Privacy Policy

1. Who we are

MVM Tech is a trading name of MVM-ICT W.L.L., a limited liability company registered and operating in Doha, Qatar, under the laws of the State of Qatar. We are part of the MVM Group and specialise in software development, web applications, and mobile technology services for businesses.

This Privacy Policy explains how MVM Tech ("we", "us", "our") collects, uses, stores, and protects personal data you provide when you interact with our website at mvm-ict.com, submit a contact enquiry, apply for a position, or otherwise communicate with us. It applies to all individuals whose data we process, regardless of nationality or location.

For privacy-related enquiries, contact us via our contact page.

2. What data we collect

We collect personal data only when you actively provide it. We do not collect data through tracking technologies, advertising networks, or behavioural analytics.

• Contact / project enquiries: full name, email address, phone number (optional), company name, and the content of your message or project description.
• Job applications: full name, email address, phone number, CV / résumé (PDF), LinkedIn profile URL, portfolio URL, and cover note.
• Technical metadata: IP address and browser user-agent string, collected automatically alongside form submissions for spam prevention and abuse detection purposes only.
• Admin authentication: if you are a member of our team, we process your email address and a hashed credential via Firebase Authentication to manage access to the admin dashboard.

We do not collect sensitive personal data (such as health information, biometric data, financial account numbers, or national identification numbers). We do not knowingly collect personal data from children under the age of 18.

3. Legal basis for processing

We process personal data on the following legal bases, consistent with the Qatar Personal Data Privacy Protection Law (Law No. 13 of 2016) and, where applicable to data subjects located in the European Economic Area, the General Data Protection Regulation (GDPR):

• Legitimate interests — responding to enquiries, managing business relationships, and preventing fraudulent submissions. We have assessed that our legitimate interest does not override your rights and freedoms.
• Pre-contractual steps — processing data necessary to respond to your project enquiry and to take steps at your request before entering into a contract.
• Consent — for job application data, which you provide voluntarily for the purpose of being considered for employment. You may withdraw consent at any time by contacting us.
• Legal obligation — where we are required to process or retain data to comply with applicable Qatari law or a lawful order of a competent authority.

4. How we use your data

We use the personal data you provide solely for the following purposes:

• To respond to your enquiry or project brief.
• To review, evaluate, and communicate with you regarding your job application.
• To maintain a record of business discussions and ongoing project engagements.
• To detect and prevent spam, abuse, or unauthorised access to our systems.
• To comply with legal obligations imposed on us under applicable law.

We do not use your personal data for automated decision-making or profiling. We do not send unsolicited marketing communications. We do not sell, rent, or trade your personal data to any third party.

5. Third-party processors

We share your data with the following third-party service providers acting as data processors on our behalf. Each is engaged under contractual obligations to process data only as instructed and to maintain appropriate security:

• Google Firebase (Firestore + Firebase Storage) — stores enquiry data, application records, and uploaded CV files. Operated by Google LLC on Google Cloud infrastructure. Google Cloud is certified to ISO 27001, ISO 27017, ISO 27018, SOC 1/2/3, and PCI DSS.
• Resend — transactional email delivery. When you submit a contact or application form, notification emails are delivered via Resend's API. Resend processes the email address and message content strictly for delivery.
• Cloudflare Turnstile — bot and spam protection on public forms. Cloudflare may process your IP address and browser signals to determine whether a form submission is human. No data from Turnstile is used for advertising.
• Vercel — website hosting and edge delivery. Vercel processes request logs (including IP addresses) at the infrastructure layer. Logs are retained for a limited period for diagnostic purposes.

We do not share your data with any other third parties, including advertising networks, analytics platforms, or data brokers.

6. International data transfers

Our third-party processors (Google Cloud, Vercel, Resend, Cloudflare) are headquartered in the United States and may process data in data centres located outside Qatar. Where such transfers occur, we rely on the processors' standard contractual clauses and certification to internationally recognised security frameworks (ISO 27001, SOC 2) as the transfer mechanism. By submitting data through our website, you acknowledge that your data may be transferred to and processed in these jurisdictions.

7. Data storage and security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, disclosure, destruction, or alteration. These measures include:

• Encryption in transit (TLS 1.2 / 1.3) for all data transmitted between your browser and our servers.
• Encryption at rest for all data stored in Firebase Firestore and Firebase Storage, managed by Google Cloud's default encryption keys.
• Role-based access control — admin panel access is restricted by Firebase Authentication custom claims; only authorised staff can access customer data.
• httpOnly, Secure session cookies for admin authentication — not accessible to JavaScript running in the browser.
• Firestore security rules that prevent public read or write access to any stored enquiry or application data.

No method of transmission over the internet or method of electronic storage is completely secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee absolute security.

8. Data retention

We retain personal data only for as long as necessary for the purpose for which it was collected, and in compliance with applicable legal obligations:

• Enquiry / contact data: retained for up to 3 years from the date of last interaction to maintain a record of business discussions and correspondence.
• Job application data: retained for 12 months after the relevant position is closed, then permanently deleted from all systems including Firebase Storage (CVs).
• Admin authentication data: retained for as long as the relevant staff member is employed by MVM Tech. Access is revoked and the account is deleted upon termination of employment.
• Technical / server logs: retained by our hosting provider (Vercel) for a limited period in accordance with their own data retention policy.

You may request early deletion of your data at any time. See Section 9 for your rights and how to exercise them.

9. Your rights

Subject to applicable law, you have the following rights in respect of your personal data:

• Right of access: you may request a copy of the personal data we hold about you and information about how it is processed.
• Right to rectification: you may request correction of inaccurate or incomplete personal data.
• Right to erasure: you may request deletion of your personal data where there is no compelling reason for its continued processing, subject to any legal obligations to retain it.
• Right to data portability: where processing is based on consent or contract, you may request that we provide your data in a structured, commonly used, machine-readable format.
• Right to restriction: you may request that we restrict processing of your data in certain circumstances, for example while you contest the accuracy of the data.
• Right to object: you may object to processing based on our legitimate interests. We will cease processing unless we have compelling legitimate grounds that override your interests.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, submit a request via our contact page. We will acknowledge your request within 5 business days and respond substantively within 30 calendar days. We may ask you to verify your identity before processing your request. There is no charge for exercising these rights unless requests are manifestly unfounded or excessive.

10. Children's privacy

Our website and services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently received data from a child, please contact us immediately and we will delete it promptly.

11. Cookies

This website uses one session cookie (mvm_session) solely for admin panel authentication. This cookie is only set when a member of our team logs into the admin dashboard at /admin and is not used to track visitors in any way. Regular site visitors will have no cookies stored on their device. See our Cookie Policy for full details.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our website or services after any update constitutes your acknowledgement of the revised policy.

13. Contact and complaints

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact us via our contact page. We are based in Doha, Qatar.

If you are a resident of Qatar and believe your data privacy rights under Law No. 13 of 2016 have been violated, you have the right to lodge a complaint with the competent authority in Qatar. If you are located in the European Economic Area, you have the right to lodge a complaint with your local supervisory authority.