Last updated: 27 October 2026
In short
We are Dune Dynamics Digital Consulting FZCO, a company in the United Arab Emirates. This policy explains how we handle personal data from our website, from demo and security pack requests, and from people we deal with in sales and business.
We collect what you type into our forms, what you send us by email, and standard server logs when you visit the site. Our website uses no cookies and no third-party scripts.
We use your details to arrange your demo, send the pack you asked for, follow up on your request and run our business relationships. We do not send marketing emails or newsletters.
When our customers use AgentFlow or Navigator, we handle their callers' and staff's data on their behalf. For that data, the customer's own privacy notice applies, and the customer is the right place to ask questions.
You can ask to see, correct or delete your data, or object to how we use it, by writing to privacy@dunedynamics.ai. We reply within one month.
1. Who we are and how to contact us
Dune Dynamics Digital Consulting FZCO (“Dune Dynamics”, “we”, “us”) is a free zone company registered in the United Arab Emirates with the International Free Zone Authority (IFZA), Dubai under licence number 78955. Our registered address is Premises 78955-001, IFZA Business Park, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates.
We decide how and why the personal data described in this policy is used, which makes us its controller. For any question about this policy or your personal data, write to privacy@dunedynamics.ai or to our registered address, marked for the attention of the privacy team.
We follow the European Union's General Data Protection Regulation (GDPR) as our standard for handling personal data. The GDPR will apply to us directly if we offer our services to people in the European Union or monitor their behaviour there. We also follow the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and the Saudi Personal Data Protection Law where they apply.
2. What this policy covers
This policy covers personal data that we collect and use for our own purposes, which means:
- visits to our website, dunedynamics.ai, and the server logs those visits create;
- requests for a live demo or for our security and architecture pack;
- sales conversations and other business contact with people at prospects, customers, partners and suppliers.
Data inside AgentFlow and Navigator. Our customers are businesses such as banks, insurers and customer service teams. When they use AgentFlow or Navigator, we process personal data about their callers, customers and staff (for example call recordings, chat messages, transcripts and quality scores) on their behalf, following their instructions under a written contract. The customer decides how and why that data is used, and the customer's own privacy notice applies to it. This policy does not cover that data. If you spoke to an organisation through one of its voice or chat agents, or you work in a team whose conversations are scored, please contact that organisation about your data. If you contact us instead, we will pass your request to the customer concerned and help them answer it.
3. What we collect
| Data | Where it comes from |
|---|---|
| Full name, work email address and company name | From you, when you fill in the “Book a live demo” or “Get the security and architecture pack” form. We need these to arrange the demo or send the pack. |
| Your role, phone number, industry, the product you are most interested in, and anything you write in the “What would you like to see?” box | From you, if you choose to add them under “Add more detail”. These are optional, and you can leave them blank. |
| The date and time you sent the form, and the page of our website you sent it from | Recorded automatically with your form, so that we know which request you made. |
| Emails, meeting notes and the content of our conversations, including your contact details and job title | From you and your colleagues, when we talk or write to each other before, during and after a demo or contract. |
| Business contact details of people at our customers, partners and suppliers | From you, or from colleagues at your organisation who give us your details so we can work together. |
| Recordings or transcripts of conversations sent to us for a demo | From your organisation, only if it chooses to send them. See section 6. |
| Server logs, which record your IP address, browser type, the pages you request and the date and time of each request | Created automatically by our web server when your browser loads a page on our website. |
| Your privacy request or complaint and our correspondence about it | From you, when you contact us about your personal data. |
We do not ask for sensitive data, such as health information or religious beliefs, through our website. Please do not include it in the “What would you like to see?” box or in emails to us.
4. Information you must give us
You need to give us your name, work email address and company name for us to arrange a demo or send the security pack. Everything else on the form is optional. If you do not give us the required details, we will not be able to deal with your request.
