Privacy Policy
This policy describes how Digital Foundry (“we”, “us”, “our”) processes personal data when you visit digitalfoundry.ai, use our forms, training tools, newsletters, and related services. It is written to align with the EU/UK General Data Protection Regulation (GDPR), the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, “PDPL”), applicable UK Data Protection Act 2018 requirements, and privacy governance concepts from the NIST Privacy Framework. Where we deploy AI features, we also address transparency expectations under the EU Artificial Intelligence Act for limited-risk and general-purpose interactions on our public website. This document is not legal advice; contact us if you need a data processing agreement for enterprise engagements.
1. Who we are (data controller)
Digital Foundry is the controller for personal data described in this policy for our website and marketing operations. We operate globally with teams in the United Arab Emirates, United Kingdom, India, and Pakistan.
- Website: https://digitalfoundry.ai/
- Privacy contact: contact@digitalfoundry.ai
- General inquiries: info@digitalfoundry.ai
For client projects, a separate controller/processor role may apply under your contract and Data Processing Agreement (DPA). This policy covers our corporate website and publicly offered sign-up flows unless we tell you otherwise.
2. Scope
This policy applies to:
- Visitors and registered users of digitalfoundry.ai and sub-paths (AI Hub, training assessments, careers, contact forms).
- Newsletter and event subscribers.
- Applicants who submit CVs or portfolio links through our careers forms.
- Participants in AI readiness surveys and training feedback forms hosted on our site.
It does not cover third-party websites linked from our pages (social networks, partner tools, video platforms). Those sites have their own policies.
3. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identity & contact | Name, email, phone, job title, company, country/location | Forms you submit (consultation, survey, careers, feedback) |
| Professional & application | CV/resume files, portfolio URLs, role applied for, survey answers about AI maturity | Careers upload; training assessment APIs |
| Account & authentication | Email address used to sign in; session identifiers | Google Identity / OTP flows where enabled; browser storage |
| Usage & session telemetry | Pseudonymous session ID, pages/sections visited, link clicks, time on site, coarse geo (country), IP address, browser user-agent | Our telemetry API and optional third-party IP geolocation lookup |
| Communications | Email content of confirmations we send; admin notifications of subscriptions | SMTP/mail systems processing your submissions |
| Preferences | Language choice (e.g. English/Arabic); cookie consent choices when saved | Browser local storage |
We do not intentionally collect special categories of data (health, biometrics, etc.) through the public website. Please do not submit sensitive personal data in free-text fields unless we explicitly request it for a regulated engagement.
4. Purposes and legal bases (GDPR / UK GDPR)
We process personal data only where we have a valid legal basis:
- Contract / pre-contract steps (Art. 6(1)(b)): responding to consultation requests, processing job applications, delivering training access you request.
- Legitimate interests (Art. 6(1)(f)): securing and improving the website, fraud prevention, aggregated analytics, understanding product interest, and B2B marketing to business contacts who interact with us—balanced against your rights.
- Consent (Art. 6(1)(a)): non-essential cookies/analytics where required; newsletter where opt-in is presented; optional marketing beyond existing customer relationship.
- Legal obligation (Art. 6(1)(c)): record-keeping, responding to lawful requests from authorities.
Under UAE PDPL, we rely on equivalent grounds including consent, performance of contract, and legitimate interest where permitted, and we apply data minimization and purpose limitation by default.
5. Artificial intelligence and automated processing
5.1 Website AI features
Our site showcases AI agents, prompts, tools, and interactive demos. When you use features that send text to external model providers (for example sandbox chat or third-party embedded runtimes), your inputs may be processed by those providers under their terms. We design enterprise deployments with governance, logging, and human oversight; the public marketing site is not a production tenant for your confidential data.
5.2 Surveys and assessments
AI training readiness surveys store your responses to score baseline maturity and route follow-up from our team. Outcomes are not used for fully automated decisions with legal or similarly significant effects without human review.
5.3 Recruitment
Automated parsing or ranking may assist recruiters, but hiring decisions involve human review. You may request human intervention regarding any automated shortlisting where applicable law grants that right.
5.4 EU AI Act transparency
Where our public site exposes chatbots or AI-generated content, we aim to label synthetic outputs and provide this policy so users understand that interactions may be logged for security and quality. High-risk AI systems used in client engagements are governed separately under client contracts.
