Privacy policy

• VulnXperts Consultancy W.L.L. is the controller of the personal data described in this policy.
• We collect the personal data you provide through the contact form, the demo scheduler and emails to us, and technical information that your browser sends when you use the Website.
• We use it to respond to your enquiry, to schedule and hold demonstrations, to protect our forms and to operate the Website. We use Google Analytics and send product updates only with your consent.
• We share personal data with our service providers Zoho, Google, Hostinger and Microsoft, some of which process it in the United States. We do not sell personal data.
• You may ask for access to your personal data, ask us to correct or erase it, object to its processing and withdraw your consent, as described in “Your rights”.

VulnXperts Consultancy W.L.L. (“VulnXperts”, “we”, “us” or “our”) is the controller of the personal data described in this policy. Vikax is a product of VulnXperts. In this policy, “you” means the person whose personal data we process.

Our address is Building 2648, Road 5720, Block 257, Amwaj, Bahrain. You can contact us at hello@vikax.app or by telephone on +973 1725 0364.

This policy applies to personal data we collect when you visit the website at vikax.app (the “Website”), use the contact form or the demo scheduler, or email us at hello@vikax.app.

It does not apply to the Vikax product, which is governed by a separate agreement, or to third-party websites linked from the Website, which have their own policies.

We are established in the Kingdom of Bahrain, and our processing of personal data is subject to the Personal Data Protection Law (Law No. 30 of 2018) (the “PDPL”). Where you are located in the European Economic Area or the United Kingdom, the General Data Protection Regulation (the “GDPR”) or the UK GDPR may also apply.

• Contact form. When you submit the contact form, we collect your first and last name, work email address, company, job title (if provided), the topic you select and your message. We also record your acknowledgement of this policy and whether you have asked to receive product updates. We use this information to respond to your enquiry. It is stored as a lead in Zoho CRM and identified as originating from the Website.
• Demo scheduler. When you book a demonstration, we collect your first and last name, work email address, company, job title (if provided), the topic you select, any notes, the time you choose and your time zone, which your browser suggests and you may change. We use this information to schedule and hold the call. It is stored as an appointment in Zoho Bookings, and the call is held on Microsoft Teams.
• Guests. You may add up to ten guest email addresses to a booking. We share them with Zoho Bookings so that your guests can be invited. Please add only people who expect the invitation, and make them aware of this policy.
• Product updates. The contact form includes an optional box to receive product updates by email, which is not ticked by default. If you tick it, we may send you product updates, and you may unsubscribe at any time by writing to hello@vikax.app. Booking a demonstration does not subscribe you to product updates.
• Mandatory fields. Fields marked with an asterisk are mandatory. If you do not complete them, we cannot respond to your enquiry or book the call. All other fields are optional.
• Emails. When you email hello@vikax.app, we receive your email address, the content of your message and any attachments, and we use them to respond to you.

When you use the Website, we and our service providers collect certain information automatically:

• Spam protection. When you submit the contact form, the page loads Google reCAPTCHA, which receives your IP address and collects information about your device and browser to determine whether the form was submitted by a person. Our server then sends the resulting reCAPTCHA token to Google to verify it, without your IP address.
• Server. Our server receives your IP address and technical details of each request when you load a page or submit a form. It counts form submissions per IP address in memory to prevent abuse, and it records errors when they occur. Our code does not record the content of your form submissions in server logs.
• Analytics. If you accept analytics cookies, Google Analytics records the pages you visit, the referring page, general information about your device and browser, and certain interactions with the Website, such as selecting a link to book a demonstration or a link to another website, scrolling to the end of a page and reading a blog post to its end. When you submit a form, it records that event and the topic you selected, but not the content of the form. Google states that Google Analytics 4 does not log or store IP addresses. If you reject analytics cookies or make no choice, Google Analytics is not loaded. If your browser sends a Global Privacy Control signal, we treat it as a rejection unless you accept analytics cookies through Cookie settings. If you withdraw your consent, we stop Google Analytics and delete the analytics cookies it set on vikax.app.

Your choice in the cookie banner is stored in your browser for six months, after which we ask you again. Google Analytics sets cookies only if you accept analytics cookies, and Google reCAPTCHA sets a cookie on google.com when you submit the contact form.

Our cookie policy explains each cookie and similar technology that the Website uses, how long each one lasts, and how you can change your choice through Cookie settings at the foot of each page.

Under the PDPL, these correspond to the grounds in Article 4: consent, taking steps at your request before entering into a contract, compliance with a legal obligation, and legitimate interests. Under the GDPR and the UK GDPR, they correspond to Article 6(1)(a), (b), (c) and (f).

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may object to such processing at any time, as described in “Your rights”.

We use the following service providers, which process personal data on our behalf:

• Zoho. Zoho CRM stores enquiries submitted through the contact form, and Zoho Bookings stores demonstration bookings and guest email addresses.
• Google. Google provides reCAPTCHA for the contact form and, where you accept analytics cookies, Google Analytics. Google also processes reCAPTCHA data under its own privacy policy.
• Hostinger. Hostinger hosts the Website and its server.
• Microsoft. Microsoft provides Microsoft Teams, which we use for demonstration calls.

We do not disclose personal data to any other party except with your consent or where required by law, a court order or the Public Prosecution. We do not sell personal data.

We are based in Bahrain. Zoho CRM and Zoho Bookings store your information in Zoho's United States data centre, and Google may process data in the United States and in other countries in which it operates.

We transfer personal data outside Bahrain only in accordance with Articles 12 and 13 of the PDPL, for example where the destination country is on the Personal Data Protection Authority's list of countries that provide adequate protection.

Where the GDPR or the UK GDPR applies, we rely on a transfer mechanism recognised by those laws, such as an adequacy decision or standard contractual clauses. You may ask us which mechanism applies to your personal data.

• Enquiries, bookings and emails. We retain them for as long as necessary to respond to you and to manage any resulting business relationship, and thereafter only for as long as the law requires us to keep business records.
• Product updates. We retain your email address on our mailing list until you unsubscribe. We then keep a record of your request so that we do not contact you again.
• Rate limiting. The server holds its count of requests per IP address in memory for no more than ten minutes, and a restart of the server clears it.
• Server logs. We retain them only for as long as necessary to operate and secure the Website.
• Analytics. Google Analytics cookies expire after up to two years. Google keeps the analytics event data for 14 months, after which it is deleted.
• Cookie choice. Your choice is stored in your browser for six months, after which we ask you again.

When we no longer need personal data, we delete or anonymise it.

The Website is served only over HTTPS. Its content security policy permits pages to load scripts only from the Website itself and from the Google services named in this policy, and the forms are rate-limited. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Under the PDPL, you have the right to:

• be informed whether we process your personal data, and receive a copy of it together with its source, the purposes of processing and its recipients;
• request that we correct, block or erase personal data that is inaccurate, incomplete, out of date or processed unlawfully;
• object, free of charge, to the processing of your personal data for direct marketing;
• object to processing that causes, or is likely to cause, unwarranted and substantial damage to you or others;
• withdraw your consent at any time; and
• lodge a complaint with the Personal Data Protection Authority.

Where the GDPR or the UK GDPR applies, you also have the right to request restriction of processing, to receive your personal data in a portable format, and to object to processing based on our legitimate interests.

To exercise any of these rights, please contact us at hello@vikax.app. We do not charge a fee. We may need to verify your identity before we respond. Under the PDPL, we respond to access requests within 15 working days, and to requests for correction, blocking or erasure, and objections, within 10 working days. Under the GDPR and the UK GDPR, we respond within one month.

You may withdraw your consent to product updates by contacting us, and your consent to analytics cookies through Cookie settings at the foot of each page, as described in our cookie policy. Withdrawal does not affect the lawfulness of processing carried out before it.

reCAPTCHA assigns a score to each contact form submission. If the score falls below the threshold we have set, the server rejects the submission automatically, and you may contact us at hello@vikax.app instead. We do not make any other decisions about you by automated means.

The Website is intended for people acting on behalf of an organisation and is not directed at children. If you believe that a child has provided us with personal data, please contact us and we will delete it.

We may update this policy from time to time, and we will revise the date at the top of this page when we do. If a change affects how we use personal data you have already provided, we will notify you by email before the change takes effect.

If you have any questions about this policy or your personal data, please contact us at hello@vikax.app, or write to VulnXperts Consultancy W.L.L., Building 2648, Road 5720, Block 257, Amwaj, Bahrain.