Privacy Notice

This notice applies to personal data we process:

• when you visit this website;
• when you contact us, or we contact you, about work;
• in the course of an engagement with a client, supplier or partner organisation, including personal data about that organisation's personnel;
• in the operation of our own business, accounting, record-keeping and the defence of legal claims.

It does not apply to:

• personal data we process on behalf of a client in systems we build or operate for them. There, the client is the controller and their own privacy notice governs; our role is described in Processing on behalf of clients.
• third-party websites we link to. Their operators publish their own notices and we are not responsible for them.

We are a DIFC entity with an international client base, so more than one data protection regime is capable of applying to us. We apply, as relevant to each activity:

• DIFC Data Protection Law, DIFC Law No. 5 of 2020, and the Data Protection Regulations issued under it. This is our primary regime. The supervisory authority is the Commissioner of Data Protection of the DIFC.
• Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the UAE PDPL), where a processing activity falls within its scope rather than the DIFC regime.
• Regulation (EU) 2016/679 (the GDPR) and the UK GDPR together with the Data Protection Act 2018, in respect of personal data of individuals in the EEA and the United Kingdom where our processing is caught by their territorial scope.

Where more than one regime applies to the same processing, we apply the standard that affords you the greater protection. References in this notice to a right or an obligation are to be read as references to the equivalent provision under whichever of those laws applies to you.

We collect the minimum needed for the purpose at hand. We do not collect special categories of personal data, health, biometric, genetic, religious, political or similar, and we ask you not to send them to us.

Every purpose below is tied to a lawful basis. Where we rely on legitimate interests, those interests are set out in Our legitimate interests.

Where we rely on legitimate interests we have carried out a balancing assessment: we identified the interest, tested whether the processing is necessary to achieve it, and weighed it against your interests, rights and freedoms. The interests we rely on are:

• responding to people who approach us, and approaching organisations about work we can do for them;
• performing and administering contracts entered into with organisations, which necessarily involves processing data about their personnel;
• keeping accurate business records;
• keeping this website and our systems secure and available, and understanding which parts of the site are read and how they are used;
• protecting our legal position, including establishing, exercising and defending claims.

In each case the processing is limited to business contact information used in a business context, it is what a professional would reasonably expect, and it does not involve sensitive data, profiling or automated decision-making. You may object at any time, see Your rights. If you object to business development contact, we will stop and record the objection so we do not contact you again.

This website is a publication, not a product. It has no user accounts and no advertising, and it does not build a profile of you.

• Cookieless page counting. We count page views so we know which pages are read. That measurement sets no cookie, writes nothing to your device, and carries no identifier that could recognise you here or anywhere else.
• Heatmaps and session replay. We run Microsoft Clarity, which records how a page is used: clicks, taps, scrolling, pointer movement and the order you moved through the site in. A replay is a reconstruction of the page and those interactions, not a recording of your screen, and Clarity's masking is left on so the text you type into form fields is not captured. It exists so we can find the paragraph nobody reads and the button nobody finds.
• One third-party script. Clarity is served by Microsoft from clarity.ms, so loading a page here does cause your browser to contact Microsoft. Everything else, fonts, images, our own scripts and the page-view counter, is served from our own domain.
• Three cookies. NEXT_LOCALE remembers the interface language you selected. Clarity sets two more so your page views read as one visit, except for visitors in the EEA, the United Kingdom and Switzerland, where it sets none because we send it no consent signal. Every one of them, and the cookies Microsoft sets on its own domains, is named in the Cookie Policy.
• No advertising or social tracking by us. There are no advertising pixels, no conversion tags, no social media plugins, and nothing here is used to sell you something elsewhere. Microsoft does set its own cookies when Clarity loads, and one of them is an identifier it uses across its own sites, including for advertising there. We cannot read it, and the Cookie Policy names it.
• Server logs. Our hosting provider records standard request logs so the site can be delivered and protected against abuse.

Clarity is the only place where this site depends on another company to work, and we would rather say so in the first paragraph than bury it in a vendor list. If we add anything else that stores information on your device or sends it to a third party, we will update this notice and the Cookie Policy before the change goes live.

Much of our work involves building and operating systems that process personal data for which our client, not Sayfitech, is the controller. In that role we are a Processor. We:

• act only on the client's documented instructions;
• enter into a written data processing agreement before the processing begins;
• impose equivalent obligations on any sub-processor and remain responsible for their performance;
• bind our personnel to confidentiality;
• assist the client in responding to data subject requests, in securing the processing, and in meeting their breach notification and impact assessment obligations;
• return or delete the personal data at the end of the engagement, save where we are required to retain a copy by law.

If you are an individual whose data is held in a system we operate for a client, please direct your request to that client. If you send it to us, we will pass it on promptly and tell you that we have done so.

We do not sell personal data, and we do not disclose it to third parties for their own marketing. We share it only with the following categories of recipient, and only so far as necessary:

• Cloud hosting and content delivery providers, who host this website and our working systems, and who count page views for us in aggregate.
• Microsoft, which operates the Clarity service that produces the heatmaps and session replays described in What this website actually collects.
• Business email, storage and productivity providers, which hold our correspondence and project documents.
• Accounting, audit and tax advisers, and our banking and payment providers, for invoicing and statutory reporting.
• Professional and legal advisers, where we need advice or must establish or defend a claim.
• Specialist subcontractors, engaged under written confidentiality and data protection terms where a project requires a capability we do not hold in-house.
• Courts, regulators and public authorities, where disclosure is required by law or by an order binding on us.
• A buyer or successor, in the event of a reorganisation, merger or sale of the business or its assets, subject to equivalent protections.

