01 Who we are
This Privacy & Data Protection Policy explains how Awaley Technologies Ltd ("Awaley", "we", "us" or "our") handles personal data when you visit our website, contact us, participate in a public demonstration or interact with our professional services.
Awaley Technologies Ltd operates this website and is the data controller for personal data collected for its own website, communications and business administration purposes. For client projects, Awaley may act as a data processor on behalf of a client, or another Awaley contracting entity may be responsible, as described in the relevant agreement.
- Website operator and data controller
- Awaley Technologies Ltd
- Legal representative
- De Ghimelle KARABOUE, Founder & CEO
- Business location
- Dubai AI Campus, Dubai International Financial Centre (DIFC), Dubai, United Arab Emirates
- Privacy enquiries and requests
- privacy@awaleytech.com
02 What this Policy covers
This Policy applies to our public website at awaleytech.com and Awaley-controlled web pages, contact requests, professional correspondence, event registrations and public-facing demonstrations. It also describes our own handling of business contact data in the course of providing cybersecurity, digital resilience and AI governance services.
Where Awaley processes personal data solely under a client’s instructions, the client’s privacy notice, our contract and any applicable data processing agreement govern that activity. Some specialist platforms may provide an additional notice at the point of use.
03 Personal data we collect
- Professional contact information, such as your name, role, employer, business email address, telephone number, country and the content of your enquiry.
- Technical and security information generated when you use the website, such as IP address, browser type, device information, access timestamps, referral source and records needed to protect the service.
- Business relationship information, such as meeting arrangements, correspondence, proposals, authorised representatives and contractual records.
- Information you choose to enter into an interactive demonstration, including questions, selected scenarios and feedback, where the feature supports these interactions.
- Marketing preferences and cookie choices, where relevant.
Please do not enter passwords, live customer records, special-category personal data or confidential regulated information into public contact forms or demonstration environments.
04 Why we use personal data and our lawful grounds
- Answer enquiries and arrange meetings. To respond to your request and take steps before a possible contract, or for our legitimate business interests.
- Provide and administer services. To perform an agreement, manage authorised business relationships and meet legal obligations.
- Operate and secure our website and demonstrations. For our legitimate interests in delivering reliable services, preventing misuse and protecting systems and information.
- Maintain business and compliance records. To meet legal duties and establish, exercise or defend legal claims.
- Send relevant news and event invitations. With your consent where required, or another lawful basis permitted for the communication and location concerned. You may opt out.
Where consent is the relevant lawful ground, it may be withdrawn at any time without affecting prior lawful processing. The precise legal basis depends on the processing activity and applicable law.
05 AI demonstrations and responsible use
Our public AI and cybersecurity demonstrations are intended to illustrate scenarios using synthetic or appropriately de-identified information. They are not connected to client production systems unless this is expressly agreed as part of a separate, secured engagement.
If a demonstration accepts user-entered text, we process that input as necessary to provide the feature, maintain security and respond to any related enquiry. Authorised technical service providers may support the interaction under appropriate contractual safeguards.
We do not use confidential customer information or personal data submitted through public contact forms to train general-purpose AI models without an appropriate legal basis and express authorisation where required. Demo outputs are illustrative and should not be treated as definitive legal, financial, regulatory or cybersecurity advice.
06 Who receives personal data
Personal data is accessible to authorised Awaley personnel and, where necessary, trusted service providers supporting hosting, business email, website operation, customer communications, cybersecurity, professional services and AI functionality.
Providers may act on our documented instructions, subject to appropriate confidentiality, security and data protection safeguards. We may also share information with professional advisers or public authorities where required or permitted by law. We do not sell personal data to advertisers.
07 International transfers and data residency
Awaley serves organisations across the UAE, the wider GCC and Africa. Depending on the service, authorised processing or support may involve access from a country other than the one in which information was collected.
Where personal data is transferred internationally, we assess the laws applicable to the relevant data and use an appropriate lawful mechanism, such as an adequacy arrangement, recognised contractual safeguards or a permitted legal exception, together with technical and organisational protections where required.
Data residency and sector-specific localisation commitments for regulated client projects are agreed separately in the relevant service and contractual documentation. We do not assume that one jurisdiction’s transfer authorisation automatically applies in another.
08 Security and confidentiality
We use a risk-based approach to protecting information, including access controls, authentication, confidentiality obligations, supplier assessment, secure system administration and appropriate monitoring and incident-response arrangements. Specific safeguards vary according to the sensitivity of the information and the service concerned.
No digital service can guarantee absolute security. When a personal data incident occurs, we assess its impact and take the notification and response steps required by applicable laws and contracts.
09 How long we keep information
- General business enquiries: ordinarily for up to 24 months after our last meaningful communication, unless a business relationship develops or a legitimate legal reason requires longer retention.
- Client and financial records: for the contract term and any additional statutory, tax, accounting or legal claims period that applies.
- Website and security information: for a period proportionate to system administration, fraud prevention and incident investigation, normally no longer than 12 months unless preservation is necessary.
- Public demonstration activity: only for as long as reasonably required to operate the session, troubleshoot the feature, protect against misuse or fulfil a request connected to the interaction.
- Marketing preferences: until you opt out, or until the information is no longer relevant to the stated purpose. Minimal suppression records may be retained to respect an opt-out.
At the end of an applicable retention period, we delete, anonymise or securely archive data where there is a continuing legal justification. Backup deletion may follow a controlled technical cycle.
10 Your data protection rights
Depending on the applicable law and any lawful limitations, you may have rights to access your personal data, correct inaccurate information, request deletion, restrict or object to processing, withdraw consent and receive or transfer certain data. Additional safeguards may apply to certain automated decisions.
To exercise a right or ask a privacy question, email privacy@awaleytech.com. We may request information reasonably necessary to identify you and locate the relevant records. We will respond within the timeframe required by the law applicable to your request.
If you remain dissatisfied, you may complain to the DIFC Commissioner of Data Protection where the DIFC framework applies, or to the competent data protection authority in another applicable jurisdiction. Details of the DIFC Commissioner are available at www.difc.com.
11 Marketing and cookies
You may ask us to stop promotional communications at any time by using an unsubscribe option where provided or emailing privacy@awaleytech.com. Essential service or contractual communications may continue where justified.
Our Cookie Policy explains how cookies and similar technologies are used, the purposes they serve and how you can manage available choices. Where applicable law requires consent for non-essential technologies, that consent must be obtained before their use.
12 Children and consequential automated decisions
Our corporate website is primarily intended for professional audiences. Any educational experience designed specifically for younger users will be subject to age-appropriate safeguards and any parental authorisation required by law.
Public website interactions and demonstrations are not intended to make solely automated decisions producing legal or similarly significant effects on individuals. Any client deployment involving consequential decisions is subject to a separate assessment and appropriate governance arrangements.
13 Applicable laws and updates
Awaley is established in the DIFC and handles relevant processing in accordance with applicable DIFC Data Protection Law No. 5 of 2020, as amended, and associated regulations, including rules for AI-enabled processing where relevant. Other requirements may apply depending on the actual service, affected individuals and territory, including national data protection legislation in the UAE, other GCC countries and West Africa, and the GDPR where its territorial scope is met.
We may update this Policy to reflect changes in our services, processing activities or legal requirements. The latest version will be published on the website with its effective date.