Privacy policy

Who we are. This website is run by Collaborative Architecture, Mumbai Studio (“Collaborative Architecture”, “we”, “us”), G/4, Amit Industrial Estate, Dr. S S Rao Road, Lalbaug, Mumbai 400012, India. We decide how personal data collected through the website is used, as its controller (in India’s terms, its data fiduciary).

Privacy contact. Nitika, Coordinator, handles every question and request under this policy:

• email: enquiry@collaborativearchitecture.com, with “Privacy” in the subject line;
• telephone: +91 22 4004 7007;
• post: the Mumbai Studio address above.

What it covers. Personal data we collect when you:

• visit the website;
• send an inquiry, including for a career or as a vendor;
• subscribe to our newsletter;
• write to us at one of our published email addresses.

It does not cover our project work for clients, which follows the terms of each engagement. Nor does it cover other websites we link to, such as Instagram, LinkedIn and YouTube, which have their own policies.

Which law applies. We follow this policy for everyone, wherever they live. Where the law of your country gives you more, Section 10 sets out what it adds, and that law prevails.

We collect only what we need to answer you and to run the website. The fields marked required on our forms are needed to reply; the rest are optional.

When	What we collect	Required or optional
You send an inquiry (Contact page)	Name, email address, country, type of inquiry (Client, Consultants, Research, Career, Vendors), the studio it is for, your message. The page it was sent from and the time.	Required
	Organization, telephone number, portfolio link (career inquiries)	Optional
You subscribe to the newsletter	Email address. Our newsletter service may record when an edition is opened and which links are clicked.	Required
You apply for a role	What you send with a career inquiry or by email: name, contact details, portfolio, CV and covering note	Your choice
You email us directly	Your name, email address and what you choose to write or attach	Your choice
You visit the website	Standard server logs kept by our host: internet (IP) address, browser and device type, pages requested, the page you came from, date and time	Automatic, for security and operation
You accept analytics	Through Google Analytics: pages viewed, time on the site, approximate location (city or country), device and browser, how you reached us	Only with your consent
A form’s security check runs (if enabled)	Through Cloudflare Turnstile: technical browser and device signals, and your IP address, to tell people from automated programs	Automatic, when the check is enabled

We do not ask for sensitive data, and we ask you not to send it. That includes health, religious or political beliefs, biometric data, identity numbers and financial details.

If you send someone else’s details, for example a colleague’s, please make sure they are content for you to do so.

We use personal data for these purposes only. The legal basis column uses the terms of the GDPR and the Saudi PDPL. Where a law relies mainly on consent, such as India’s DPDP Act, sending a form or an email is your consent to the use described here, and you may withdraw it at any time.

Purpose	Data used	Legal basis
Answer your inquiry, discuss a project, prepare a proposal	Inquiry and email details	Steps you ask for before a contract; our legitimate interest in replying to people who contact us
Consider you for a role	Career inquiry, portfolio, CV	Steps before a contract; your consent to keep it for future roles
Send the newsletter	Email address	Your consent (Mailchimp asks you to confirm it)
Run the website, keep it secure, stop spam and abuse	Server logs, security-check signals	Our legitimate interest in a secure, working site; legal obligations on security
Understand how the website is used, to improve it	Analytics data	Your consent, given in the cookie box
Work with clients, consultants and vendors once a project starts	Contact and correspondence details	Performance of a contract
Meet legal, tax and regulatory duties; establish or defend legal claims	Any of the above, as needed	Legal obligation; our legitimate interest in protecting our rights

What we do not do:

• We do not sell personal data, rent it out, or use it for advertising.
• We do not build profiles of visitors.
• We do not make decisions about anyone by automated means alone.

We do not use personal data for a new purpose without telling you, and, where the law requires it, asking for your consent.

The website sets no advertising or social-media tracking cookies. It uses a few small notes in your browser to work, and Google Analytics only if you accept it. Its fonts are served from our own server, so no font service learns of your visit.

Name	Set by	What it does	How long	When
Essential site storage	This website (browser storage)	Remembers your cookie choice, and keeps small notes that let the site work as you left it: the opening animation, the featured project, and your place on each page	Your cookie choice: 12 months. The rest: until you close the tab or clear your browser data	Always (essential)
_ga, _ga_[ID]	Google Analytics	Distinguish visitors and visits, to count them	Up to 2 years	Only after you accept analytics

Your choice. Choose “Accept all”, “Essential only” or your own settings in the cookie box.

• You can change your choice at any time through Cookie settings at the foot of every page.
• If you withdraw consent, analytics stop and the analytics cookies are removed.
• Your browser’s settings can also block or delete cookies; the site keeps working without them.

Films and links. Films on this site play from our own server and set no cookies. Films and pages on YouTube, Instagram, LinkedIn and other services open on those sites, under their own cookie policies. Our share buttons are plain links: nothing is sent to a social network unless you choose to share.

