Privacy Policy

KarvTec Trading FZC is a business-to-business industrial tools and equipment supplier serving the MENA region. We act as a data controller for the personal information described below. Our registered office is in Sharjah, UAE.

For privacy matters, contact us at sales@karvtec.com.

We only collect what we need to operate our business:

• Newsletter signup — email address only. Source: the newsletter form on our website.
• Contact form / enquiries — name, company name, business email, phone number (optional), product category, and the message you submit.
• Quotations & orders — billing details, TRN (where applicable), shipping addresses, and product specifications you share when requesting a quote.
• Analytics & performance — anonymous or pseudonymous browsing data (page views, country, device type, referrer) via Vercel Analytics and Vercel Speed Insights. No personal identifiers are passed to these services.
• Communications — copies of emails you send us and our replies, stored in our customer support systems.

We do not collect special-category data (health, ethnicity, religion, etc.). We do not knowingly process data from children under 16.

We do not sell personal data. We share data only with the service providers we need to run our business, and only what is necessary for the specific task:

• Sendy — our self-hosted email marketing platform, located on our own infrastructure (AWS us-east-1). Receives newsletter subscriber email addresses.
• Zoho Corporation — provides our customer support (Zoho Desk), accounting (Zoho Books), and email (Zoho Mail). Hosted in EU, US, and India data centres depending on module.
• Vercel — hosts karvtec.com and provides analytics. Servers in the United States.
• Amazon Web Services (SES) — sends transactional email. Servers in the United States and EU.
• Google Workspace — internal email and collaboration. Servers in the United States.
• Anthropic — assists our team with AI-supported quote generation and customer-success workflows. We redact pricing, TRN, and other sensitive fields before any AI call.
• Government authorities and auditors — only where required by law (UAE Federal Tax Authority, Sharjah Economic Department, etc.).

Each provider is bound by a data processing agreement and acts as a processor on our behalf.

Some of our processors are located outside the UAE and the EEA. Where this is the case, we ensure appropriate safeguards are in place — typically standard contractual clauses, adequacy decisions, or equivalent contractual protections — so that your data continues to be protected to the standard required by UAE PDPL and GDPR.

• Newsletter subscribers — until you unsubscribe, plus 30 days for deletion processing.
• Enquiries that did not lead to a relationship — 24 months from last contact.
• Customer records (orders, invoices) — 5 years after the last transaction, in line with UAE record-keeping requirements.
• Server logs and security telemetry — 12 months.

Whether you are in the UAE, the EU/UK, or elsewhere, you have the following rights regarding the personal data we hold about you:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data (subject to legal retention obligations).
• Restriction and objection — ask us to pause or limit specific uses of your data.
• Portability — receive your data in a machine-readable format.
• Withdraw consent — for any processing based on consent (e.g. marketing emails), at any time. Use the unsubscribe link in our emails or contact us directly.
• Complain — to the UAE Data Office, your local EU Data Protection Authority, the UK Information Commissioner's Office, or the equivalent regulator in your jurisdiction.

To exercise any of these rights, email sales@karvtec.com. We will respond within 30 days.

karvtec.com uses a small number of cookies and similar technologies:

• Strictly necessary — required for the site to function (e.g. session, security). No consent required.
• Performance & analytics — Vercel Speed Insights and Vercel Analytics, used to measure aggregate page performance and visit counts. No advertising identifiers.

We do not currently use advertising cookies or third-party tracking pixels. If this changes, we will update this policy and add a clear consent banner.

We use technical and organisational measures to protect personal data: TLS 1.2/1.3 in transit, encryption at rest where practicable, access controls scoped to job role, multi-factor authentication on internal systems, audit logging, and regular security reviews. Despite our efforts, no system on the internet is perfectly secure — you share your data with us at your own risk.

If we ever discover a personal data breach that is likely to result in risk to you, we will notify the relevant authority within 72 hours and notify affected individuals without undue delay.

We may update this policy from time to time. The "Last updated" date at the top reflects the latest revision. If we make material changes, we will highlight them on this page and, where appropriate, notify you by email.

Questions, complaints, or requests about your personal data can be sent to: