Privacy Policy

INTRODUCTION

Welcome to GenuDo ("Company", "we", "us", or "our"). GenuDo is an AI-powered sales agent platform designed specifically for small and medium enterprises (SMEs) in the Middle East and North Africa (MENA) region, providing 24/7 bilingual Arabic-English AI agents for customer engagement across multiple communication channels.

We understand the importance of protecting your personal data and are committed to maintaining the highest standards of data privacy and security. This Privacy Policy describes how GenuDo collects, uses, processes, stores, and protects your personal information in compliance with applicable data protection laws in the MENA region and internationally.

This Privacy Policy applies to all users of our services, including customers, their end users, website visitors, and any individuals whose personal data we process through our platform.

IMPORTANT NOTICE FOR MENA RESIDENTS:

This Privacy Policy has been specifically designed to comply with:

UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
Saudi Arabia Personal Data Protection Law (PDPL) (Royal Decree No. M/19)
Egypt Data Protection Law (Law No. 151 of 2020)
Bahrain Personal Data Protection Law (Law No. 30 of 2018)
European Union General Data Protection Regulation (GDPR) (for European data subjects)
Other applicable data protection laws in jurisdictions where we operate

CONTACTING US ABOUT DATA PROTECTION

GenuDo is committed to protecting your privacy and ensuring transparent data practices. For any inquiries, concerns, or requests regarding your personal data, please contact our dedicated Privacy Team.

Privacy Team Contact Information:

GenuDo

Email: [email protected]

Website: https://genudo.ai

Data Protection Officer (DPO):

For customers in Saudi Arabia, UAE, and other jurisdictions requiring a DPO, our designated Data Protection Officer can be reached at: [email protected]

Regulatory Authority Contacts:

UAE: UAE Data Office - https://www.tdra.gov.ae
Saudi Arabia: Saudi Data & Artificial Intelligence Authority (SDAIA) - https://sdaia.gov.sa

INFORMATION WE COLLECT

1. Customer Account Information

When you create a GenuDo account or workspace, we collect:

Full name
Email address
Phone number
Company name and details
Job title and role
Billing address
Payment information (processed securely through third-party payment processors)
Account credentials (encrypted passwords)
User preferences and settings

2. AI Agent Configuration Data

When you configure AI agents on our platform, we collect:

AI agent instructions and personas
Custom prompts and response templates
Pipeline and stage configurations
Knowledge base content uploaded by you
Integration settings and API credentials for connected communication channels
Training data and conversation examples

3. Conversation and Usage Data

When your AI agents interact with end users, we collect:

Conversation transcripts and message content
End user contact information (names, phone numbers, email addresses provided during conversations)
Conversation metadata (timestamps, channel types, message status)
Opportunity and lead information
Customer interaction history
Follow-up sequences and automation logs

4. Technical and Device Information

We automatically collect certain technical information, including:

IP addresses and general location data (country, city)
Browser type and version
Operating system
Device identifiers
Access times and dates
Pages visited and features used
Referral sources
Error logs and diagnostic data

5. Communication Channel Data

When you integrate third-party communication channels (WhatsApp Business, Facebook Messenger, Telegram, etc.), we may collect:

Channel-specific user identifiers
Message delivery status
Media files shared in conversations
Channel metadata as provided by third-party services

6. Information from Third Parties

We may receive information about you from:

Third-party communication platforms (WhatsApp, Facebook, Telegram, Gmail, Instagram)
Payment processors
Analytics providers
Marketing platforms
Publicly available sources (e.g., LinkedIn, company websites)

HOW WE USE YOUR INFORMATION

Legal Bases for Processing (GDPR, UAE, Saudi Arabia, Egypt)

We process your personal data based on the following legal grounds:

1. Consent: Where you have provided explicit consent for specific processing activities (primary basis for Saudi Arabia PDPL)

2. Contract Performance: To provide our services and fulfill our contractual obligations to you

3. Legal Obligations: To comply with applicable laws, regulations, and legal processes

4. Legitimate Interest: To operate, improve, and secure our services (note: not applicable as primary basis in Saudi Arabia)

5. Public Interest: To protect vital interests of individuals or serve public interest where applicable

Specific Purposes for Processing

We use your personal information for the following purposes:

Service Delivery:

Providing and maintaining the GenuDo platform and AI agent services
Processing your transactions and managing your account
Enabling AI-powered conversations between your agents and end users
Managing workspaces, teams, pipelines, and opportunities
Facilitating integrations with communication channels
Providing customer support and technical assistance

