Privacy Policy

This website, legato.law, is run by Legato W.L.L. (“Legato”, “we”, “us”), a creative agency and production studio based at Bahrain Financial Harbour, Manama, Kingdom of Bahrain.

For the personal data described in this policy, Legato decides how and why it is used, so we are responsible for it under Bahrain’s Personal Data Protection Law (Law No. 30 of 2018, the “PDPL”).

If you have any question about this policy or about your data, email [email protected] or call +973 3366 1181.

When you contact us

Through our contact form we collect your name, email address, phone number, company, subject and message, and any services you select (such as Branding or Website). Email, company and subject are required; everything else is optional.

When you apply for a job

Through our careers form we collect your full name, email address, mobile number, the position you’re applying for, your CV, a link to your portfolio and anything you choose to tell us about yourself. Your CV may include other details, such as your education and work history — please share only what’s relevant to the role.

Automatically, when you send a form

To protect our forms from spam and abuse, we record the date and time of each submission, your IP address and your browser’s user-agent (a short technical description of your browser). Our server may also keep brief technical logs of requests for security and troubleshooting.

When you email or call us

We receive whatever you decide to share with us, such as your contact details and the content of your message.

Sensitive data

We don’t ask for sensitive personal data — for example information about your health, religious or philosophical beliefs, political opinions, ethnic origin or criminal record. Please leave it out of your messages and CV.

We use personal data only for clear, specific purposes:

• To reply to your enquiry and discuss a possible project with you.
• To consider your job application, contact you about it and, if you join us, prepare your employment.
• To keep our website and forms secure, and to prevent spam, fraud and abuse.
• To meet our legal obligations and to establish or defend legal claims.

We process personal data only where the PDPL allows it — for example, with your consent, where it’s needed to take steps you’ve asked for before entering into an agreement, to comply with the law, or for our legitimate interests where those aren’t overridden by your rights.

We don’t use your data for automated decision-making or profiling, and we never sell it.

We keep your data within Legato and share it only when we have to:

• Our team — only the people who need it to reply to you or to review applications.
• Service providers acting on our instructions, such as the providers that host our website and deliver our email. They may use your data only to provide their service to us.
• Authorities — when the law requires it.

We don’t sell, rent or trade personal data, and we don’t share it with advertisers.

Some of our service providers (for example, our email provider) may store or process data outside the Kingdom of Bahrain. When that happens, we transfer data only in the ways the PDPL permits — for example, to countries that offer an adequate level of protection, or with appropriate safeguards in place.

• Contact messages — for as long as we need to respond and follow up, and no longer than 24 months after our last exchange. If your enquiry becomes a project, the related records are kept for the life of the project and as the law requires.
• Job applications and CVs — for up to 12 months after we receive them, so we can consider you for the role and for similar openings, unless you ask us to delete them sooner. If you join Legato, your application becomes part of your employee file.
• Technical records (IP address, user-agent, server logs) — only as long as needed for security, then deleted.

When we no longer need personal data, we delete it or anonymise it securely.

Under the PDPL you have the right to:

• Access — ask whether we hold data about you and receive a copy of it.
• Rectification — ask us to correct data that is inaccurate or incomplete.
• Erasure — ask us to delete your data, for example to withdraw a job application.
• Objection — object to our processing of your data, including for direct marketing (which we don’t do).
• Withdraw consent — where we rely on your consent, you can withdraw it at any time. This doesn’t affect processing that happened before.

To use any of these rights, email [email protected]. We may ask you to confirm your identity first, and we’ll respond as quickly as we can and within the time the law requires.

If you’re unhappy with how we’ve handled your data, please tell us first so we can put it right. You also have the right to complain to Bahrain’s Personal Data Protection Authority.

• Our website is served over an encrypted (HTTPS) connection.
• Messages and applications are stored on a secured server. Access is password-protected and limited to authorised members of our team.
• CV files are stored under random file names and are never publicly accessible.
• Our forms are protected with rate limits and spam checks.

No method of sending or storing data is completely secure, but we work hard to protect your data and will act promptly if something goes wrong.

We don’t use advertising or tracking cookies, and we don’t set analytics cookies.

To make the site feel smooth, we keep a few small values in your browser’s sessionStorage — for example, to remember that you’ve already seen our intro animation in this tab, and to label the transition to the next page. These values don’t identify you, are never sent to us and are cleared when you close the tab.

Interactive map

The map on our contact page is provided by Google Maps and loads only if you choose “Load interactive map”. Once it loads, Google may set cookies and collect data under its own privacy policy.

Links to other sites

Our site links to other services — such as the Legato Studio website, Instagram, YouTube, the App Store and Google Play. Their own privacy policies apply when you visit them.

Our website and forms are intended for adults. We don’t knowingly collect personal data from children. If you believe a child has sent us their data, please contact us and we’ll delete it.

We may update this policy from time to time — for example, when we add a new feature or when the law changes. The date at the top of this page shows when it was last updated, and we’ll highlight significant changes here.

Questions, requests or concerns about your data? We’re happy to help.