Shaffra AI Privacy Notice

1. About Shaffra and this Privacy Notice

Shaffra Technology Labs Ltd and its applicable affiliates and entities are referred to in this Privacy Notice as “Shaffra,” “we,” “us” or “our.”

Shaffra develops enterprise artificial intelligence software that enables organisations to configure and deploy AI-powered digital workers, agents and business automation solutions. Depending on the customer’s requirements, these solutions may support business functions such as human resources, recruitment, finance, accounting, customer service and other operational activities.

Shaffra’s solutions are predominantly deployed within infrastructure selected and controlled by the customer, including on-premises environments. Where requested by a customer, Shaffra may also host and manage the customer’s application through Google Cloud infrastructure located in Dammam, Kingdom of Saudi Arabia.

This Privacy Notice explains how Shaffra collects, uses, stores, discloses and otherwise processes Personal Data in the following distinct contexts:

1. when individuals visit or interact with Shaffra’s website;
2. when Shaffra manages enquiries, customer accounts and other business relationships;
3. when Shaffra recruits employees, contractors or other personnel; and
4. when Shaffra provides hosted customer services.

This Notice also explains the distinction between circumstances in which Shaffra acts as a Data Controller and circumstances in which it acts as a Data Processor on behalf of a customer.

Shaffra is subject to the Data Protection Law, DIFC Law No. 5 of 2020, as amended or supplemented from time to time, referred to in this Notice as the “DIFC Data Protection Law.” Where Personal Data processing takes place in, or relates to individuals residing in, the Kingdom of Saudi Arabia, Shaffra may also be subject to the Saudi Personal Data Protection Law issued under Royal Decree No. M/19 dated 9/2/1443H, as amended by Royal Decree No. M/148 dated 5/9/1444H, together with its Implementing Regulations and applicable supporting rules, referred to in this Notice as the “Saudi PDPL.”

Other privacy and data protection laws may apply depending on the location of the individual, the relevant customer and the processing activity.

In this Notice, “Personal Data” means information referring to an identified or identifiable natural person. References to “processing” include collecting, recording, organising, storing, accessing, using, disclosing, transferring, modifying, analysing, restricting, deleting and otherwise handling Personal Data.

2. Scope

This Privacy Notice applies to individuals whose Personal Data Shaffra processes in connection with its business activities, including:

• visitors to our website;
• individuals who contact us or request information about our products or services;
• customers and authorised users of our services where Shaffra acts as Data Controller;
• representatives of our customers, suppliers and business partners;
• applicants for employment; and
• any other individuals whose Personal Data we collect or process in accordance with this Privacy Notice.

This Privacy Notice does not apply where Shaffra processes Personal Data solely on behalf of a customer as a Data Processor. In those circumstances, the relevant customer is responsible for providing the applicable privacy information to the individuals whose Personal Data is processed.

3. Collection of Information

Information you give us

This is Personal Data you provide directly to us, including when you use our website, contact us by telephone, email or other electronic means, request information about our products or services, subscribe to newsletters or other communications, apply for employment, or otherwise interact with Shaffra.

If you contact us, we will keep an electronic record of our correspondence and any Personal Data you choose to provide so that we can respond to your enquiry, manage our relationship with you, or fulfil another legitimate business purpose.

Depending on how you interact with us, the Personal Data you provide may include your name, employer, job title, business or residential address, email address, telephone number, account credentials, photographs, curriculum vitae, employment history, qualifications, and any other information you choose to provide.

Where you apply for employment, we may also collect information relating to your professional experience, education, references, interview notes and, where relevant to the role, the results of recruitment assessments, including AI-assisted or psychometric assessments. Such assessments support our recruitment process only and do not replace meaningful human review.

Our website, products and services collect and process Personal Data only for specific, lawful and transparent purposes in accordance with the DP Law and other applicable laws.

Our website and services are not directed at children, and we do not knowingly collect Personal Data from children except where this is necessary for a specific lawful purpose and permitted by applicable law.

