Privacy Policy

Opsvanta Technologies FZ-LLC (“OpsVanta”, “we”, “us”) is the controller of the personal data described in this policy. We are a Free Zone Limited Liability Company registered with the Ras Al Khaimah Economic Zone Authority (RAKEZ) under registration number 0000004097331, in Ras Al Khaimah, United Arab Emirates.

We are part of the Red Ruby group. Red Ruby Enterprises Pvt. Ltd. provides shared delivery and administrative services to us and may process personal data on our behalf under the group information security management system.

For any question about this policy or about how we handle your data, contact info@opsvantatech.com.

This policy covers personal data we handle as a controller: data you give us through this website, by email, or in the course of a commercial relationship — for example as a prospective client, client contact, supplier or job applicant.

It does not cover personal data we process on behalf of a client while delivering an engagement. In that situation the client is the controller, we act as a processor, and the applicable terms are set out in the data processing agreement signed with that client — not in this policy.

Information you give us

When you submit the contact form we collect your name, email address and message, and — if you choose to provide them — your company name, phone number and the area of interest you select. If you email us directly, we receive whatever you include in that email.

Information collected automatically

Our hosting provider records standard server logs when a page is requested, including IP address, user agent, requested URL and timestamp. These logs exist for security and reliability purposes. We also record the IP address of contact-form submissions briefly in memory in order to rate-limit abuse.

What we do not collect

This website sets no cookies. We use no analytics, advertising, profiling or session-tracking technologies, and no third-party tracking pixels. Typefaces are self-hosted from our own domain, so loading a page makes no request to a third-party font service. We do not store anything in your browser’s local or session storage. There is therefore no cookie banner, because there is nothing to consent to.

• To respond to your enquiry and to discuss a possible engagement. Lawful basis: steps taken at your request prior to entering a contract, and our legitimate interest in responding to business enquiries.
• To manage a client, supplier or candidate relationship, including contracting, delivery, invoicing and support. Lawful basis: performance of a contract, and legitimate interests.
• To keep our systems secure — detecting abuse, rate-limiting and investigating incidents. Lawful basis: legitimate interests in protecting our service.
• To meet legal and regulatory obligations, including accounting, tax and records retention requirements. Lawful basis: legal obligation.

We do not sell personal data, we do not share it with advertisers, and we do not use it for automated decision-making or profiling. We will not add you to a marketing list because you sent us an enquiry.

We share personal data only with service providers who process it on our instructions under a written agreement, and with professional advisers or authorities where the law requires it.

A current list of sub-processors used in a specific client engagement is provided as part of vendor onboarding and maintained in the relevant data processing agreement.

We operate from the United Arab Emirates and work with group delivery teams in India, so personal data may be transferred outside the country in which you are located, including outside the European Economic Area. Where such a transfer involves data protected by the GDPR, we rely on an appropriate safeguard — typically the European Commission’s Standard Contractual Clauses — together with the technical and organisational measures described in our security policy. Where a client requires data to remain in a specific jurisdiction, that is agreed as a design constraint before the engagement begins.

• Enquiries that do not become engagements — retained for up to 24 months, then deleted.
• Client and supplier records — retained for the life of the relationship and then for as long as required by contract, tax and accounting law.
• Job applications — retained for up to 12 months unless you ask us to remove them sooner or agree to a longer period.
• Server logs — retained for a short operational period by our hosting provider. Rate-limiting records are held in memory only and are discarded when the service restarts.

Depending on where you are located and which law applies, you may have the right to access the personal data we hold about you, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to receive your data in a portable format, and to withdraw consent where processing is based on consent.

These rights arise under the EU and UK GDPR, UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), and India’s Digital Personal Data Protection Act 2023, as applicable to you.

To exercise a right, email info@opsvantatech.com with “Data request” in the subject line. We respond within 30 days and will not charge a fee for a reasonable request. We may ask you to verify your identity before we act.

If you are dissatisfied with our response, you may complain to your local data protection authority — in the UAE, the UAE Data Office; in the EEA or UK, your national supervisory authority.

Personal data is handled under the Red Ruby Enterprises Pvt. Ltd. information security management system, which includes access control on a least-privilege basis, multi-factor authentication, encryption in transit and at rest, logging, and a defined incident response process. Our security and compliance page sets out the control environment in more detail. No system is perfectly secure, but we will notify affected individuals and the relevant authority where a breach requires it.

This website and our services are directed at businesses. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this policy as our services or the law change. The effective date at the top of this page always reflects the current version. Where a change materially affects how we use personal data you have already given us, we will take reasonable steps to tell you directly.