Privacy Policy

NexusEdge ResilienceLab ("NexusEdge", "we", "us" or "our") operates a multi-tenant enterprise resilience platform available at resilience-labs.base44.app and related subdomains (the "Platform"). This Privacy Policy explains how we collect, use, disclose, and protect personal data in connection with the Platform, in accordance with applicable laws of the United Arab Emirates.

1. Regulatory framework

We process personal data in alignment with the following UAE instruments, as applicable:

• Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "UAE PDPL");
• Federal Decree-Law No. 34 of 2021 on the Fight Against Rumours and Cybercrimes;
• Federal Law No. 2 of 2019 concerning the UAE Central Bank and Financial Institutions and Electronic Payment Systems, where applicable to regulated clients;
• Relevant sector-specific guidance issued by the UAE Data Office, the Telecommunications and Digital Government Regulatory Authority (TDRA), and the Dubai International Financial Centre (DIFC) Data Protection Law No. 8 of 2020 and the Abu Dhabi Global Market (ADGM) Data Protection Regulations 2021, where a client operates within those financial free zones.

Where a client organisation operates within a free zone with its own data protection regime (for example DIFC or ADGM), the contractual terms with that client reflect the applicable free-zone requirements.

2. Data controller

NexusEdge ResilienceLab is the data controller for personal data collected directly from visitors and registered users of the Platform (for example, contact details submitted through demo request forms). For personal data that a client organisation uploads to its own tenancy on the Platform, the client organisation acts as the data controller and NexusEdge acts as a data processor under the terms agreed with that client.

3. Personal data we collect

• Account data — full name, work email address, organisation, job title, and role, collected when an account is created or a user is invited to a tenancy.
• Contact-request data — name, email, organisation, and any message submitted through the "Request a demo" or "Contact" forms.
• Usage data — authentication events, feature interactions, and device/IP information collected automatically when you use the Platform.
• Client-controlled data — assessment responses, evidence files, resilience documentation, and contact records that authorised users within a client organisation enter into their tenancy.

4. Legal bases for processing

Under the UAE PDPL we rely on the following lawful bases:

• Consent — where you submit a contact or demo request, or accept an invitation to join a tenancy.
• Contractual necessity — to provide the Platform services under our agreement with you or your organisation.
• Legal obligation — where UAE law or a competent regulator requires us to retain or disclose data.
• Legitimate interest — for security, fraud prevention, and platform integrity, balanced against your privacy rights.

5. How we use personal data

• to provision and administer client tenancies and user accounts;
• to respond to enquiries and provide support;
• to maintain audit logs required for security and regulatory alignment;
• to improve the Platform's functionality, reliability, and usability; and
• to meet legal, regulatory, and contractual obligations applicable in the UAE.

6. Data sharing and disclosure

We do not sell personal data. We share personal data only in the following circumstances:

• with the client organisation that owns a tenancy, to the extent the data relates to that tenancy;
• with trusted sub-processors engaged to host or operate the Platform, under written agreements that require equivalent data protection safeguards;
• where required by UAE law, judicial order, or a competent regulatory authority; and
• in connection with a merger, acquisition, or asset transfer, subject to confidentiality consistent with this policy.

7. Cross-border transfers

The Platform is hosted on cloud infrastructure that may store or process data outside the UAE. Where personal data is transferred outside the UAE, we rely on one of the lawful bases set out in Article 22 of the UAE PDPL, including the data subject's explicit consent or the use of standard contractual clauses or an equivalent approved mechanism, and we apply technical and organisational measures to ensure a comparable level of protection.

8. Data retention

We retain personal data only for as long as necessary to fulfil the purposes set out in this policy and to meet legal, regulatory, and contractual obligations. Account data is retained for the duration of the client relationship and thereafter for a limited period to allow audit, dispute resolution, and regulatory compliance. Contact-request data is retained for a maximum of 24 months unless a longer period is required by law.

9. Your rights under the UAE PDPL

• the right to be informed about how your data is processed;
• the right to access your personal data;
• the right to rectify inaccurate or incomplete data;
• the right to erase your personal data, subject to legal retention obligations;
• the right to restrict or object to certain processing;
• the right to data portability, where technically feasible; and
• the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at operations@nexusedge.info. We will respond in accordance with the timelines prescribed by the UAE PDPL.

10. Security

We apply technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or loss. Further detail is available in our Security statement. No system can be guaranteed to be completely secure; we continuously review and strengthen our controls in line with recognised good practice.

11. Children's data

The Platform is an enterprise service intended for organisations and professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have collected data from a minor, please contact us and we will take steps to delete it.

12. Cookies

The Platform uses essential cookies and similar technologies required for authentication and core functionality. We do not use advertising or third-party tracking cookies. Where analytics are enabled, they are configured to pseudonymise usage data before collection.

13. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or regulatory guidance. The "last updated" date above indicates when the policy was last revised. Material changes will be communicated through the Platform or by email to account holders.

14. Contact

For questions about this Privacy Policy or your personal data, contact us at operations@nexusedge.info or +971 507065691.