Vandyx ("Vandyx", "we", "us", or "our") respects your privacy. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you hold over it. It applies to this website and to the design, development, automation, and artificial intelligence services we provide.

1. Who we are

Vandyx acts as the data controller for personal data collected through this website and through our direct business relationships. Where we process personal data on behalf of a client as part of a paid engagement, we act as a data processor and handle that data only on documented instructions from the client under a separate agreement.

2. Information we collect

• Identity and contact data. Name, company name, role, email address, phone number, and any other detail you choose to provide through our forms, email, calls, or scheduling tools.
• Project data. Information about your business, systems, objectives, requirements, and any materials or credentials you share so that we can perform the services.
• Transaction data. Billing details, invoice records, and payment confirmations. Card details are processed by our payment providers and are never stored by us.
• Technical and usage data. IP address, device and browser type, operating system, referring pages, pages viewed, and interaction data collected through cookies and analytics tools.
• Communications data. The content of your messages, support requests, and, where you have been notified and consent is required, call recordings or transcripts.

We do not intentionally collect special category data such as health, biometric, or political information. Please do not send such data to us unless we have agreed in writing on how it will be handled.

3. How we use your information

• To respond to enquiries and prepare proposals
• To deliver, support, and improve our services and deliverables
• To manage contracts, invoicing, accounting, and record keeping
• To operate, secure, and improve our website and infrastructure
• To send service updates and, where permitted, relevant marketing that you can opt out of at any time
• To comply with legal obligations, enforce our agreements, and prevent fraud or misuse

4. Legal bases for processing

Where the General Data Protection Regulation or a similar law applies, we rely on the following legal bases:

• Contract. To take steps at your request before entering an agreement and to perform the services.
• Legitimate interests. To operate and secure our business, understand website performance, and communicate with business contacts, balanced against your rights.
• Consent. For non-essential cookies, marketing communications, and call recordings where consent is required. Consent may be withdrawn at any time.
• Legal obligation. For tax, accounting, and compliance requirements.

5. Artificial intelligence processing

Some of our services use artificial intelligence systems supplied by third-party providers, including language models and speech technologies. Where content you submit is processed by such a system, it is transmitted to that provider under its own terms and security controls. We select providers that offer business terms excluding customer content from model training where such an option is available, and we limit the data sent to what is necessary for the task. Please do not submit sensitive personal data into AI enabled features unless the engagement documentation expressly permits it.

6. Sharing your information

We do not sell or rent your personal data, and we do not share it for cross context behavioural advertising. We disclose personal data only to:

• Service providers acting on our behalf, such as hosting, analytics, email, scheduling, payment, and AI infrastructure providers, each bound by contractual confidentiality and security obligations
• Professional advisers such as accountants, auditors, and lawyers
• Authorities, regulators, or courts where disclosure is required by law or is necessary to establish, exercise, or defend legal claims
• A successor entity in connection with a merger, acquisition, or sale of assets, subject to this policy

7. International transfers

Our providers may process data in countries other than your own, including the United States. Where personal data is transferred out of the European Economic Area, the United Kingdom, or another region with transfer restrictions, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

8. Cookies and tracking technologies

We use strictly necessary cookies to operate the website and, subject to your choices where consent is required, analytics cookies to understand how the site is used. You can accept, refuse, or delete cookies through your browser settings. Blocking certain cookies may affect site functionality.

9. Data retention

We keep personal data only for as long as necessary for the purposes described in this policy. Enquiry records are typically retained for up to twenty four (24) months, client and project records for the duration of the engagement and for up to seven (7) years afterwards to satisfy tax, accounting, and legal requirements, and website analytics data for up to twenty six (26) months. Data is then deleted or anonymised.

10. Data security

We apply appropriate technical and organisational measures, including encryption in transit, access controls, credential management, and least privilege access, to protect personal data against unauthorised access, alteration, disclosure, or loss. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Where a personal data breach is likely to result in a risk to your rights, we will notify the relevant authority and affected individuals as required by law.

11. Your rights

Subject to applicable law, you may have the right to access your personal data, to request correction or deletion, to restrict or object to processing, to request portability, to withdraw consent, and to opt out of marketing. Residents of certain jurisdictions may also have the right to be free from discrimination for exercising these rights.

To exercise a right, contact us using the details below. We respond within thirty (30) days, or within the period required by applicable law. We may need to verify your identity before acting on a request. You also have the right to lodge a complaint with your local data protection authority.

12. Children's privacy

Our website and services are directed to businesses and are not intended for children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Third-party links

Our website may link to third-party websites and platforms. We are not responsible for their content, security, or privacy practices. Please review their privacy policies before providing them with any personal data.

14. Changes to this policy

We may update this Privacy Policy from time to time. The revised version takes effect when published on this page, and the date above is updated accordingly. Where changes are material, we will provide additional notice by email or through the website.

15. Contact us

For questions about this Privacy Policy or to exercise your rights, contact us at:
Email: moustafa@vandyx.com