Privacy Policy
How AUREON INTELLIGENCE L.L.C-FZ processes personal data as a website operator, as a service provider and as an employer, under the UAE Personal Data Protection Law and the EU General Data Protection Regulation.
1. Who we are
AUREON INTELLIGENCE L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates (TRN 105484189300001) ("Aureon", "we", "us") is the controller of the personal data described in this policy, except where we act as a processor on behalf of a client as explained in section 5.
Privacy contact: privacy@aureonintelgroup.com.
2. Laws that apply to us
We are established in the United Arab Emirates and are subject to Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and its implementing regulations.
Where we offer services to, or monitor the behaviour of, individuals located in the European Economic Area or the United Kingdom, we also comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the UK GDPR, as applicable. Where this policy refers to a legal basis, the corresponding provisions of the PDPL and the GDPR are both intended.
3. Personal data we collect and why
3.1 Website visitors
When you visit the Website, our web server records technical data necessary to deliver pages securely: IP address, date and time of the request, requested URL, HTTP status, referring page, browser type and operating system. These server logs are used to operate and secure the Website, to detect abuse and to investigate security incidents.
Legal basis: our legitimate interest in operating a secure website and, where applicable, compliance with legal obligations.
Retention: server logs are retained for a maximum of 90 days unless they are required for an ongoing security investigation.
The Website does not use analytics or advertising cookies by default. Fonts and all other resources are served from our own servers, so your visit does not trigger requests to third-party content networks. Details of the cookies we use are in our Cookie Policy.
3.2 People who contact us
By email. When you contact us by email, we process the data you provide: your name, email address, organisation, role, the content of your message and any attachments. If you contact us about an active incident, this may include details about your organisation's systems and the incident itself.
Purposes: to respond to your enquiry, to scope and provide services, to manage our relationship with you and to keep records of our communications.
Legal basis: steps taken at your request prior to entering into a contract, performance of a contract, and our legitimate interest in managing business relationships.
Retention: enquiry records are retained for 24 months after our last contact. Records relating to an engagement are retained in accordance with section 5.
Through the Website forms. The incident and enquiry forms on our contact page ask for your name, company, work email address, telephone number and a message, so that a practitioner can call or write back. The forms are intended for organisations that wish to engage our services.
Each submission is delivered as an email to the relevant Aureon mailbox. It is not stored in any other system or database. We answer it and we delete the email within 7 days of our reply. If the enquiry leads to an engagement or a continuing business relationship, the data is then processed as described in sections 3.3 and 5.
To protect the forms against automated abuse, our server checks the origin of each submission, applies limits to the number of submissions per network address and per hour, and keeps a technical log for 30 days containing the time, the form used, the outcome and a one-way keyed hash of the network address. The log contains none of the details you submit. The forms do not use cookies, tracking or third-party verification services.
Legal basis: steps taken at your request prior to entering into a contract and our legitimate interest in answering enquiries and keeping the Website secure.
3.3 Clients, prospects and business contacts
We process business contact data of client personnel, prospective clients, insurers, brokers, counsel, suppliers and partners: name, job title, employer, business contact details and the history of our interactions. We obtain this data directly from you, from your organisation or from public professional sources.
Purposes: contract management, invoicing, service delivery, relationship management, and sending professional communications about our services and publications, which you may opt out of at any time.
Legal basis: performance of a contract, compliance with legal obligations (including tax and accounting rules) and our legitimate interest in conducting and promoting our business.
Retention: for the duration of the relationship and for up to 7 years thereafter where required by accounting, tax or limitation rules.
3.4 Job applicants
If you apply to work with us, we process your application data (CV, cover letter, qualifications, references, interview notes and, where lawful and relevant, background screening results) to assess your application.
Legal basis: steps taken at your request prior to entering into a contract and our legitimate interest in recruiting suitable staff.
Retention: unsuccessful applications are deleted within 12 months of the decision unless you ask us to keep your details for future opportunities.
