Privacy Policy
This policy covers the personal data we handle as the operator of vega-sky.com: enquiries sent through the contact form, job applications, and the technical data a web server necessarily sees. It is written for the UAE Personal Data Protection Law first. Data we handle inside a client engagement is governed by that client’s contract rather than by this policy, and section 9 explains the difference.
Version 3.0, 12 September 2026
1. Who is responsible
This website is operated by VEGA SKY INFORMATION TECHNOLOGY SERVICES L.L.C, licensed in Dubai, United Arab Emirates under trade licence no. 1545530, at Office 304, 48 Burj Gate, Sheikh Zayed Road, Downtown, Dubai. For the personal data described in sections 2 to 8 we are the controller: we decide what is collected and why.
Privacy enquiries, and every request under section 8, go to privacy@vega-sky.com. That address reaches the people who can act on it.
2. The contact form
The form on the contact page is the main way this website collects personal data. What it collects, and whether you have to provide it:
| Field | Required? | What it is for |
|---|---|---|
| Full name | Required | To address you correctly in the reply |
| Work email | Required | To send the reply, and as the address a consultant replies to |
| Phone / WhatsApp | Required | To call you back where a written reply is not the quickest route |
| Company | Optional | Context for the reply |
| What you need help with | Required | To route the enquiry to the right consultant |
| How you heard about us | Optional | To understand which channels reach people. Submitted as referral_source, and it opens with no answer selected |
| Company size | Optional | To size the response. Opens with no answer selected |
| Indicative budget | Optional | The figure you have in mind, so we can tell you early whether we are the right fit. It is not a price of ours and there is no price list on this site |
| Your message | Required | The enquiry itself |
| Consent tick | Required | Recorded as evidence that you agreed, with the time, the language of the page and the version of the wording you were shown. Section 7 sets out exactly what is recorded |
The phone number is required. Some enquiries are answered in two minutes on a call and in three days by email, which is why we ask for one. It is more than a written reply strictly needs, and we would rather say that than pretend otherwise. If you would prefer not to give a number, email info@vega-sky.com directly; the address is on the contact page for exactly this reason, and an enquiry sent that way gets the same answer.
Where a submission goes
There is no third-party form service involved. The form posts to a script on this website’s own hosting, which checks the submission, formats it as a plain-text email and sends it to info@vega-sky.com. From that point it is an email in our mailbox, handled by our email provider. Nothing is written to a database and nothing is kept on the web server except what this section and section 4 describe.
What we add to the message
The email also carries the IP address the submission came from and the time it was received. These are not collected from you; they are properties of the request. They are there for one reason: so that after the fact we can tell an ordinary enquiry from an automated or abusive one, which is the only way to act on a pattern rather than on a single message. They are visible to the same people who read the mailbox, they are deleted when the email is deleted, we do not use them to locate or identify you, and we do not combine them with anything else.
We do not shorten or hash the address, and we would not describe either as making it anonymous if we did: a truncated or hashed address sitting next to a name and an email address in the same message still points at a person.
Automated abuse protection
The same script protects the form and the mail service behind it from automated or excessive submissions. To do that it temporarily processes the IP address a submission came from and the times submissions arrived, and nothing else.
The address itself is not kept in that protection data. What is held is temporary pseudonymous state, and it is held for that purpose alone. There is no list of visitors here and nothing that can be read as one.
How long it affects anything. A recorded time stops counting towards the protection after a short window. Once none of the times still counts, the state has no further purpose and is removed by an automated clean-up.
This is separate from the enquiry email. The full IP address and the time of receipt that travel in a successfully delivered enquiry are part of that email, and they follow the enquiry-email rule in section 6: a different record, kept for a different reason.
3. Job applications
Applications reach us by email at career@vega-sky.com. This website has no upload form: what we receive is what you send.
What we process: your name and contact details, your CV and covering message, and anything else you choose to include, such as employment history, education, certifications, references and attached documents. Please send only what is relevant to the role. We do not ask for a photograph, a date of birth, a marital status, a nationality or a copy of an identity document at application stage, and we would rather you did not send them.
Why: to assess your application for the role you applied for, and to contact you about it.
Who sees it: the people involved in hiring for that role. An application is an email, so our email provider processes it in the same way it processes every other message we receive (section 10).
How long: we keep an application while the role is open, and after it is filled or withdrawn only for as long as we may need it to answer a question about the decision we took. When that reason no longer applies, we delete it. We keep you in mind for a future role only if you ask us to, and only until you tell us to stop. Email career@vega-sky.com at any time and we will delete your application, or take you off file, without asking you for a reason.
4. What the web server necessarily sees
Serving a page means receiving a request, and a request carries an IP address, a time, the page asked for, the referring page where the browser sends one, and a user-agent string. Our hosting provider records these in access and error logs, which exist so that the site can be kept available and so that an attack on it can be investigated. Which fields that provider records, and how long it holds them, are set by the provider’s own configuration rather than by us. We do not copy those logs anywhere, and we do not use them to build a profile of a visitor. If you want to know what the current setting is, ask at privacy@vega-sky.com and we will tell you what it is on the day you ask.
