Privacy Policy

1. Who We Are

2. Information We Collect

3. How We Use Your Information

We use the personal information we collect for the following lawful purposes:

• To respond to your enquiries and provide the information, services, or resources you request
• To deliver requested resources such as PDF downloads, assessments, and consultation bookings
• To communicate with you about your engagement, including sending invoices, reports, and operational updates
• To send you information you have specifically opted in to receive, such as our newsletter (only where you have explicitly checked the relevant opt-in box)
• To improve our website and services by understanding how visitors interact with our content
• To comply with legal obligations, including financial record-keeping, regulatory reporting, and responses to lawful requests from regulators or law enforcement
• To protect our legitimate business interests, including security monitoring, fraud prevention, and the establishment, exercise, or defence of legal claims

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

4. Lawful Basis for Processing

Under the UAE PDPL, we process your personal data on the basis of:

• Your consent — when you submit a form, opt into our newsletter, or download a resource
• Performance of a contract — when you engage us for services, processing is necessary to deliver those services
• Compliance with legal obligations — where applicable laws or regulations require us to process data
• Legitimate interests — where processing is necessary for our legitimate business interests, balanced against your rights and interests

You may withdraw consent at any time by contacting us at info@nexaguardcyberlabs.com.

5. How We Share Your Information

We do not sell, rent, or trade your personal data to third parties for marketing purposes. We may share your information only in the following limited circumstances:

• Service providers: We work with carefully selected third-party service providers who help us operate our business — for example, email delivery providers (such as Resend), website hosting providers (such as Vercel), and analytics platforms. These providers are bound by confidentiality and data protection obligations.
• Legal requirements: We may disclose information if required to do so by law, regulation, or valid legal process, or to protect the rights, property, or safety of Nexaguard, our clients, or others.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of our business, personal data may be transferred as part of that transaction. We will notify affected users where required.
• Engagement-specific data: Information shared with us during a client engagement may be processed by our authorised technical team strictly for the purposes of delivering the engaged services, under signed confidentiality terms.

6. International Data Transfers

Some of our service providers may be located outside the UAE. Where personal data is transferred internationally, we ensure that appropriate safeguards are in place, including:

• Selection of providers in jurisdictions with adequate data protection standards
• Contractual data protection commitments
• Compliance with applicable UAE PDPL requirements regarding cross-border data transfer

7. How We Protect Your Information

As a cybersecurity firm, data protection is fundamental to our practice. We implement technical, administrative, and physical safeguards designed to protect personal data, including:

• Encryption of data in transit (TLS 1.2 minimum)
• Encryption of sensitive data at rest where applicable
• Access controls limiting personal data access to authorised personnel
• Regular security reviews of our infrastructure and providers
• Confidentiality and data protection training for all team members
• Incident response procedures in the event of any suspected data breach

While we apply strong protections, no method of transmission or storage is fully secure. We continually review and improve our security practices.

8. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Indicative retention periods:

When personal data is no longer required, it is deleted, anonymised, or securely destroyed.

9. Your Rights Under UAE PDPL

Under UAE Federal Decree-Law No. 45 of 2021, you have the following rights regarding your personal data:

To exercise any of these rights, please contact us at info@nexaguardcyberlabs.com. We will respond within 30 days, in line with UAE PDPL requirements.

You also have the right to lodge a complaint with the UAE Data Office or any competent regulatory authority if you believe your data protection rights have been infringed.

10. Children's Privacy

Our services and website are intended for business audiences and are not directed to children under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected such data, we will take steps to delete it promptly.

11. Third-Party Links

Our website may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party services you engage with through our links.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Last Updated” date at the top of this policy and, where appropriate, provide additional notice. We encourage you to review this Privacy Policy periodically.

13. Contact Us

If you have any questions about this Privacy Policy or our data protection practices, or if you wish to exercise any of your rights, please contact us: