PRIVACY POLICY

25.11.2024

Codeway Technologies - FZCO (“Codeway Technologies” or “Company”) aims to process the personal data of users of Chat & Ask AI (“Chat & Ask AI”) in accordance with the general principles of privacy and the provisions of the applicable data protection legislation, particularly the Law on Personal Data Protection No. 6698 (“PDP Law”) and other applicable legislation. In addition to the PDP Law, this Privacy Policy also grants additional rights to individuals where the General Data Protection Regulation (European Union) 2016/679 (“GDPR”) is applicable.

Your personal data, which you provided or will provide to the Company and/or which the Company obtains by any other means, may be processed by the Company as “Data Controller”:

in the context of, and in a manner limited and measured to, the purpose of processing your personal data;
by maintaining the accuracy and up-to-date state of the personal data as reported or notified to the Company;
and may be recorded, stored, preserved, reorganized and transferred to institutions authorized to request such personal data by law, and shall be transferred, classified and shared with third parties within the country or abroad under the conditions stipulated by legislation and, where necessary, upon your explicit consent, and may otherwise be processed and subject to the other procedures set out in the legislation.

This Privacy Policy is adopted for the continuance and improvement of the activities carried out by the Company in line with the principles set forth in the PDP Law.

This Privacy Policy describes which data the Company collects, how it intends to use, store, protect and share the data collected, how you can withdraw your consent for the processing of this data, and how you can correct and revise the data.

Capitalized terms in this Privacy Policy shall have the meanings specified in the Terms and Conditions unless separately defined in this Privacy Policy.

1. Objective

The Company aims to process the personal data of users in accordance with general principles of privacy and the provisions of the applicable data protection legislation, particularly the PDP Law and, where applicable, the GDPR, as described throughout this Privacy Policy.

2. Collection of Personal Data and Method

The Company may process your personal data for the purposes specified in this Privacy Policy.

The personal data of users collected and used by the Company includes, in particular: your name and surname, e-mail address and phone number, which the Company receives once you contact the Company; your order information if you make a purchase through an in-app purchase; messages, phrases, text, information, photos, images, videos, visual and audio records, voice recordings and other data which you have uploaded or transmitted to the Chat & Ask AI application; your profile or social media information if you choose to register; and the identifier for advertisers designated on your mobile device used to access the Services (Identifier for Advertisers – IDFA), the identifier for vendors/developers designated on your mobile device (Identifier for Vendors – IDVF), Internet Protocol Address (IP), and, if you give permission, geolocation information.

Data Categories and Data Types

Identity and Contact Information	Name, surname, phone number and e-mail address (if you contact us).
Process Security	Internet traffic data (network movements, IP address, visit data, time and date information, information about your access to and use of the application, the time spent on Chat & Ask AI), device name, purchase history, Token ID (when you allow notifications through your device), screen recordings, IDFA (if you give permission), and IDVF.
Profile Information	If you choose to register by providing your profile information: User ID, nickname, username, profile picture, user token, Open ID, phone number, e-mail address, password.
Social Media Information	If you choose to register with your social media account: Through Google: Google user ID, nickname, username, profile picture, user token, Open ID, phone number, e-mail address. Through Apple: Apple user ID, nickname, username, profile picture, user token, Open ID, phone number, e-mail address. Through Facebook: Facebook user ID, nickname, username, profile picture, user token, Open ID, phone number, e-mail address.
User Content	Messages, posts, communication, statements, information, phrases, entries, text, questions, materials, files, documents, links, images, photos, videos, visual and audio records, voice recordings, graphics, media, responses, answers, choices, and any content, record or data that you provide, upload, transmit, create, store, use, edit or share with or through Chat & Ask AI. The Company may ask for your permission to access your device’s photo file or gallery app, camera and audio recording tools, in order to provide certain services, such as generating output for photos you share or transcribing your audio recordings. You can choose not to allow this access, or later disable it in your device settings, though some features may then be unavailable. If you make a voice recording for transcription via Chat & Ask AI, your voice recordings are deleted from the Company's servers within 24 hours of transcription. Please do not share any content that might contain sensitive personal information. Providing financial information, social security numbers, health information, images of other individuals, information about children, or other sensitive or confidential information via Chat & Ask AI is strictly prohibited. User content is stored in accordance with this Privacy Policy and relevant legislation, in particular so that the Company can provide the Services. You can request deletion of this information at any time; your other rights are outlined in this Privacy Policy.
Customer Transaction	Order information.
Marketing Data	IDFA, IDVF.