5. What this site loads, and what it stores in your browser
Cookies and browser storage
As this site is delivered to you, it sets no cookies of its own and writes nothing to your browser’s storage. No analytics cookie, no preference cookie, nothing in local storage. There is no cookie banner, because in that state there is no choice to offer: a banner asking you to accept cookies that do not exist would be a control that decides nothing.
That describes the site as it arrives. One thing on it can change that, and only if you ask for it: the Google Maps frame described below. Once you press the button that loads it, Google may set cookies or use other browser storage inside that frame under its own terms. Nothing about that is under our control, which is exactly why it does not happen until you choose it.
Analytics: none
There is no analytics on this website. No Google Analytics, no Google Tag Manager, no measurement of any kind. No analytics code is loaded, no analytics request is made, and no analytics cookie is set. Nothing on this site counts your visit.
If analytics is ever switched on, this section will be rewritten before it runs, and it will not run before you have been asked. It would then name the tool, what it collects, the retention actually configured, and where the data goes. One thing we would not be able to promise, and would not write here, is that refusing produces no network traffic at all: Google documents a mode in which a container still sends measurement pings carrying no identifier when storage consent is denied.
External connections
Opening a page on this site contacts nobody but this site. The typefaces, the stylesheet, the scripts and the images are all served from this domain, so your browser makes no request to any other company in order to draw a page. Two things on the site can reach somewhere else, and both need you to act first:
- Google Maps, only if you ask for it. The home page and the contact page offer a map of our office. It is not loaded when you open the page: what you see is a button and an explanation of what pressing it does. Nothing is requested from Google until you press it. If you do, an embedded frame from Google loads, Google receives your IP address, and Google may store data in that frame under its own terms. A plain link is offered beside the button for anyone who would rather open the map in a new tab instead.
- WhatsApp. The WhatsApp buttons are ordinary links. Nothing is sent until you click one, and if you do, the conversation takes place on Meta’s platform under Meta’s terms and privacy policy rather than ours.
6. How long we keep things
The rows below are governed by a criterion rather than by a clock. Rather than give you a round number, we say what has to stop being true before something is deleted: that is a commitment you can hold us to, and it describes how these records are actually kept. Where a period is set by somebody other than us, such as our email provider or a legal requirement, the row says so.
| What | How long | Who sets it |
|---|---|---|
| Automated abuse-protection data | Kept only while it still affects the protection. Once it no longer does, it is eligible for deletion and is removed by an automated clean-up, as section 2 sets out | Enforced by the code |
| Enquiry emails from the contact form, including the IP address, timestamp and consent record in them | While the enquiry is live, and afterwards for as long as we may need it to pick the conversation back up, to answer a question about what we said, or to establish or defend a legal claim. When none of those applies, it is deleted | Ours, and this is the rule we apply |
| Job applications | As section 3 sets out: while the role is open, then only while we may need it to explain the decision. On file for future roles only at your request, and only until you say stop | Ours, and this is the rule we apply |
| Web server access and error logs | As long as the hosting provider’s own log configuration holds them. Ask and we will tell you what that is on the day you ask | The provider |
| Mailbox and its backups | Deleting an email removes it from the mailbox. A provider’s backup cycle can hold a copy for a period after that, and that period is the provider’s to set | The provider |
| Client engagement data | As the engagement contract requires, plus the period UAE tax and commercial law requires for records | Governed by the contract rather than by this policy |
None of this stops you asking us to delete something sooner. Ask, and we will, and you do not need to give a reason. Section 8 is how.
7. Consent, and the evidence of it
Two separate things, and we do not treat one as the other.
- Replying to your enquiry. The tick box on the contact form covers this and nothing else.
- Anything else. We have no newsletter and we send no marketing. If that changes it will be a separate, unticked, clearly labelled choice, and it will never be a condition of getting a reply.
- Client data. Personal data we encounter inside a client’s systems during an engagement is not covered by this tick at all. Section 9 explains who decides what happens to it.
What we record as evidence. The enquiry email carries a short block recording that the box was ticked, the moment the submission was received, the language of the page, the version of the consent wording that was on your screen, the version of this notice that wording referred to, and the exact sentence you agreed to.
Those version numbers come from our own configuration rather than from your browser. The page sends a short reference to the wording it displayed, and the server resolves that reference against its own register before it accepts anything. A page left open across a change of wording is therefore recorded as the wording it actually showed you. A submission whose reference the server cannot resolve is refused, with a message asking you to reload the page and send it again: we would rather ask you to press a button twice than file a record that cannot say which words you agreed to.
That is the whole record. No extra identifier, no separate log, nothing written to disk and nothing published anywhere. It lives in the enquiry email and is deleted with it.
Withdrawing. Email privacy@vega-sky.com and say so. We act on it when we receive it and in any event without undue delay; it takes effect then, and it does not make earlier processing unlawful. If there is a specific reason we must keep something despite your withdrawal, for example because we need it to comply with a legal obligation or to establish or defend a legal claim, we will tell you what we are keeping and why. We will not treat the possibility of a future contract as a general reason to carry on after you have asked us to stop.
