Privacy Policy

Last updated: 4 August 2026 · Applies to all users of Markena worldwide.

This notice explains what personal data Markena collects, why we collect it, who we share it with, how long we keep it, and what rights you have. Please read it alongside our Terms of Service, Cookie Policy and Sub-processors page.

S H H P M services co LLC, a limited liability company registered in Dubai, United Arab Emirates under professional trade licence number 1183314, with its registered office at Office 43–44, Bin Darwish Building, Deira, Dubai, United Arab Emirates. We trade as Markena. In these terms "we", "us" and "our" mean S H H P M services co LLC.

This policy is general information about Markena's service and is not legal advice. Mandatory rights under applicable law are not limited by it.

1. Who this notice covers, and in what role

This notice applies to three different groups of people, and our legal role differs for each.

• Visitors to markena.co.uk — people browsing the marketing site, docs or blog. We are the controller.
• Customers and their users — people who hold or use a Markena account at app.markena.co.uk. We are the controller for account, billing, security and usage data.
• Your contacts and leads — people who message your website chatbot or your connected channels, whose details land in your workspace. For that data you are the controller and we are your processor, acting on your instructions under section 15 below.

The distinction matters. If someone asks us to delete data we hold about them as your lead, we will refer them to you, because it is your data and yours to decide about.

2. Which laws apply

Because we are established in the UAE and offer the service to customers in the UK and the EEA, more than one regime applies at the same time:

• UK GDPR and the Data Protection Act 2018, as amended — including relevant changes made by the Data (Use and Access) Act 2025, for our UK customers and visitors and for offering the service to people in the UK.
• EU GDPR (Regulation 2016/679) — on the same basis, for people in the European Economic Area.
• Privacy and Electronic Communications Regulations 2003 (PECR) — for cookies, similar storage technologies and electronic marketing to UK recipients.
• UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL) and its executive regulations — as the law of our place of establishment.

Where these regimes differ, we apply whichever gives the individual the stronger protection. Nothing in this notice takes away a right you have under any of them.

3. What personal data we collect

3.1 Data you give us

• Account data — your name, email address, a salted scrypt hash of your password (never the password itself), your chosen language, and your two-factor status.
• Business context — company details, services, target customers, goals, constraints, brand voice samples and any website content you ask us to analyse. This is what the AI agents work from. It is business information, but it may contain personal data if you put personal data into it.
• Billing data — your plan, credit balance, invoice history and subscription status. We never see or store your card number. Card details go directly to Stripe.
• Support correspondence — messages you send us and our replies.

3.2 Data we collect automatically

• Security and anti-abuse signals — IP address, a hashed device identifier, browser user agent, and your signup and login history, including the reasons any account was flagged for review.
• Usage data — which features you use, which agent tasks you run, and how many credits each one consumes.
• Technical logs — one structured line per HTTP request containing a request identifier, method, path, response status, duration and client IP.

3.3 Data we receive from third parties

• Google sign-in — if you sign in with Google we receive your Google account identifier, name, email address and whether that address is verified. We request the openid profile email scopes only. We do not request, receive or read the contents of your Gmail.
• Connected marketing accounts — where you link Google Ads, Search Console, Analytics 4, Business Profile or Meta Ads, we receive the reporting metrics you authorise and an encrypted access token. These connectors are read-only.
• Stripe — payment status, subscription events and the last four digits and brand of the card, for your invoice records.

4. Why we use it, and our lawful basis

Where we rely on legitimate interests, we have carried out a balancing assessment and concluded that our interest does not override your rights and freedoms. You may ask us for a summary of that assessment at privacy@markena.co.uk, and you have the right to object — see section 12.

Under the UAE PDPL we process on the equivalent bases of contractual necessity, legitimate interest, legal obligation and, for marketing, consent.

5. Artificial intelligence processing

This section matters more than any other, so we have set it out plainly.

5.1 What is sent where

To generate marketing output, we transmit your business context and your instructions to third-party AI model providers listed on our Sub-processors page. The transmission is encrypted in transit. The provider processes the request and returns generated text or media.

