Privacy Policy

1. Executive Summary

2. Definitions

In this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any data relating to an identified or identifiable natural person (Data Subject), including any information that can directly or indirectly identify an individual.
• "Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction.
• "Data Subject" means the identified or identifiable natural person to whom Personal Data relates.
• "Controller" means the natural or legal person that determines the purposes and means of the Processing of Personal Data.
• "Processor" means a natural or legal person that processes Personal Data on behalf of the Controller.
• "Sub-Processor" means a Processor engaged by the Controller's Processor to carry out specific Processing activities on behalf of the Controller.
• "DIFC" means the Dubai International Financial Centre.
• "DIFC DPL" means the DIFC Data Protection Law 2020 (DIFC Law No. 5 of 2020), as amended from time to time, together with any regulations, rules, and guidance issued thereunder by the DIFC Commissioner of Data Protection.
• "SCCs" means Standard Contractual Clauses adopted by the European Commission pursuant to Article 46(2)(c) GDPR for the transfer of personal data to third countries.
• "Platform" means the Resolved.ae online dispute resolution and settlement platform, accessible at resolved.ae.
• "AI Processing" means the use of artificial intelligence models (specifically Anthropic Claude) to analyse dispute data and generate settlement proposals.

3. Data Controller and Contact Information

The Controller responsible for the Processing of your Personal Data is:

Resolved.ae
Website: resolved.ae
General Privacy Enquiries: admin@resolved.ae

Data Protection Officer

We have appointed a Data Protection Officer ("DPO") who is responsible for overseeing our data protection strategy and ensuring compliance with applicable data protection laws. You may contact the DPO at:

Email: dpo@resolved.ae

The DPO is available to address any questions, concerns, or requests regarding the Processing of your Personal Data or the exercise of your data protection rights.

4. Scope and Applicability

This Privacy Policy applies to all Personal Data collected and processed through the Platform, regardless of the Data Subject's location. We have adopted the DIFC Data Protection Law 2020 as our primary operative standard, supplemented by the EU General Data Protection Regulation (GDPR) to the extent applicable.

4.1 DIFC Data Protection Law 2020 (Primary Standard)

We have voluntarily adopted the DIFC Data Protection Law 2020 and its implementing regulations as the primary operative standard governing our Processing activities. The DIFC regime provides a comprehensive, internationally recognised data protection framework with enhanced accountability obligations and strict cross-border transfer controls. By adopting this standard, we commit to applying DIFC-equivalent protections to all Personal Data processed through the Platform.

4.2 EU General Data Protection Regulation (GDPR)

The GDPR applies to our Processing activities because: (a) our servers are located in Finland, within the European Union; and (b) we may offer services to, or monitor the behaviour of, individuals within the EU/EEA. We comply with the GDPR's requirements for lawful Processing, Data Subject rights, international transfers, and data breach notification to the extent required by its extraterritorial scope.

4.3 Other Applicable Laws

We additionally comply with any other data protection laws applicable to our operations, including the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection to the extent it applies to our activities, sector-specific regulations, and directives issued by the DIFC Commissioner of Data Protection and relevant EU supervisory authorities.

5. Categories of Personal Data Collected

We collect and process the following categories of Personal Data:

5.1 Account and Registration Data

• Full name
• Email address
• Telephone number
• Company or organisation name (where applicable)
• Password (stored as a bcrypt hash; we do not store plaintext passwords)
• Account verification status
• User role and permissions

5.2 Dispute and Case Data

• Claim submissions and descriptions
• Defence statements and responses
• Supporting documents uploaded by parties
• Settlement terms and agreements
• Dispute workflow data (status, deadlines, actions taken)
• Case reference numbers and metadata

5.3 AI-Generated Data

• Settlement proposals generated by Anthropic Claude AI
• Reasoning summaries produced by the AI model
• Cryptographic audit hashes for integrity verification
• AI model version identifiers

5.4 Payment and Transaction Data

• Payment status and transaction references
• Stripe and Telr payment processor references
• Invoice details and billing history

Note: We do not store credit or debit card numbers. All payment card data is processed directly by our payment processors (Stripe and Telr) in accordance with PCI-DSS standards.

5.5 Technical and Security Data

• IP addresses
• Session identifiers
• Browser type and version
• Device information
• Comprehensive audit logs (user actions, timestamps, system events)
• Access timestamps and login history

5.6 Communication Data

• Correspondence related to disputes conducted through the Platform
• Notifications and system messages
• Support requests and enquiries

6. Purposes and Legal Bases for Processing

The following table sets out the purposes for which we process your Personal Data and the corresponding legal bases under the DIFC DPL and GDPR:

7. AI-Powered Processing

7.1 Use of Anthropic Claude AI

We utilise Anthropic's Claude AI model to analyse dispute submissions and generate settlement proposals. This AI Processing is integral to our service and is designed to assist parties in reaching fair and efficient resolutions.