Information we collect about you and your device

Each time you visit our website, we may automatically collect certain technical information, including:

• technical information such as IP address, browser type and version, device identifiers, operating system, language settings, time zone, referring URLs, pages visited, date and time of access, session identifiers, cookie identifiers, diagnostic information, crash logs, usage statistics and other telemetry generated through your interaction with our website or services;
• information about how you use our website, including pages visited, referring websites, interactions with content, and other website usage information; and
• technical logs generated to maintain the security, availability and performance of our website and services.

We use this information to operate, maintain, improve and secure our website and online services.

Where required by applicable law, non-essential analytics or similar technologies are used only with your consent. You have the right to manage your cookie preferences at any time.

Other information we may collect

Depending on your relationship with Shaffra, we may also collect Personal Data:

• from publicly available business sources, such as company websites or professional networking platforms;
• from your employer where you represent one of our customers, suppliers or business partners;
• from recruitment agencies, referees or publicly available professional profiles during recruitment; and
• from authorised customer administrators where you are an authorised user of a customer deployment.

Where Shaffra provides hosted services to customers, the customer determines the Personal Data processed through its deployment and remains responsible for providing appropriate privacy information to the relevant individuals. Shaffra processes such Personal Data only on the customer’s documented instructions where it acts as a Data Processor.

4. Use of Personal Data

Shaffra processes your Personal Data on one or more of the following legal bases, as permitted by the DIFC Data Protection Law:

• Consent where you have given your consent for a specific purpose, such as receiving marketing communications or accepting non-essential cookies.
• Performance of a Contract where processing is necessary to take steps at your request before entering into a contract with you or to perform a contract to which you are a party.
• Compliance with Legal Obligations where processing is necessary to comply with applicable legal or regulatory obligations.
• Legitimate Interests where processing is necessary for Shaffra’s legitimate business interests, provided those interests are not overridden by your rights and freedoms.

We may use your Personal Data to operate and improve our services, respond to enquiries, create and manage customer accounts, provide hosted solutions requested by customers, communicate updates where permitted by law, administer recruitment, perform internal administration and compliance, improve security and performance, develop and test products using anonymised or aggregated data where appropriate, and comply with legal obligations.

Where Shaffra provides enterprise AI solutions to customers, many deployments are installed within the customer’s own environment or otherwise managed by the customer. Where Shaffra provides optional managed hosting, customer Personal Data is processed on behalf of the customer in accordance with the customer’s documented instructions. Shaffra does not use customer Personal Data processed through customer deployments to train its proprietary AI models or for its own independent business purposes.

5. Processing, Storage and Transfer of Personal Data

We take reasonable steps to ensure that your Personal Data is processed lawfully, fairly and transparently in accordance with the DIFC Data Protection Law, the Saudi PDPL (where applicable), this Privacy Notice and any other applicable laws.

We process and store Personal Data only for as long as necessary to fulfil the purposes described in this Privacy Notice, comply with legal and regulatory obligations, resolve disputes and enforce our legal rights. Retention periods vary depending on the type of Personal Data and the purpose for which it was collected.

Where you request correction of inaccurate Personal Data or exercise another applicable data protection right, we will take reasonable steps to update, restrict or erase your Personal Data where required by law. We may retain certain information where continued retention is necessary to comply with legal obligations, establish or defend legal claims, or perform our contractual obligations.

Many of Shaffra’s enterprise AI solutions are deployed within our customers’ own environments or otherwise managed by the customer. Where Shaffra provides optional managed hosting, customer environments are hosted using Google Cloud Platform in Dammam, Kingdom of Saudi Arabia.

For Personal Data processed by Shaffra as a Data Controller, we determine the purposes and means of processing in accordance with this Privacy Notice.

Where Shaffra provides services on behalf of a customer, including optional managed hosting, Shaffra generally acts as a Data Processor and processes Personal Data only on the documented instructions of the relevant customer.

Personal Data processed through customer deployments is not used to train Shaffra’s proprietary AI models, improve models for other customers, or for Shaffra’s own independent commercial purposes.

Where Personal Data is transferred outside the jurisdiction in which it was collected, Shaffra implements appropriate safeguards in accordance with applicable data protection laws, including contractual commitments, DIFC Standard Contractual Clauses or another recognised transfer mechanism, together with appropriate technical and organisational measures.