5.2 What we do not do

• We do not sell your data. Not to model providers, not to anyone.
• We do not use your business content to train our own models. We do not have our own models.
• We contract with our model providers on terms that prohibit them from using your content to train their foundation models. Where a provider's standard terms would allow training, we do not use that provider for customer content.

5.3 What you should not put in

Please do not paste customer personal data, payment card details, health information, government identifiers or any special-category data into agent prompts. It is not needed to produce marketing work, it widens your own exposure, and it puts data into a processing chain designed for business context rather than for sensitive records. If you do, you remain the controller for it and you are responsible for having a lawful basis.

5.4 Automated decision-making

Markena does not make decisions producing legal or similarly significant effects about you by automated means. Two processes deserve a specific mention:

• Trial-abuse scoring. New signups are scored against email, device, network and account-history signals. A high score does not ban an account — it places it in a queue for a human to review, and a person makes the decision. An IP address match alone never results in an automated block.
• AI-generated content. The agents produce drafts. A human on your team approves them. No decision about any person is made by the model.

6. Who we share personal data with

We share personal data only in the circumstances below, and never sell it.

• Sub-processors. The service providers listed on our Sub-processors page, each under a written contract containing the terms required by Article 28 UK/EU GDPR and the equivalent PDPL requirements.
• Providers you connect yourself. When you link Google, Meta, WordPress, Telegram or a similar service, that provider processes data under its own terms and its own relationship with you. They are not our sub-processors; you authorise each connection directly and can revoke it at any time.
• Professional advisers. Our lawyers, accountants and auditors, bound by professional confidentiality.
• Authorities. Where we are legally required to disclose, or where disclosure is necessary to establish, exercise or defend legal claims. We will tell you about a request unless we are legally prohibited from doing so.
• A successor. If the business or the relevant part of it is sold, merged or reorganised, personal data may transfer to the acquirer, who will remain bound by this notice until it gives you notice of any change.

7. International transfers

We are established in the UAE and our sub-processors operate in several jurisdictions, so personal data will be transferred outside the UK and the EEA.

For transfers from the UK we rely on the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, unless the destination has UK adequacy. For transfers from the EEA we rely on the EU Standard Contractual Clauses unless the destination benefits from an adequacy decision. For each transfer we carry out a transfer risk assessment and apply supplementary measures — encryption in transit and at rest, and access controls — where the assessment calls for them.

Transfers out of the UAE are made in accordance with Articles 22 and 23 of the PDPL.

You may request a copy of the relevant transfer safeguards and the destination information for an enabled provider at privacy@markena.co.uk.

8. How long we keep it

Where a retention period has expired but the data is needed for a live legal claim, we keep only what is needed for that claim, and only until it is resolved.

9. Security

We take the measures described on our Trust & security page, which include:

• Passwords hashed with salted scrypt. We cannot read your password and we will never ask you for it.
• Connected-account tokens and third-party API keys encrypted at rest with AES-256-GCM, under a key held separately from our session-signing key, and never returned to the browser.
• Two-factor authentication available on every account, staff and customer, with single-use backup codes. We strongly recommend enabling it.
• Staff and customer sessions kept distinct, stored only in browser sessionStorage , and scoped to separate origins so a marketing-site page can never reach a workspace session.
• Rate limiting on authentication and AI routes, applied per account as well as per network.
• Server-side controls preventing outbound fetches from reaching private or internal network addresses, with bounded download sizes.
• Response security headers including a strict content-security policy, frame denial, MIME-sniffing protection and a restrictive permissions policy.

No system is perfectly secure. If we become aware of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and we will tell affected individuals without undue delay where the risk is high.

10. Cookies and similar storage

Markena is deliberately light on tracking: no advertising cookies and no cross-site trackers. The full list of what we store and why is in the Cookie Policy.

11. Marketing communications

We send two kinds of email:

• Service email — verification, password reset, billing receipts, security alerts and product notices. These are part of the service and you cannot unsubscribe from them while you hold an account.
• Marketing email — our newsletter and product announcements. You receive these only if you asked for them, or under the PECR soft opt-in as an existing customer for our own similar products. Every one carries a working unsubscribe link, and unsubscribing takes effect immediately.