Change your cookie settings

Inside the studio, personal data is seen only by the people who need it. An inquiry goes to the team its type names:

• client, consultant and research inquiries → the client inquiries team;
• career inquiries → the careers team;
• vendor inquiries → the vendor team.

Inquiries marked for our Riyadh studio are passed to our team in Riyadh to answer.

Outside the studio, we use these service providers. Each acts on our instructions and may use the data only to provide its service to us.

Provider	What it does for us	Data it handles	Where
Google (Google Workspace)	Our email: delivers inquiries and newsletter sign-ups to our mailboxes	Inquiry and email contents	Google’s data centers worldwide
Our website host	Hosts the website and its form handlers; keeps server logs and a protected copy of each message sent through the site	Server logs, form contents	Its data centers
Mailchimp (Intuit)	Sends the newsletter and manages subscriptions	Email address, newsletter activity	United States
Google (Google Analytics)	Counts visits and shows how the site is used, only with your consent	Analytics data	United States and worldwide
Cloudflare (Turnstile), if enabled	Checks that a form is sent by a person	Browser signals, IP address	Worldwide

We may also share personal data when the law requires it, or to establish or defend a legal claim. That could be with a court, a regulator or the police, or with our professional advisers (lawyers, accountants and auditors) under a duty of confidence.

We do not pass your details to project consultants, collaborators or clients without your agreement.

We are based in India, and our team in Riyadh answers inquiries for the Riyadh studio. Our providers keep data in the United States and elsewhere (Section 5). So your personal data may be stored and used outside your country, including in countries whose laws protect it less than yours.

When we transfer personal data across borders, we do it only as your country’s law allows. Each transfer is protected, for example:

• From the EU, EEA, UK or Switzerland: an adequacy decision, or the standard contractual clauses approved for such transfers.
• From Saudi Arabia: a destination SDAIA recognizes as adequate, or the appropriate safeguards of the Transfer Regulation under the PDPL, such as standard contractual clauses.
• From other countries with transfer rules: the mechanism that law sets. That may be a contract, a transfer impact assessment, a regulator’s authorization, or your separate consent where the law requires it (Section 10).

For a copy of the safeguards that apply to your data, write to Nitika at enquiry@collaborativearchitecture.com.

We keep personal data only as long as the purpose needs it, then delete it or make it anonymous.

Data	How long
Inquiries that do not lead to a project	Up to 2 years after our last exchange
Inquiries that become a project	For the engagement, then as long as the law requires us to keep business records
Career applications	12 months; longer only with your consent, to consider you for future roles
Newsletter subscription	Until you unsubscribe. We then keep only your email address on a do-not-send list, so you are not added again by mistake.
Messages held as likely automated	90 days
Server logs	Up to 90 days, as set by our host
Analytics data	14 months
Your cookie choice	12 months

We may keep data longer only where the law requires it, or for an actual or likely legal claim, and then only for as long as needed.

How we delete it. We remove it from our mailboxes, our website’s protected folder and our providers’ systems. Backups are overwritten on their normal cycle, within 90 days.

Our principles. We handle personal data:

• lawfully, fairly and openly;
• for the purposes stated, and no more than they need;
• accurately, and only for as long as needed (Section 7);
• securely.

We are accountable for meeting these principles, and we consider privacy from the start whenever we change the website or our systems.

Security measures.

• The website is served only over encrypted connections (HTTPS), with modern security settings.
• Every message sent through a form is checked again on our server.
• The copies of messages we keep are in a folder closed to the internet.
• Passwords and keys are kept out of the website’s public code.
• Our email accounts use two-step sign-in.
• Access to personal data is limited to the people who need it for their work, and they are bound to keep it confidential.
• Our service providers are bound by contract to protect it.

No transmission over the internet can be guaranteed to be completely secure. Please do not send us information you consider highly confidential through the website.

If something goes wrong. If a breach of security puts personal data at risk, we act at once to contain it. We notify the relevant authority and the people affected, as and when the law requires.

Wherever you live, you can ask us to do any of the following. Some rights depend on the law of your country and on our reason for using the data; Section 10 notes the differences.

Right	What it means
To be informed	Know what we collect, why and how. This policy does that.
Access	Get confirmation of whether we hold your personal data, a summary of how we use it, and a copy of it
Correction	Have inaccurate or incomplete data corrected, completed or updated
Erasure	Have your data deleted, unless the law requires us to keep it
Restriction	Have us pause using your data while a question about it is resolved
Objection	Object to our use of your data based on legitimate interests. You can always object to direct marketing.
Portability	Receive the data you gave us in a common, machine-readable format, or have it sent to another organization
Withdraw consent	Withdraw consent you have given, at any time and as easily as you gave it. Use that has already taken place stays lawful.
Complain	Raise a concern with us, and with the data protection authority of your country (Section 10)

How to make a request.

