Privacy Policy
What personal data we collect from website visitors, enquiries, job applications and demo apps, how we use it, who receives it, how long we keep it, and your rights over your data.
Who we are
We are Veengu — software provider for digital wallets, e-money, and payment ecosystems. Our website address is https://veengu.com.
The data controller for the personal data described in this policy is Veengu - FZCO, a company incorporated in Dubai, United Arab Emirates (registration number DSO-FZCO-14255), Office 307-B, IFZA, Dubai Digital Park, Building A3, Dubai Silicon Oasis, Dubai, United Arab Emirates.
This policy covers how we handle personal data when you visit our website, contact us, request a demonstration, attend an event, apply for a job, use a Veengu demonstration application, or deal with us about a business relationship. Where we instead process personal data on behalf of a customer using the Veengu platform, that customer is the controller — see Data we process for our customers.
For privacy questions or requests, email sales@veengu.com.
What personal data we collect and why we collect it
What personal information we collect about you
Depending on how you interact with us, we may collect:
- Your name, company or project name, job title, business or personal email address, telephone number, location, and other contact details.
- The content of enquiries, meeting and call notes, correspondence, attachments, demonstration requests, event registrations, proposals, contracts, and the records generated in the course of our work together.
- If you apply for a job: your CV, employment history, qualifications, professional profiles, preferred role, location, salary expectations, and other information you provide during recruitment.
- Relevant publicly available business information about a prospective customer, its representatives, or a candidate — for example a company website or a public professional profile.
- Information needed to operate and protect the website and its forms, which may include your IP address, browser and device information, approximate location, submission time, and spam-protection signals.
- Information generated when you use a Veengu demonstration application, as described under Veengu demo apps.
We receive this information from you, from the organisation you represent, from our communications with you, and from relevant public sources. This policy covers enquiries however they reach us — website forms, direct email, telephone, LinkedIn, meetings, and demonstration applications — wherever Veengu controls the resulting records.
Please avoid including sensitive personal information in an enquiry, or in a demonstration environment, unless it is needed for the purpose you are discussing with us. In demo apps and portals, please use placeholder data rather than real personal information.
The following information is created and recorded automatically when you visit our website: IP address, country from which you access information, pages visited, browser, operating system and platform information, and information about your visit and behaviour.
The following information is created and recorded automatically when you use our demo mobile apps: IP address, country, operating system and device information, and information about your activity within the demo apps. To demonstrate some features the demo app may request:
- Access to your contact book for demo P2P transfer by phone number.
- Access to photos and the camera for the demo onboarding scenario and demo P2P / P2M transfers using QR code.
- Access to push notifications for demo notifications about events affecting your demo profile (such as demo money transfers).
- Access to biometric authentication functions for the demo authentication scenario.
You control these permissions through your device settings.
How we use your personal information
We use relevant personal data to:
- Receive, assess, route and respond to enquiries; arrange demonstrations and event meetings; and prepare and follow up on proposals.
- Discuss, enter into, perform, manage and support business relationships and agreements.
- Keep a record of prior discussions, proposals and commitments, so that we can respond accurately when an opportunity resumes.
- Assess job applications, communicate with candidates, and manage recruitment.
- Consider candidates for future roles where they have separately agreed to that use.
- Send a newsletter or other marketing email where the recipient has separately subscribed, and manage subscriptions and withdrawals.
- Maintain accounting and business records, meet applicable legal obligations, and establish, exercise or defend legal claims.
- Operate, secure, measure and improve our website, demo apps and demo portals, including analysing the locations from which visitors reach our pages.
Where the UAE Personal Data Protection Law applies, we process personal data with consent or under a specific exception that applies to the activity. Such exceptions may include steps requested by an individual toward a contract with that individual, compliance with an obligation imposed by UAE law, or the establishment, exercise or defence of legal rights. Where another data protection law applies, we assess the grounds available under that law.
A request to discuss our products does not, by itself, subscribe you to a marketing newsletter, and applying for a role does not, by itself, place you in a future-role pool. Those are separate, optional choices — see Marketing emails and Recruitment.
Business contact data
Separately from website and demo-app visitors, we process personal data about the people we deal with at our customers, prospective customers, partners and suppliers — for example directors, officers, employees and contractors acting as commercial, technical or finance contacts. We call this business contact data.
What we collect
Name, job title, employer, business email address, business phone number, and the correspondence and records generated in the course of our dealings — enquiries, meeting and call notes, project and support communications, contract documentation, and billing and payment records.
We obtain this data from the individual, from their employer, from our contract documentation, and from publicly available business sources.
Why we process it
- To negotiate, enter into, perform and administer agreements with the organization the individual represents.