6. Cookies and similar technologies
We use:
- Strictly necessary: session continuity, security, load balancing, and storage of essential preferences (e.g. language).
- Analytics & grid telemetry (optional): pseudonymous session measurement when you accept cookies via our consent banner.
- Personalization (optional): remembering choices that tailor on-site experience when enabled and accepted.
You can withdraw consent via browser settings or our cookie banner (“Decline” / “Manage”). Blocking necessary cookies may limit sign-in or form features. We do not sell personal data obtained through cookies.
7. How we share personal data
We may share data with:
- Hosting & infrastructure: web hosting, CDN, and email delivery providers that process data on our instructions.
- Authentication: identity providers (e.g. Google) when you choose social login.
- Geolocation lookup: limited IP-to-country services to display aggregate telemetry (e.g. ipapi.co) — not for advertising profiles.
- Professional advisers: lawyers, auditors, insurers under confidentiality.
- Authorities: when required by applicable law.
We require processors to implement appropriate safeguards by contract (Article 28 GDPR-style clauses where applicable).
8. International transfers
Digital Foundry operates internationally. Data may be stored or processed in the UAE, EEA, UK, India, Pakistan, the United States, or other locations where our providers maintain facilities. Where GDPR/UK GDPR applies, we use appropriate transfer tools such as Standard Contractual Clauses, UK IDTA/Addendum, or adequacy decisions, plus supplementary measures where required. UAE PDPL cross-border rules are assessed per transfer purpose and recipient jurisdiction.
9. Retention
- Active session telemetry: rolling short-term storage (e.g. five minutes of inactivity pruning for live session counters; longer retention only in aggregated or security logs).
- Form submissions & surveys: retained for the duration of the business relationship and up to 24 months afterward unless law requires longer or you request earlier deletion.
- Newsletter: until you unsubscribe or we retire the list.
- Job applications: typically up to 12 months for talent pool purposes unless you consent to longer retention or local law requires otherwise.
- Security logs: as needed to investigate incidents, generally not more than 12 months.
10. Security (NIST-aligned practices)
We apply administrative, technical, and organizational measures aligned with NIST Privacy Framework concepts (Identify, Govern, Control, Communicate, Protect): access control, encryption in transit (HTTPS), least-privilege admin access, secure upload validation for CVs, API hardening, and monitoring. No method of transmission over the Internet is 100% secure; we encourage strong passwords and caution against submitting secrets via public forms.
11. Your rights
Depending on your location, you may have the right to:
- Access a copy of your personal data.
- Rectify inaccurate data.
- Erase data (“right to be forgotten”) where grounds apply.
- Restrict or object to processing, including direct marketing.
- Data portability for data you provided, where processing is automated and based on consent or contract.
- Withdraw consent at any time (without affecting prior lawful processing).
- Lodge a complaint with a supervisory authority.
UAE PDPL provides comparable rights including access, correction, erasure, and restriction in defined circumstances.
To exercise rights, email contact@digitalfoundry.ai with “Privacy Request” in the subject. We may verify identity before responding. We aim to reply within 30 days (GDPR) or the timeframe required by UAE PDPL.
Supervisory authorities (examples)
- UAE: UAE Data Office — u.ae data protection portal
- UK: Information Commissioner’s Office (ICO) — ico.org.uk
- EEA: your local EU/EEA data protection authority
12. Children
Our services are directed at business professionals. We do not knowingly collect personal data from children under 16 (or under 13 where U.S. COPPA applies). If you believe a child provided data, contact us for deletion.
13. California residents (CPRA)
We do not sell or share personal information for cross-context behavioral advertising as defined under the California Privacy Rights Act. California residents may request access, deletion, and correction by contacting us. We will not discriminate against you for exercising privacy rights.
14. Changes to this policy
We may update this policy to reflect legal, technical, or business changes. We will post the new effective date at the top of this page. Material changes may be highlighted on the website or via email where appropriate.
15. Contact
Digital Foundry — Privacy
Email: contact@digitalfoundry.ai
Web: Contact form
Locations: Sharjah, UAE · Skipton, UK · Kumbakonam, India · Islamabad, Pakistan