The Company may collect this data directly from you through electronic or physical means, your mobile device, or third-party applications or sources through which you access the application, such as the Apple App Store or Google Play (together, “App Stores”), for the purposes of complying with legal obligations, enhancing the Services, administering your use of the Services, and enabling you to enjoy and navigate the Services.

The Company may collect log data generated while you use the Services, which may include your device's IP address, device name, operating system version, application configuration, the time and date of use, and other statistics.

General Principles Regarding Personal Data Processing

In accordance with this Privacy Policy, personal data is processed by the Company as a data controller in line with the following basic principles: (i) being in accordance with the law and good faith; (ii) being accurate and, where necessary, up to date; (iii) being processed for specific, explicit and legitimate purposes; (iv) being limited and minimized to the purpose for which it is processed; and (v) being stored for the period stipulated in the relevant legislation or required for the purpose for which it is processed.

3. Purposes of Processing Personal Data and Legal Reasons

Your personal data will be processed via automatic or non-automatic means for the purposes stated below, in accordance with the applicable legislation, including Articles 5 and 6 of the PDP Law where expressly permitted by law, where necessary for the establishment or performance of a contract, or for the Company's legitimate interests provided that your fundamental rights and freedoms are protected.

a) Purposes of Processing Personal Data

Identity and Contact Information, Profile Information, Social Media Information	Execution of activities in compliance with legislation; compliance with legislation and protection of persons' rights, privacy and safety; execution of company/product/service commitment operations; execution of communication activities; execution/auditing of business activities; conducting after-sales support services and, with your consent, marketing communications; execution of goods/services sales processes; conducting storage and archive activities; execution of agreement processes; operation of the Chat & Ask AI product.
Process Security	Execution of information security processes; execution of company/product/service commitment operations (detecting and correcting technical defects); operation of the product; conducting audit/ethical activities; execution/audit of business activities; conducting activities to ensure business continuity; providing information to authorized persons, institutions and organizations.
Customer Transaction	Execution/auditing of business activities; conducting after-sales support services; execution of goods/services sales processes; conducting activities for customer satisfaction; execution of agreement processes.
User Content	Operation of the product, e.g. to prepare responses to user inputs; conducting after-sales support services and related communications; execution of activities in compliance with legislation; compliance with legislation and protection of persons' rights, privacy and safety; prevention of crimes and other illegal acts; execution of agreement processes; conducting storage and archive activities; execution/auditing of business activities; conducting activities to ensure business continuity; execution of activities for customer satisfaction; improving the Services, including training AI models (you can opt out of your information being used to train AI models by filing a request through the Data Subject Application Form at askaiweb@codeway.co).
Marketing Data	Conducting marketing analysis studies; execution of advertising/campaign/promotion processes.

The purposes of processing personal data may also be updated in line with the Company's obligations arising from its policies and applicable legislation, in particular to:

create user accounts for service recipients/application users;
customize the Services, understand users and their preferences to enhance user experience, and improve the Services;
inform users about new products, services and applications, and deliver information about advertisements and promotions;
carry out digital subscription and in-app purchase processes;
carry out auto-renewable subscriptions giving users access to content, services or premium features;
carry out information security processes;
conduct activities in accordance with legislation;
fulfil the demands of competent authorities;
conduct finance and accounting transactions;
conduct communication activities;
conduct contract processes;
carry out strategic planning activities; and
follow up on requests and complaints.

b) Legal Reasons

Identity and Contact Information, Profile Information, Social Media Information	It is necessary to process your personal data because we have established, or the processing is directly related to the performance of, a contractual relationship with you; we must process the data to establish, exercise or protect a right; or you have given your consent (e.g. to receive marketing material).
User Content and Facial Data	It is necessary to process your personal data because we have established, or the processing is directly related to the performance of, a contractual relationship with you; we must process the data to establish, exercise or protect a right; processing is necessary for our legitimate interests, provided your fundamental rights and freedoms are not harmed; or you have given your consent.
Process Security	The law explicitly stipulates this processing; it is necessary to fulfil a legal obligation; it is necessary because we have established, or the processing is directly related to the performance of, a contractual relationship with you; processing is necessary for our legitimate interests, provided your fundamental rights and freedoms are not harmed; or you have given your consent.
Marketing Data	Your explicit consent (acquired via Apple and/or Google).

