Privacy Policy

Base7 Ltd (“Base7”) is a company registered in the Abu Dhabi Global Market (ADGM), Commercial Licence 34877, with its registered office at 1801-C14.D001, Office 1801, Floor 18, Sky Tower, Shams Abu Dhabi, Al Reem Island, Abu Dhabi, United Arab Emirates. Base7 is part of the NXT Holding Group.

Base7 is the controller of the personal data described in this policy. For any question about this policy, or to exercise a right under it, write to info@base7.ai and mark your message for the attention of the Data Protection contact.

This policy covers personal data we collect through this website, through direct correspondence, and during the scoping and delivery of our services. Where we build and operate systems for a client, that client is the controller of the data inside those systems and Base7 acts as a processor under a separate written agreement. This policy does not govern that processing.

We collect personal data that you give us directly, namely:

1. your name, work email, company, phone number, and the content of any message you send through the contact form or by email;
2. records of our correspondence and meetings when you engage with us about a project.

We also collect limited data automatically when you use the site:

1. a theme preference and your cookie choice, both stored in your own browser, as set out in our Cookie Policy;
2. standard server and security logs, which may include your IP address and browser type, kept to run and protect the site.

Under Article 6 of the ADGM Data Protection Regulations 2021 we process personal data only where we have a lawful basis:

1. To answer you and scope work. When you contact us, we use your details to reply and to prepare a proposal. Our basis is our legitimate interest in responding to enquiries and, once you engage us, the performance of a contract.
2. To deliver and operate services. Our basis is the performance of our contract with you or your organisation.
3. To run and secure the site. Our basis is our legitimate interest in keeping the site available and safe.
4. To meet legal duties. Where a law or regulator requires it, our basis is compliance with a legal obligation.

Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms. You may object to that processing at any time using the contact details above.

We do not sell personal data. We share it only with:

1. service providers who host the site, send our email, and provide infrastructure, each bound by a written contract to protect the data and use it only on our instructions;
2. other companies in the NXT Holding Group, where a project requires it;
3. regulators, courts, or law enforcement where we are required to disclose data or where disclosure protects our rights.

We hold personal data on infrastructure located in the United Arab Emirates wherever we can. Where a provider stores or processes data outside the ADGM, we transfer it only under Part 8 of the ADGM Data Protection Regulations 2021, either to a jurisdiction that offers an adequate level of protection or under appropriate safeguards such as standard contractual clauses. You may ask us for a copy of those safeguards.

We keep personal data only as long as we need it for the purpose we collected it, or as long as a law requires. Enquiry correspondence is kept for up to 24 months after our last contact. Records tied to a signed engagement are kept for the life of the contract and for the period our legal and tax duties require after it ends. Security logs are kept for a short, rolling window.

We apply encryption in transit and at rest, role-based access control, logging, and regular review, and we restrict access to personal data to the people who need it to do their work. No system is perfectly secure, so we also plan for incidents: if a breach is likely to cause a risk to your rights, we will notify the ADGM Office of Data Protection and, where the Regulations require, you.

Under the ADGM Data Protection Regulations 2021 you have the right to:

1. ask whether we hold data about you and get a copy of it;
2. have inaccurate data corrected;
3. have data erased where the Regulations allow;
4. restrict or object to how we process your data;
5. receive data you gave us in a portable form and have it sent to another controller where that right applies;
6. not be subject to a decision based solely on automated processing that produces a legal or similarly significant effect on you.

To exercise any of these, write to info@base7.ai. We answer within the period set by the Regulations and we do not charge for a reasonable request. If you are not satisfied with our response, you may complain to the Office of Data Protection of the ADGM Registration Authority.

The site is aimed at businesses and public-sector organisations and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, tell us and we will delete it.

We may update this policy as our services or the law change. The version and effective date above show the current issue. Where a change is significant, we will make it clear on this page.