- Account management, relationship management and customer communications.
- Delivering and supporting our software and services, including project delivery, acceptance and support requests.
- Invoicing, payment collection and credit control.
- Maintaining, updating and improving our client records.
- Internal management analysis and reporting.
- Statutory returns, crime prevention, and legal and regulatory compliance, including sanctions and anti-money-laundering screening where applicable.
- Establishing, exercising or defending legal rights.
Our grounds for processing
The grounds described under How we use your personal information apply to business contact data as well. An agreement with an organisation is not itself an agreement with the individuals who work there, so we do not treat a contract with a company as the ground for processing the personal data of its employees.
Where an individual submits one of our forms, the notice beside the submit button describes what they are agreeing to. Where we obtain a business contact another way — from their employer or a colleague, from LinkedIn or another public professional source, or at a meeting or an event — that notice supplies no ground, because the individual never saw it. For those contacts we rely on a specific exception applicable to the activity, such as steps requested toward a contract with that individual, an obligation imposed by UAE law, or the establishment, exercise or defence of legal rights, and we explain how their data is being used when we first contact them.
How long we keep it
- Contracts, invoices and other records required for accounting or tax purposes are retained for the applicable statutory periods. Relevant UAE corporate tax records are generally retained for at least seven years after the end of the relevant tax period, as required under the UAE Corporate Tax Law or as updated by law.
- Other correspondence is retained while reasonably necessary for the relationship or a specific legal purpose, as described in How long we retain your data.
- Enquiries and prospect contact data that do not lead to an agreement: for as long as we are pursuing or maintaining a business relationship with the individual or their organisation. Requests to delete are assessed as described under What rights you have over your data.
- Support and project communications: for the term of the agreement and for as long afterwards as they remain relevant to supporting, evidencing or accounting for the work carried out.
Where we send it
Business contact data is held in our corporate email and productivity systems, which are operated by Microsoft, and in the internal enquiry-management systems that we operate on cloud infrastructure. Access to business contact records within Veengu is limited to authorised Veengu - FZCO employees whose responsibilities require it. The service providers described in this policy process data as necessary to provide their services, including the corporate AI services described under Enquiries, form submissions, and AI tools.
Where personal data is transferred out of the United Arab Emirates, we do so only where a transfer condition permitted under the PDPL applies — for example transfer to a country recognised as providing an adequate level of protection, or under appropriate contractual safeguards binding the recipient.
Enquiries, form submissions, and AI tools
How a submission reaches us
Form submissions on /contact-us/,/request-demo/,/jobs/ and our event pages are processed by a Vercel Function that we operate. The function delivers your message by email to our business mailbox via Twilio SendGrid. That email — including any CV attached to the careers form — is retained according to Twilio SendGrid's retention policy and our own mailbox retention.
The website form function records limited delivery information: the form type, submission time, a random submission reference, whether an attachment was present, and whether delivery succeeded. The log excludes the submitted message and direct identifiers such as name, email address, IP address, user agent and attachment filename. We can match the submission reference to the delivered email when investigating a delivery issue. Our hosting and security providers keep their own technical request logs, as any website's do.
What happens after we receive it
Authorised employees review and manage correspondence in our business mailbox and in internal enquiry-management systems that we operate on cloud infrastructure. Relevant messages, attachments, notes, proposals and contracts may become part of an enquiry or customer record. The same applies to enquiries that reach us by email, telephone, LinkedIn or at an event rather than through a form.
Consent choices recorded with a submission
We record the form type, the time of submission, and the version of the notice the form actually displayed to you, so that we can show which words you agreed to rather than the wording we happen to publish later. Where a form offers an optional choice — marketing email, or retention of a job application for future roles — the choice you made is recorded the same way. A box you left unticked is recorded as such and is never treated as consent.
Use of AI tools
Incoming messages to our business mailboxes may be examined by automated systems, including corporate AI services, to classify and route enquiries and, where appropriate, create or update records in our internal enquiry-management system. This processing may involve the sender's contact details, message, correspondence and attachments. Our employees manage the resulting enquiries and review AI-generated drafts before sending substantive responses. AI tools do not make final recruitment decisions on our behalf.
Authorised employees may also use these services themselves — to summarise correspondence, draft replies, proposals or contracts, review applications, prepare meeting notes, or research publicly available business information. The material supplied may include your name, contact details, company, the content of an enquiry or of correspondence, an attachment, or a CV where relevant to the task. These services process information for the purposes described here under their commercial arrangements with Veengu, and their processing may take place outside the United Arab Emirates. We limit employee access according to role, and assess what information is actually needed for each task.
