Privacy Policy — MN IDEAL COMPANY
Transparent information on how we collect, process, protect, and manage your personal data across our website and consulting services.
Who we are
This Privacy Policy explains how we collect and use personal data on www.mnidealcompany.com and when we provide our guides and consulting services. “MN IDEAL COMPANY” is the trading name used by two companies (together, “we”, “us”, “our”):
MN IDEAL COMPANY L.L.C-FZ
MN IDEAL COMPANY, S.L.
Which company is responsible for your data (the “controller”):
- •MN IDEAL COMPANY L.L.C-FZ is the controller for the website, user accounts, website analytics, and all purchases of guides and services made on the website and paid through Stripe.
- •For consulting services under a signed contract, the controller is the company named as the Contractor in that contract.
- •MN IDEAL COMPANY, S.L. acts as the representative of MN IDEAL COMPANY L.L.C-FZ in the European Union under Article 27 of the General Data Protection Regulation (GDPR). You may contact it on any data protection matter.
Whose data we process and what we collect
This Policy applies to website visitors, registered users, buyers of our guides and consultations, representatives of our business partners (such as recruitment agencies), and candidates whose data partners share with us under a consulting contract.
| Category | Data | Source |
|---|---|---|
| Account data | Full name, email address | You, when you register |
| Purchase data | Product or service bought, price, currency, date, billing name, email, country, payment status, Stripe transaction ID | You and Stripe |
| Communications | Your messages and the contact details you use to reach us (email, phone, messengers) | You |
| Business partner data | Name, position, company, business email and phone, company registration and bank details | You or your company |
| Candidate data | Name, date of birth, nationality, passport details, contact details, qualifications and work history, and other documents an employer or authority requires for a visa or work permit | The partner agency that refers the candidate, or the candidate |
| Technical data | IP address, browser and device type, pages visited, referring page, approximate location, cookie identifiers | Automatically, through cookies and similar technologies (Section 4) |
Passwords
We store passwords only in a one-way encrypted (hashed) form. We cannot see or recover your password.
Payment cards
Card details are entered directly into Stripe's secure form. They never reach our servers, and we do not see your full card number.
Uploads
The website currently has no document upload function. Candidate documents are exchanged only under a signed consulting contract.
Sensitive data
Some visa or work permit procedures require a medical certificate or a criminal record certificate. We process such documents only when the destination country requires them, only with the candidate's explicit consent, and only for that procedure.
Why we use your data and on what legal basis
We use personal data only for the purposes below. The legal bases are those of the GDPR; the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) recognises equivalent grounds.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and manage your account and keep you signed in | Account, technical | Performance of a contract (Art. 6(1)(b)) |
| Sell and deliver guides and consulting services | Account, purchase, communications | Performance of a contract (Art. 6(1)(b)) |
| Process payments and prevent fraud | Purchase, technical | Performance of a contract; Legitimate interest (Art. 6(1)(f)) |
| Issue invoices and keep accounting and tax records | Purchase, business partner | Legal obligation (Art. 6(1)(c)) |
| Provide consulting services to partner agencies | Business partner, communications | Performance of a contract (Art. 6(1)(b)) |
| Prepare employment and visa documents for referred candidates | Candidate | Candidate request (Art. 6(1)(b)) & Legitimate interest (Art. 6(1)(f)); Explicit consent for sensitive data (Art. 9(2)(a)) |
| Answer your questions and requests | Communications | Steps before contract (Art. 6(1)(b)) or Legitimate interest (Art. 6(1)(f)) |
| Measure website traffic and improve the website | Technical | Your consent (Art. 6(1)(a)) |
| Establish, exercise or defend legal claims | Any relevant data | Our legitimate interest (Art. 6(1)(f)) |
We do not send marketing messages without your consent. We do not sell personal data, and we do not make decisions about you based solely on automated processing.
Automated Support & AI Chatbot Assistance
When you contact us via WhatsApp, Telegram, or our website messaging channels, your inquiries may be processed by an automated AI assistant powered by Large Language Models (LLMs) to provide prompt informational support.
The AI assistant provides informational guidance only and does not make automated decisions that produce legal or similarly significant effects. You can request communication with a human specialist at any time during your consultation.
Cookies and authentication
Cookies are small text files stored by your browser. We use strictly necessary cookies without asking, because the website cannot work without them. We use analytics cookies only after you agree.
How sign-in works
When you log in, our server issues a signed JSON Web Token (JWT) and stores it in a cookie in your browser. On each request the token proves that you are signed in, so you do not have to enter your password again. The token contains your user identifier and an expiry time, not your password. It is deleted when you log out or when it expires.
| Cookie | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
| token (JWT) | Us | Keeps you signed in and protects your account | Strictly necessary | Until logout or 30 days |
| __stripe_mid, __stripe_sid | Stripe | Fraud prevention during payment | Strictly necessary | 1 year; 30 minutes |
| _ga, ga[ID] | Google Analytics | Counts visits and shows how the website is used | Analytics (consent) | Up to 2 years |
Your choice
You can accept or reject analytics cookies in our cookie banner and change your choice at any time. You can also block or delete cookies in your browser settings, but blocking strictly necessary cookies will prevent you from signing in.
