What we collect, why, and what we will never do with it.

This notice explains how Katalyst Labs handles personal information collected through this website. Katalyst Labs is the controller of that information: it decides why the information is collected and how it is used.

Katalyst Labs is a hospitality commercial-strategy practice operating from the United Arab Emirates. Questions about this notice, or about information held about you, go to privacy@thekatalystlabs.com.

Most of what is held is information you choose to send through the diagnostic request form or the contact page.

• Contact and company information — your name, email address, phone or WhatsApp number, company or brand name, your role, and a website or social profile if you provide one.
• Commercial context — the market you operate in, the commercial pressure you describe, anything you have already tried, your approximate timing, and your preferred contact method. This is free text, so its content is entirely your choice.
• How you arrived — the page you submitted from, the referring website, and campaign tags (UTM values) in the link you followed. This shows which channels produce genuine enquiries.
• Technical and security records — our hosting and security provider, Cloudflare, creates request logs including IP address, approximate location, browser and device details, and timestamps. These support security, abuse prevention and basic performance measurement.
• Your privacy acknowledgement — the version of this notice shown to you and the time you confirmed it, recorded alongside your request.

Please do not include unnecessary sensitive personal information in free-text fields. A commercial diagnostic does not require health, financial-account, identity-document or similar details, and they should not be sent through this website.

Information submitted through this website is used to:

• review your request and judge whether Katalyst Labs is a suitable fit;
• reply to you, arrange an initial conversation, and answer follow-up questions;
• prepare for a possible engagement — for example scoping a diagnostic, outlining what it would cover, and preparing a proposal;
• keep this website secure, prevent spam and automated abuse, and measure basic performance;
• keep an accurate record of enquiries and of the privacy acknowledgement given.

Where the law requires a specific basis, the processing rests on your consent when you submit the form, on the steps taken at your request before entering an engagement, and on the legitimate interest in running and protecting a business website. Where consent is the applicable basis, you may withdraw it at any time by writing to privacy@thekatalystlabs.com. Withdrawing consent does not affect processing that already took place.

• Personal data is not sold, rented or traded.
• Submitting a request does not add you to a newsletter, mailing list or automated marketing sequence. Any marketing contact would need separate, explicit agreement.
• There are no decisions producing legal or similarly significant effects made solely by automated means, and no profiling of that kind.
• The privacy acknowledgement on the form is not marketing consent. It confirms only that you have read this notice.

A small number of service providers process information on behalf of Katalyst Labs, under contract and only for the purposes above.

• Cloudflare — website hosting, content delivery, security and privacy-focused analytics.
• Resend — delivery of transactional email, meaning the notification of your request and your acknowledgement message.
• Zoho — the business email service where enquiries and replies are received and stored.

These providers operate internationally, so your information may be processed on servers outside the United Arab Emirates, including in the European Union and the United States. Where a transfer requires safeguards, reliance is placed on the providers’ standard contractual protections. Information may also be disclosed where the law requires it.

Business enquiries are generally kept for up to 24 months after the last meaningful interaction, then deleted or anonymised. A shorter period applies where a request is clearly not a fit and no reply is needed. A longer period applies only where it is justified — for example an engagement that is under way, or records that must be kept for legal, tax or dispute-resolution reasons.

Security and request logs created by Cloudflare are kept for the shorter periods set by that service.

Depending on where you are located and which law applies, you may have the right to:

• ask what personal information is held about you and get a copy of it;
• have inaccurate or incomplete information corrected;
• ask for information to be deleted;
• ask that processing be restricted;
• object to processing carried out on the basis of legitimate interests;
• receive information you provided in a portable, machine-readable form, where that right applies;
• withdraw consent where consent is the basis for the processing.

To exercise any of these, write to privacy@thekatalystlabs.com. Requests are answered as promptly as practical, and enough information may be requested to confirm who you are before acting. You may also raise a concern with the data-protection authority responsible for your location.

Information is transmitted over encrypted connections, access to enquiry data is limited to those who need it, credentials are held as environment secrets rather than in code, and the request form is rate limited and protected against automated submissions.

These measures reduce risk but cannot eliminate it. No website, email system or transmission method can be guaranteed absolutely secure, and no such guarantee is made here.

This website and the diagnostic request process are intended for business users aged 18 or older, acting in a professional capacity. Services are not directed at children, and information is not knowingly collected from them. If you believe a child has submitted information, write to privacy@thekatalystlabs.com and it will be deleted.

This notice may be updated as the practice or its providers change. The version identifier below changes whenever the text materially changes, and the version you accepted is stored with your request, so what you agreed to remains identifiable even after this page is revised.