Service Improvement:

Analyzing usage patterns to improve platform functionality
Developing new features and services
Conducting research and analytics (using aggregated, anonymized data)
Testing and optimizing AI model performance
Identifying and fixing technical issues

Communication:

Sending service-related notifications and updates
Providing customer support and responding to inquiries
Sending marketing communications (with your consent)
Conducting surveys and gathering feedback
Notifying you of changes to our terms or policies

Security and Compliance:

Detecting and preventing fraud, abuse, and security threats
Monitoring compliance with our Terms of Service
Conducting security audits and risk assessments
Responding to legal requests and protecting legal rights
Complying with regulatory obligations

Marketing and Analytics (With Consent):

Personalizing your experience on our platform
Sending promotional materials about new features and services
Conducting market research and customer analysis
Displaying relevant content and recommendations

IMPORTANT: NO AI MODEL TRAINING

We explicitly confirm that any data processed through GenuDo is NOT used to develop, improve, or train generalized AI and/or machine learning models.

We use Retrieval-Augmented Generation (RAG) technology to generate AI responses without training models on your data
Your conversation data, customer information, and business data remain confidential and are never used to train AI models
Third-party AI model providers (OpenAI, Anthropic, Google) are contractually restricted from using your data for model training
We do not share your data with AI research programs or model improvement initiatives

DATA SHARING AND DISCLOSURE

Categories of Recipients

We share your personal data only in the following limited circumstances:

1. Service Providers and Sub-Processors

We engage trusted third-party service providers to facilitate our services, including:

Cloud hosting providers (AWS)
AI model providers (OpenAI, Anthropic, Google Gemini, xAI, DeepSeek, Z.AI, Alibaba Cloud (Qwen), Moonshot AI (Kimi))
Communication channel APIs (Meta: official WhatsApp Business API, Instagram and Messenger)
Payment processors (PayTabs)
Analytics services (limited and anonymized)
Customer support tools
Email delivery services

A current and comprehensive list of our sub-processors is available at: https://genudo.ai/legal/subprocessors

All sub-processors are bound by strict contractual obligations to protect your data and use it only for specified purposes. We conduct due diligence on all service providers and ensure they maintain adequate security measures.

2. Within Your Organization

We share data with team members and users within your workspace according to the role-based access controls you configure (Admin, Developer, Sales Manager, Moderator).

3. Communication Channel Providers

When you integrate third-party communication channels, certain data is necessarily shared with those platforms (e.g., WhatsApp, Facebook, Telegram) to enable message delivery and conversation functionality. Such sharing is governed by the terms and privacy policies of those third-party services.

4. Legal and Regulatory Requirements

We may disclose personal data when required by law or legal process, including:

In response to valid court orders, subpoenas, or legal processes
To comply with regulatory investigations or requests from government authorities
To protect our rights, property, or safety, or that of our customers or the public
To enforce our Terms of Service or other agreements
In connection with fraud prevention or security investigations

For Saudi Arabia customers: We will notify SDAIA and comply with all PDPL disclosure requirements.

For UAE customers: We will notify the UAE Data Office as required by applicable regulations.

For Egypt customers: We will comply with Egyptian Data Protection Center requirements.

5. Business Transfers

In the event of a merger, acquisition, reorganization, sale of assets, or bankruptcy, your personal data may be transferred to the successor entity, subject to the same privacy protections outlined in this policy.

6. With Your Consent

We may share your information with third parties when you provide explicit consent for specific purposes.

What We Do NOT Do

We explicitly confirm that we:

DO NOT sell your personal data to any third party for any purpose
DO NOT share your data with advertisers for targeted advertising purposes
DO NOT use your business data or customer conversations for our own marketing purposes
DO NOT disclose your sensitive business information to competitors or unauthorized parties
DO NOT share data with AI training programs or use your data to train generalized AI models

DATA STORAGE, RESIDENCY, AND CROSS-BORDER TRANSFERS

Data Residency Options

GenuDo stores and processes customer data in secure data centers located in:

European Union (primary data centers)
United Arab Emirates (regional data center for Middle East customers)
United States (for specific services and backups)

Data center selection depends on your subscription tier and preferences indicated during account setup.

Saudi Arabia Data Localization Requirements

IMPORTANT NOTICE FOR SAUDI ARABIA CUSTOMERS:

The Saudi Arabia Personal Data Protection Law (PDPL) requires that personal data of Saudi residents be processed and stored within the Kingdom's geographical boundaries unless specific exceptions apply.

