Privacy Policy

Effective: 1 June 2025  ·  Updated: May 2026  ·  Ras Al Khaimah, UAE

Your privacy matters. This Policy explains what data we collect, why we collect it, and what rights you have under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“UAE PDPL”).

01

Who We Are

UltoLabs is an AI solutions agency registered in Ras Al Khaimah, United Arab Emirates. Contact: contact@ultolabs.com.

We act as Data Controller for data collected directly from website visitors and prospective clients. Where we process personal data on behalf of a client — for example, call recordings via Ulto Voice — we act as Data Processor under a separate Data Processing Agreement.

02

Scope

This Policy applies to visitors to our website, individuals who submit enquiries or proposals, and anyone whose data is processed as part of our service delivery. It does not cover data processed purely on behalf of business clients — that is governed by the applicable Data Processing Agreement.

03

Data We Collect

We collect only what we need. Depending on how you interact with us, this may include:

–   Identity & contact: name, business name, email address, phone number.

–   Enquiry content: information you share in contact forms or proposal requests.

–   Usage data: IP address, browser type, pages visited, and time on site.

–   Service data: business information, workflow details, or call recordings shared during service delivery.

–   Communications: emails and messages exchanged with our team.

We do not collect sensitive personal data (health, financial, or biometric data) unless explicitly required for a specific service and agreed in writing.

04

How We Use It

We use your data to:

–   Respond to enquiries and deliver contracted services.

–   Issue invoices and manage payments.

–   Improve our website and service performance.

–   Comply with UAE legal obligations.

–   Send relevant updates or service communications — you can opt out at any time.

We do not sell, rent, or commercialise your personal data.

05

Legal Basis for Processing

We process your data on the following legal grounds under the UAE PDPL: contract performance (to deliver services you have engaged us for); legitimate interests (to operate and improve our business, provided this does not override your rights); legal obligation (to comply with UAE law); and consent (where you have explicitly opted in, such as for marketing communications).

06

AI Processing

Several of our services involve AI systems that process data on your behalf. Ulto Voice may process call recordings and transcripts. Ulto Flow may process CRM records and workflow data. Ulto Web may process chat interactions and visitor behaviour. Ulto Studio processes creative briefs and campaign assets.

AI processing occurs solely to deliver the contracted service. No client data is used to train third-party AI models without explicit written consent. Where AI processing involves personal data of your customers, we operate as Data Processor and you remain the Data Controller.

07

Cookies & Tracking

Our website uses essential cookies (required for the site to function) and, where you consent, analytics cookies to understand how visitors use the site. We do not use advertising or behavioural tracking cookies. You can manage cookie preferences at any time through your browser settings.

08

Data Sharing

We only share your data where necessary. Recipients include our technology partners and sub-processors (such as cloud infrastructure providers and AI platforms) who are contractually bound to process data solely on our instructions, and UAE regulatory authorities where required by law. We do not share data with third parties for their own commercial purposes.

09

International Transfers

Some of our technology partners operate outside the UAE. Where data is transferred internationally, we ensure appropriate safeguards are in place in accordance with UAE PDPL requirements — including data processing agreements and, where necessary, standard contractual clauses.

10

Data Retention

We retain data only for as long as necessary. Client and enquiry records are kept for up to 5 years after the end of an engagement to satisfy UAE legal and tax requirements. Financial records are retained for 7 years. Usage and analytics data is retained for up to 24 months. You may request earlier deletion where permitted by law.

11

Your Rights

Under the UAE PDPL, you have the following rights in relation to your personal data:

Access

Request a copy of the personal data we hold about you.

Rectification

Ask us to correct inaccurate or incomplete data.

Erasure

Request deletion of your data where there is no legal basis to retain it.

Restriction

Ask us to limit processing of your data in certain circumstances.

Objection

Object to processing based on legitimate interests.

Portability

Receive your data in a structured, machine-readable format.

Withdraw Consent

Opt out of any processing based on your consent, at any time.

Automated Decisions

Request human review of any decision made solely by automated means.

To exercise any of these rights, contact us at contact@ultolabs.com. We will respond within 30 days.

12

Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. These include encrypted data storage, access controls, and regular security reviews. We will notify you promptly in the event of a breach that affects your data.

13

Children

Our services are not directed at individuals under 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, contact us and we will delete it promptly.

14

Changes to This Policy

We may update this Policy from time to time. Material changes will be posted on our website with a revised effective date. Continued use of our services after any update constitutes acceptance of the revised Policy.

15

Contact & Complaints

For any privacy-related questions or to exercise your rights, contact us at contact@ultolabs.com. We aim to respond within 30 days.

If you are unsatisfied with our response, you have the right to lodge a complaint with the UAE Data Office, the supervisory authority responsible for the UAE PDPL.