Each provider acts under a written contract that restricts them to processing on our instructions. A current list of the processors we use is available on request from privacy@sayfi.ai.

We are established in the DIFC, our clients are international, and some of our providers are located outside the DIFC and outside the United Arab Emirates. Personal data may therefore be transferred across borders. Every such transfer is made on one of the following bases:

• the destination jurisdiction has been assessed as providing an adequate level of protection under Article 26 of the DIFC Data Protection Law;
• otherwise, appropriate safeguards under Article 27 of that Law, contractual clauses, including the standard clauses published by the Commissioner, or binding corporate rules;
• for personal data protected by the GDPR, the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914; for personal data protected by the UK GDPR, the UK International Data Transfer Agreement or Addendum. In each case we carry out a transfer risk assessment and apply supplementary measures where the assessment calls for them;
• in narrow cases, a statutory derogation, your explicit consent, necessity for a contract concluded in your interest, or the establishment, exercise or defence of legal claims.

You may request a copy of the safeguards we rely on for a particular transfer by writing to privacy@sayfi.ai. We may redact commercially confidential terms.

We keep personal data only for as long as we need it for the purpose it was collected for, then delete it or irreversibly anonymise it. Our standard periods are:

Where no fixed period is stated, we set retention by reference to the nature and sensitivity of the data, the purpose it serves, the risk of harm from unauthorised use, whether the purpose can be achieved by other means, and the limitation periods and statutory retention rules that apply.

We maintain technical and organisational measures appropriate to the risk, which we review as our systems change. In general terms they include:

• access granted on a need-to-know basis, with multi-factor authentication on the systems that hold personal data;
• encryption in transit, and encryption at rest where the platform supports it;
• least-privilege, time-limited credentials on client systems, revoked at the end of an engagement;
• separation of production data from development and test environments;
• written confidentiality and security obligations on personnel and subcontractors;
• logging and monitoring, and a documented process for assessing and responding to security incidents.

If a personal data breach occurs, we assess it without undue delay and notify the Commissioner of Data Protection and, where the breach is likely to result in a high risk to you, notify you directly, in each case within the timeframes the applicable law requires.

No transmission over the internet is completely secure. Ordinary email in particular is not a secure channel: please do not send us confidential or sensitive information by unencrypted email, and ask us for a secure channel if you need one.

We do not make decisions about you that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing. We do not profile you for advertising, scoring or evaluation purposes.

We do build artificial intelligence and automation systems for clients. Where such a system processes personal data, the client determines its purpose and we act as processor, and we support the client in meeting the additional requirements the DIFC regime places on autonomous and semi-autonomous processing.

Our services are offered to organisations, not to individuals under 18, and this website is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, write to privacy@sayfi.ai and we will delete it.

Subject to the conditions and exemptions in the applicable law, you have the following rights over your personal data:

• Access. To be told whether we process personal data about you and, if we do, to receive a copy of it together with information about the processing.
• Rectification. To have inaccurate personal data corrected and incomplete data completed.
• Erasure. To have personal data deleted where it is no longer necessary for the purpose it was collected for, where you withdraw the consent it relied on, where you successfully object, or where it has been processed unlawfully.
• Restriction. To have processing limited to storage while a dispute about accuracy, lawfulness or an objection is resolved.
• Portability. To receive the personal data you gave us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible, when the processing is based on consent or contract and carried out by automated means.
• Objection. To object at any time to processing based on our legitimate interests, on grounds relating to your particular situation. Where you object to direct marketing, the right is absolute and we will stop immediately.
• Withdrawal of consent. To withdraw consent at any time, where consent is the basis we rely on. Withdrawal does not affect the lawfulness of processing carried out before it.
• Automated decisions. Not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, and to obtain human intervention where such a decision is made.
• Complaint. To lodge a complaint with a supervisory authority, see Complaints.

These rights are not absolute. Where an exemption applies, or where a right does not extend to the processing in question, we will tell you which one and why.

Write to privacy@sayfi.ai. Tell us which right you are exercising and, where it helps, what the request relates to. You do not need to use a particular form of words.

• Verification. We will ask for information sufficient to satisfy us of your identity before we act, so that we do not disclose personal data to the wrong person. If you are acting for someone else, we will ask for evidence of your authority.
• Cost. There is no charge. We may charge a reasonable fee, or decline to act, only where a request is manifestly unfounded or excessive, in particular because it is repetitive, and we will explain our reasoning if that ever arises.
• Timing. We respond within one month of receipt. Where a request is complex, or where you have made a number of requests, we may extend that period by up to two further months; if we do, we will tell you within the first month and explain why.
• Outcome. We will confirm what action we have taken. If we decline a request, we will tell you why and how you can challenge that decision.

If you are unhappy with how we have handled your personal data or your request, tell us first at privacy@sayfi.ai. We would rather resolve it directly, and a complaint to us does not affect your right to go to a regulator.

You may complain to:

• the Commissioner of Data Protection of the DIFC, the supervisory authority for our jurisdiction, through the contact channels published by the DIFC's Office of the Commissioner of Data Protection;
• if you are in the EEA, the supervisory authority of the country where you live or work, or where you believe the infringement took place;
• if you are in the United Kingdom, the Information Commissioner's Office;
• if the UAE federal regime applies to the processing, the UAE Data Office.

The version in force is always the one published at this address, with its date shown at the top of the page. We keep previous versions and will provide one on request.

Where we make a change that materially affects how we use your personal data, and we hold contact details for you in an ongoing relationship, we will take reasonable steps to tell you directly rather than relying on you to check this page.

This notice is published in English. Any translation is provided for convenience only; in the event of a conflict or inconsistency, the English text prevails.