5.1 Cross-border data transfers from the Kingdom of Saudi Arabia

Where Shaffra processes or stores Personal Data originating in, or relating to, individuals within the Kingdom of Saudi Arabia, any transfer or disclosure of such Personal Data outside the Kingdom will take place only where permitted under the Saudi PDPL and its Implementing Regulations.

Where Shaffra provides optional managed hosting services, customer environments are hosted on Google Cloud Platform located in Dammam, Kingdom of Saudi Arabia. Depending on the services used, limited Personal Data may also be processed through Google Workspace for business communications and collaboration, and AWS email infrastructure where applicable.

Where an international transfer of Personal Data is required, Shaffra will ensure that appropriate safeguards are in place, including contractual transfer mechanisms recognised under applicable law and appropriate technical and organisational measures.

5.2 Autonomous Processing

Our services incorporate artificial intelligence (AI) technologies to deliver automation, analytics and decision-support capabilities to our customers. Depending on the service being provided, AI may process Personal Data under the instructions of our customers or, where we determine the purposes and means of processing, as an independent Controller.

AI processing may include analysing submitted information, classifying or categorising data, extracting information from documents and structured or unstructured content, generating summaries or recommendations, supporting workflow automation, identifying patterns, and performing assessments where implemented by the relevant customer.

Some AI-enabled functions may operate with a degree of autonomy by generating outputs, recommendations or decisions without human intervention at every processing stage. However, our AI systems operate within defined technical, organisational and governance controls designed to ensure alignment with intended purpose, applicable law and contractual obligations.

Where legally significant decisions are made solely through automated processing, or where automated processing otherwise materially affects individuals, we implement appropriate safeguards as required by applicable law. These safeguards may include human review, the ability to challenge or request reconsideration of decisions where applicable, and technical measures intended to promote fairness, reliability, security and accountability.

Unless expressly agreed with the relevant customer, Personal Data processed on behalf of customers is not used to train or improve Shaffra AI’s proprietary models. Shaffra AI maintains an AI governance framework designed to support responsible and trustworthy AI.

6. Sharing of Personal Data

We may share your Personal Data as described in this Privacy Notice or as otherwise notified to you at the time of collection, but only where necessary for the relevant purpose and in accordance with applicable law.

Through our website and services

Where necessary to provide our website, products or services, we may share your Personal Data with service providers supporting operation and security, with third parties necessary to deliver a requested integration or service, or where you have instructed or authorised us to do so.

Other types of data sharing

We will only share your Personal Data where it is necessary for the purposes for which it was collected, where required by law, or where another lawful basis applies.

• sharing is limited to the minimum Personal Data reasonably necessary for the relevant purpose;
• sharing is carried out in accordance with applicable data protection laws; and
• sharing is subject to appropriate contractual, technical and organisational safeguards.

We do not sell your Personal Data or disclose it to third parties for their own independent marketing purposes.

We may share your Personal Data with Shaffra group companies, trusted suppliers and advisers, cloud and communications providers, competent authorities where required by law, parties involved in legal claims, and in connection with actual or proposed corporate transactions. We may also share data in aggregated, anonymised or de-identified form where it can no longer reasonably identify you.

Government data sharing

In certain circumstances, we may be required to disclose Personal Data to regulatory authorities, law enforcement agencies, courts or other competent public authorities where required or permitted by applicable law. Before making such disclosures, we take reasonable steps to satisfy ourselves that the request is lawful and limited to what is required in the circumstances.

7. Your Rights and Choices

You have the following rights regarding your Personal Data, subject to the conditions and limitations set out in applicable law:

1. Right of Access: request confirmation of whether we process your Personal Data and receive a copy with related processing information.
2. Right to Rectification: request correction of inaccurate or incomplete Personal Data.
3. Right to Erasure: request erasure where no longer necessary, where consent is withdrawn, or where otherwise required by law.
4. Right to Restrict Processing: request restriction in circumstances permitted by law, including while we consider a request to correct or object.
5. Right to Object: object where processing relies on legitimate interests, including direct marketing.
6. Right to Data Portability: request your provided data in a structured, commonly used, machine-readable format, or request transmission to another controller where technically feasible.
7. Right to Withdraw Consent: withdraw consent at any time where consent is the lawful basis.
8. Right to Complain: lodge a complaint with the DIFC Commissioner of Data Protection or another competent supervisory authority where applicable.