8. Your rights, and how to use them
Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) you may ask us for a copy of your personal data (Article 13), for it in a portable form (Article 14), to correct or delete it (Article 15), to restrict how we process it (Article 16), or to stop processing it altogether, including for any direct marketing (Article 17). You may also object to a decision taken about you by automated means (Article 18); we take none.
If another country’s law applies to you, for instance because you are in the EU or the UK, you may have equivalent or wider rights, and we will deal with your request on that footing.
Making a request
Email privacy@vega-sky.com and say what you want. You do not need to use a form or cite an article.
Identity. We will ask for enough to be reasonably sure the request is yours, and no more. For an enquiry sent through this website, replying from the address you used is normally enough. We will not ask for a copy of a passport or an Emirates ID to answer a request about an email address, and you should be sceptical of anyone who does.
How quickly. We acknowledge a request as soon as we see it, and we answer it as quickly as the request allows. Deleting an enquiry is the work of a minute; assembling a copy of everything we hold takes longer. If your request is going to take longer than you would reasonably expect, we tell you that and we tell you when to expect the answer, rather than leaving you to wonder.
What we may not be able to do
A right can be limited by other law. We may keep a record longer than you ask if we need it to comply with a legal obligation, to establish or defend a legal claim, or where the law otherwise requires or permits it. If we refuse or limit a request we will tell you which of these applies.
Complaining
Tell us first, at privacy@vega-sky.com: it is the fastest route to a fix. You are entitled to go to the competent UAE authority instead, or as well, and nothing here asks you to come to us first. The Personal Data Protection Law gives that role to the data office established under Federal Decree-Law No. 44 of 2021. Ask us and we will give you its current public contact route as it stands on the day you ask. If another country’s law applies to you, you may complain to its regulator.
9. Visitors to this website, and clients
This policy is about the first. The distinction matters because the answer to “who decides what happens to this data” is different in each case.
As a visitor, sending an enquiry, applying for a job or reading a page, we are the controller. This policy applies in full and the rights in section 8 are exercised against us.
As a client, and in particular in a data-classification engagement where we necessarily encounter personal data inside your own systems, you are the controller and we act on your instructions as a processor. What we may do with that data, how long we keep it, who may see it and what happens at the end of the engagement are set by the services agreement and its data-processing terms rather than by this page. If you are an individual whose data sits in a client’s systems, your rights are exercised against that client; if you contact us we will tell you so and, where we are permitted to, pass the request on.
Which of the two roles applies is a question we answer engagement by engagement rather than by assuming. Some work makes us a processor for a client; some makes us a controller in our own right, for instance for the contact details of the people we deal with at a client.
10. Sharing, and sending data outside the UAE
We do not sell personal data and we do not share it for anyone else’s marketing.
The parties that come into contact with it are our hosting provider, which serves the website and keeps the logs in section 4; our email provider, which carries and stores the mailbox; Google, if you press the button that loads the map; professional advisers where we need advice; and any authority or court to whom the law requires us to disclose. We do not claim a shorter list than that, because a provider that stores our mailbox necessarily processes what is in it.
International transfer. Hosting and email are provided by companies that operate internationally, so personal data in the mailbox and in the server logs may be stored or processed outside the United Arab Emirates. Under the UAE Personal Data Protection Law, personal data may be transferred outside the State where the destination offers an adequate level of protection (Article 22), or under one of the specific grounds in Article 23, which include contractual safeguards and the data subject’s explicit consent.
We name providers and locations to a person who asks rather than on this page, and for a plain reason: a provider changes, a region changes, and a page naming yesterday’s arrangement is less accurate than a person answering today’s question. Write to privacy@vega-sky.com and ask where your enquiry is stored and who holds it, and you will get a specific answer.
11. Security
What is actually in place for this website: it is served over HTTPS; the form handler validates submissions and rejects malformed ones rather than passing them on, and refuses submissions that did not come from this site; it applies the flood protection in section 2; its state files sit outside the public directory; and the site sends a content-security policy restricting what a page may load and where it may send data. Access to the mailbox is limited to the people who need it.
We could write a longer list here without much effort. We have not, because a control described in a privacy policy and not implemented is worse than one that is simply absent. If you want to know whether a specific control is in place, ask.
No transmission over the internet is completely secure and this page does not claim the site is. If you believe data you sent us has been exposed, tell us at privacy@vega-sky.com and we will investigate.
12. Children
This is a business website and nothing on it is directed at children. We do not knowingly collect personal data from anyone under 18, and if you believe we have, tell us and we will delete it.
13. Changes to this policy
The version and effective date are at the top. When we change something that affects what we do with your data we change the version number, note what changed, and keep the previous version available on request so that you can see what applied when you contacted us. The consent record described in section 7 names the version you were shown, which is what makes that promise checkable rather than decorative. Editorial corrections do not get a new version number.