How we handle your information

MUNDUS CRAS is the data controller for the personal data collected through this website. The firm operates across the Netherlands and the United Arab Emirates, where it is licensed as MUNDUS CRAS Project Management L.L.C. Both regions work to this policy.

• Postal address: [TODO: postal address to be supplied by MUNDUS CRAS]
• Email for privacy questions and requests: [TODO: contact email address to be supplied by MUNDUS CRAS]

Confidentiality is the firm's working standard, not a courtesy. An enquiry sent through this website is treated as confidential from receipt. It is read only by the people at MUNDUS CRAS who need to read it in order to answer you. It is not shared with anyone outside the firm, it is not used as a reference or an example, and the fact that you made contact is not disclosed.

We only hold what you give us and what is needed to serve the site securely.

• What you enter in the enquiry form, which is your name, your organisation, your email address, any telephone number you choose to add, and the message you write.
• Technical data created when a page is served, such as your IP address and your browser type. This is processed by our hosting provider to deliver the page and to protect the site against abuse.
• Aggregate usage statistics from Google Analytics, and only if you have allowed analytics cookies. Without that permission no analytics data is collected at all.

We do not ask for special categories of personal data and we ask you not to send commercially sensitive detail in a first message. A short outline is enough to start a conversation on a secure channel.

• To read and answer your enquiry and to take the steps you asked for before any engagement begins. The basis is the performance of a contract or the steps taken at your request before entering one.
• To run the website, keep it available and protect it against abuse. The basis is our legitimate interest in a working and secure site.
• To measure in aggregate how the site is used, so it can be improved. The basis is your consent, given through the cookie banner and withdrawable at any time.
• To meet legal and accounting obligations once an engagement starts. The basis is compliance with a legal obligation.

We do not sell personal data, we do not trade it, and we do not use it to build advertising profiles.

A small number of suppliers process data on our instructions so the site can run. Each one is bound by a data processing agreement and may use the data only for the purpose we set.

• Vercel, which hosts this website and serves every page.
• Neon, which runs the database in which enquiry submissions are stored.
• Resend, which delivers the two transactional emails an enquiry triggers, being the notification to the firm and the acknowledgement to you.
• Vercel Blob, which stores the images used on the site.
• Google, which provides Google Analytics 4. This runs under Google Consent Mode v2 and is only activated after you allow analytics cookies.

Beyond these suppliers we disclose personal data only where a court or a regulator requires it by law.

Some of the suppliers above are established in the United States, and the firm itself works in the United Arab Emirates as well as the Netherlands. Where personal data leaves the European Economic Area we rely on the European Commission standard contractual clauses together with the technical measures those clauses require. You can ask us for a copy of the safeguards that apply to a given transfer.

• Enquiries that do not lead to an engagement are kept while the conversation is live and for up to 24 months after our last contact, then deleted.
• Records relating to an engagement are kept for the duration of that engagement and for the statutory retention periods that follow it.
• Analytics data is held in Google Analytics under the retention period set on the property, which is capped at 14 months.
• Your cookie choice is kept for 180 days, after which we ask again.

The site is served over an encrypted connection. Enquiry data is stored in an access controlled database and is reachable only by the people who need it. Access to the systems behind the site is limited to named individuals and is reviewed. If a breach ever affected your data and carried a real risk to you, we would tell you and the supervisory authority within the time the law allows.

Under the General Data Protection Regulation you hold the following rights over the data we keep about you.

• Access, meaning a copy of the personal data we hold about you.
• Rectification of anything inaccurate or incomplete.
• Erasure, where we no longer have a valid reason to keep the data.
• Restriction of processing while a question about the data is open.
• Objection to processing that rests on our legitimate interest.
• Portability, meaning a copy in a structured and machine readable format.
• Withdrawal of consent at any time, which stops analytics from that moment without affecting what was lawful before it.

Send a request to [TODO: contact email address to be supplied by MUNDUS CRAS] and we will answer within one month. If you are not satisfied with how we handled it, you may lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the supervisory authority where you live.

This site places only the cookie that remembers your consent choice, plus analytics cookies if you allow them. The cookie policy sets out exactly what is placed and lets you change your choice.

If what we do with personal data changes, this page changes with it and the date below the title is updated. Where a change affects what you consented to, we ask for your choice again.