Equipt

/ Privacy notice

Privacy notice.

Last reviewed: 2026-04-25

Tell a procurement officer, a buyer, and a regulator in three jurisdictions exactly what data Equipt holds, why we hold it, how long we hold it, and how to get it removed. One page; covers UAE PDPL, Qatar PDPPL (Law 13/2016), and KSA PDPL.

Who we are (controller and contact)

Equipt is the trading name of three legal entities; one of them is your data controller depending on which country you engaged us in.

  • UAE: Equipt LLC-FZ; controller for visitors landing on /ae.
  • Qatar: Equipt Supplier; controller for visitors landing on /qa.
  • KSA: Equipt KSA (currently dormant; reactivates on first signed lead); controller for visitors landing on /sa.

Single contact for all data queries: ivan@equipt.ae; subject line "Data request". We respond inside 14 working days.

What data we collect

  1. Lead enquiry data. Name, work email, segment, timeline, optional company, optional message, optional phone, country of enquiry. UTM parameters travel with the form payload.
  2. Booking data. When you pick a slot on /thanks, Cal.com captures your email, the slot you chose, and any answer you typed in the booking question.
  3. Site-usage data. Vercel Speed Insights and Vercel Analytics; cookieless and aggregated; no IP storage; no individual visitor profiles.

We do not collect government ID, financial data, health data, biometric data, location data beyond country of access, or social-graph data. We do not run Meta Pixel, Google Analytics 4, TikTok Pixel, or LinkedIn Insight Tag in v3.0.

Why we collect it (lawful basis)

  • Lead enquiry data: legitimate interest plus consent. UAE PDPL Article 4; Qatar PDPPL Article 4; KSA PDPL Article 6.
  • Booking data: consent plus contract performance.
  • Site-usage data: legitimate interest; cookieless.

How long we keep it

  • Lead enquiry data plus booking data: 24 months from last contact, then deleted from Odoo.
  • Site-usage data: aggregate only; 12-month rolling window in Vercel.
  • Email correspondence: kept for the life of the engagement plus 7 years for tax and audit (UAE FTA, Qatar GTA, KSA ZATCA retention).

Who we share it with

  1. Hosting and analytics: Vercel (EU region; Frankfurt edge); Vercel Speed Insights and Analytics, cookieless.
  2. CRM and email: Odoo Enterprise (Odoo S.A., Belgium; Odoo.sh hosted); Google Workspace (Google Ireland) for the equipt.ae and equipt.shop mailboxes.
  3. Operations: Cal.com (Cal.com Inc., US, with EU data-residency tier); Cloudflare Turnstile (Cloudflare Inc., US, anonymised); Telegram (internal alerts; no visitor data sent).

We do not sell your data; we do not share it with advertisers; we do not use it to train any third-party model.

Cross-border transfers

Your data may move from your country to the EU (Vercel, Google Workspace), to the US with EU-equivalent safeguards (Cal.com EU tier), and to the UAE (Wio invoicing context for UAE billing only). Each transfer relies on Standard Contractual Clauses or the regulator-approved equivalent in the receiving country.

Cookies

Strictly necessary cookies only at v3.0. No marketing pixels, no advertising cookies. Full table at /cookies.

Your rights

In all three jurisdictions you have the right to:

  • Access the data we hold on you.
  • Correct inaccurate data.
  • Erase data (subject to tax and audit retention above).
  • Object to processing.
  • Withdraw consent at any time.
  • UAE PDPL: right to portability; right to limit processing; 14-day response window.
  • Qatar PDPPL: right to refuse direct-marketing processing; complaint route to the Compliance and Data Protection Department of the Ministry of Communications.
  • KSA PDPL: right to know logic of automated decisions (we do not run automated decisioning on visitors in v3.0); complaint route to the Saudi Data and AI Authority (SDAIA).

Complaints

  • UAE: UAE Data Office.
  • Qatar: National Cyber Security Agency, Compliance and Data Protection Department.
  • KSA: Saudi Data and AI Authority (SDAIA).

We would rather you came to us first; the regulator route is always available.

Security measures

TLS on every page; access control on Odoo and Google Workspace via single-sign-on; least-privilege roles; encryption at rest on Odoo, Google Workspace, and Vercel; quarterly access review.

Updates to this policy

We update this page when our processing changes. Material changes get pushed to anyone who has an active enquiry inside 14 days.