4. Special categories and criminal data
We do not deliberately collect special categories of personal data (such as health, religion or biometric data) or criminal offence data from website visitors or business contacts. During investigative engagements we may encounter such data within client systems. We process it only as instructed by the client, under the safeguards described in section 5, and we do not use it for any other purpose.
5. Personal data processed during our services
Our core services, including digital forensics, incident response, threat intelligence, offensive security and compliance advisory, necessarily involve processing personal data contained in client systems, logs, mailboxes, documents and datasets, and data about threat actors and third parties involved in incidents.
In these engagements we generally act as a processor on behalf of the client, who remains the controller. We process personal data only on the client's documented instructions and under a written agreement that sets out the subject matter, duration, nature and purpose of processing, our security obligations and the rules for sub-processors, international transfers and deletion or return of data at the end of the engagement.
Where we act as a controller in our own right, for example when we retain evidence to meet legal obligations, to defend legal claims or to maintain professional records, we do so on the basis of legal obligation or legitimate interest, and we limit retention to what is necessary for those purposes.
Threat intelligence activities may involve the collection of data from publicly accessible and criminal sources, including exposed credentials belonging to individuals. We process such data for the purpose of protecting our clients and the affected individuals, on the basis of legitimate interest, and we apply strict access controls, minimisation and retention limits.
6. Recipients of personal data
We share personal data only where necessary with:
- our personnel and contractors bound by confidentiality obligations and our Code of Ethics;
- service providers who host our infrastructure, provide email, collaboration, security and business tools, under contracts that require appropriate safeguards;
- clients, their insurers, brokers and legal counsel, where you are involved in an engagement they have instructed;
- professional advisers, auditors and insurers of the Company;
- courts, regulators, law enforcement and other authorities where required by law or to establish, exercise or defend legal claims.
We do not sell personal data and we do not share it with third parties for their own marketing.
7. International transfers
We are established in the United Arab Emirates and operate across Europe, the Middle East and Africa. Personal data may therefore be transferred to and processed in countries other than the one in which it was collected.
Where personal data subject to the GDPR or the UK GDPR is transferred outside the EEA or the UK, we rely on an adequacy decision where one exists or, otherwise, on the European Commission's Standard Contractual Clauses or the UK International Data Transfer Agreement, together with supplementary measures identified in transfer impact assessments.
Where personal data subject to the PDPL is transferred outside the United Arab Emirates, we rely on the mechanisms permitted by the PDPL and its implementing regulations, including transfers to jurisdictions with adequate protection and contractual safeguards.
You may request a copy of the relevant safeguards by contacting us.
8. Security
We apply technical and organisational measures appropriate to the sensitivity of the data we handle, including encryption in transit and at rest, strong authentication and least-privilege access, segregated evidence storage with chain-of-custody records, logging and monitoring, secure development practices and regular testing of our own environment. Access to engagement data is limited to the personnel assigned to the engagement.
9. Your rights
Subject to applicable law, you have the right to:
- request access to the personal data we hold about you;
- request rectification of inaccurate or incomplete data;
- request erasure of your data in certain circumstances;
- request restriction of processing in certain circumstances;
- object to processing based on legitimate interests, and to direct marketing at any time;
- receive your data in a portable format where processing is based on consent or contract and is automated;
- withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing;
- not be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not make such decisions.
To exercise your rights, email privacy@aureonintelgroup.com. We may need to verify your identity before responding. We respond within the time limits set by applicable law.
Where we act as a processor for a client, we will refer your request to the client and assist them in responding.
10. Complaints
If you believe that we have not handled your personal data in accordance with the law, please contact us first so that we can address your concern. You also have the right to lodge a complaint with a supervisory authority: the UAE Data Office under the PDPL, the supervisory authority of your EU Member State under the GDPR, or the Information Commissioner's Office in the United Kingdom under the UK GDPR.
11. Children
The Website and our services are directed at business audiences. We do not knowingly collect personal data from children under 18 through the Website.
12. Changes to this policy
We review this policy regularly and update it when our processing or the law changes. The date of the last update is shown below. Material changes will be highlighted on the Website.