5. Why we use your data and our legal basis
Under the GDPR, we must have a legal basis for each use of personal data. The table shows each purpose, the data we use for it, and the basis we rely on, with the matching letter of GDPR Article 6(1). Where the UAE or Saudi law applies, we use your data on the grounds that those laws allow, and we ask for your consent where they require it.
| Purpose | Data | Legal basis |
|---|---|---|
| Arranging and running the demo you asked for, and sending you the security pack | Form details, emails and meeting notes | Steps you asked us to take before a possible contract (Art. 6(1)(b)). Where you make the request for your employer, our legitimate interest in answering a business request that you made (Art. 6(1)(f)). |
| Following up after a demo or pack request, for example to answer questions or discuss a pilot | Form details, emails and meeting notes | Our legitimate interest in following up on your request (Art. 6(1)(f)). You can object at any time, as explained below the table, and we will stop. |
| Agreeing and running contracts with our customers, partners and suppliers, including support, invoices and payments | Business contact details, emails and meeting notes | Our legitimate interest in running our business relationship with your organisation (Art. 6(1)(f)). Where we must keep records such as invoices, the legal obligation that applies to us (Art. 6(1)(c)). |
| Showing a demo with your organisation’s recordings or transcripts | Recordings and transcripts your organisation sends us | We act for your organisation under a written agreement. See section 6. |
| Keeping our website secure and working, finding faults and blocking abuse | Server logs | Our legitimate interest in running a secure and reliable website (Art. 6(1)(f)). |
| Answering privacy requests and complaints, and keeping a record of how we dealt with them | Your request and our correspondence | The legal obligation to answer requests about personal data (Art. 6(1)(c)), and our legitimate interest in being able to show how we handled your request (Art. 6(1)(f)). |
| Meeting our legal duties and protecting our legal rights | Any of the data above, where needed | A legal obligation that applies to us (Art. 6(1)(c)), and our legitimate interest in making or defending legal claims (Art. 6(1)(f)). |
How to object. Where we rely on our legitimate interest, you can object at any time by writing to privacy@dunedynamics.ai or by replying to any email from us. If you object to follow-up emails, we will stop sending them. For other uses, we will stop unless we have strong legitimate grounds that outweigh your interests, or we need the data to make or defend a legal claim.
We do not make decisions about you based only on automated processing that have legal or similarly significant effects on you.
6. Recordings or transcripts you share for a demo
Our demos can show Navigator scoring one of your own transcripts, and we can check dialect coverage against your recordings. These recordings and transcripts usually contain personal data about your customers and staff.
Please send us anonymised material wherever you can, with names, account numbers, phone numbers and other details that identify a person removed or replaced. If you need to use real recordings or transcripts, we will first sign a short data processing agreement with your organisation. It says that we use the material only for the demo, keep it secure and limit access to the people running the demo. We delete the material within five working days after the demo ends and confirm to you when we have done so. In this case your organisation decides how the data is used, and its own privacy notice to its customers and staff applies.
7. Who we share your data with
We share personal data only where we need to, and only with:
- Google, whose Google Cloud service hosts our website, stores the requests sent through its forms and keeps its server logs;
- Google, whose Google Workspace service carries and stores our email;
- Resend, which delivers the emails our website sends when you submit a form, to you and to our team;
- our professional advisers, such as lawyers, accountants and auditors, who are bound by duties of confidentiality;
- courts, regulators, the police and other authorities, where the law requires it or where we need to protect our legal rights;
- a buyer of, or investor in, all or part of our business, if we sell or reorganise it, under a duty of confidentiality and on the basis that they use your data as this policy describes.
Our providers handle your data only on our instructions, under contracts that require them to keep it secure and confidential. We do not sell your personal data.
8. Where your data is stored
We are based in the United Arab Emirates. Our website, and the requests sent through its forms, are hosted on Google Cloud servers in Mumbai, India. Our email is stored by Google Workspace in Google's data centres, which are located in several countries, including the United States. Resend processes the emails it delivers for us in the United States.
9. International transfers
When personal data is protected by the GDPR and we receive it in the UAE, or send it to a provider in another country such as India or the United States, we make sure it stays protected. We rely either on a decision of the European Commission that the receiving country protects personal data adequately, or on the European Commission's standard contractual clauses, which are model contract terms that bind the receiver to protect the data.
When we send personal data outside the UAE, we follow the UAE law's rules on transfers abroad. If you are in Saudi Arabia, we handle your personal data, including any transfer outside the Kingdom, in line with the Saudi Personal Data Protection Law and its rules on transfers.
You can ask us for a copy of the safeguards we use by writing to privacy@dunedynamics.ai.
10. How long we keep your data
We keep personal data only for as long as we need it for the purposes in section 5. These are our retention periods.
| Data | How long we keep it |
|---|---|
| Demo and security pack requests that do not lead to a sales conversation | 12 months after our last contact with you |
| Sales conversations that do not lead to a contract | 24 months after our last contact with you |
| Business contact details of people at our customers and partners | For as long as the business relationship lasts, plus 2 years |
| Recordings and transcripts shared for a demo | Deleted within five working days after the demo ends, and from backups within 30 days |
| Contracts, invoices and payment records | For as long as UAE company and tax law requires us to keep them |
| Server logs | 14 days |
| Privacy requests and complaints | 3 years after we close the request |
We may keep data for longer if we need it to deal with a security incident, a legal claim or a regulator's enquiry, and only for as long as that takes. When a period ends, we delete the data or make it anonymous.
11. Cookies
Our website does not use cookies or similar technologies today. It does not store anything in your browser and it loads no third-party scripts or services. If that changes, we will ask for your consent before we store or read anything on your device that the site does not strictly need to work, and we will update this policy.
12. How we keep your data secure
We protect personal data with technical and organisational measures suited to the risk. These include limiting access to the staff who need it, encryption of data in transit and at rest, and contracts that require our providers to protect the data. If a personal data breach is likely to put your rights at risk, we will tell you and the relevant regulator as the law requires.
13. Your rights
Under the GDPR you have the right to:
- ask for a copy of the personal data we hold about you, and information about how we use it;
- ask us to correct data that is wrong or incomplete;
- ask us to delete your data;
- ask us to restrict how we use your data, for example while we check a correction you asked for;
- receive data you gave us in a common electronic format, or ask us to send it to another organisation, where we use it on the basis of your consent or a contract;
- object to our use of your data where we rely on our legitimate interest, and object at any time to direct marketing, in which case we will always stop;
- withdraw your consent at any time, where we rely on it;
- not be subject to a decision based only on automated processing that has legal or similarly significant effects on you;
- complain to a data protection regulator (see section 14).
You have similar rights under UAE and Saudi law.
How to use your rights. Write to privacy@dunedynamics.ai and tell us what you would like us to do. We may ask you for information to confirm your identity before we act, so that we do not give your data to someone else. We will reply within one month. If your request is complex or you send us several requests, we may need up to two more months; if so, we will tell you within the first month and explain why.
Some rights have limits. For example, we may need to keep some data to meet a legal obligation. If we cannot do what you ask, we will explain why.
14. Complaints
If you are unhappy with how we have handled your personal data, please contact us first at privacy@dunedynamics.ai if you wish, so we can try to put it right. You can also complain to a regulator at any time:
- if you are in the European Union, the data protection supervisory authority in the country where you live or work, or where you think the problem happened;
- in the UAE, the UAE Data Office;
- in Saudi Arabia, the Saudi Data and Artificial Intelligence Authority (SDAIA).
15. Representative in the European Union
We have no office in the European Union and do not currently offer our services to people there, so we have not appointed a representative in the EU. If we start offering services to people in the EU, we will appoint one and give their name and contact details here.
16. Children
Our website and services are for businesses and are not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, please contact us and we will delete it.
17. Changes to this policy
We may update this policy when our services or the law change. We will change the “Last updated” date at the top of the page each time. If we make a significant change that affects how we use your data, we will also tell you by email where we have your address.
18. Contact
Dune Dynamics Digital Consulting FZCO, Premises 78955-001, IFZA Business Park, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates. Licence number 78955, issued by the International Free Zone Authority (IFZA), Dubai.
For anything about this policy or your personal data, email privacy@dunedynamics.ai.