Draft. Not legal advice. Review by a qualified lawyer before launch.
Privacy Policy
Effective date: 17 October 2026
This policy explains what personal data VintCode collects through this website, why, who receives it and what rights you have. We apply the EU General Data Protection Regulation (GDPR) as our standard for every visitor, wherever you are.
1. Who is responsible
The controller is VintCode, based in Dhaka, Bangladesh, with a team member working from Germany. Full provider details are in our Legal Notice. Contact for all privacy matters: contact@vintcode.com.
Because VintCode is established in Germany, we have not appointed a separate representative in the EU. We have not appointed a representative in the United Kingdom.
2. What we collect and why
| Situation | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Contact form | Name, email address, message, time of submission, confirmation that you ticked the consent box | Replying to your enquiry and, if you ask, preparing a proposal | Your consent (Art. 6(1)(a)) and steps you ask for before a contract (Art. 6(1)(b)) |
| Emailing us directly | Your email address and whatever you write | Replying and handling the request | Steps before a contract (Art. 6(1)(b)) or our legitimate interest in answering correspondence (Art. 6(1)(f)) |
| Booking a call on cal.com | Name, email address, chosen time, time zone, any notes you add | Scheduling and holding the call | Steps you ask for before a contract (Art. 6(1)(b)) |
| Visiting any page | IP address, browser and device details, page requested, time (server logs kept by our host) | Delivering the site, security and abuse prevention, including rate limiting of the contact form | Legitimate interest in a secure, working website (Art. 6(1)(f)) |
| Analytics, only if you accept | Page address (without query strings), referrer, country, browser, operating system, device type | Counting visits to improve the site | Your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG) |
We do not use your data for automated decision-making or profiling, and we do not sell it. You do not have to give us any personal data; without it we simply cannot reply to you.
3. Who receives your data
We use these service providers (processors) under data processing agreements:
- Vercel Inc. (USA): hosting, server logs and, if you consent, Vercel Web Analytics.
- Resend (USA): delivers contact-form messages to our inbox. Resend stores message content and delivery logs in the USA and deletes them after 30 days.
- Cloudflare, Inc. (USA): DNS and email forwarding for vintcode.com. Cloudflare states that Email Routing does not store or access email content.
- Google (Gmail, USA): hosts the mailbox where our emails arrive.
- Cal.com, Inc. (USA): appointment booking, when you choose to book a call. Cal.com also has its own privacy policy for its website.
The VintCode team reads enquiries in Bangladesh and in Germany. We may disclose data where the law requires it.
4. International transfers
Your data is processed outside your country, including in the USA and Bangladesh. Neither the European Commission nor the UK has found Bangladesh to provide an adequate level of protection.
- USA: we rely on the EU Standard Contractual Clauses (Commission Decision 2021/914) in our providers' agreements and, where a provider is certified, on the EU-U.S. Data Privacy Framework (Resend is certified). For UK data, the UK Addendum or UK Extension applies.
- Bangladesh: enquiries are read by our own team there. We share them only with the people who need them to reply and protect them with access controls.
You can ask us for a copy of the safeguards using the contact details above.
5. How long we keep data
- Enquiries that do not lead to a contract: 12 months after our last exchange, then deleted.
- Enquiries that lead to a contract: for the life of the contract and as long as tax and commercial law require.
- Resend delivery logs: 30 days. Server logs at Vercel: a short period set by Vercel.
- Analytics: aggregated; Vercel discards the daily visitor hash after 24 hours.
6. Your rights
Under the GDPR and UK GDPR you have the right to:
- access your data and get a copy (Art. 15)
- have it corrected (Art. 16) or deleted (Art. 17)
- restrict its use (Art. 18) and receive it in a portable format (Art. 20)
- object to processing based on legitimate interests (Art. 21)
- withdraw consent at any time, without affecting earlier processing (Art. 7(3))
Email contact@vintcode.com. We answer within one month and may ask you to confirm your identity. To change your analytics choice, use “Cookie settings” in the footer.
7. Complaints
- EU and EEA: you can complain to the data protection authority where you live or work, or where you think the problem happened (list: EDPB members). The authority competent for us is the data protection authority of the German state where our German establishment is located.
- UK: please contact us first. We acknowledge complaints within 30 days. You can then complain to the Information Commissioner's Office.
- Bangladesh: the National Data Management Authority under the Personal Data Protection Act 2026.
- USA: the attorney general or privacy regulator of your state.
8. Your privacy rights in the USA
This section covers the California Online Privacy Protection Act (CalOPPA) and state privacy laws such as the CCPA/CPRA. Based on our size we expect to fall below the thresholds of these state laws, but we follow these practices for everyone:
- Categories we collect: identifiers (name, email address, IP address), the content of your messages, and internet activity on this site (only with consent for analytics). Sources and purposes are listed in section 2.
- We share these categories only with the service providers in section 3.
- We do not sell or share personal information for cross-context behavioral advertising.
- You can request access, correction or deletion, and you will not be treated differently for using these rights. Authorised agents may contact us on your behalf with proof of authorisation.
- Global Privacy Control and Do Not Track: if your browser sends a GPC or DNT signal, we treat it as a refusal of analytics and do not show the consent banner.
- Other parties do not collect personal information about your activity on this site over time or across other websites. The booking page on cal.com is operated by Cal.com and covered by its own policy.
9. Bangladesh
VintCode processes data in Dhaka and follows the Personal Data Protection Act 2026 (Act No. 63 of 2026). Your consent covers the purpose, retention period and transfers described above, and you can withdraw it at any time by emailing us.
10. Cookies and similar storage
See our Cookie Policy. In short: nothing non-essential runs unless you accept analytics.
11. Children
This website is for businesses and is not directed at children under 18. We do not knowingly collect their data.
12. Security
We use HTTPS everywhere, a strict Content Security Policy, limited access to enquiries and providers with security certifications.
13. Changes to this policy
We will post any change on this page with a new effective date.