GDPR-aligned with regional notes for UAE, Saudi Arabia, Qatar, and wider MENA operations.
Last updated: 20 August 2025
This Privacy Policy explains how STORM Consultancy Solutions (“STORM”, “we”, “us”) processes personal data relating to website visitors, prospective and current clients and suppliers, and job candidates. For most activities, STORM acts as a data controller; for certain client services we may act as a data processor (per the relevant contract and data processing addendum).
| Purpose | Examples | Legal Basis (GDPR) |
|---|---|---|
| Operate our website | Security, analytics, performance | Legitimate interests / Consent for non-essential cookies |
| Sales & marketing | Responding to inquiries, event follow-ups | Legitimate interests / Consent where required |
| Provide services | Projects, support, training, governance | Contract performance / Legitimate interests |
| Compliance | Audit, legal requests, sanctions screening | Legal obligations / Legitimate interests |
| Recruitment | Candidate evaluation and hiring | Legitimate interests / Consent where required |
Where data is transferred across borders, we implement safeguards such as Standard Contractual Clauses (and relevant addenda) or rely on adequacy decisions, and we follow local data localization rules where applicable. For client work, transfer mechanisms are defined in the governing contract and data processing addendum.
Where GDPR or the UK GDPR applies, you have statutory rights (see Section 11). We may appoint local representatives where required. Non-essential cookies require consent.
We take into account applicable laws in the Middle East & North Africa, including (as applicable): United Arab Emirates, Saudi Arabia, Qatar, Kuwait, Bahrain, Oman, Jordan, Lebanon, Iraq, Syria, Palestine, Yemen, Egypt, Libya, Tunisia, Algeria, Morocco, Sudan, and Mauritania. Local requirements may affect notices, lawful bases, localization, breach notifications, and rights handling. If you are based in one of these countries, you may exercise rights under local law via the process in Section 11.
We keep personal data only as long as necessary for the purposes described in this policy, including to meet legal, accounting, or reporting requirements. Typical periods: marketing contacts (until opt-out or inactivity), contracts and billing records (legal retention periods), support records (project lifecycle + limited archive), recruitment (12–24 months unless you ask us to keep your profile longer or delete it sooner).
We use administrative, technical, and physical controls appropriate to the nature of the data (e.g., access controls, encryption in transit, backups, and least-privilege). No system can be 100% secure; we maintain processes for detecting and responding to incidents and, where required, notifying regulators and affected individuals.
Subject to applicable law, you may have the right to request access, rectification, deletion, restriction, objection, data portability, or to withdraw consent. To exercise rights, email us at privacy@stormcso.com. We may verify your identity and ask for more information to process your request. You may also have the right to lodge a complaint with your local data protection authority.
Our services are for professional use and not directed to children. We do not knowingly collect personal data from children.
We may update this policy from time to time. We will adjust the “Last updated” date above and, where appropriate, provide additional notice.
Email: privacy@stormcso.com
Address (if required for your local process): add your registered office details.
You may contact your local supervisory authority. We are happy to work with you to resolve any concerns promptly.
