Privacy Policy

Who we are

YCM Ventures LLC is a Limited Liability Company registered in the Sharjah Media City (Shams) Free Zone, Sharjah, United Arab Emirates. Licence no. 2644816.01, formation no. 2644816. Registered office: Shams Business Center, Sharjah Media City Free Zone, Al Messaned, Sharjah, United Arab Emirates, P.O. Box 515000. Email: contact@ycmventures.com. Phone: +971 58 612 3753.

We are the controller of the personal data described in this policy. That means we decide why and how it is processed.

Our work is licensed as computer programming, IT consultancy and management consultancy. We sell to businesses (B2B), mostly in the EU and the UK.

What data we collect

We only collect what we need to answer you and to keep the site secure. There is no account, no profile and no advertising on this website.

• Contact form: your name, work email address, company name, your message, the timestamp of your consent, plus your IP address and browser user agent for anti-spam purposes.
• Email correspondence: anything you choose to send us by email, and our replies.
• Technical data: server logs and aggregated page metrics generated when you visit the site.

Cookies and analytics

We use no advertising cookies, no Google Analytics and no tracking pixels. We do not build profiles and we do not sell data.

We use Vercel Analytics and Vercel Speed Insights only. Both are cookie-less and report aggregated figures such as page views and loading times. They do not identify you.

Why we process your data, and on what legal basis

• To answer your request and take pre-contractual steps at your request — GDPR article 6(1)(b).
• To keep the site secure and block spam, and to measure aggregate traffic — our legitimate interest, GDPR article 6(1)(f).
• For the contact form, we also rely on your consent, as required by the UAE Personal Data Protection Law. You tick the box before sending, and you can withdraw that consent at any time.
• To meet our legal obligations, in particular accounting and tax record-keeping under UAE law — GDPR article 6(1)(c).

Who else handles your data

We use a small number of service providers. They act as processors: they may only process data on our instructions, under a data processing agreement.

• Vercel Inc. — website hosting and server functions, with the function region set to Frankfurt (fra1), in the EU.
• Supabase Inc. — database hosting, region eu-central-1 (Frankfurt), in the EU.
• Cloudflare Inc. — Turnstile, the anti-spam check on the contact form.
• Resend — email notifications when a form is submitted.
• Our email provider, for correspondence with you.

International transfers

Your data is stored in the European Union. Our founder and manager accesses it from the United Arab Emirates, so there is a transfer from the EU to the UAE. That transfer is covered by standard contractual clauses.

Some of our processors are established in the United States. Those transfers rely on standard contractual clauses and, where the provider is certified, on the EU-US Data Privacy Framework.

How long we keep it

• Contact form messages: deleted 12 months after our last exchange, unless a contract follows.
• Contract and invoicing data: kept 5 years under UAE Corporate Tax law, and 7 years for accounting records where that longer period is required.
• Analytics: aggregated and non-identifying, so it is not linked to you.

Your rights

You can ask us to access, correct, erase, restrict or transfer your data. You can object to processing based on our legitimate interest, and you can withdraw your consent at any time. Write to contact@ycmventures.com and we will reply within one month.

We make no automated decisions about you and we do no profiling.

If you think we have got something wrong, you can complain to a supervisory authority in the EU — for example the CNIL in France — or to the UAE Data Office.

Security

The site is served over HTTPS. The database uses row-level security, and access is limited to the controller. We keep the number of tools and the number of people involved deliberately small.

If a breach affects your data, we notify the competent supervisory authority within 72 hours under the GDPR, and immediately as required by the UAE Personal Data Protection Law. We tell you directly when the risk to you is high.

EU representative

We process EU personal data occasionally and in a business-to-business context. On that basis we have not appointed a representative under GDPR article 27. We review this position as our volume grows.

Children

This website is aimed at businesses. It is not intended for anyone under 18, and we do not knowingly collect their data.

Changes to this policy

We may update this policy when our tools or our obligations change. The date at the top always shows the current version. Questions go to contact@ycmventures.com.