising campaigns
• To understand how users engage with our video content
• To facilitate remarketing through advertising platforms using anonymised or pseudonymised audience data
• To comply with legal obligations

6. Third-Party Processors

We share your personal data with the following categories of third-party service providers who act as data processors on our behalf. All processors have entered into Data Processing Agreements with MangoEyes and maintain appropriate security measures.

A detailed list of specific sub-processors is available upon request by contacting privacy@mangoeyes.co.

7. Advertising and Retargeting

We use tracking technologies on this website, deployed through a tag management platform, to measure the effectiveness of our advertising campaigns and to improve our marketing efforts. This includes:

• Website activity tracking: When you visit our website, tracking tags may record information such as pages visited, time spent, and actions taken (e.g., form submissions, video views). This data is sent to our advertising platforms.
• Retargeting: If you visit our website and later browse other websites or social media platforms, you may see advertisements from MangoEyes. This is because our advertising platforms recognise your previous visit and display relevant content to you.
• Audience creation: We may use aggregated or pseudonymised visitor data to create similar or lookalike audiences on advertising platforms. This helps us reach other business owners who may benefit from our services.

These tracking technologies only operate if you have given your consent through our cookie consent banner. If you reject marketing cookies, no retargeting data will be collected. You can change your preferences at any time by clicking the "Manage Cookies" link in the footer.

8. Call Recordings

Where calls are made in connection with our services, these calls may be recorded for quality assurance and training purposes. Callers are informed at the start of every call that the conversation is being recorded.

These calls are used for initial qualification, appointment coordination, and enquiry handling. We use AI-powered calling tools to assist with initial lead qualification.

Call recordings are stored within our CRM platform (based in the United States) and are retained for a maximum of 12 months, after which they are securely deleted.

9. Data Access Locations

Your personal data may be accessed by authorised MangoEyes team members located in the following countries for the purposes described in this policy:

• United Kingdom — client services and operations
• Poland — operations, marketing, and administration
• India — marketing, advertising operations, and lead quality assurance

All team members with access to personal data are bound by contractual confidentiality obligations and internal data handling policies.

10. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Form submission data: Retained for 24 months from the date of submission, after which it is securely deleted unless there is an ongoing business relationship.
• Call recordings: Retained for a maximum of 12 months.
• Analytics data: Retained in accordance with the default retention periods set by each analytics provider.
• Cookie data: Retained for the duration specified in our Cookie Policy.

11. International Transfers

MangoEyes is headquartered in Dubai, United Arab Emirates. As our third-party processors are primarily based in the United States, and our team members access data from multiple countries, your personal data may be transferred internationally.

Where we transfer personal data outside the United Kingdom or European Economic Area, we ensure that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• The UK International Data Transfer Addendum to the EU SCCs
• Data Processing Agreements with all third-party processors
• Internal data handling policies and contractual confidentiality obligations for all team members

These measures ensure that your personal data receives an adequate level of protection regardless of where it is processed.

12. Your Rights

12.1 For UK and EU Data Subjects

Under the UK GDPR and EU GDPR, you have the following rights in relation to your personal data:

• Right of access: You have the right to request a copy of the personal data we hold about you.
• Right to rectification: You have the right to request that we correct any inaccurate or incomplete personal data.
• Right to erasure: You have the right to request that we delete your personal data in certain circumstances.
• Right to restriction of processing: You have the right to request that we restrict the processing of your personal data in certain circumstances.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to object: You have the right to object to the processing of your personal data where we rely on legitimate interests as our lawful basis.

12.2 For UAE Data Subjects

Under UAE Federal Decree-Law No. 45 of 2021, you have similar rights including the right to access, correct, and request deletion of your personal data.

12.3 For US, Canadian, and Australian Data Subjects

If you are located in the United States, Canada, or Australia, you may have additional rights under applicable local privacy legislation (including the California Consumer Privacy Act, the Personal Information Protection and Electronic Documents Act, or the Australian Privacy Act). To enquire about your specific rights, please contact us at privacy@mangoeyes.co.

13. How to Exercise Your Rights

To exercise any of the rights set out above, please contact us by email at privacy@mangoeyes.co.

We will respond to your request within one month of receipt. In certain circumstances, we may extend this period by a further two months, in which case we will inform you of the extension and the reasons for it.

14. Right to Complain

If you are not satisfied with how we handle your personal data or your rights request, you have the right to lodge a complaint with the relevant supervisory authority:

15. Client Data Processing

Where MangoEyes processes personal data on behalf of our clients, we act as a Data Processor. In these circumstances:

• The client is the Data Controller and determines the purposes and means of processing.
• MangoEyes processes data strictly in accordance with the client's instructions and a signed Data Processing Agreement (DPA).
• We handle lead and business enquiry data only through our white-labelled lead management platform.
• All sub-processors used in the delivery of our services are disclosed to the client within the DPA.
• Upon termination of services, client data is securely deleted or returned within 30 days in accordance with the DPA.

If you are a lead or enquiry of one of our client businesses and wish to exercise your data rights, please contact the business directly as the Data Controller. They may then instruct us to take the necessary action on their behalf.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated policy on this page with a revised "Last updated" date. We encourage you to review this policy periodically.

17. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at: