Legal

Privacy Policy

1. Who we are

Vlomkat Solutions FZ-LLC (“Vlomkat”, “we”, “us”) is a Free Zone company registered in Ras Al Khaimah, United Arab Emirates. Our full company details are in the Imprint.

For personal information we collect through this website and through our own business operations (inquiries, correspondence, accounting), Vlomkat acts as the data controller. For personal information we handle on behalf of a client during a paid engagement (for example, a customer list you ask us to clean up, or contacts inside a CRM we help configure), Vlomkat acts as a data processor and processes that data strictly under the client’s instructions and the engagement agreement — this policy does not govern that processing.

For any privacy question, contact privacy@vlomkatsolutions.com.

2. What information we collect

We only collect what we need to reply to you and to deliver our consulting services:

  • Contact form data: name, business name, country, business type, website or social link, email address, phone or WhatsApp number, your preferred contact method, the topics you ticked, and the message you wrote.
  • Email and messaging correspondence: messages you send us directly by email, WhatsApp, or other channels you choose, including any attachments.
  • Engagement records: for clients, the documents, configurations, notes, and invoicing records produced during an engagement.
  • Technical data: standard server-side request logs (IP address, user-agent, referrer, timestamp) retained for security and abuse-prevention purposes, plus Google Analytics usage data if you accept analytics cookies.

We do not run advertising trackers or social pixels. We use Google Analytics only if you accept analytics cookies in the banner.

3. Why we use it

We use the information you give us to:

  • Reply to your inquiry and arrange an introductory call where relevant.
  • Deliver the services you engage us for (assessment, recommendations, implementation).
  • Issue invoices and keep accounting and tax records as required by UAE law.
  • Operate, secure, and improve this website and our internal tools.
  • Understand aggregate site visits and conversion interactions, such as successful contact-form submissions and booking-link selections, if you consent to analytics cookies.

We do not use your contact details for marketing or unsolicited outreach. If we ever introduce a newsletter or similar, it will be strictly opt-in.

Where the EU / UK GDPR applies to you, our lawful bases for processing are:

  • Steps prior to entering a contract (Art. 6(1)(b)) — when you submit the contact form or correspond with us about a possible engagement.
  • Performance of a contract (Art. 6(1)(b)) — when we deliver services under an engagement agreement.
  • Legal obligation (Art. 6(1)(c)) — for tax, accounting, and similar record-keeping required by UAE or other applicable law.
  • Legitimate interests (Art. 6(1)(f)) — for basic server logging, IT security, and protecting our business against fraud, abuse, and legal claims. We have weighed these interests against your rights and consider them proportionate.
  • Consent (Art. 6(1)(a)) — for Google Analytics cookies and similar analytics storage, where required by applicable law.

Where the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) applies, we process personal data with consent where required or under a specific Article 4 exception in that law, including when processing is necessary to perform or take steps toward a contract, comply with applicable UAE law, or establish or defend legal claims.

5. Who we share information with

We share personal information only with service providers and advisors we need to operate, including:

  • Contact-form processing — submissions are stored in Microsoft Azure Table Storage before Formspree receives a server-side copy for email notification.
  • Scheduling — if you choose the Cal.com booking link, Cal.com processes your name, email address, selected time, meeting location, booking details, and the source-attribution parameters included in that link to create, attribute, and manage the appointment.
  • Analytics — Google Analytics helps us understand aggregate website usage and consented conversion interactions if you accept analytics cookies.
  • Email and productivity — our email and document-storage providers (for sending replies and storing engagement files).
  • Messaging — WhatsApp / Meta, if you choose that channel to contact us.
  • Cloud infrastructure — reputable hosting providers for this website and our internal tools.
  • Professional advisors — accountants, auditors, and lawyers, where strictly required to meet a legal or regulatory obligation or to advise on a specific matter.
  • Authorities — where we are legally required to disclose information to a competent regulator, court, or law-enforcement body.

We do not sell, rent, or otherwise commercialise personal information.

6. International transfers

Because Vlomkat is based in the United Arab Emirates and some of our service providers are located in the United States, the European Economic Area, the United Kingdom, or other jurisdictions, your personal information may be transferred outside of your country of residence.

Where Armenian law applies to a transfer from Armenia, we follow Armenian transfer requirements separately from any EU or UK mechanism. We first confirm that the transfer is permitted by the data subject’s consent or is necessary for the stated processing purposes. A transfer may proceed without prior authorisation from the Armenian personal data protection authority only where the destination provides an adequate level of protection under Armenian law, including where the transfer is covered by an international treaty or the destination appears on the authority’s official list. For a destination that does not provide an adequate level of protection, we seek the authority’s prior authorisation and use a contract containing safeguards the authority accepts as sufficient. EU Standard Contractual Clauses or a UK transfer document do not by themselves satisfy or replace these Armenian requirements.