Current Status:

GenuDo currently utilizes data centers located in the UAE and EU regions
We are actively working to establish local data residency options within Saudi Arabia for full compliance
We expect to have Saudi Arabia-based data storage available by [target date]

Options for Saudi Arabia Customers:

Regional Storage (UAE Data Center): Your data can be stored in our UAE regional data center (closest geographical option) with appropriate cross-border transfer safeguards
Hybrid Deployment: We can work with enterprise customers to implement hybrid or on-premises deployment solutions where technically feasible
Consent-Based Transfer: You may provide informed consent for temporary cross-border data transfer with appropriate safeguards until local storage becomes available

Customer Responsibilities:

Saudi Arabia customers are responsible for conducting a Data Protection Impact Assessment (DPIA) if processing personal data of Saudi residents
Customers may need to obtain approval from the Saudi Data & Artificial Intelligence Authority (SDAIA) for cross-border data transfers
We will provide all necessary documentation and cooperation for regulatory approvals

Migration Commitment: When local Saudi Arabia data residency becomes available, we will:

Notify all Saudi customers with reasonable advance notice
Provide migration assistance at no additional cost for existing customers
Offer migration tools and support documentation

Cross-Border Data Transfers

For transfers from the UAE:

We implement Standard Contractual Clauses (SCCs) approved by the UAE Data Office
Transfers are made only to countries with adequate data protection or with appropriate safeguards
Customers consent to necessary transfers to provide the service

For transfers from Saudi Arabia:

Transfers require explicit consent or SDAIA-approved safeguards
We conduct risk assessments for all cross-border transfers
We implement technical and organizational measures to protect data in transit
Transfers are limited to what is necessary to provide the service

For transfers from Egypt:

We obtain necessary licenses from the Egyptian Data Protection Center when required
We implement Standard Contractual Clauses for data transfers outside Egypt
Written consent may be required for certain transfers

For transfers from the EU:

We use Standard Contractual Clauses (SCCs) approved by the European Commission
We comply with the EU-US Data Privacy Framework where applicable
We implement supplementary measures as recommended by the European Data Protection Board

Data Transfer Mechanisms

We employ the following safeguards for international data transfers:

EU Standard Contractual Clauses (SCCs)
SDAIA-approved transfer mechanisms for Saudi Arabia
Adequacy decisions where available
Binding Corporate Rules (where applicable)
Explicit user consent
Encryption in transit (TLS 1.3) and at rest (AES-256)

DATA SECURITY MEASURES

GenuDo implements comprehensive technical and organizational security measures to protect your personal data:

Technical Security Measures

Encryption:

All data encrypted in transit using TLS 1.3 protocol
All data encrypted at rest using AES-256 encryption
End-to-end encryption for sensitive credentials and API keys
Secure key management using industry-standard practices

Access Controls:

Multi-factor authentication (MFA) for all user accounts
Role-based access control (RBAC) within workspaces
Principle of least privilege for internal access
Regular access reviews and audit logs
Secure password policies and credential management

Infrastructure Security:

Hosting on secure AWS infrastructure (us-east-1 and regional data centers)
Managed database services with automated security patching (AWS)
Web application firewall (WAF) protection
DDoS protection and rate limiting
Network segmentation and isolation
Regular vulnerability scanning and penetration testing

Application Security:

Secure software development lifecycle (SDLC)
Regular security code reviews
Automated security testing and dependency scanning
Input validation and sanitization
Protection against common vulnerabilities (OWASP Top 10)
API security and authentication

Monitoring and Logging:

24/7 security monitoring and intrusion detection
Comprehensive audit logging of all data access
Real-time alerts for suspicious activities
Regular security incident response drills
Automated anomaly detection

Organizational Security Measures

Personnel Security:

Background checks for employees with data access
Mandatory security awareness training
Confidentiality agreements and data protection obligations
Limited employee access to customer data (need-to-know basis)
Regular security training and updates

Business Continuity:

Automated daily backups with geographic redundancy
Disaster recovery procedures and testing
Business continuity planning
Incident response procedures
Data recovery capabilities (up to 90 days)

Compliance and Auditing:

Regular internal security audits
Third-party security assessments
Compliance with ISO 27001 standards (in progress)
SOC 2 Type II compliance (in progress)
Saudi Arabia Essential Cybersecurity Controls (ECC) alignment
Saudi Arabia Cloud Cybersecurity Controls (CCC) alignment
Regular compliance reviews and updates

Platform-Specific Security Features

Customer Controls:

Domain allowlist for agent embedding
Rate limiting per agent and workspace
Configurable data retention policies
Ability to delete data at any time
Export functionality for data portability
Session timeout and automatic logout

DATA BREACH NOTIFICATION

GenuDo takes data security incidents extremely seriously and has established comprehensive breach response procedures.