Meta (Facebook) Pixel & Advertising Measurement
When you grant explicit marketing consent, we use the Meta Pixel operated by Meta Platforms Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) to evaluate advertising performance and measure campaign conversions.
Joint Controllership: Under Article 26 GDPR, MN IDEAL COMPANY and Meta Platforms Ireland Ltd. act as Joint Controllers for event data collection and transmission. Meta's Joint Controller Addendum applies. Once data is transmitted to Meta, Meta processes it as an independent controller. Details of Meta's data practices can be reviewed in the Meta Privacy Policy.
Payments
Online payments on the website are processed by Stripe on behalf of MN IDEAL COMPANY L.L.C-FZ. You enter your card details directly into Stripe's payment form.
From Stripe we receive only what we need to confirm and record your purchase: your name, email, country, card brand, the last four digits of the card, the amount, and the payment status. Stripe also processes payment data as an independent controller for its own purposes, such as fraud prevention and meeting financial regulations. See the Stripe Privacy Policy.
Payments under signed consulting contracts are made by bank transfer to the account of the contracting company named in the invoice.
Who receives your data and international transfers
We share personal data only with the recipients below and only as far as each needs it.
| Recipient | What they do | Location |
|---|---|---|
| Railway (Railway Corporation) | Hosts the website and its database | United States |
| Cloudinary | Stores and delivers website images | United States |
| Google (Analytics, Gmail) | Website statistics (with consent); email | EU and United States |
| Meta Platforms Ireland Ltd. | WhatsApp Business Cloud API messaging infrastructure; ad conversion measurement & marketing campaign optimization (strictly with marketing consent) | Ireland (EU) and United States |
| AI Service Providers (Google LLC / OpenAI LLC) | Processing of inbound customer consultation messages via secure API for automated AI assistance (data is not used to train public foundation models) | United States |
| Stripe | Payment processing | EU, United States and other countries |
| Our two group companies | Each may access data the other holds where needed to provide a service or for accounting | UAE and Spain |
| Employers, their local partners, consulates and immigration authorities | Receive candidate data needed for a job application, visa or work permit | EU countries and destination countries |
| Accountants, lawyers, auditors and public authorities | Professional advice, or where the law requires disclosure | Spain, UAE |
Our service providers act on our instructions under data processing agreements, except where this Policy says they act as independent controllers.
Transfers outside the European Economic Area
Some recipients, including our UAE company and US-based providers, are in countries without an EU adequacy decision. When we transfer data from the EEA to them, we rely on the EU-U.S. Data Privacy Framework where the provider is certified under it, or otherwise on the European Commission's Standard Contractual Clauses. Transfers between our two companies are covered by an intra-group data transfer agreement based on the Standard Contractual Clauses. You can request a copy of the relevant safeguards at mnidealcompany9@gmail.com.
How long we keep your data
We keep personal data only as long as the purpose requires, then delete or anonymise it.
| Data | Retention period |
|---|---|
| Account data | While your account is active; deleted within 30 days after you delete the account, or after 24 months of inactivity |
| Purchase, invoice and accounting records | As tax and commercial law requires: at least 5 years under UAE law and 6 years under Spanish law |
| Business partner and contract data | For the term of the contract, then 5 years for possible legal claims |
| Candidate data | For the term of the related contract, then 2 years, unless a longer period is needed for a legal claim or the candidate asks for earlier deletion |
| Communications | 2 years after our last contact |
| Analytics data | 14 months in Google Analytics |
| Authentication cookie | Until logout or token expiry |
Your rights
Depending on the law that applies to you, you have the right to:
- •Access the personal data we hold about you and get a copy
- •Correct inaccurate or incomplete data
- •Delete your data when we no longer need it or have no legal basis to keep it
- •Restrict our use of your data in certain cases
- •Portability: receive your data in a portable format and have it sent to another company
- •Object to processing based on our legitimate interests
- •Withdraw consent at any time, without affecting processing that took place before
To exercise a right, email mnidealcompany9@gmail.com. We may ask you to confirm your identity. We reply within one month; for complex requests we may extend this by up to two more months and will tell you why.
WhatsApp / Chatbot User Data Deletion: If you interacted with our WhatsApp bot and wish to erase your phone number and conversation records, please email us at mnidealcompany9@gmail.com with your phone number (including country code) and the subject “WhatsApp Data Deletion Request”. Your conversation records will be permanently erased from our database within 30 days.
Complaints
You can complain to a data protection authority. In Spain this is the Agencia Española de Protección de Datos (www.aepd.es). In the EU you can also contact the authority in your country of residence. In the UAE, complaints under the Personal Data Protection Law go to the UAE Data Office. We would appreciate the chance to resolve your concern first.
Security, age limit and changes
Security
We protect personal data with encrypted connections (HTTPS), hashed passwords, signed authentication tokens, and access limited to staff who need it. No system is completely secure. If a breach puts your rights at risk, we will notify you and the competent authority as the law requires.
Age limit
Our website and services are intended for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this Policy
We may update this Policy when our services or the law change. The date of the latest version appears at the top. We will notify registered users by email of significant changes before they take effect.