P

l

a

i

n

-

E

n

g

l

i

s

h

Vorex Solutions SH.P.K., NIPT / Fiscal No. 812435396, registered at Rr. Valbona, Nr. 2, Prishtinë, Kosovo, operates Vorex and is the controller responsible for personal data handled through this website. When this policy says "we," "us," or "Vorex," it means Vorex Solutions SH.P.K..

Contact: hello@vorex.co, +383 45 661 456, or https://www.vorex.co. If you have questions about this policy or about data we hold on you, we respond within one business day.

We collect information you give us directly and, only after you accept analytics, limited information about how the website is used. We don't fingerprint visitors or use analytics for advertising.

• ●Contact form / email. Your name, email address, company (if supplied), project type, budget range, message, the page you submitted from, and submission time. We use this to deliver your enquiry, reply, and send one automatic confirmation.
• ●Spam protection. The contact form uses Cloudflare Turnstile. Cloudflare receives technical information needed to distinguish people from automated traffic, such as network and browser signals. We do not use it for advertising.
• ●Calendar bookings. When you open our EU-hosted Cal booking page at cal.eu, Cal.com collects your name, email, time zone, and any answers to their booking questions under its privacy policy (cal.com/privacy). We see that information in our Cal dashboard and the calendar invite.
• ●Consent-based website analytics. If you accept analytics, Google Analytics records page views, approximate location, browser and device information, referrer, scroll depth, outbound-link clicks, and other Enhanced Measurement interactions. We do not send your contact-form fields, email address, or other directly identifying form content to Google Analytics.
• ●Project work. If we sign a project together, we'll handle the data needed to do the work — invoice details, repo access, anything you choose to share. That's covered by the Master Services Agreement we sign with you, not by this policy.

• ●No Google Analytics data before you accept analytics.
• ●No advertising pixels, behavioural advertising, remarketing, or marketing profiles.
• ●No contact-form content or email addresses sent to Google Analytics.
• ●No newsletter, no sign-up list. If we ever add one, it'll be opt-in and we'll update this page.

Google Analytics is blocked until you select “Accept analytics.” If you decline, the Google tag is not loaded and no analytics request is sent. Your choice is saved in your browser's local storage so we can respect it on later visits.

After consent, Google Analytics may set first-party cookies named _ga and _ga_<container-id> to distinguish visitors and maintain session state. Google documents a default lifetime of up to two years, subject to browser limits and our Google Analytics settings.

You can change or withdraw your choice at any time through “Cookie settings” in the footer. Turning analytics off stops future measurement and removes Google Analytics cookies that are accessible from vorex.co.

Under GDPR, we need a lawful basis for processing your data. Ours is straightforward:

• ●Steps before a contract. You asked us to assess a project, arrange a call, or prepare a quote.
• ●Legitimate interest. Operating a secure contact channel, responding to your inquiry, and keeping a reasonable record of the conversation. We balance that against your right not to be spammed — which is why we don't send marketing from the form.
• ●Consent. We use Google Analytics only after you actively accept analytics. You can withdraw that consent at any time through Cookie settings.
• ●Contractual necessity. If we end up working together, we need to handle your project data to actually do the work.

We don't sell data. We don't share it with marketers. The only third parties involved are tools we use to run the studio:

• ●Cal.eu (Cal.com) — for EU-hosted calendar bookings (cal.com/privacy)
• ●Zoho Mail EU — our business inbox provider. Enquiries sent to hello@vorex.co are received and stored there.
• ●Resend — our transactional email delivery provider. It delivers contact-form enquiries to us and the confirmation email to you.
• ●Cloudflare Turnstile — to protect the contact form from automated abuse.
• ●Google Analytics — only after consent, to measure website usage and understand which pages and interactions are useful. Advertising storage and personalization remain disabled.
• ●Payment processor — if we work together, invoices go through Stripe or a wire transfer. Stripe's privacy policy applies to Stripe-processed payments.
• ●We use those services because we have to, not because we want to share your data. We don't add anyone else without updating this page.

Inquiries that don't become projects: we keep the email thread for up to 24 months in case you circle back. After that we delete it.

Active client data: kept for the duration of the project plus 7 years after, for tax and legal reasons.

Spam-verification data and transactional delivery logs are retained by Cloudflare and Resend under their applicable service settings and policies.

Google Analytics user-level and event-level data may be retained for up to 14 months under the property's retention controls. Aggregated reports may remain available for longer.

Calendar bookings sit in Cal.com's systems under their retention policy.

If you're in the EU, UK, or California, you have specific rights under GDPR/CCPA. If you're somewhere else, we extend the same rights anyway — it's the right way to do it.

• ●Access — ask us what we hold on you. We'll send it within 30 days.
• ●Correct — tell us if anything is wrong, we'll fix it.
• ●Delete — ask us to remove your data. We will, unless we're legally required to keep it (e.g. tax records).
• ●Object / restrict — tell us to stop using your data for something. We'll stop.
• ●Portability — ask us to send you a copy. We'll send it.
• ●Withdraw analytics consent — open Cookie settings in the footer and choose “Turn analytics off” or “No thanks.”
• ●To exercise any of these: email hello@vorex.co with "Privacy request" in the subject. No forms, no hoops.

Business email is hosted with Zoho Mail EU. Contact-form delivery also passes through Resend, and spam-verification data passes through Cloudflare. Google Analytics, Cal.com, and GitHub may process data outside Kosovo or the EEA.

Where a provider processes data internationally, we rely on the safeguards offered in that provider's data-processing terms, such as standard contractual clauses where applicable.

If we change anything material, we'll update the date at the bottom of this page. If you've given us your email through any of the channels above, we'll let you know directly.

If you think we've handled your data badly, email us first — we want to fix it. If we don't, you can complain to your local data protection authority. In the EU, that's typically your country's DPA. In the UK, it's the ICO.