Recruitment
We use application materials to assess a candidate for the role they applied for and to communicate about the recruitment process. Only authorised Veengu employees currently handle these applications.
If you separately choose to be considered for future roles, we may retain your application materials for that purpose for up to five years after the relevant recruitment process ends. You can withdraw that choice at any time by emailing sales@veengu.com. If you do not make that choice, we retain application materials for the current process, and for a further period only where reasonably necessary for an applicable obligation or a specific potential claim, then delete or anonymise them.
Submitting an application for a particular vacancy is not treated as consent to the future-role pool. The two are separate choices on the form.
If our recruitment practices or recipients change materially, we will update the relevant notice before using applicant data for the new purpose.
Marketing emails
We are not currently sending a newsletter or other marketing email. Our forms offer an optional subscription choice, and where you tick it we record that choice so that it can be acted on when a newsletter starts. If you did not tick it, your address is not used for marketing.
We will send marketing email to an individual only where we hold a record of that individual's separate affirmative subscription, or another applicable legal permission. A marketing choice is optional and has no effect on how we respond to an enquiry or an application.
You can withdraw a subscription at any time, using the instructions in the email or by writing to sales@veengu.com. We will stop sending marketing email to that address, and may keep a minimal suppression record so that the withdrawal is respected.
A follow-up about a specific enquiry or an ongoing discussion is part of that discussion rather than marketing. If you tell us that you do not want further contact about it, we will respect that, subject to any communication required by law or by an existing agreement.
Media
If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS).
If you upload images to a demo app, please avoid uploading real photos or scans of real documents — use non-sensitive demo images instead. Veengu team members may have access to this data when reviewing activity in the demo environment. Uploaded media in the demo environment is not automatically purged on a schedule; it is removed on request. To have your uploads deleted, email sales@veengu.com with demo data in the subject line; removal is completed within five working days.
Analytics
We use the following analytics services:
- Google Analytics 4 (GA4) — cookie-based; consent-gated as described under Cookies above. See policies.google.com/technologies/cookies for its cookie policies.
- Vercel Web Analytics — cookieless, aggregate page-view measurement with no personal data. See vercel.com/legal/privacy-policy.
- Cloudflare Web Analytics — cookieless, aggregate page-view measurement with no personal data. See cloudflare.com/privacypolicy.
- Google Search Console — read-only crawl analytics. See policies.google.com for the global Google privacy policy.
Spam protection
Form submissions are protected by Cloudflare Turnstile. See cloudflare.com/privacypolicy for Cloudflare's privacy policy.
Veengu demo apps
The Veengu demo apps allow prospective customers to evaluate the platform without integration. They are published on the Apple App Store and Google Play under Veengu accounts. Inside the demo app:
- Profile data (phone number, email, name) is stored in the demo environment for the lifetime of the demo session.
- Demo-environment data, including any media you upload, is not purged on a schedule. It is retained until you request deletion (see What rights you have over your data below).
- Demo environment administrators can see data provided by you within the demo apps and portals.
- Please use placeholder data, not real personal information, in the demo.
Data we process for our customers
When a customer uses the Veengu platform, personal data about that customer's own end users is processed by us on the customer's behalf and on its instructions. For that data the customer is the controller and we act as processor. This policy does not govern that processing — it is governed by the agreement between us and that customer, including its data-processing terms, which set out the purposes and means of processing, our security obligations, the subprocessors we use, and how deletion and return of data are handled at the end of the agreement.
If you are an end user of a service built on the Veengu platform and you want to exercise your rights over your data, please contact the provider of that service. If you contact us instead, we will refer your request to them.
How long we retain your data
We retain identifiable personal data only while it is reasonably necessary for the purposes described in this policy, subject to applicable legal obligations and to the circumstances of the particular record.
- Current customers — relationship and project records are retained while the relationship continues. Afterwards, particular records are retained for as long as needed for accounting, tax, contractual, regulatory or legal-claim purposes. UAE corporate tax records relevant to a tax period are generally retained for at least seven years after the end of that period, as required under the UAE Corporate Tax Law or as updated by law.
- Prospective customers and enquiries — enquiries, correspondence and proposals are retained while negotiations continue or can reasonably be resumed. A pause or a lack of reply does not automatically close an enquiry. We periodically assess whether retaining identifiable information in older inactive records is still necessary.
- Discussions expressly closed without a contract — relevant commercial records may be retained for up to ten years after the discussion closes, where reasonably necessary to document prior proposals or to protect legal rights. A shorter period may apply; a longer one applies only where a particular obligation, dispute or claim justifies it.
- Job applicants — the periods explained under Recruitment apply.
- Marketing subscriptions — subscription details are retained while the subscription remains active, together with the records reasonably needed to show or honour a subscription or a withdrawal.
