Privacy Policy

Controller and contact

Sulook Technologies Limited is a technology company based in DIFC, Dubai AI Campus, Dubai, UAE. For website enquiries and business communications, Sulook Technologies Limited acts as the controller of the personal data described in this Policy.

Contact: hello@sulook.ae

DIFC data protection framework

As a DIFC entity, Sulook aims to handle personal data in line with the DIFC Data Protection Law No. 5 of 2020 and related DIFC data protection regulations and guidance where applicable. This includes processing personal data fairly, lawfully, transparently, securely, and for specified purposes.

Information we may collect

• Contact details, such as name, work email, phone number, company name, and job title.
• Messages, enquiries, meeting notes, requirements, and information you choose to share with us.
• Business documents or workflow records shared for discovery, scoping, implementation, support, or review.
• Technical information from our website, such as browser type, device information, approximate location, pages visited, IP address, cookies, and basic analytics, where enabled.

Purposes and lawful bases

We process personal data only where we have a lawful basis to do so. Depending on the context, this may include taking steps before entering into a contract, performing a contract, complying with legal obligations, protecting legitimate business interests, maintaining security, responding to requests, or using consent where required.

• To respond to enquiries and provide information about Sulook services.
• To assess, scope, deliver, support, and improve client engagements.
• To prepare proposals, workflow maps, diagnostics, technical notes, and approval materials.
• To operate internal records, project management, communication, and security systems.
• To comply with applicable legal, regulatory, security, and administrative obligations.

AI systems and client data

Sulook designs systems around governance, human approval, evidence-backed outputs, and role-based boundaries. Where client information is used during discovery or implementation, we aim to limit access to the relevant engagement team and use it only for the agreed business purpose.

We do not sell client data. We do not use confidential client materials for public marketing without permission. Unless specifically agreed in writing, Sulook does not rely solely on automated decision-making for decisions that produce legal or similarly significant effects for individuals.

Sharing and international transfers

We may share information with service providers, contractors, advisors, hosting providers, communication tools, analytics providers, technical platforms, or authorities where needed to operate our business, deliver services, protect systems, or comply with law.

Some recipients may be located outside the DIFC or outside the UAE. Where personal data is transferred internationally, we aim to use appropriate safeguards or lawful transfer mechanisms required by applicable DIFC data protection rules.

Security and retention

We use reasonable administrative, technical, and organisational measures to protect information. No internet or technology system is completely secure, but we design our operations to reduce unnecessary access, exposure, and retention.

We retain information only as long as reasonably needed for the purpose collected, including service delivery, business records, legal obligations, dispute resolution, and legitimate administrative needs.

Your rights

Subject to applicable law, individuals may have rights to request access to personal data, correction of inaccurate data, deletion, restriction, objection to processing, portability, withdrawal of consent where processing is based on consent, and review of certain automated processing.

You may contact us at hello@sulook.ae. You may also have the right to contact or complain to the DIFC Commissioner of Data Protection.

Children

Our website and services are intended for business users and are not directed at children. We do not knowingly seek to collect children’s personal data through this website.

Breach reporting and updates

If we become aware of a personal data breach, we will assess it and take appropriate steps, which may include notifying affected individuals, clients, or the DIFC Commissioner of Data Protection where required by applicable law.

Last updated: 4 July 2026