Privacy Policy

Effective date: 1 January 2026 · Last updated: 30 June 2026

1. Who We Are & Applicable Law

AgileCatalyst.AI Ltd ("Agile Catalyst", "we", "us") is incorporated in the Dubai International Financial Centre (DIFC), Dubai, UAE. We operate the website agilecatalyst.ai and its sub-domains. We are the data controller for personal data processed in connection with our website and services.

This policy is issued in compliance with the DIFC Data Protection Law 2020 (DIFC Law No. 5 of 2020) and its accompanying regulations, which is our primary applicable law as a DIFC-registered entity. Where we serve individuals in the European Economic Area (EEA) or the United Kingdom, we additionally apply GDPR-equivalent standards as set out in this policy.

We do not currently meet the threshold requiring mandatory appointment of a Data Protection Officer (DPO) under DIFC DP Law 2020. All privacy enquiries are handled by our privacy contact at compliance@agilecatalyst.ai.

2. Data We Collect

  • Contact & enquiry data — name, email address, company, and message content when you submit a contact form or email us directly.
  • Usage data — pages visited, time on site, referral source, browser type, and IP address collected via analytics tools (see §6).
  • Engagement data — information you provide during the course of a consulting engagement, governed by a separate Data Processing Agreement where applicable.

3. How We Use Your Data

  • To respond to your enquiries and deliver our services.
  • To improve our website and understand how visitors engage with our content.
  • To send relevant updates about our services where you have provided consent or where we have a legitimate business interest.
  • To comply with legal and regulatory obligations under DIFC law.

4. Processing Conditions (DIFC DP Law 2020) & Legal Bases (GDPR)

Under the DIFC Data Protection Law 2020, we process personal data on the following conditions, which also correspond to GDPR lawful bases for EEA/UK individuals:

  • Performance of a contract — processing necessary to perform a contract with you or take steps at your request prior to entering into one.
  • Legitimate interests — responding to enquiries, analytics, and business development, where these interests are not overridden by your rights and freedoms.
  • Consent — where we have asked for and received your explicit consent (e.g., marketing emails). You may withdraw consent at any time by contacting us or using the unsubscribe link in any communication.
  • Legal obligation — where processing is required by applicable DIFC or UAE law.

5. Data Retention

We retain contact and enquiry data for up to three (3) years after last contact. Engagement data is retained for the duration of the engagement plus seven (7) years for compliance and record-keeping purposes. Usage and analytics data is retained for up to 26 months.

6. Third-Party Tools & International Transfers

We may use third-party tools including analytics providers and email platforms. Where these involve transfer of personal data outside the DIFC or EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or transfers to jurisdictions recognised as providing adequate protection. We do not sell your personal data to third parties.

7. Your Rights

Under the DIFC Data Protection Law 2020, you have the right to: access your personal data; request correction of inaccurate data; request deletion in certain circumstances; object to processing based on legitimate interests; and request portability of data you have provided to us in structured, machine-readable form.

If you are in the EEA or UK, you additionally have the right to restrict processing and to withdraw consent where processing is based on consent.

To exercise any of these rights, contact compliance@agilecatalyst.ai. We will respond within 30 days.

8. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the DIFC Commissioner of Data Protection without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as required by DIFC DP Law 2020. Where the breach is likely to result in a high risk to affected individuals, we will also notify those individuals without undue delay.

9. Cookies

Our website uses essential cookies required for site operation and, where you consent, analytics cookies to help us improve the experience. You can control cookies through your browser settings at any time.

10. Complaints

If you are located in the DIFC or UAE, you have the right to lodge a complaint with the DIFC Commissioner of Data Protection. If you are in the EEA, you may contact your national data protection supervisory authority. We would, however, appreciate the opportunity to address your concerns directly before you escalate — please contact us first at compliance@agilecatalyst.ai.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by updating the "Last updated" date and, where appropriate, by direct communication at least 14 days before changes take effect.

12. Contact & Data Controller

AgileCatalyst.AI Ltd
DIFC, Dubai, United Arab Emirates
compliance@agilecatalyst.ai