Privacy Policy

Vantacrypt Digital FZCO ("we", "us", "our") is the data controller responsible for the personal data described in this policy. We are a Free Zone Company (FZCO) registered with IFZA — International Free Zone Authority under registration number 83055 and licence number 89824, with our registered office at IFZA Business Park, Dubai Silicon Oasis, Dubai, United Arab Emirates.

This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you can exercise. It applies to this website, to our dealings with client and supplier personnel, and to research participants.

Privacy enquiries and rights requests should be sent to info@vantacrypt.com.

We collect the following categories of personal data:

We do not intentionally collect special categories of personal data (such as health, religious or biometric data) and ask that you do not send such information to us.

• Directly from you — when you request a proposal, sign a scope of work, take part in research we are running, contact us or subscribe to updates.
• Automatically — through cookies and similar technologies when you use our websites, as described in our Cookie Policy.
• From third parties — payment providers (authorisation and fraud outcomes), advertising and analytics platforms we manage on a client's behalf, and screening or business-registry sources used for due diligence.

We do not sell personal data. We share it only where necessary, and only with recipients bound by confidentiality and data-protection obligations:

• Payment service providers and acquiring banks — to authorise, settle, refund and reconcile transactions, and to investigate disputes and chargebacks.
• Advertising and analytics platforms — where we operate a client's accounts on that client's instruction, under that platform's own terms.
• Technology providers — hosting, email delivery, project management, survey tooling and analytics.
• Professional advisers — auditors, accountants and lawyers, where required.
• Authorities and regulators — where we are legally required to disclose information, or to protect our rights and the safety of others.
• Successors in title — in connection with a corporate transaction, on terms preserving the protections in this policy.

We operate internationally and our service providers may process personal data outside the United Arab Emirates, including in the European Economic Area, the United Kingdom and the United States. Where we transfer personal data across borders, we do so on the basis of an adequacy decision or recognised safeguards such as standard contractual clauses, together with contractual confidentiality and security commitments from the recipient.

We keep personal data only as long as necessary for the purpose it was collected for, and to satisfy legal, accounting and reporting requirements. In practice:

• Engagement, invoice and transaction records — retained for the period required by UAE commercial and tax law, currently at least five years from the end of the relevant financial period.
• Client and enquiry correspondence — retained for up to 24 months after the matter is closed.
• Due-diligence and screening records — retained for at least five years after the business relationship ends.
• Marketing preferences — retained until you withdraw consent, plus a suppression record so we do not contact you again.

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit, access control on a least-privilege basis, separation of production and administrative systems, logging, and vendor due diligence for the providers we rely on.

Card data is handled exclusively by PCI-DSS compliant payment service providers. We do not store complete payment card numbers or security codes.

No system is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the relevant authority and affected individuals as required by applicable law.

Subject to applicable law, you may exercise the following rights in relation to your personal data. We extend these rights to all customers, wherever they are located.

• Access — obtain confirmation of whether we process your data and receive a copy of it.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — have data deleted where we no longer have a lawful reason to keep it.
• Restriction — ask us to limit processing while a concern is investigated.
• Portability — receive data you provided in a structured, machine-readable format.
• Objection — object to processing carried out on the basis of legitimate interests, and to direct marketing at any time.
• Withdraw consent — where processing is based on consent, withdraw it without affecting processing already carried out.

To exercise a right, email info@vantacrypt.com. We respond within 30 days and may need to verify your identity first. There is no charge unless a request is manifestly unfounded or excessive.

We send marketing only where you have opted in, or where you are an existing customer and the message relates to similar products or services. Every marketing email contains an unsubscribe link, and you can opt out at any time by writing to info@vantacrypt.com. Opting out of marketing does not stop transactional messages such as invoices and engagement updates.

Our websites use cookies and similar technologies. The categories used, their purpose and how to control them are described in our Cookie Policy.

Our services are business-to-business and are not directed at children. We do not knowingly collect personal data from anyone under 18, and we do not accept engagements that would require us to market to children. If you believe a child has provided us with personal data, contact us and we will delete it.

If you are unhappy with how we have handled your personal data, contact us first at info@vantacrypt.com so we can put it right. You also have the right to complain to the data-protection authority in the United Arab Emirates or, where applicable, to the supervisory authority in your country of residence.

We review this policy regularly and may update it to reflect changes to our operations or to the law. The current version is always published on this page with the date it last changed. Where a change materially affects how we use your data, we will bring it to your attention directly.