Privacy notice

1. Who we are

Regulyx [legal name], a company incorporated on the UAE mainland with registered address [address], is the controller of the personal data described in this notice. Contact: [email address].

2. The law that applies

This notice is written under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL) and its executive regulations. [Counsel to confirm whether any free-zone data protection law also applies to any part of the processing, and whether a data protection officer must be appointed.]

3. What we collect

• Invitation and call-back requests. Your name, work email address, company or project name, and, if you give them, a sentence about the business, the regulator you have in mind and a preferred time for a call.
• The assessment account. Your email address and company name, used to sign you in. There is no password.
• Your answers and messages in the assessment. The answers you give and, once the model-backed conversation is in use, the messages you type.
• Technical data. This site sets no cookies and uses no analytics or advertising trackers. The assessment stores your progress in your own browser so that you can return to it. [Confirm server logs retained by the hosting provider and the assessment backend, and for how long.]

We never ask for identity documents through this site or the assessment, and we ask you not to upload or paste them.

4. Why we use it and on what basis

• To reply to your request, send an invitation, arrange a call-back and prepare the confirmed report: steps taken at your request before any contract. [Counsel to confirm the PDPL basis.]
• To run the assessment and process your messages with an AI model: your consent, which you give at the start of the assessment and can withdraw.
• To correct errors and improve the rules the assessment runs on: our legitimate interest in the accuracy of our work, using anonymised records. [Counsel to confirm.]

5. Processing by an AI model

The messages you type in the assessment are processed by an AI model, Lyx, which runs inside the UAE. This happens only with your consent, which the assessment asks for before the first message is sent.

Your name, email address, company name and any other contact details are never sent to the model. Messages are sent without identifiers, and the provider is not given the means to link them to you. [Name of the model provider, the UAE region where it runs, and the contractual terms, including that the provider does not use the data to train its models, to be confirmed by counsel.]

6. Other recipients and transfers

• The invitation and call-back form is delivered to Regulyx through a Google service. [Counsel to confirm where Google processes it and the basis for that transfer.]
• The assessment backend is hosted in the Amazon Web Services region in the UAE. [Confirm region and the terms that apply.]
• This site is hosted by [hosting provider and location].
• We do not sell or share personal data for marketing.

7. How long we keep it

• Assessment transcripts and answers: 12 months from your last message, then deleted.
• Invitation and call-back requests, and the confirmed report: [period] from our last contact with you, unless you ask us to delete them sooner or an engagement follows.
• Anonymised records used to correct the rules: kept without any link to you.

8. Your rights

Under the PDPL you can ask for access to your personal data, correction, deletion, restriction of processing, portability, and to object to processing, and you can withdraw consent at any time. Write to [email address]. We will respond within the period the law sets. [Counsel to state the period, the identity checks we apply, and the complaints route to the UAE Data Office.]

9. Security and breaches

[Counsel and Regulyx to describe the technical and organisational measures in place and the breach-notification procedure, including the time limits for notifying the regulator and affected individuals.]

10. Changes

We will post any change to this notice on this page with the date it took effect. This version: [date].