Our Breach Response Commitment

For Saudi Arabia Customers:

72-hour notification to SDAIA from the moment we become aware of a breach
Prompt notification to affected data subjects if the breach poses significant risk
Detailed analysis of the breach and remediation steps
Coordination with SDAIA throughout the incident response process

For UAE Customers:

Immediate notification to the UAE Data Office upon becoming aware of a breach
Prompt notification to affected data subjects
Comprehensive incident report with timeline and impact assessment
Remediation plan and follow-up reporting

For Egypt Customers:

Notification within 72 hours to the Egyptian Data Protection Center
Immediate notification to affected data subjects for high-risk breaches
Detailed breach report and corrective action plan
Compliance with PDPC investigation requirements

For EU Data Subjects:

72-hour notification to relevant supervisory authority (GDPR requirement)
Without undue delay notification to affected data subjects for high-risk breaches
Documentation of the breach and response measures
Cooperation with data protection authorities

Breach Notification Contents

If we notify you of a data breach, we will provide:

Description of the breach and how it occurred
Date and time of the breach and when we became aware
Categories and approximate number of affected data subjects
Types of personal data involved
Likely consequences and potential risks
Measures taken or proposed to address the breach
Contact information for our Data Protection Officer
Recommendations for protective measures you can take

Your Role in Data Security

Customers are responsible for:

Maintaining security of their account credentials
Promptly reporting suspected security incidents
Implementing appropriate security measures for their own systems
Ensuring end-user data is collected lawfully with proper consents
Monitoring AI agent interactions for inappropriate content

DATA RETENTION

Retention Principles

We retain personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements.

Retention Periods

Active Customer Data:

Retained for the duration of your active subscription
Conversation and opportunity data retained according to your workspace settings (default: 24 months)
User account information retained while account is active

Post-Termination:

30-day grace period after subscription termination for data export and recovery
After 30 days, customer data is deleted or anonymized
Backup systems retain data for maximum 90 days before automatic deletion
Billing and transaction records retained for 7 years (legal and tax compliance)

Anonymized Data:

Aggregated, anonymized analytics data may be retained indefinitely for service improvement
Anonymized data cannot be linked back to individual users or customers

Legal Holds:

Data may be retained longer if required by law, legal process, or regulatory investigation
We will notify you if legal holds affect your data retention

Data Deletion Rights

You have the right to request deletion of your personal data at any time:

Customers: Can delete their entire workspace and all associated data through the platform End Users: Can request deletion by contacting the business that uses GenuDo or by contacting us at [email protected] Data Subjects in Saudi Arabia/UAE/Egypt/EU: Have enhanced deletion rights under local data protection laws

Upon verified deletion request, we will:

Delete data from production systems within 30 days
Delete data from backup systems within 90 days
Provide confirmation of deletion upon request
Retain only data required by law or for legal proceedings

YOUR DATA PROTECTION RIGHTS

GenuDo respects your rights regarding your personal data. The specific rights available to you depend on your location and applicable data protection laws.

Universal Rights (Available to All Users)

1. Right to Access

You can request a copy of the personal data we hold about you
We will provide this information in a commonly used electronic format
First access request provided free of charge

2. Right to Rectification

You can request correction of inaccurate or incomplete personal data
We will update information promptly upon verification

3. Right to Deletion ("Right to be Forgotten")

You can request deletion of your personal data
Subject to legal retention requirements and legitimate business needs

4. Right to Object

You can object to processing based on legitimate interests
You can opt out of marketing communications at any time

5. Right to Data Portability

You can receive your data in a structured, machine-readable format
You can request transfer of data to another service provider where technically feasible

Additional Rights for GDPR (EU) Data Subjects

6. Right to Restriction of Processing

Request temporary suspension of data processing in certain circumstances

7. Right to Withdraw Consent

Withdraw consent at any time where processing is based on consent

8. Right to Lodge a Complaint

File a complaint with your local data protection authority

9. Rights Related to Automated Decision-Making

Object to decisions based solely on automated processing (including profiling)

