Privacy Policy

1. Who we are

This policy applies to the Entiqo marketing website (scalarstate.com/entiqo), the ScalarState corporate site (scalarstate.com), and the Entiqo client portal sign-in page (entiqo.scalarstate.com/login) — all operated by ScalarState Technologies W.L.L., a company incorporated in the Kingdom of Bahrain (CR 195284-1), with its registered address in Manama, Bahrain.

ScalarState acts as the Data Controller for all personal data collected through these websites and through the portal sign-in process. Contact us at [email protected] for any privacy-related enquiry.

Personal data held inside the client portal after you have signed in — your company's corporate records, filings, and documents — is processed on behalf of the client company under our separate engagement terms with that company. This policy covers the public websites and the act of signing in.

2. What data we collect

We collect personal data only when you voluntarily submit the consultation booking form on this site. The form collects:

• Full name — required
• Email address — required
• Company name — optional
• Message — optional; a description of what you need help with

On the client portal sign-in page (entiqo.scalarstate.com/login) we collect:

• Email address — required; used to send you a one-time access code
• One-time access code — a 6-digit code, stored only until it expires or is used
• IP address — processed transiently to rate-limit sign-in attempts and prevent abuse

We do not collect payment details, identification documents, or any special-category personal data through these sites. The portal has no self-service registration: an access code can only be issued to an email address already registered by us as a contact of an existing client company.

3. How we use your data

We use the data you submit through the contact form solely to:

• Respond to your consultation or service enquiry
• Follow up on your request by email

We use the data you submit on the portal sign-in page solely to:

• Send you a one-time access code and verify it
• Establish and maintain your authenticated session
• Rate-limit sign-in attempts to protect accounts against abuse

We do not use your data for automated decision-making, profiling, or unsolicited marketing. We will only contact you in connection with your submitted request or your use of the portal.

4. Legal basis

Under Bahrain's Personal Data Protection Law (PDPL, Law No. 30 of 2018), our legal basis for processing contact form data is your consent, given when you voluntarily complete and submit the form. You may withdraw consent at any time by contacting us at [email protected], and we will cease processing and delete your data upon request.

For portal sign-in data, our legal basis is the performance of the contract between ScalarState and the client company you represent: we cannot provide you access to the portal without authenticating you. Rate-limiting data (your IP address) is processed on the basis of our legitimate interest in securing the service against unauthorised access.

5. Third-party processors

We share your data with the following third-party service providers, who act as Data Processors on our behalf:

Each processor operates under its own privacy policy and data protection framework. We have reviewed their terms and are satisfied they provide adequate safeguards. No other third parties receive your personal data.

6. Cookies and tracking

Marketing website. The marketing and corporate sites do not set any cookies and do not use analytics tracking of any kind. No behavioural data, session data, or device fingerprints are collected or retained by ScalarState. The only network requests your browser makes are to serve fonts (Google Fonts) and to submit the contact form (web3forms.com) if you choose to do so.

Client portal sign-in. When you successfully sign in at entiqo.scalarstate.com, we set a single strictly necessary cookie named portal_session. It holds a random session token — not your email, name, or any readable personal data. It is HttpOnly (unreadable by scripts in your browser), restricted to our own site, transmitted only over HTTPS, and expires 30 days after sign-in or immediately when you sign out.

This cookie is required to keep you signed in; the portal cannot function without it. We set no analytics, advertising, profiling, or third-party cookies on any of our sites, which is why we do not show a cookie consent banner — there is nothing optional to consent to.

7. Data retention

Form submissions are retained for a maximum of 12 months from the date of submission, or from the date of last contact related to your enquiry, whichever is later. After this period, data is deleted from our systems and from web3forms.com in accordance with their data retention policy.

If you request deletion before the 12-month period, we will action the request within 30 days.

For the portal sign-in process: one-time access codes expire after 10 minutes and are invalidated once used. Session records expire after 30 days, or immediately when you sign out, at which point the session is revoked on our servers. Your contact record itself is retained for as long as you remain a registered contact of a client company.

8. Your rights

Under the Bahrain PDPL you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — request that inaccurate data be corrected
• Erasure — request deletion of your data
• Withdrawal of consent — withdraw consent at any time without affecting lawfulness of prior processing

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

9. Data security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. Form submissions are transmitted over HTTPS. We restrict internal access to enquiry data to personnel who need it to respond to your request.

Portal access is protected by one-time email codes rather than passwords, so no password is ever stored. Session cookies are HttpOnly and transmitted only over HTTPS. Sign-in attempts are rate-limited, and signing out revokes the session on our servers rather than merely clearing the cookie in your browser.

10. Changes to this policy

We may update this policy from time to time. The effective date at the top of this page reflects the most recent revision. Material changes will be noted on this page.

11. Contact

For any questions about this policy or how we handle your data:

ScalarState Technologies W.L.L.
CR 195284-1 · Manama, Kingdom of Bahrain
[email protected]