Privacy Policy

1. Who we are.

This Policy explains how Defense AI Holding – S.P.C. – L.L.C ("Defense^AI", "we") collects, uses and protects the personal data of visitors and users of www.Defense^AI.com (the "Site"). Defense^AI is the controller of that data; where we engage service providers, they act as processors under our documented instructions. This Policy is issued under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and its Executive Regulations, and other applicable UAE laws. The UAE Data Office is the supervisory authority under the PDPL. Contact details are in section 10.

This Policy does not apply to third-party websites; your use of them is at your own risk and subject to their own policies.

The Site is not directed to children under the age of 18. If you believe a child has provided personal data to us, contact us; we will delete it.

2. Data we collect.

"Personal data" means any information relating to an identified or identifiable individual, as defined in the PDPL.

We do not currently collect special categories of personal data under the PDPL (data on racial or ethnic origin, political views, religious or philosophical beliefs, trade-union membership, criminal background, health, biometric or genetic data, or sexual life or orientation). If we ever do, we will notify you of the purpose in advance and process only with your explicit consent or another lawful basis.

We may collect: Identity (name, title, date of birth, gender); Contact (address, email, phone); Financial (payment details); Transaction (payments and purchases); Technical (IP address, device, browser and login information); Profile (account details — passwords stored in hashed/encrypted form only — preferences and feedback); Usage (how you interact with the Site); and Marketing & Communications (marketing preferences).

Where we obtain data from third parties or public sources (e.g., payment or fraud-screening providers), we identify the source as required by the PDPL. Providing your data is voluntary, except where necessary to provide the service you request or required by law; without it we may be unable to complete your transaction or provide the service. We may also process aggregated or anonymised data that does not identify you.

3. Cookies.

The Site uses: (i) strictly necessary cookies, required for operation (no consent); and (ii) analytics and (iii) advertising/personalisation cookies, each requiring your prior consent, obtained via the cookie consent banner on first visit. You may change or withdraw consent at any time via the same banner or your browser settings.

4. How we use your data (lawful basis).

• Register you, and process and deliver orders — performance of a contract / legal obligation (e.g., tax, delivery).
• Manage the customer relationship and answer enquiries — contract / legal obligation / legitimate interests.
• Secure the Site and prevent and detect fraud — legitimate interests / legal obligation.
• Run voluntary surveys — your consent.
• Serve general (non-personalised) advertising and measure effectiveness with aggregated data — legitimate interests.
• Serve targeted or personalised advertising, and personalise content, suggestions or recommendations (including via profiling) — your prior consent.
• Send direct marketing by email, SMS or similar — your prior consent.
• Improve the Site through analytics — legitimate interests (your consent where profiling or cross-site tracking is involved).

Where we rely on consent, it is freely given, specific, informed and unambiguous, and not a condition of using the Site or of any contract except where required by law. You may withdraw consent at any time, as easily as you gave it.

Automated decision-making. We do not take decisions based solely on automated processing (including profiling) that produce legal effects concerning you or similarly significantly affect you, other than automated fraud screening. Where we do, we will tell you the logic involved and give you the right to request human intervention, express your point of view and contest the decision.

5. Who we share your data with.

Only where necessary for the purposes in section 4, with: (a) Defense^AI and group companies; (b) service providers (payment, hosting/IT, CRM/marketing, analytics, fraud screening); (c) professional advisers; (d) a successor in any sale, transfer or merger of the business; and (e) regulators and law-enforcement bodies as required by law, or to establish, exercise or defend legal claims. All recipients are bound by confidentiality, the law and appropriate security measures, and may not use your data for their own purposes

6. Transfers outside the UAE.

We transfer personal data outside the UAE only where: (a) the UAE Data Office has determined the destination provides adequate protection; (b) appropriate safeguards are in place (e.g., the Data Office's standard data protection clauses, equivalent contract terms, or approved binding corporate rules); (c) you give explicit consent after being informed of the risks; or (d) the transfer is necessary for a contract with you or steps at your request.

7. Security and breach.

Appropriate technical and organisational measures protect your data; access is limited to those with a business need to know, under a duty of confidentiality. We maintain breach-response procedures. Where a breach is likely to result in a high risk to you, we will notify the UAE Data Office without undue delay and, where required, notify you of what happened, our response, and steps you may take.

8. Retention.

We retain personal data only as long as necessary for the purposes collected, including legal, tax, accounting and reporting requirements, and longer where there is a complaint or litigation. By law we must keep certain tax records for seven years and certain customer identification and transaction records for ten years for anti-money-laundering purposes. You may request deletion where permitted by the PDPL; we may retain data that law requires us to keep.

9. Your rights.

Under the PDPL you have the right to: access and copy your data; rectify inaccurate or incomplete data; erasure where permitted; restriction where permitted (accuracy disputes, unlawful processing, or while an objection is resolved); data portability in a structured, machine-readable format where feasible; object to processing on grounds relating to your particular situation, including an unconditional right to object to direct marketing and any related profiling; withdraw your consent; and not be subject to solely automated decisions, as described in section 4.

To exercise any right, write to legal@Defense^AI.com. We may verify your identity. We respond without undue delay and in any event within [30 days – verify]; requests are free of charge unless manifestly unfounded or excessive. You also have the right at any time to lodge a complaint with the UAE Data Office.

10. Contact.

Defense^AI Holding – S.P.C. – L.L.C, Level 7, Aldar HQ, Abu Dhabi, UAE.

General: help@Defense^AI.com.

Legal notices and data requests: legal@Defense^AI.com.

11. Changes.

We may update this Policy by posting a revised version; continued use of the Site after posting constitutes acceptance. For material changes (in particular changes to processing purposes), we will notify you in advance and seek renewed consent where consent is the lawful basis.

12. General; governing law.

If any provision is invalid or unenforceable, the remainder continues in effect; no failure to enforce any provision is a waiver. Nothing in this Policy limits or waives any right under the PDPL or other applicable UAE law. This Policy is governed by the laws of the Emirate of Abu Dhabi and the federal laws of the UAE, and disputes are subject to the jurisdiction of the UAE courts. Nothing prevents you from seeking urgent interim relief or lodging a complaint with the UAE Data Office.