Additional Rights for Saudi Arabia Data Subjects (PDPL)

10. Right to Know Processing Purposes

Request detailed information about why and how your data is processed

11. Right to Transparency

Receive clear information about data processing in Arabic language

12. Right to Stop Processing

Request cessation of processing in certain circumstances

13. Right to Limit Use

Request restrictions on how your data is used

14. Right to Complain to SDAIA

File complaints with Saudi Data & Artificial Intelligence Authority

Additional Rights for UAE Data Subjects

15. Right to Object to Direct Marketing

Opt out of marketing communications immediately

16. Right to Complain to UAE Data Office

File complaints with the UAE Data Office

Additional Rights for Egypt Data Subjects

17. Right to Complain to PDPC

File complaints with Egyptian Data Protection Center

18. Right to Detailed Processing Information

Request comprehensive information about data processing activities

How to Exercise Your Rights

To exercise any of these rights, please contact us at:

Email: [email protected]

Subject Line: "Data Subject Request - [Your Right]"

Include:

Your full name and contact information
Description of your request
Account information (if applicable)
Verification documents (if necessary)

Response Timeline:

We will acknowledge your request within 3 business days
We will respond substantively within 30 days (GDPR, UAE, Egypt)
For Saudi Arabia requests: We will respond within 30 days as required by PDPL
Complex requests may require additional time (up to 60 days), with notification

Verification: We may request additional information to verify your identity before processing requests, particularly for deletion, access, or data portability requests.

Free of Charge: We provide responses to data subject requests free of charge. For manifestly unfounded or excessive requests (particularly repetitive requests), we may charge a reasonable fee or refuse the request.

CONSENT MANAGEMENT

Obtaining Consent

For Saudi Arabia (PDPL - Consent-First Model): Explicit, informed consent is required for all personal data processing unless an exception applies. Consent must be:

Clear and specific for each processing purpose
Freely given without coercion
Informed with full transparency about data use
Unambiguous through affirmative action
Documented with records maintained

Sensitive Data (Health, Biometric, Religious, etc.):

Written consent required for processing sensitive personal data
Additional safeguards and security measures applied
Limited access on need-to-know basis

For Egypt (Explicit Consent Model):

Explicit consent required for all personal data processing
Written consent required for sensitive data
Separate consent required for electronic marketing

For UAE: Consent required for processing, with certain exceptions such as contract performance, legal obligations, and legitimate interests (though consent is preferred).

For GDPR (EU): Consent must meet GDPR standards of being freely given, specific, informed, and unambiguous, with easy withdrawal mechanisms.

How We Obtain Consent

We obtain consent through:

Clear consent checkboxes during account creation (not pre-checked)
Explicit opt-in for marketing communications
Separate consent requests for different processing purposes
Clear privacy notices at the point of data collection
Consent management interfaces within customer accounts

Withdrawing Consent

You can withdraw consent at any time by:

Using account settings and preference centers
Clicking "unsubscribe" in marketing emails
Contacting [email protected]
Submitting a data subject request

Important: Withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal. Some processing may continue on other legal bases (e.g., contract performance).

Third-Party Consents

Customers using GenuDo are responsible for:

Obtaining necessary consents from end users before collecting their data through AI agents
Providing clear privacy notices to end users
Maintaining records of consent
Honoring end-user data protection rights
Complying with communication channel requirements (WhatsApp Business Policy, etc.)

CHILDREN'S PRIVACY

GenuDo's services are not intended for children under the age of 18 (or the minimum age for consent in their jurisdiction).

We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child without appropriate parental or guardian consent, we will take steps to delete such information promptly.

For parents or guardians: If you believe that your child has provided personal information to GenuDo, please contact us immediately at [email protected] so we can delete the information.

COOKIES AND TRACKING TECHNOLOGIES

What Are Cookies?

Cookies are small text files stored on your device when you visit our website. We use cookies and similar tracking technologies to enhance your experience, analyze usage, and provide personalized content.