- Form-submission emails (including any CV attached to the careers form) follow Twilio SendGrid's retention and our own mailbox retention.
- Delivery log entries are retained in our Vercel function-log store (typically 30 days, depending on plan). They exclude the submitted message and direct identifiers, but the submission reference they carry can be matched to the delivered email — see Enquiries, form submissions, and AI tools.
- Demo-app data is retained until you request deletion (email sales@veengu.com with demo data in the subject; removal within five working days). It is not purged on a schedule.
- Analytics — Google Analytics 4 data follows GA4's retention policy. Cookieless Web Analytics (Vercel, Cloudflare) stores only aggregate counts with no personal data.
Correspondence and attachments can exist in more than one business system, and a request to erase personal data is assessed across those systems. We assess requests to delete personal data under applicable law. We delete or irreversibly anonymise information where required. If a valid legal exception requires us to retain particular records, we explain what remains and why. Replacing a name with a code is not treated as anonymisation where the person can still be identified.
What rights you have over your data
Several data-protection regimes may be relevant to our processing, including the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the EU and UK GDPR, the California CPRA, Brazil's LGPD and India's DPDP Act. Which of the rights below you have, and their exact scope, depends on the law that applies to the particular processing rather than on your nationality or residence alone. Subject to that, you may ask to:
- Access — request an exported copy of the personal data we hold about you.
- Rectification — ask us to correct data that is inaccurate or incomplete.
- Erasure — ask us to delete personal data we hold about you, except data we are obliged to keep for legal or security reasons.
- Restriction — ask us to limit the way we process your data while a question about it is being resolved.
- Portability — receive your data in a machine-readable format.
- Objection — where the applicable law provides it, object to particular processing, including processing for direct marketing.
- Right to know how your data is processed — request information about the purposes, categories, recipients and retention of your data.
- Withdraw consent for cookies and analytics at any time via the Cookie settings link in the footer.
- Complain to a supervisory authority (in the UAE, the UAE Data Office; in the EU, your local data-protection authority; in the UK, the Information Commissioner's Office).
You can also object to processing for direct marketing at any time, and withdraw a consent you have given. Withdrawing consent does not make processing carried out while that consent was in effect unlawful, and it does not remove a separate legal obligation to retain a particular record.
Email sales@veengu.com with the request and the email address (or other identifier) you used. We aim to respond within 30 days. For removal of demo-environment data, please mention demo data in the subject line — it will be deleted within five working days.
Where we send your data
Form submissions are processed by Vercel Functions (the platform routes to the nearest available region); email is delivered via Twilio SendGrid. Analytics data is processed by Google (Google Analytics 4, Search Console) and, on a cookieless basis, by Vercel and Cloudflare (Web Analytics). Demo-app data is stored in the Veengu demo environment.
Enquiry, customer and recruitment records are held in our corporate email and productivity systems and in internal enquiry-management systems that we operate on cloud infrastructure. Where authorised employees use corporate AI services for the tasks described under Enquiries, form submissions, and AI tools, the material supplied is processed by those providers.
Some of these recipients and processing locations are outside the United Arab Emirates. Where personal data is transferred out of the UAE, we do so only where a transfer condition permitted under the PDPL applies — for example transfer to a country recognised as providing an adequate level of protection, or under appropriate contractual safeguards binding the recipient. You can contact us for information about the safeguards relevant to a particular transfer.
EU and UK representatives
Veengu - FZCO is established in the United Arab Emirates and primarily serves customers in the Middle East, Africa, and other non-EU/UK markets. We do not actively offer goods or services to data subjects in the European Union or the United Kingdom, nor do we monitor their behaviour.
On the basis of this posture we have not appointed a representative under Article 27 of the EU GDPR or the equivalent Article 27 of the UK GDPR. If you believe this assessment no longer holds — for example, if you are an EU or UK resident whose personal data we process — please contact us at sales@veengu.com so we can review the position. We will update this statement when material circumstances change.
Changes and contact information
We may update this policy when our practices change. The date shown at the top of the page indicates the current version. Where a change requires a new choice from you under applicable law, we will seek that choice before relying on the new purpose.
For privacy-related questions, data-subject requests, or anything else covered by this policy, please email sales@veengu.com. You can also reach us via the form on /contact-us/.
Postal address: Veengu - FZCO, Office 307-B, IFZA, Dubai Digital Park, Building A3, Dubai Silicon Oasis, Dubai, United Arab Emirates.
If you are a Veengu customer, the privacy terms that apply to our agreement with you — including our obligations as processor and the subprocessors we use — are set out in that agreement and its data-processing schedule. This policy does not vary those terms.