You can also withdraw consent at any time by emailing privacy@markena.co.uk. Withdrawing consent does not affect the lawfulness of processing before you withdrew it.

12. Your rights

Under the UK and EU GDPR you have the right to:

• Be informed — which is what this notice is for.
• Access a copy of the personal data we hold about you.
• Rectification of data that is inaccurate or incomplete.
• Erasure of your data where one of the grounds in Article 17 applies.
• Restriction of processing in the circumstances set out in Article 18.
• Data portability — to receive data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
• Object to processing based on legitimate interests, and to object to direct marketing at any time — an objection to direct marketing is absolute and we will always honour it.
• Withdraw consent where we rely on it.
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. As explained in section 5.4, we do not make such decisions.

Under the UAE PDPL you have equivalent rights of access, correction, erasure, restriction, portability and objection, together with the right to request that processing be stopped where it harms you.

How to exercise them

Email privacy@markena.co.uk from the address on your account, or write to us at the postal address in section 18. We will respond within one month. If your request is complex or you have made several, we may extend that by up to two further months and will tell you why within the first month.

We do not charge for responding, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse — and we will explain why and how to challenge that.

We may ask for information to confirm your identity. We ask for the minimum needed, and we do not use it for anything else.

Many of these rights you can exercise yourself and immediately: your business details, brand voice and workspace content are editable in Settings, and Settings → Export all my data downloads a server-side account export covering your workspace and feature records. Settings → Permanently delete account erases the account after re-authentication and confirmation.

13. Complaints

If you are unhappy with how we have handled your personal data, please tell us first at privacy@markena.co.uk — most issues are resolved quickly.

You also have the right to complain to a supervisory authority:

• United Kingdom — the Information Commissioner's Office, ico.org.uk, helpline 0303 123 1113.
• European Economic Area — the data protection authority in your country of residence, place of work, or where the alleged infringement occurred.
• United Arab Emirates — the UAE Data Office.

Complaining to a regulator does not affect any other remedy you may have, including a claim in the courts.

14. Children

Markena is a business tool and is not directed at children. You must be at least 18 to hold an account. We do not knowingly collect personal data from children. If you believe a child has given us personal data, tell us at privacy@markena.co.uk and we will delete it.

15. When we act as your processor

Leads, chatbot conversations, automation contacts and anything else about your customers is your data. For it:

• You are the controller and we are your processor. We process it only on your documented instructions, which are the instructions given by your use of the platform's features.
• We will assist you, so far as is reasonable, in responding to data-subject requests, in meeting your security obligations, and in carrying out data protection impact assessments.
• We will tell you without undue delay if we become aware of a breach affecting it.
• On termination we delete it in line with section 8, or return it to you if you ask before deletion.
• Our sub-processors for this data are the ones listed on the Sub-processors page. We will update that page before adding a new one.

Your own obligations as controller do not transfer to us. You need a lawful basis for collecting the data, a privacy notice of your own that covers it, and a retention period you have decided on. If you require a signed data processing agreement, email legal@markena.co.uk.

16. Third-party links

Our site and the product link to third-party websites and services. We are not responsible for their privacy practices. Read their notices before giving them your data.

17. Changes to this notice

We review this notice at least annually and whenever we change how we process personal data. When we make a material change we will update the date at the top, and we will notify account holders by email or an in-product notice at least 14 days before it takes effect, unless the change is required by law to take effect sooner. Continuing to use the service after a change takes effect means the updated notice applies to you.

18. How to contact us

S H H P M services co LLC, Office 43–44, Bin Darwish Building, Deira, Dubai, United Arab Emirates.

Privacy enquiries and data-subject requests: privacy@markena.co.uk
General support: support@markena.co.uk
Legal notices: legal@markena.co.uk
Security reports: security@markena.co.uk

We have not appointed a separate Data Protection Officer. The contact for all data-protection matters is privacy@markena.co.uk. Because we are established outside the UK and EEA, the operator reviews the Article 27 representative obligation for every territory in which the service is offered and will publish representative contact details in this section and on our contact page whenever an appointment is required.