Legal

Privacy policy

Last updated: 20 October 2026

Draft. To be reviewed by a lawyer before trypipecheck.com goes live. Remove this line once approved.

PipeCheck builds, checks, fixes and runs sales CRMs for B2B companies in the GCC. This policy explains what personal data this website (trypipecheck.com) collects, why, who we share it with, and what rights you have. It covers the EU General Data Protection Regulation (GDPR), because the company that runs PipeCheck is registered in the EU, and the data protection laws of the GCC countries we serve.

1. Who is responsible

The controller of the personal data described in this policy is:

We have not appointed a Data Protection Officer, as the thresholds in Art. 37 GDPR are not met.

2. The free CRM health check form

When you ask for a free CRM health check, the form collects:

• your name, email address, mobile or WhatsApp number, company and country
• which CRM you use, how many people use it, and what's going wrong with it
• if you choose to give them: your role, the language you prefer for the call, and any notes

We use these details to contact you, book your 30-minute call, prepare for it, send you your health score and top three fixes, and follow up about our services afterwards. We don't sell your details or share them for anyone else's marketing.

Legal basis: Art. 6(1)(b) GDPR, steps taken at your request before a possible contract. Follow-up after the call: Art. 6(1)(f) GDPR, our legitimate interest in offering our services to businesses that asked about them. Under the GCC laws listed in section 9, we rely on the consent you give when you tick the box on the form. You can object to follow-up, or withdraw your consent, at any time.

The form's answers are stored in our own CRM, Zoho CRM, provided by Zoho Corporation and hosted in Zoho's data centre in the European Union. Our emails to you are sent through Zoho Mail, hosted in the same data centre. More at zoho.com/privacy.html.

3. Spam protection

The form is protected by Cloudflare Turnstile, which checks that a person, not a bot, is sending it. To do that it processes technical signals from your browser, such as your IP address and browser details. It does not show you puzzles in most cases, and it is not used to track you or to show you ads.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is keeping the form free of spam and abuse.

4. Data in your CRM during a health check or project

If you give us access to your CRM, or send us an export from it, the records in it (for example your customers' and prospects' contact details) stay yours. We process them only on your instructions, only to do the work you asked for, and under a data processing agreement signed before we start. Under the GDPR and the GCC laws we act as your processor, and you remain the controller.

We ask for read-only access wherever it's enough. We delete any export we received within 30 days of finishing the work it was needed for, and we remove our access when you ask or when our work ends.

5. Emailing or messaging us

If you write to hello@trypipecheck.com, legal@trypipecheck.com or message us on WhatsApp, we process your message and contact details to reply. Legal basis: Art. 6(1)(b) or (f) GDPR, depending on what you ask.

6. Hosting and server logs

This site is hosted by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. When you open a page, your browser sends technical data to Cloudflare's servers: your IP address, the page requested, the date and time, the referring page, and your browser and operating system. Cloudflare uses this to deliver the site and protect it from attacks. We don't combine this data with anything else.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is delivering the website reliably and securely.

7. Fonts

This site loads its fonts from Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which means your IP address is sent to Google when a page loads. Legal basis: Art. 6(1)(f) GDPR, our interest in a consistent, readable design. More at policies.google.com/privacy.

8. Cookies

We don't use analytics or advertising cookies, and we don't track you across sites. Cloudflare and Turnstile may use what they strictly need to deliver the site and protect the form.

9. If you are in the GCC

We also follow the data protection law of the country you are in:

• Saudi Arabia: the Personal Data Protection Law (PDPL), supervised by the Saudi Data and AI Authority (SDAIA)
• United Arab Emirates: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
• Qatar: Law No. 13 of 2016 on Personal Data Privacy Protection
• Bahrain: Law No. 30 of 2018, the Personal Data Protection Law
• Oman: the Personal Data Protection Law, Royal Decree No. 6 of 2022
• Kuwait: the Data Privacy Protection Regulation issued by the Communication and Information Technology Regulatory Authority (CITRA)

These laws give you rights similar to those in section 12, and you can use them the same way. You can also complain to the data protection authority in your country.

10. Transfers outside your country

Your health check request, and our emails with you, are stored by Zoho in the European Union. Cloudflare, which hosts the site and runs the spam check, is based in the USA and runs servers in many countries, so technical data such as your IP address may be processed outside your country. For transfers from the EU, we rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). For transfers from the GCC, we rely on the safeguards and conditions each country's law allows, including your consent on the form and our contracts with these providers.

11. How long we keep it

Health check requests and contact details are kept for two years after our last contact with you. CRM exports are deleted as described in section 4. If you become a client, we keep what the law requires for contracts and accounting, for as long as it requires.

12. Your rights

Under the GDPR you have the right to:

• Access (Art. 15): ask what data we hold about you
• Rectification (Art. 16): have inaccurate data corrected
• Erasure (Art. 17): have your data deleted
• Restriction (Art. 18): limit how we process it
• Data portability (Art. 20): receive it in a machine-readable format
• Object (Art. 21): object to processing based on legitimate interests, including follow-up about our services
• Withdraw consent: at any time, without affecting what we did before

To use any of these, email legal@trypipecheck.com. We reply within one month.

Right to complain. You can complain to a supervisory authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, www.aki.ee. You can also complain to the authority in your own country, including those listed in section 9.

13. Changes

We update this policy when the site or our services change. The date at the top shows the latest version.