7.2 Data Sent to the AI Model

The following data may be transmitted to Anthropic for AI Processing:

• Claim text and descriptions submitted by the claimant
• Defence text and responses submitted by the respondent
• Document summaries (not full documents unless necessary for analysis)
• Relevant case metadata required for contextual analysis

7.3 Anthropic as Data Processor

Anthropic acts as a Data Processor on our behalf. We have entered into a Data Processing Agreement with Anthropic that complies with Article 28 GDPR and the processor requirements under the DIFC DPL. Anthropic is contractually prohibited from using your data for model training or any purpose other than providing the contracted service.

7.4 Audit Integrity

We retain cryptographic hashes of all AI-generated outputs to ensure auditability and integrity. These hashes allow verification that settlement proposals have not been altered after generation.

7.5 Rights Regarding Automated Decision-Making

Under Article 22 of the GDPR, you have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. In relation to our AI Processing:

• AI-generated settlement proposals are recommendations only and do not constitute binding decisions.
• Both parties must expressly accept a proposal before it becomes a binding settlement agreement.
• You may request human review of any AI-generated proposal by contacting us at privacy@resolved.ae.
• You may express your point of view and contest any AI-generated output.

8. Data Sharing and Recipients

We share your Personal Data only where necessary and lawful. The following categories of recipients may receive your data:

8.1 Counterparties to Disputes

By the nature of dispute resolution, the counterparty to your dispute will necessarily have access to your submissions, claims, defences, and supporting documents insofar as they relate to the dispute. This sharing is essential for the performance of our service and the fair administration of the dispute resolution process.

8.2 Sub-Processors

We engage the following Sub-Processors to assist in delivering our services:

Each Sub-Processor is bound by a Data Processing Agreement that imposes obligations equivalent to those set out in this Privacy Policy, including appropriate security measures and restrictions on further Processing.

8.3 Legal and Regulatory Authorities

We may disclose Personal Data to competent courts, regulatory bodies, law enforcement agencies, or government authorities where required by applicable law, regulation, legal process, or enforceable governmental request.

8.4 Professional Advisers

We may share Personal Data with our legal advisers, auditors, and other professional consultants where necessary for the establishment, exercise, or defence of legal claims or for obtaining professional advice.

8.5 No Sale of Personal Data

We do not sell, rent, or trade your Personal Data to any third party for commercial, marketing, or advertising purposes.

9. Cross-Border Data Transfers

Given that our Platform is based in the UAE and our servers are located in Finland, cross-border transfers of Personal Data are inherent to our operations. We ensure that all such transfers comply with applicable data protection laws.

9.1 Transfer from UAE to Finland (Server Location)

Personal Data collected through the Platform is transferred to and stored on servers located in Finland, a member state of the European Union. Finland benefits from the comprehensive data protection framework of the GDPR, which provides a high standard of protection for Personal Data.

9.2 Legal Basis for Cross-Border Transfers

Cross-border transfers of Personal Data are made in accordance with Articles 26 and 27 of the DIFC DPL, which require either an adequacy finding by the DIFC Commissioner of Data Protection or the implementation of appropriate safeguards such as standard data protection clauses. The European Union, including Finland, is recognised as providing adequate protection under the DIFC framework.

9.3 GDPR Chapter V Compliance

For transfers of Personal Data from Finland (or elsewhere within the EU/EEA) to jurisdictions outside the EU/EEA, we rely on the following mechanisms under Chapter V of the GDPR:

• Adequacy Decisions: Where the European Commission has determined that a third country provides an adequate level of protection (Article 45 GDPR).
• Standard Contractual Clauses (SCCs): We have entered into SCCs adopted by the European Commission (Commission Implementing Decision (EU) 2021/914) with all relevant recipients in non-adequate jurisdictions (Article 46(2)(c) GDPR).
• Supplementary Measures: In accordance with the EDPB Recommendations 01/2020, we implement supplementary technical measures including encryption in transit and at rest, pseudonymisation where feasible, and contractual prohibitions on government access disclosure.

9.4 Transfers to the United States (Anthropic and Stripe)

Anthropic (our AI provider) and Stripe (our payment processor) are established in the United States. For these transfers, we rely on:

• The EU-US Data Privacy Framework, where the recipient is certified;
• Standard Contractual Clauses (Module 2: Controller to Processor) executed with each provider;
• Supplementary measures including data minimisation (only necessary data is transmitted), encryption of data in transit (TLS 1.2+), and contractual restrictions on onward transfers.

A copy of the relevant transfer safeguards may be obtained by contacting our DPO at dpo@resolved.ae.

10. Data Retention

We retain Personal Data only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal obligations, to resolve disputes, and to enforce our agreements. The following retention periods apply:

The retention periods above are determined by reference to: (a) the nature and sensitivity of the data; (b) the purposes for which it is processed; (c) applicable statutory limitation periods; (d) regulatory requirements; and (e) the principle of data minimisation. Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised such that it can no longer be associated with an identifiable individual.

11. Data Subject Rights

Depending on your jurisdiction and the applicable legal framework, you may exercise the following rights in respect of your Personal Data:

11.1 Right of Access

You have the right to obtain confirmation as to whether your Personal Data is being processed and, where that is the case, to access such data together with information about the purposes, categories of data, recipients, retention periods, and available rights.

11.2 Right to Rectification

You have the right to obtain the rectification of inaccurate Personal Data and to have incomplete data completed.

11.3 Right to Erasure (Right to Be Forgotten)

You have the right to request the erasure of your Personal Data where: the data is no longer necessary for its original purpose; you withdraw consent (where Processing is based on consent); you object to Processing and there are no overriding legitimate grounds; or the data has been unlawfully processed. This right is subject to applicable legal retention obligations.

11.4 Right to Restriction of Processing

You have the right to request restriction of Processing where you contest the accuracy of the data, the Processing is unlawful, we no longer need the data but you require it for legal claims, or you have objected to Processing pending verification.

11.5 Right to Data Portability

Where Processing is based on consent or contract performance and carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, and machine-readable format, and to transmit it to another controller without hindrance.

11.6 Right to Object

You have the right to object to Processing based on legitimate interests. We shall cease Processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the Processing is necessary for the establishment, exercise, or defence of legal claims.

11.7 Right to Withdraw Consent

Where Processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of Processing carried out prior to the withdrawal.

11.8 Rights Regarding Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where the decision is necessary for a contract, authorised by law, or based on your explicit consent. In all cases, you have the right to obtain human intervention, express your point of view, and contest the decision.

11.9 How to Exercise Your Rights

To exercise any of the above rights, please submit a written request to:

• Email: privacy@resolved.ae
• DPO: dpo@resolved.ae

11.10 Response Timeframes

• Under the DIFC DPL: We shall respond within 30 days of receipt of a valid request.
• Under the GDPR: We shall respond without undue delay and in any event within one month of receipt. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests.

11.11 Identity Verification

To protect your privacy and security, we may require you to verify your identity before processing your request. We may request additional information to confirm your identity where we have reasonable doubts. We shall not charge a fee for the exercise of your rights unless the request is manifestly unfounded or excessive.

12. Security Measures

We implement appropriate technical and organisational measures to protect Personal Data against unauthorised or unlawful Processing, accidental loss, destruction, or damage.

12.1 Technical Measures

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher (HTTPS enforced).
• Password Security: User passwords are hashed using bcrypt with a cost factor of 12. Plaintext passwords are never stored or logged.
• Access Controls: Role-based access control (RBAC) ensures that users can only access data to which they are entitled.
• Session Security: Session cookies are configured with HttpOnly, Secure, and SameSite=Strict attributes to prevent session hijacking and cross-site attacks.
• CSRF Protection: Cross-Site Request Forgery tokens are implemented on all state-changing operations.
• Rate Limiting: API endpoints are protected by rate limiting to prevent brute-force attacks and abuse.
• Audit Logging: All significant user and system actions are logged with timestamps, user identifiers, and IP addresses for security monitoring and incident investigation.
• Document Access Restrictions: Documents uploaded in connection with a dispute are accessible only to the parties to that dispute and authorised platform administrators.

12.2 Organisational Measures

• Personnel with access to Personal Data are subject to confidentiality obligations.
• Access to production systems is limited to authorised personnel on a need-to-know basis.
• Regular security assessments and vulnerability testing are conducted.
• Data Processing Agreements are in place with all Sub-Processors.

12.3 Incident Response and Breach Notification

We maintain documented incident response procedures. In the event of a Personal Data breach:

• DIFC DPL: We shall notify the DIFC Commissioner of Data Protection within 72 hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of natural persons. Where the breach is likely to result in a high risk, we shall also notify the affected Data Subjects without undue delay.
• GDPR: We shall notify the competent supervisory authority (the Finnish Data Protection Ombudsman) within 72 hours of becoming aware of a breach. Where the breach is likely to result in a high risk, we shall also notify the affected Data Subjects without undue delay.

13. Cookies and Tracking Technologies

13.1 Essential Session Cookie

We use a single, strictly necessary session cookie (connect.sid) to maintain your authenticated session while using the Platform. This cookie:

• Is essential for the operation of the Platform and cannot be disabled;
• Does not track your behaviour across other websites;
• Is automatically deleted when your session expires or you log out;
• Is configured with HttpOnly, Secure, and SameSite=Strict attributes.

13.2 No Analytics, Tracking, or Advertising Cookies

We do not use any analytics cookies, tracking pixels, web beacons, advertising cookies, or similar technologies. We do not engage in behavioural advertising or cross-site tracking.

13.3 Consent

As we use only strictly necessary cookies required for the provision of our service, no consent is required under the GDPR (Article 5(3) of the ePrivacy Directive) or applicable UAE law. Should we introduce non-essential cookies in the future, we shall obtain your prior consent in accordance with applicable law.

13.4 User Control

You may configure your browser to refuse cookies or to alert you when cookies are being sent. However, disabling the session cookie will prevent you from using the authenticated features of the Platform.

14. Children's Data

The Platform is designed for business use by adults. We do not knowingly collect or process Personal Data from individuals under the age of 18. If you are under 18 years of age, you may not use the Platform or submit any Personal Data to us.

If we become aware that we have inadvertently collected Personal Data from a child under 18, we shall take immediate steps to delete such data. If you believe that we may have collected data from a minor, please contact us immediately at privacy@resolved.ae.

15. Third-Party Links

The Platform may contain links to external websites or services that are not operated or controlled by us. This Privacy Policy does not apply to such third-party websites. We are not responsible for the privacy practices, content, or security of any third-party websites. We encourage you to review the privacy policies of any third-party websites that you visit.

16. Complaints and Dispute Resolution

If you are dissatisfied with our Processing of your Personal Data or believe that we have not complied with our obligations under applicable data protection laws, you have the right to lodge a complaint through the following channels:

16.1 Internal Complaint

In the first instance, please contact us directly at privacy@resolved.ae or dpo@resolved.ae. We shall investigate your complaint and endeavour to resolve it within 30 days.

16.2 DIFC Commissioner of Data Protection

As we have adopted the DIFC Data Protection Law as our primary operative standard, you may lodge a complaint with the DIFC Commissioner of Data Protection if you believe your rights have been infringed.

16.3 UAE Data Office

To the extent the UAE Federal Decree-Law No. 45 of 2021 applies to our Processing activities, you may also lodge a complaint with the UAE Data Office.

16.4 EU Supervisory Authority

If you are located in the EU/EEA, you have the right to lodge a complaint with the supervisory authority in your member state of habitual residence, place of work, or place of the alleged infringement.

16.5 Finnish Data Protection Ombudsman

As our servers are located in Finland, you may also lodge a complaint with the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) in Finland:

• Address: Lintulahdenkuja 4, 00530 Helsinki, Finland
• Website: tietosuoja.fi

The exercise of your right to lodge a complaint does not prejudice any other administrative or judicial remedy available to you.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our Processing activities, legal requirements, or business operations. Where we make changes:

• Material Changes: We shall provide at least 7 days' prior notice of any material changes to this Privacy Policy by email notification to the address associated with your account and/or by displaying a prominent notice on the Platform.
• Non-Material Changes: Minor amendments (such as typographical corrections or clarifications that do not affect your rights) may be made without prior notice.
• The "Last Updated" date at the end of this Policy will always reflect the date of the most recent revision.
• Your continued use of the Platform after the effective date of a revised Privacy Policy constitutes your acknowledgement of the changes. If you do not agree with the revised terms, you should discontinue your use of the Platform.

18. Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the Dubai International Financial Centre (DIFC). This is without prejudice to:

• The mandatory application of the GDPR to the extent that it applies to our Processing activities by virtue of Article 3 GDPR;
• The application of the DIFC Data Protection Law to the extent that it applies by virtue of its jurisdictional scope; and
• Any other mandatory provisions of applicable law that cannot be derogated from by agreement.

19. Contact Information

20. Version Control

---

This Privacy Policy is governed by the laws of the Dubai International Financial Centre (DIFC), supplemented by the EU General Data Protection Regulation (GDPR) to the extent applicable. Resolved.ae — resolved.ae