Privacy

Overview

This privacy policy explains which personal data we process when you visit this website or are in contact with us, what we use it for and what rights you have. Personal data is any data that can be used to identify you personally.

This website uses no analytics or advertising services and loads no content from third parties. Fonts are served from our own web space.

Controller

DATYS AI - FZCO,
Building A5, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates. E‑mail: privacy@datys.ai.

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

Where your data is processed

We are based in the United Arab Emirates, so data you send us is processed there. Our mailboxes and file storage at Microsoft are located there as well. There is no adequacy decision of the European Commission for the United Arab Emirates, so its level of data protection is not formally recognised as equivalent. The transfer takes place because it is necessary to handle your enquiry or to perform a contract with you (Art. 49(1)(b) GDPR).

Further places of processing are Cyprus (hosting of this website) and the USA (AI services and WhatsApp metadata, see the respective sections).

Hosting and server log files

This website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. A data processing agreement is in place with Hostinger.

When a page is requested, the server automatically stores information your browser transmits: browser type and version, operating system, referrer URL, host name of the accessing computer, time of the request and IP address. We do not combine this data with other data sources. We need it to run the website securely and without errors (Art. 6(1)(f) GDPR). How long the log files are kept is governed by Hostinger, see the Hostinger privacy policy.

Cookies and storage in the browser

This website sets no cookies and stores nothing in your browser.

Enquiries by e-mail

When you write to us by e-mail, we store and process your enquiry with the personal data it contains in order to handle your request. Our mailboxes are hosted in Microsoft 365 with data stored in the United Arab Emirates. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or its preparation, otherwise our legitimate interest in handling enquiries (Art. 6(1)(f) GDPR). The data stays with us until your enquiry is settled, you ask us to delete it or the purpose no longer applies. Statutory retention periods remain unaffected.

Communication via WhatsApp

When you write to us via WhatsApp, we use the regular WhatsApp app on our team’s mobile phones, not WhatsApp Business. Your phone number, profile name and picture, the content of the messages and the times of communication are processed. The content is end-to-end encrypted and cannot be read by WhatsApp. WhatsApp does, however, process the metadata of the communication itself, including in the USA.

The provider is the Meta company with which your own WhatsApp account exists, for users in the EU WhatsApp Ireland Limited, Dublin, Ireland. Details are in the WhatsApp privacy policy.

We only use WhatsApp if you choose this channel yourself. The legal basis is Art. 6(1)(b) GDPR where a contract or its preparation is concerned, otherwise our legitimate interest in straightforward communication (Art. 6(1)(f) GDPR). You can switch to another channel at any time.

Online meetings with Microsoft Teams

We use Microsoft Teams for online meetings. Your name, e-mail address, video and audio, chat messages, shared content and technical connection data are processed. The data is held in our Microsoft 365 tenant with data stored in the United Arab Emirates.

We record some meetings or have a transcript made to capture the results. We announce this before the meeting starts, and it only happens with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. We use AI services to turn transcripts into minutes, see the next section.

Otherwise the legal basis is Art. 6(1)(b) GDPR where the meeting serves the preparation or performance of a contract, otherwise our legitimate interest in efficient collaboration (Art. 6(1)(f) GDPR).

AI services

For following up on meetings, for example to produce minutes from transcripts, and when working on documents and correspondence, we use AI services: Claude by Anthropic, and ChatGPT and Codex by OpenAI, both based in the USA. Content from transcripts, messages and project documents, including the personal data it contains, may be transmitted to and processed by these providers.

The legal basis is Art. 6(1)(b) GDPR where this serves the performance of our contract with you, otherwise our legitimate interest in working efficiently (Art. 6(1)(f) GDPR).

Customer and contract data

When you become a customer or a contract is being prepared, we process the contact details of your contact persons, contract content, quotes, invoicing and payment data and the correspondence in order to perform and invoice the contract and to meet legal obligations (Art. 6(1)(b) and (c) GDPR).

This data is held in Microsoft 365 (e-mail and OneDrive) with data stored in the United Arab Emirates.

We delete the data once it is no longer needed for the contract and the statutory retention periods of the United Arab Emirates have expired. For tax-relevant records these currently amount to up to seven years.

Recipients

We only pass on personal data where this is necessary for a contract, where we are legally obliged to do so, where we have a legitimate interest in it or where you have consented. The service providers we use are named in the sections above.

Legal bases at a glance

We process data on the basis of your consent (Art. 6(1)(a) GDPR), for the performance of a contract or pre-contractual measures (point b), to meet legal obligations (point c) or on the basis of our legitimate interest (point f). The basis that applies in each case is stated in the respective section.

Retention

Unless a more specific period is stated above, we keep your data until the purpose of the processing no longer applies. If you make a justified request for deletion or withdraw your consent, we delete your data unless a statutory retention obligation prevents this. In that case we delete it as soon as the obligation ends.

Your rights

You have the right at any time to obtain information free of charge about your stored data, its origin, its recipients and the purpose of processing. You can request rectification, erasure or restriction of processing, and receive data that we process automatically on the basis of your consent or a contract in a common, machine-readable format.

You can withdraw consent at any time with effect for the future; the lawfulness of processing carried out until then remains unaffected. To do so, write to privacy@datys.ai.

Right to object (Art. 21 GDPR)

Where processing is based on Art. 6(1)(e) or (f) GDPR, you may object to it at any time on grounds relating to your particular situation. We then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

Where your data is processed for direct marketing, you may object to this at any time. Your data will then no longer be used for this purpose.

Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement.

Notes for persons in Switzerland

For persons in Switzerland the Federal Act on Data Protection (FADP) applies. The rights described above are available to you within the scope of the FADP. Data is transferred to the United Arab Emirates, Cyprus and the USA. The Swiss Federal Council has not found the level of data protection in the United Arab Emirates to be adequate. The transfer there takes place because it is necessary to handle your enquiry or to perform a contract with you.

The competent supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch.

Encryption

This website uses TLS encryption, recognisable by “https://” in the address bar and the padlock symbol in your browser. Data you send us through the website cannot then be read by third parties. Communication by e-mail cannot be fully protected against access by third parties.

Objection to advertising e-mails

We hereby object to the use of the contact details published in the imprint for sending advertising and information material that has not been expressly requested.

Changes

We update this privacy policy when the website, our services or the legal situation change. The version published here applies.