Equipt

Privacy notice

Privacy notice.

Last reviewed: 2026-06-01 (v4.0)

Tell a procurement officer, a buyer, and a regulator in three jurisdictions exactly what data Equipt holds, why we hold it, how long we hold it, and how to get it removed. One page; covers UAE PDPL, Qatar PDPPL (Law 13/2016), and KSA PDPL.

Who we are (controller and contact)

Equipt is the trading name of three legal entities; one of them is your data controller depending on which country you engaged us in.

  • UAE: Equipt LLC-FZ; controller for visitors landing on /ae.
  • Qatar: Equipt Supplier; controller for visitors landing on /qa.
  • KSA: Equipt KSA (currently dormant; reactivates on first signed lead); controller for visitors landing on /sa.

Single contact for all data queries: ivan@equipt.ae. Subject line "Data request". We respond inside 14 working days.

What data we collect

  1. Lead enquiry data. Name, work email, segment, timeline, optional company, optional message, optional phone, country of enquiry. UTM parameters travel with the form payload.
  2. Booking data. When you pick a slot on /thanks, Cal.com captures your email, the slot you chose, and any answer you typed in the booking question.
  3. Site-usage and advertising data. After you accept on the cookie banner, Google Analytics 4, Google Ads, and the Meta Pixel record which pages you view, which ad brought you, and which actions you take, so Equipt can measure campaigns, attribute enquiries, and build retargeting audiences. Until you accept, none of these load.

We do not collect government ID, financial data, health data, biometric data, location data beyond country of access, or social-graph data. Equipt runs Google Analytics 4, Google Ads, and the Meta Pixel, but only after you accept them on the cookie banner; Equipt does not run a TikTok Pixel or a LinkedIn Insight Tag.

Why we collect it (lawful basis)

  • Lead enquiry data: legitimate interest plus consent. UAE PDPL Article 4; Qatar PDPPL Article 4; KSA PDPL Article 6.
  • Booking data: consent plus contract performance.
  • Site-usage and advertising data: consent, given through the cookie banner and withdrawable at any time from the footer.

How long we keep it

  • Lead enquiry data plus booking data: 24 months from last contact, then deleted from Odoo.
  • Site-usage and advertising data: held by Google and Meta under their own retention controls; Equipt sets Google Analytics 4 retention to the shortest practical window and does not store this data in its own systems.
  • Email correspondence: kept for the life of the engagement plus 7 years for tax and audit (UAE FTA, Qatar GTA, KSA ZATCA retention).

Who we share it with

  1. Hosting: Vercel (EU region; Frankfurt edge).
  2. Analytics and advertising (only after you accept): Google (Google Analytics 4 and Google Ads; Google Ireland Limited and Google LLC, US) and Meta Platforms (Meta Pixel; Meta Platforms Ireland Limited and Meta Platforms, Inc., US). Equipt shares the behavioural signals these tools collect for measurement, attribution, and retargeting.
  3. CRM and email: Odoo Enterprise (Odoo S.A., Belgium; Odoo.sh hosted); Google Workspace (Google Ireland) for the equipt.ae and equipt.shop mailboxes.
  4. Operations: Cal.com (Cal.com Inc., US, with EU data-residency tier); Cloudflare Turnstile (Cloudflare Inc., US, anonymised); Telegram (internal alerts; no visitor data sent).

We do not sell your data. After you accept on the cookie banner, we share limited analytics and advertising signals with Google and Meta so we can measure our campaigns and show relevant ads; you can decline this, or withdraw it later, from the footer. We do not use your data to train any third-party model.

Cross-border transfers

Your data may move from your country to the EU (Vercel, Google Workspace), to the US with EU-equivalent safeguards (Cal.com EU tier), and to the UAE (Wio invoicing context for UAE billing only). Each transfer relies on Standard Contractual Clauses or the regulator-approved equivalent in the receiving country. When you accept analytics and advertising cookies, your data also moves to Google and Meta in the EU and the US under Standard Contractual Clauses.

Cookies

Strictly necessary cookies are always set. Analytics and advertising cookies (Google Analytics 4, Google Ads, the Meta Pixel) load only after you accept them on the cookie banner, and you can change your choice at any time from the footer. Full table at /cookies.

Your rights

In all three jurisdictions you have the right to:

  • Access the data we hold on you.
  • Correct inaccurate data.
  • Erase data (subject to tax and audit retention above).
  • Object to processing.
  • Withdraw consent at any time.
  • UAE PDPL: right to portability; right to limit processing; 14-day response window.
  • Qatar PDPPL: right to refuse direct-marketing processing; complaint route to the Compliance and Data Protection Department of the Ministry of Communications.
  • KSA PDPL: right to know logic of automated decisions (we do not run automated decisioning on visitors); complaint route to the Saudi Data and AI Authority (SDAIA).

Complaints

  • UAE: UAE Data Office.
  • Qatar: National Cyber Security Agency, Compliance and Data Protection Department.
  • KSA: Saudi Data and AI Authority (SDAIA).

We would rather you came to us first; the regulator route is always available.

Security measures

TLS on every page; access control on Odoo and Google Workspace via single-sign-on; least-privilege roles; encryption at rest on Odoo, Google Workspace, and Vercel; quarterly access review.

Updates to this policy

We update this page when our processing changes. Material changes get pushed to anyone who has an active enquiry inside 14 days.