Scope of this policy
This Privacy Policy explains how VELTRA DIGITAL SOLUTIONS, trading as Veltra Digital ("Veltra Digital", "we", "us"), collects, uses and protects personal information in connection with this website and the professional services we provide to our clients.
It applies to visitors to veltradigital.com, to prospective clients who contact us, and to the representatives of our business clients. It does not apply to third-party websites we link to, or to the websites and online stores we build and operate on behalf of clients, which are governed by those clients' own privacy policies.
We provide services to businesses. We do not knowingly market to or collect information from individuals acting as consumers outside a business context, and our services are not directed to children under 16.
Our role: controller and processor
Our responsibilities depend on the context in which we handle personal information.
- As a controller. For information collected through this website, our own marketing, our client relationships and our business administration, we decide why and how the information is used, and we are the controller.
- As a processor. When we work inside a client's systems, for example managing advertising accounts, configuring analytics and server-side tracking, building or maintaining an online store, or operating email and SMS programs, we handle end-customer information strictly on that client's documented instructions. In those cases the client is the controller and we act as a processor on their behalf, under a written agreement. See our Data Processing and Sub-processors page.
Information we collect
Information you give us. When you submit the contact form, email us, or speak with us about an engagement, we collect your name, email address, the website or store address you provide, the revenue range and service you select, and anything else you choose to include in your message.
Information we receive during an engagement. Business contact details for client personnel, account and billing information, and the credentials or delegated permissions required to perform the work. We request delegated access through platform-native permission systems wherever possible rather than shared passwords.
Information collected automatically. Our hosting provider processes standard server and security log data, including IP address, user agent, requested URL, timestamp and basic security signals, in order to deliver the site and protect it from abuse. This website does not run advertising pixels, analytics tags or visitor-tracking scripts of its own. See our Cookie Policy.
We do not collect special category data, government identifiers or payment card numbers through this website.
How we use information, and our legal bases
We are established in the United Arab Emirates and handle personal information in line with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Because we serve clients and markets in the United Kingdom, the European Union and the United States, we also apply the standards of the UK GDPR and the EU GDPR where they apply to the processing in question. On that basis we rely on the following legal bases.
| Purpose | Legal basis |
|---|---|
| Responding to enquiries and preparing proposals | Steps taken at your request prior to entering a contract; our legitimate interest in responding to business enquiries |
| Delivering and administering contracted services | Performance of a contract |
| Invoicing, accounting and tax records | Legal obligation; performance of a contract |
| Securing the website and preventing abuse | Legitimate interest in the security and integrity of our systems |
| Occasional updates to existing business contacts about our services | Legitimate interest in business-to-business marketing, subject to your right to object at any time |
| Establishing, exercising or defending legal claims | Legitimate interest; legal obligation |
We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not make decisions producing legal or similarly significant effects about you by automated means.
International transfers
We operate internationally and some of our providers process information outside the country in which you are located, including in the United States. Where information is transferred out of the United Kingdom or the European Economic Area, we rely on an adequacy decision where one applies, or on Standard Contractual Clauses together with the UK International Data Transfer Addendum, supported by additional safeguards where appropriate. You may request further information about the transfer mechanism applicable to a specific provider.
How long we keep information
| Category | Retention |
|---|---|
| Enquiries that do not become engagements | Up to 24 months from last contact |
| Client records and deliverables | Duration of the engagement, then up to 7 years |
| Invoices and accounting records | As required by applicable tax and company law, typically 6 to 7 years |
| Website security and server logs | Short-term, as applied by our hosting provider |
| Data processed on behalf of a client | Per that client's instructions; deleted or returned at the end of the engagement |
How we protect information
We maintain technical and organisational measures appropriate to the risk, including encryption in transit across our website and systems, access on a least-privilege and need-to-know basis, multi-factor authentication on business-critical accounts, use of delegated platform permissions in place of shared credentials, separation of client environments, secret management for credentials and API keys, and prompt revocation of access when an engagement or role ends.
No method of transmission or storage is completely secure. Where we are required to notify a personal data breach, we will do so without undue delay and, where we act as a processor, we will notify the affected client so they can meet their own obligations.
Your rights
Depending on where you live, you may have the right to access the personal information we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, to withdraw consent where processing is based on consent, and to object to direct marketing at any time.
If you are a resident of California or another US state with comparable legislation, you may also have the right to know what personal information we collect and disclose, to request deletion or correction, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act.
To exercise any right, email hello@veltradigital.com. We will respond within the period required by applicable law, normally within one month, and may ask for information needed to verify your identity. If your request concerns data we process on behalf of a client, we will refer you to that client as the controller and support their response.
You also have the right to lodge a complaint with your local supervisory authority, or with the UAE Data Office where the processing falls under UAE law. We would appreciate the chance to address your concern first.
Changes to this policy
We review this policy periodically and will update it when our practices, services or legal obligations change. The date at the top of this page shows when it was last revised. Material changes affecting an active engagement will be communicated directly to the client.
How to contact us
For privacy questions, data rights requests and all other enquiries: hello@veltradigital.com
Postal address: VELTRA DIGITAL SOLUTIONS, IFZA Business Park, Building A2, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates, Postal Code 342001