Privacy Policy
Effective 2 July 2026
This Privacy Policy explains how Exec X AI Ltd (DIFC Registration No. 10474), of the Dubai International Financial Centre, Dubai, United Arab Emirates (“we”, “us”, the “Controller”), collects, uses, discloses and protects personal data through regulation10.ae and its platform (the “Service”). It is issued in accordance with the DIFC Data Protection Law No. 5 of 2020 (the “DIFC DPL”) and the DIFC Data Protection Regulations.
These documents are scaffolds. Final clauses are reviewed by external counsel before commercial launch.
1. Data Protection Officer
We have appointed a Data Protection Officer. For any privacy matter, or to exercise your rights, contact:
Khaled Shivji, Data Protection Officer
Email: Khaled@execxai.com
Telephone: +971 55 853 2913
Address: Exec X AI Ltd, DIFC, Dubai, United Arab Emirates
2. Personal data we process
- Account & identity data: name, work email, role, organisation, and authentication data (one-time codes, authenticator enrolment, recovery codes).
- Contact & enquiry data: information you submit via contact, demo, and support forms.
- Usage & technical data: IP address, device and browser information, pages visited, and access logs used for security and to operate the Service.
- Compliance & assessment data: information you enter into assessments and compliance modules, and documents you generate. You are responsible for the lawful basis of any third-party personal data you input.
- Billing data: subscription tier, and payment metadata processed by our payment providers (we do not store full card numbers).
3. Purposes and legal bases (Article 10, DIFC DPL)
| Purpose | Legal basis |
|---|---|
| Provide, authenticate and secure the Service | Performance of a contract; our legitimate interests in security |
| Respond to enquiries and provide support | Our legitimate interests; steps prior to a contract |
| Billing and subscription management | Performance of a contract; compliance with legal obligations |
| Cookieless aggregate analytics to improve the Service | Our legitimate interests (see the Cookie Policy) |
| Comply with law and respond to lawful requests | Compliance with a legal obligation |
4. Recipients and processors
We share personal data only with service providers who process it on our instructions under appropriate contracts, including hosting and cloud infrastructure (data resident in UAE North), payment processing, invoicing, transactional email, and privacy-friendly analytics. We do not sell personal data.
5. International transfers (Articles 26–27, DIFC DPL)
Service data is hosted in the UAE North region. Where personal data is transferred outside the DIFC, we do so only to jurisdictions recognised as providing an adequate level of protection, or subject to appropriate safeguards (such as standard contractual clauses) as required by the DIFC DPL.
6. Retention
We retain personal data only for as long as necessary for the purposes above, to meet legal, audit and evidentiary obligations, and to resolve disputes. Compliance artefacts and audit logs may be retained for the period required for regulatory evidence. On cancellation, account data is retained read-only before deletion as described in your service terms.
7. Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls, multi-factor authentication, sealed and tamper-evident audit logging (each record is fingerprinted when it is saved, so any later change would be detected), and UAE-North data residency.
8. Automated processing (Articles 22–24, DIFC DPL)
The Service produces AI-assisted compliance outputs (for example, draft assessments and notices). These are decision-support tools that remain subject to human review by your organisation; we do not use them to make decisions producing legal effects about you without human involvement.
9. Your rights (Articles 32–40, DIFC DPL)
Subject to the DIFC DPL, you have the right to:
- access your personal data and obtain a copy;
- rectify inaccurate or incomplete data;
- erasure (“right to be forgotten”) in defined circumstances;
- restrict or object to certain processing;
- data portability;
- withdraw consent at any time (without affecting prior processing); and
- not be subject to solely automated decisions with legal effect.
To exercise any right, contact our Data Protection Officer (section 1). We respond within the timeframes set by the DIFC DPL. You also have the right to lodge a complaint with the Commissioner of Data Protection at the DIFC (difc.ae, data protection).
10. Children
The Service is intended for business users and is not directed to children. We do not knowingly collect personal data from children.
11. Changes
We may update this Privacy Policy from time to time. Material changes will be reflected by the “Last updated” date above.