To exercise any of these rights, please contact us at dpo@shaffra.com or through the contact form available on our website. We may ask you to verify your identity before responding to your request.

We will respond within the time required by applicable law. Where Shaffra processes Personal Data solely on behalf of a customer as a Data Processor, we may refer your request to the relevant customer or assist them in responding in accordance with our contractual obligations.

Marketing and preferences

Where permitted by applicable law, we may send information about our products, services, events or other updates that may interest you. You may opt out at any time using unsubscribe instructions or by contacting us. Even if you opt out of marketing, we may continue to send administrative, transactional or service-related communications where necessary.

8. Security

Shaffra is committed to protecting your Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

We have implemented appropriate technical and organisational measures designed to protect Personal Data, taking into account the nature of the information and associated risks.

• encryption of Personal Data in transit and, where appropriate, at rest;
• role-based access controls and authentication mechanisms for authorised personnel;
• monitoring, testing and periodic review of security measures;
• security awareness training for personnel with access to Personal Data;
• procedures for detecting, investigating and responding to security incidents; and
• appropriate contractual and security requirements for third-party processors.

Although we take reasonable steps to protect Personal Data, no method of transmission or storage is completely secure. If a Personal Data Breach occurs, Shaffra will respond in accordance with applicable law and, where required, notify the relevant supervisory authority and affected individuals.

9. Cookies

A cookie is a small text file stored on your browser or device when you visit a website. Cookies help websites operate efficiently, remember preferences and improve your browsing experience.

Shaffra uses cookies and similar technologies to operate our website, understand how it is used and improve our services.

Essential cookies are necessary for operation, security and functionality of our website and do not require consent.

Non-essential cookies help understand usage, measure performance and improve user experience. These cookies are used only where you have provided consent, where required by law.

When you first visit our website, a cookie banner allows you to accept all cookies, reject non-essential cookies, or manage preferences. You can change preferences at any time through cookie settings or browser settings. Disabling certain cookies may affect functionality.

For more information about managing cookies, visit www.aboutcookies.org .

10. External Links

Our website may contain links to websites, applications or services operated by third parties (“External Sites”). These links are provided for convenience only and do not imply endorsement.

If you choose to access an External Site, you do so at your own risk. We encourage you to review the privacy notice and terms of use of any third-party website before providing Personal Data.

Shaffra is not responsible for the privacy practices, security or content of External Sites and accepts no liability for any loss or damage arising from your use of them.

11. Buildings Security and Contents

Where you visit Shaffra’s offices, we may collect limited Personal Data for building security and visitor management purposes. This may include your name, organisation, date and time of entry and departure, and other information required by building management or applicable security procedures.

Such information is processed for security, health and safety, business continuity and access control purposes, and is retained only for as long as necessary to fulfil those purposes or comply with applicable legal or regulatory obligations.

Shaffra is not responsible for personal belongings, documents or other items left on its premises.

12. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes to our business, services, processing activities, legal obligations or applicable data protection laws.

Where we make material changes, we will take appropriate steps to inform you, such as publishing the updated Privacy Notice on our website or, where appropriate, notifying you by email or through another suitable communication channel.

The effective date at the beginning of this Privacy Notice indicates when it was last updated. We encourage you to review this Privacy Notice periodically.

13. Contact Us

If you have any questions about this Privacy Notice, how Shaffra processes your Personal Data, or if you wish to exercise any of your data protection rights, please contact our Data Protection Officer:

Email: dpo@shaffra.com

Shaffra has appointed a Data Protection Officer in accordance with Article 16 of the DIFC Data Protection Law. The Data Protection Officer can also be contacted through the contact form available on our website.

If you are not satisfied with our response, or believe that your Personal Data has been processed in breach of applicable data protection laws, you have the right to lodge a complaint with the DIFC Commissioner of Data Protection.