Privacy Policy
Rasiya Last updated: [FILL: publish date] Effective date: [FILL: effective date]
Draft for review. This document is launch-ready in structure and content but must be reviewed by qualified legal counsel and have all
[FILL: …]items completed before it is published. Items in brackets are facts only Rasiya can confirm.
1. Who we are
This Privacy Policy explains how Rasiya ("Rasiya", "we", "us", "our") collects, uses, and protects personal data when you visit rasiya.ai (the "Site") or otherwise interact with us.
Rasiya is a company based in Dubai, United Arab Emirates. For the purposes of the UAE Personal Data Protection Law (PDPL) and, where it applies, the EU/UK General Data Protection Regulation (GDPR), the data controller is:
- Legal entity: [FILL: legal entity name]
- Registered address: [FILL: registered address, Dubai, UAE]
- Trade licence: [FILL: free zone and licence number]
- Privacy contact: [FILL: privacy@rasiya.ai — confirm this inbox exists and is monitored]
If you have any questions about this policy or your personal data, contact us at the address above.
2. What data we collect
We only collect data that you give us or that is necessary to operate the Site.
| Category | Examples | When |
|---|---|---|
| Contact / lead data | Name, work email, company, role, message, and anything else you submit | When you submit a walkthrough / tailored-demo form, the integrations demo form, or the audit-call form |
| Booking data | Name, email, selected time slot, time zone | When you book an audit call via our scheduling provider |
| Usage & device data | IP address, browser type, device, pages viewed, referrer, approximate location | Automatically, via cookies and analytics (only after you consent to non-essential cookies — see our Cookie Policy) |
| Communications | The content of emails or messages you send us | When you contact us directly |
We do not intentionally collect special-category data (health, ethnicity, etc.). Please do not include such data in free-text form fields.
3. Why we use your data and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Respond to your enquiry, book and run your audit call, send the materials you requested | Performance of a contract / steps prior to a contract, and our legitimate interest in responding to you |
| Operate, secure, and improve the Site | Our legitimate interest in running a safe, functional website |
| Measure Site usage with analytics | Your consent (given via the cookie banner) |
| Send you marketing or follow-up communications (where applicable) | Your consent, or legitimate interest for existing business contacts, subject to your right to opt out |
| Comply with legal obligations (tax, accounting, responding to lawful requests) | Compliance with a legal obligation |
You can withdraw consent at any time without affecting prior processing — see Section 7.
4. Who we share data with
We do not sell your personal data. We share it only with service providers ("processors") who help us run the Site and our business, under contracts that require them to protect your data:
| Provider | Role | Notes |
|---|---|---|
| Vercel | Website hosting & content delivery | [FILL: confirm — current dev deploy is on Vercel] |
| [FILL: Resend / Formspree / CRM] | Form delivery & lead storage | The service that receives form submissions |
| [FILL: Calendly / Cal.com] | Audit-call scheduling | Receives booking details |
| [FILL: Google Analytics 4 / Plausible] | Website analytics | Only loads after consent |
| [FILL: Google Workspace or other] | Business email | Where we receive and reply to your messages |
A current list of sub-processors is available on request. We may also disclose data where required by law, to protect our rights, or in connection with a merger or acquisition.
5. International transfers
Some of our providers are located outside the European Economic Area (e.g. the United States). Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (SCCs) and/or the EU–US Data Privacy Framework. [FILL: confirm with counsel which mechanism applies once vendors are finalised, and whether the Dubai entity receives any EEA personal data.]
6. How long we keep your data
We keep personal data only as long as necessary:
- Lead / enquiry data: [FILL: e.g. 24 months] from your last interaction, then deleted or anonymised, unless a contract or legal obligation requires longer.
- Booking data: for the duration of the engagement and our standard retention period.
- Analytics data: per the retention setting of our analytics provider [FILL: e.g. 14 months in GA4].
7. Your rights
Under the UAE PDPL and, where it applies, the GDPR, you have the right to: access your data, request rectification or erasure, restrict or object to processing, request data portability, and withdraw consent at any time. To exercise any of these, contact [FILL: privacy@rasiya.ai]. We will respond within one month.
You also have the right to lodge a complaint with the competent data protection authority in the UAE, or with the supervisory authority where you live.
8. Cookies
We use cookies and similar technologies as described in our Cookie Policy. Non-essential cookies load only after you give consent through our cookie banner, and you can change your choice at any time.
9. Security
We maintain technical and organisational measures appropriate to the risk, including encryption in transit, access controls, and vendor due diligence. See our security overview for more detail.
10. Changes to this policy
We may update this policy from time to time. Material changes will be posted on this page with an updated "Last updated" date.
11. Contact
[FILL: legal entity name] [FILL: registered address, Dubai, UAE] [FILL: privacy@rasiya.ai]