S.AI.F
Book a demo
Privacy & cookies · v1.0 · September 2026

We audit other people's data practices. Ours have to hold up first.

This notice covers the S.AI.F website, the validation console and the assessment engagements we run. It is written to the UK GDPR and Regulation (EU) 2016/679, and to the UAE Federal Decree-Law No. 45 of 2021 where a client is established here.

Exercise a data right
01

Privacy notice

What we hold, why we are allowed to hold it, and how long it stays. One row per purpose — if a purpose is not listed, we are not pursuing it.

What we collect
Why
Lawful basis
Retention
Booking form
Name, work email, organisation, sector and the context you type. Used to prepare and hold the session.
Art. 6(1)(b) — steps prior to a contract
24 months from last contact
Assessment artefacts
Model weights, datasets and configs a client uploads. We are the processor; the client remains controller and instructs us in the DPA.
Art. 28 — processing on documented instructions
Deleted 30 days after certification, or on request
Console accounts
Login identity, role, and an immutable audit log of who approved which gate.
Art. 6(1)(b) and 6(1)(c) — contract and legal obligation
Audit log 7 years — evidence must outlive the certificate
Site analytics
Aggregated page views with truncated IP. Only if you switch analytics on.
Art. 6(1)(a) — consent
14 months
Consent record
Your cookie choices, the version of this notice and a timestamp — so the choice can be evidenced and withdrawn.
Art. 7(1) — demonstrating consent
12 months, then we ask again
We never
· Sell or rent personal data
· Train any model on client artefacts
· Use assessment data for another client's benchmark
· Make automated decisions with legal effect about you
Processors we use
· Cloud hosting — EU or UAE region, client's choice
· Email and calendaring for scheduled sessions
· Privacy-first analytics, only on consent
· On-premise engagements use none of the above
Sovereign option

For regulated and government clients the whole assessment can run inside your own environment. Nothing leaves your perimeter, and this notice then applies only to the marketing site.

02

Cookie policy

Nothing beyond the strictly necessary set is written to your device until you switch it on. No pre-ticked boxes, no cookie walls, no “continue means consent” — rejecting is one click, exactly like accepting.

Strictly necessaryALWAYS ON
Keeping the site up and your session safe
saif-cookie-consentyour choices · 12 months · first-party
saif-sessionsigned-in state · session · first-party
saif-csrfform forgery protection · session · first-party
Exempt from consent under Art. 5(3) ePrivacy — strictly necessary to deliver a service you requested. Never used for profiling.
AnalyticsOFF BY DEFAULT
Which pages are read, where journeys break
saif-analytics-idrotating visit id · 14 months · first-party
saif-page-depthscroll depth per page · session · first-party
IP truncated before storage; reports are aggregate only. Withdrawing consent deletes the identifier on your next page load.
PersonalisationOFF BY DEFAULT
Not asking you the same question twice
saif-sectorsector view for demos · 6 months · first-party
saif-localelanguage, EN or AR · 12 months · first-party
Preference only. It never builds a profile and is never shared with a third party.
Targeted advertisingOFF BY DEFAULT
Measuring campaigns on professional networks
li_fat_idcampaign attribution · 30 days · third-party
saif-campaignwhich campaign brought you · 90 days · first-party
The only category involving a third party. Left off, no third-party tag is loaded at all — it is not merely suppressed.
Changed your mind? Consent is as easy to withdraw as it was to give. Your current choices, the version you agreed to and the timestamp are shown in the preferences panel.
03

Your rights

Exercisable free of charge, answered within one month. No account required, and no detriment for asking.

ART. 15
Access
A copy of what we hold about you and why.
ART. 16
Rectification
Correct anything inaccurate or incomplete.
ART. 17
Erasure
Deletion, except where an audit log must be kept by law.
ART. 18
Restriction
Freeze processing while a dispute is resolved.
ART. 20
Portability
Your data in a machine-readable format.
ART. 21
Objection
Object to processing based on legitimate interests.
ART. 7(3)
Withdraw consent
One click, any time, in the footer of every page.
ART. 77
Complain
To your supervisory authority, without coming to us first.
04

Transfers & security

Data stays in region

Hosting is pinned to the EU or the UAE at the client's choice. Any onward transfer runs on Standard Contractual Clauses plus a transfer risk assessment — named in the DPA, never assumed.

Encrypted and segregated

TLS 1.3 in transit, AES-256 at rest, per-client key separation. Assessment environments are isolated per engagement and destroyed when it closes.

Breach notification

Supervisory authority within 72 hours under Art. 33; affected individuals without undue delay where the risk is high. Controllers are told first, not last.

On-premise by request

For sovereign and regulated work the console runs inside your perimeter. We receive findings, not data — the strongest transfer control is not transferring.

05

Contact the DPO

Data protection officer
Rights requests answered within one calendar month.
Security disclosure
Coordinated disclosure; acknowledged within one business day.
Version history
v1.0 — September 2026, first publication. Material changes are announced on this page 30 days before they take effect, and consent is re-collected.
This is a design mockup: addresses, retention periods and processor lists are drafted to the correct shape but must be reviewed by counsel and matched to the live stack before publication.