Third Party Websites and Applications

Chat & Ask AI may contain links to other websites or apps that are unknown to, and whose content is not controlled by, the Company. These linked websites or apps may have terms and conditions other than the Company's. The Company cannot be held responsible for the use or disclosure of information that these websites or apps may process, nor for any links from other sites or apps provided to Chat & Ask AI.

The Company collects information by fair and lawful means, with your knowledge and consent, and lets you know why it is collecting information and how it will be used. You are free to refuse a request for information, with the understanding that some desired Services may then be unavailable to you.

While using Chat & Ask AI, you may provide information through third-party websites and apps; your liability and obligations toward those third parties continue, and the Company is not responsible for their terms, conditions, rules or policies.

Cookies

Cookies are small text files stored on the browser or hard drive of your computer or mobile device when you visit a webpage or application. Cookies help a website run more efficiently and enable a more personalized experience. Cookies only contain data about your visit history and do not collect personal data/files stored on your device. The Company may use cookies when necessary to operate the Services, to enhance performance and functionality, and to deliver content, including advertising relevant to your interests, on its sites or third-party sites. You can delete existing cookies and prevent new cookies from being stored via your browser settings.

Browsers are typically set to accept cookies by default. Cookie management varies by browser; consult your browser's or application's help menu for details.

Push Notifications

The Company may occasionally send push notifications via its applications regarding application upgrades or notifications about the Services. You can edit or stop such notifications at any time through your device settings.

Data Storage

Your data will be stored for the duration specified in the applicable legislation, or for a reasonable time until the purpose of processing ceases to exist, or during applicable statutory limitation periods.

The Company may continue to store your personal data even after the purpose of its use has expired, provided this is required by other laws or separately consented to by you.

Where you allow the Company to store your personal data for an additional period by giving consent, such data shall be deleted, destroyed or anonymized immediately upon expiry of that additional period, or once the purpose of processing no longer exists.

Technical and Administrative Measures

The Company stores the personal data it processes in accordance with relevant legislation, for the periods stipulated by that legislation or required for the purpose of processing. The Company undertakes to take all necessary technical and administrative measures, and due care, to ensure the confidentiality, integrity and security of personal data, and to prevent unlawful processing, unauthorized access, and unlawful disclosure, modification or destruction of data. Accordingly, the Company takes the following technical and administrative measures:

Anti-virus application. A periodically updated anti-virus application is installed on all computers and servers in the Company's information technology infrastructure.
Firewall. The data center and disaster recovery centers hosting the Company's servers are protected by periodically updated firewalls; next-generation firewalls control staff internet connections and provide protection against viruses and similar threats.
VPN. Suppliers can access the Company's servers or systems only through SSL-VPN defined on firewalls. A separate SSL-VPN identification is created for each supplier, granting access only to the systems it is authorized to use.
User identifications. Employee authorization to Company systems is limited to what is necessary for their job description; authorizations are updated on any change of role or duty.
Information security threat and event management. Events occurring on the Company's servers and firewalls are transferred to an Information Security Threat and Event Management system, which alerts responsible staff and allows an immediate response to security threats.
Encryption. Sensitive data is stored using cryptographic methods and, where required, transferred through cryptographically encrypted environments; cryptographic keys are stored securely.
Logging. All transaction records regarding sensitive data are securely logged.
Two-factor authentication. Remote access to sensitive data requires at least two-factor authentication.
Penetration testing. Periodic penetration tests are performed on the Company's servers; identified gaps are closed and verified through follow-up testing. The Information Security Threat and Event Management system also performs automated penetration tests, with results recorded.
Information Security Management System (ISMS). Topics from the ISMS control forum are audited monthly by the director of information technology and the director of financial operations.
Training. Employees receive regular training to increase awareness of information security risks and minimize the human factor in security incidents.
Physical data security. Personal data on paper is stored in lockers accessed only by authorized persons, with security measures appropriate to the storage environment (e.g. against electrical faults, fire, flood or theft).
Backup. The Company periodically backs up stored data, using cloud infrastructure backup facilities as well as its own backup solutions where necessary, in compliance with applicable legislation and this Privacy Policy.
Non-disclosure agreements. Non-disclosure agreements are concluded with employees involved in processing sensitive personal data.
Transfer of sensitive personal data. Where sensitive personal data must be transferred by e-mail, this is done through (i) encrypted corporate e-mail, or (ii) registered e-mail.