Separately, where the EU GDPR applies to a transfer from the EEA, we use an EU adequacy decision or another valid EU GDPR mechanism, such as the European Commission’s Standard Contractual Clauses, together with any required supplementary safeguards. Where the UK GDPR applies, we use UK adequacy regulations or a valid UK mechanism, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs; EU SCCs alone are not sufficient for a restricted transfer under the UK GDPR. If more than one regime applies, we satisfy each applicable regime rather than treating one mechanism as a substitute for another. You can request a copy of the relevant transfer-mechanism documentation by emailing privacy@vlomkatsolutions.com.

7. How long we keep it

We keep personal information only as long as we need it for the purposes described above:

  • Inquiries that don’t turn into engagements: deleted within twelve (12) months of last contact.
  • Client engagement records and correspondence: retained for the duration of the engagement and for a reasonable period afterwards to handle follow-up questions and warranty matters — typically up to two (2) years after engagement end.
  • Accounting, tax, and invoicing records: retained for the period required by UAE Federal Tax Authority rules and other applicable tax law (currently a minimum of five (5) years from the end of the relevant tax period) — or longer where a longer period is required by law.
  • Server logs: retained for up to ninety (90) days unless needed longer to investigate a specific security incident.

After these periods, data is deleted or irreversibly anonymised.

8. Your rights

Depending on where you live, you may have the right to:

  • access the personal information we hold about you;
  • have inaccurate or incomplete information corrected;
  • have your information deleted (the “right to be forgotten”);
  • restrict or object to certain processing;
  • receive your information in a portable, machine-readable format;
  • withdraw any consent you previously gave (without affecting the lawfulness of processing before the withdrawal); and
  • not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (see section 11).

To exercise any of these rights, email privacy@vlomkatsolutions.com. We may need to verify your identity before acting on a request. We handle each request within the deadline required by the law that applies to it. EU / EEA requests under the GDPR and UK requests under the UK GDPR are generally answered within one calendar month, subject to any extension permitted by law.

Where Armenian law applies, written requests for information about or access to personal data, and any reasoned written refusal, are handled within five days. Required completion, updating, correction, blocking, or destruction is carried out immediately or, if immediate action is not possible, within three working days. A withdrawal of consent submitted in writing with a signature, or electronically with a digital signature, requires us to stop processing and destroy the data within ten working days, unless law or a mutual agreement provides otherwise; we notify the individual within three working days after destruction. Other deadlines or verification requirements may apply depending on the request and jurisdiction, and we will explain any lawful extension or limitation.

You also have the right to lodge a complaint with a supervisory authority:

  • in the UAE: the UAE Data Office (the federal regulator under Federal Decree-Law No. 45 of 2021);
  • in the EU / EEA: your local Data Protection Authority;
  • in the UK: the Information Commissioner’s Office (ICO).

We’d appreciate the chance to address your concern directly first — please write to us before contacting a regulator.

9. Cookies & local storage

Before you make an analytics choice, this site does not set analytics cookies or store an analytics decision. On the .com site, accepting or rejecting analytics stores the value in localStorage under vlomkat_analytics_consent so the banner does not ask again. The site does not use sessionStorage or IndexedDB.

If you accept analytics on .com, we load Google Analytics using measurement ID G-BCVHX1C02T. Google Analytics may then use cookies or similar technologies to help us understand aggregate site visits, pages viewed, device/browser information, approximate location, referral source, and interactions such as successful contact-form submissions and booking-link selections. Conversion events do not include the contents of your inquiry or your contact details. If you reject analytics, Google Analytics is not loaded. Clearing this site’s browser storage resets your choice.

You can revisit or withdraw your analytics choice at any time using the “Analytics settings” control in the footer. Rejecting after acceptance stops further analytics on this site, removes its first-party Google Analytics cookies where the browser permits, and reloads the page. Withdrawal does not affect processing that occurred before it.

10. Security

We use reasonable, industry-standard measures to protect personal information: HTTPS in transit, access controls on stored data, encrypted storage where supported by the provider, and a strict need-to-know policy inside the business. No system is perfectly secure, but we treat the data you share carefully.

If we become aware of a personal data breach or another incident affecting personal information, we will investigate and contain it, and make any notification, publication, or report required by Armenian law or any other law that applies to the incident. Where Armenian law applies to a leak of personal data from an electronic system, we will immediately publish a notice and simultaneously notify the Police of the Republic of Armenia and the authorised personal data protection body. Depending on the applicable law and circumstances, we may also need to notify other regulators, affected individuals, clients, or other parties. We do not use a GDPR-style risk-to-rights-and-freedoms test as the sole trigger for incident reporting.

11. Automated decisions & profiling

We do not make decisions about you based solely on automated processing (including profiling) that produce legal or similarly significant effects. Any AI tools we may use internally support human decision-making and do not replace it. If this ever changes, we will update this policy and tell you what choices you have.

12. Children’s privacy

Our services and this website are aimed at businesses and adult professionals. We do not knowingly collect personal information from anyone under the age of 18. If you believe a child has provided us with personal information, please contact privacy@vlomkatsolutions.com and we will delete it.

13. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top will reflect any change. Material changes will be highlighted clearly and, where required by law, communicated to affected individuals directly.

14. Contact us

Questions about this policy or about how we handle your information? Email privacy@vlomkatsolutions.com. Full company details are in the Imprint.