1. Write to Nitika, Coordinator, at enquiry@collaborativearchitecture.com, with “Privacy request” in the subject line.
2. Tell us what you would like us to do, and the email address you used with us.
3. We may ask for information to confirm who you are before we act, so that no one else gets your data.
4. Someone acting for you, such as an authorized agent, needs your written permission.

What happens next.

• We reply in full within 30 days. Where the law of your country sets a shorter time, we meet it.
• If a request is complex and the law allows more time, we tell you within those 30 days, with the reason.
• Requests are free. Where the law allows, we may refuse, or charge a reasonable fee for, requests that are clearly unfounded or excessive. We explain why.
• If you are not satisfied with our answer, you can ask us to review it, or complain to your data protection authority.

Newsletter. Every edition has an unsubscribe link. You can also write to Nitika at enquiry@collaborativearchitecture.com to be removed.

Analytics. Use Cookie settings at the foot of any page.

We work in, and welcome visitors from, India, the Gulf, Asia, North Africa, Europe and the Americas. The table lists the laws of the countries where we are established or have projects, and of Europe, whose law reaches visitors we count with analytics. Where a law gives you more than this policy, that law applies.

Where you live	Law	Authority you can complain to	What it adds
India	Digital Personal Data Protection Act, 2023, and DPDP Rules, 2025. The Rules were notified on 13 November 2025, and their main duties apply from 13 May 2027. Until then, the Information Technology Act, 2000, and its 2011 rules on sensitive personal data apply.	Data Protection Board of India	Use based on consent or legitimate uses; the right to nominate; a Grievance Officer (below); grievances answered within 90 days at most
Saudi Arabia	Personal Data Protection Law (Royal Decree M/19 of 1443H, as amended), with its Implementing and Transfer Regulations; enforceable since 14 September 2024	Saudi Data & AI Authority (SDAIA)	Rights to be informed, to access and obtain a copy, to correction, to destruction and to withdraw consent; complaints and compensation; transfers only under the Transfer Regulation
United Arab Emirates	Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (in force since 2 January 2022; its Executive Regulations are still awaited)	UAE Data Office	Rights of access, correction, erasure, restriction, portability and objection
Bahrain	Law No. 30 of 2018 on the Protection of Personal Data	Personal Data Protection Authority	Rights of access, correction, objection and complaint
Qatar	Law No. 13 of 2016 on the Protection of Personal Data Privacy	National Cyber Security Agency	Rights of access, correction, withdrawal and objection
European Union and EEA (including Norway)	General Data Protection Regulation (EU) 2016/679	The supervisory authority where you live or work	The legal bases in Section 3 and every right in Section 9
United Kingdom	UK GDPR and the Data Protection Act 2018	Information Commissioner’s Office	As for the EU
Switzerland	Federal Act on Data Protection	Federal Data Protection and Information Commissioner	As for the EU, in substance

Anywhere else. If you live in another country, you have the rights your country’s law gives you, and this policy applies to you in full. Write to Nitika at enquiry@collaborativearchitecture.com and we will help.

India. Our Grievance Officer is Nitika, Coordinator, at enquiry@collaborativearchitecture.com and +91 22 4004 7007.

• We resolve a grievance within 30 days, and in any case within the 90 days the DPDP Rules allow.
• You may nominate someone to exercise your rights if you die or cannot act yourself. If you are not satisfied, you may complain to the Data Protection Board of India.

Saudi Arabia. Personal data collected through this website is stored on our website host’s servers and in the email and newsletter services in Section 5. We keep and destroy it as Section 7 describes.

European Union, EEA, United Kingdom and Switzerland. You may complain to the authority where you live or work, or where an infringement took place.

Children. This website is meant for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, tell us and we will delete it.

Links to other websites. The site links to our profiles on Instagram, LinkedIn, YouTube, Pinterest and X, and to publications, museums and partners. Those sites are run by others under their own privacy policies, which we do not control. Please read them before you share information there.

Automated decisions. We make no decision about anyone by automated means alone, and we do not profile visitors.

Changes to this policy. We update this policy when our website or the law changes in a way that affects it.

• We publish every change on this page, with its date.
• If a change matters to how we use data we already hold, we tell newsletter subscribers by email.
• Where the law requires it, we ask for your consent again.

Contact us. For any question, request or complaint about privacy:

• Who: Nitika, Coordinator, Collaborative Architecture.
• Email: enquiry@collaborativearchitecture.com, with “Privacy” in the subject line.
• Telephone: +91 22 4004 7007.
• Post: Collaborative Architecture, Mumbai Studio, G/4, Amit Industrial Estate, Dr. S S Rao Road, Lalbaug, Mumbai 400012, India.

Last updated: October 2026.