If personal data is damaged as a result of an attack on Chat & Ask AI or the Company's systems despite these measures, or is obtained by unauthorized third parties, the Company will notify affected Users immediately and, where necessary, the relevant data protection authority, and take the necessary measures.

4. Age Limitation

The Company does not permit use of Chat & Ask AI by children under the age of 16.

The Company does not knowingly collect or process personal data from anyone under the age of 16. If you learn that someone under 16 has provided personal information, please contact askaiweb@codeway.co. Users under 18 must have permission from a parent or legal guardian to use the Services.

5. Transferring Personal Data to Third Parties

The procedures and principles for transferring personal data are regulated in Articles 8 and 9 of the PDP Law. Personal data, including special categories of data, may be transferred to third parties within the country or abroad, since the Company may use servers and cloud systems located abroad.

Your personal data may be transferred abroad for the following reasons:

conducting storage and archive activities;
conducting business activities;
conducting after-sales support services;
managing customer relationship management processes; and
correction of technical specifications, technical errors and defects.

The Company may also transfer your personal data to its service providers and third parties embedded into the Services, such as Facebook SDK, Adjust and Firebase Analytics, for the following purposes:

sharing identity, communication and transaction security information with authorized public institutions and organizations, for the execution of activities in compliance with legislation, monitoring and execution of legal affairs, and informing authorized persons, institutions and organizations; and
sharing identity and contact information to manage after-sales support services, conduct business activities and manage customer relationship management processes.

6. Your Rights as the Data Subject

Pursuant to Article 11 of the PDP Law, you may apply to the Company to request the following regarding your personal data:

learn whether your personal data has been processed;
request information as to whether your personal data has been processed;
learn the purpose of processing and whether data is used in accordance with that purpose;
know the third parties, in the country or abroad, to whom your personal data has been transferred;
if personal data has been processed incompletely or inaccurately, request that this be notified to third parties to whom the data has been transferred;
request deletion, destruction or anonymization of personal data where the reasons for processing no longer exist, and request that this be notified to third parties to whom the data has been transferred;
object to any result to your detriment arising exclusively from automated analysis of your personal data; and
request compensation for damages arising from unlawful processing of your personal data.

Where the GDPR is applicable, data subjects also have the following rights:

Right of access – to learn whether your personal data is being processed and, if so, to access it and information about how it is processed;
Right to rectification – to request correction of inaccurate data or completion of incomplete data;
Right to erasure – to request deletion of personal data under the conditions stipulated in the GDPR;
Right to restriction of processing – to request restriction of processing under the conditions stipulated in the GDPR;
Right to object – to object to processing under the conditions stipulated in the GDPR;
Right to data portability – to request that data collected by the Company be transferred directly to another organization, under certain conditions; and
Right to object to automated decision-making – to object to a decision based exclusively on automated processing, including profiling, that produces an adverse legal effect concerning you.

To exercise the rights above, your application must be explicit and understandable; if you are acting on behalf of someone else, you must be specifically authorized and able to document that authority; and the application must include identity and address information together with documents proving your identity. The Company enables you to file such requests through the Data Subject Application Form at askaiweb@codeway.co. In accordance with Article 13 of the PDP Law, the Company will finalize your request, free of charge, within 30 days at the latest, depending on the nature of the request. If a request is rejected, the reason for rejection will be notified in writing or electronically, together with its justification.

If you believe that the Company, or a party to which it has transferred your data, is violating your rights, you may file a complaint with the data protection authority in your country or with another competent supervisory authority.

This Privacy Policy may be revised by the Company when deemed necessary. If you continue to access or use Chat & Ask AI without benefiting from the Services after a notification period, you will be deemed to have accepted the changes to this Privacy Policy.

Company Title	Codeway Technologies - FZCO
Address	Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, Dubai 341041
E-mail	askaiweb@codeway.co