Legal
Privacy Policy
What this page needs to cover, given the three-region scope — outline only, pending counsel review.
This page is a structural outline only — not final legal copy. It needs real drafting and counsel review before publishing, the same caution applied throughout this project to statutory content.
- Identity of the data controller/fiduciary — legal entity, registered address, privacy contact
- What personal data is collected, by product and by channel
- Legal basis for processing, stated per region — DPDP Section 4(1)(b), UAE PDPL Article 4, GDPR Article 6 (genuinely different tests, not one applied universally)
- Data Principal / Data Subject rights per region, and the mechanism for exercising them (Privacy Rights Centre)
- Cross-border data transfer — where data moves between India, UAE, and EU deployments, and what safeguards apply
- Data retention periods, by data category (not yet defined — needs business input)
- Cookies and tracking — cross-referenced with the Cookie Policy rather than duplicated
- Children's data — DPDP Section 9 and GDPR both have specific provisions
- Security measures — can reference the Trust Center's Security Architecture section
- Contact / grievance officer details — DPDP requires a named Grievance Officer; GDPR a DPO where appointed