Types of Cookies We Use

1. Essential Cookies (Strictly Necessary)

Required for platform functionality and security
Enable account authentication and session management
Cannot be disabled without affecting platform performance

2. Performance and Analytics Cookies

Help us understand how users interact with our platform
Provide aggregate statistics on usage patterns
Enable us to improve features and user experience
Used only with your consent (except in regions where anonymized analytics are permitted)

3. Functional Cookies

Remember your preferences and settings
Provide personalized features
Enhance user experience

4. Marketing Cookies (Only with Explicit Consent)

Track effectiveness of marketing campaigns
Provide relevant content and advertisements
Third-party marketing platforms (used only with consent)

Cookie Consent (MENA-Specific)

For Saudi Arabia, UAE, and Egypt: We obtain explicit consent before placing non-essential cookies on your device. You can manage your cookie preferences through our cookie banner and preference center.

For GDPR (EU): We comply with ePrivacy Directive and GDPR cookie consent requirements.

Managing Cookies

You can control cookies through:

Our cookie consent banner (displayed on first visit)
Cookie preference center in your account settings
Browser settings to block or delete cookies
Third-party opt-out tools for advertising cookies

Note: Disabling essential cookies may affect platform functionality.

Do Not Track

We honor Do Not Track (DNT) signals where technically feasible and legally required.

Full Cookie Policy: For detailed information about cookies, please see our Cookie Policy at: https://genudo.ai/legal/cookies

THIRD-PARTY SERVICES AND LINKS

Third-Party Communication Channels

GenuDo integrates with third-party communication platforms such as:

WhatsApp Business Platform
Facebook Messenger
Telegram
Gmail and Google Workspace
Instagram
Other messaging services

Important: These third-party services have their own privacy policies and data practices. We do not control how these platforms collect, use, or share data. We encourage you to review their privacy policies:

WhatsApp: https://www.whatsapp.com/legal/privacy-policy
Facebook/Meta: https://www.facebook.com/privacy/policy
Telegram: https://telegram.org/privacy
Google: https://policies.google.com/privacy

Use of Third-Party APIs

When you connect third-party communication channels:

You authorize data sharing with those platforms
You remain responsible for compliance with their terms of service
You must obtain appropriate user consents for data sharing
We act as a technical intermediary only

Links to External Websites

Our website and platform may contain links to third-party websites. We are not responsible for the privacy practices or content of external sites. Please review their privacy policies before providing personal information.

No Endorsement

GenuDo does not endorse third-party services, and we disclaim liability for their data practices, security, or service availability.

DATA PROTECTION IMPACT ASSESSMENTS (DPIA)

When DPIAs Are Required

Data Protection Impact Assessments are required for high-risk processing activities, particularly:

Saudi Arabia (PDPL):

Processing sensitive personal data on a large scale
Systematic monitoring of individuals
Processing that involves significant risk to data subjects
Use of new technologies or innovative processing methods

UAE:

High-risk processing activities as defined by UAE Data Office
Large-scale processing of sensitive data
Automated decision-making with significant effects

Egypt:

Processing likely to result in high risk to individuals
Large-scale processing of personal data
Systematic monitoring of publicly accessible areas

GDPR (EU):

Systematic and extensive profiling
Large-scale processing of special category data
Systematic monitoring of publicly accessible areas

Our DPIA Commitment

GenuDo:

Conducts DPIAs for high-risk processing activities
Reviews and updates DPIAs when processing operations change
Consults with relevant data protection authorities when required
Documents DPIA findings and mitigation measures
Makes DPIA results available to customers upon request (where relevant to their use of the service)

Customer Responsibilities

Customers using GenuDo for high-risk processing activities are responsible for:

Conducting their own DPIAs
Assessing risks specific to their use case
Implementing appropriate risk mitigation measures
Consulting with regulatory authorities if required
Maintaining DPIA documentation

We will cooperate with customers conducting DPIAs and provide necessary information about our platform and security measures.

INTERNATIONAL DATA TRANSFERS

Transfer Safeguards

When transferring personal data internationally, GenuDo implements appropriate safeguards including:

Standard Contractual Clauses (SCCs):

EU-approved SCCs for transfers from the EU/EEA
UAE-approved transfer mechanisms for transfers from the UAE
SDAIA-approved safeguards for transfers from Saudi Arabia

Adequacy Decisions:

We rely on adequacy decisions where available
Transfers to countries recognized as providing adequate protection

Additional Safeguards:

Technical measures: Encryption, pseudonymization, access controls
Organizational measures: Data protection policies, staff training, audit procedures
Contractual measures: Data processing agreements with all recipients

Explicit Consent:

We obtain explicit consent for transfers where required
Clear information provided about destination and risks

Specific Transfer Requirements

From Saudi Arabia:

Risk assessment conducted for all transfers
SDAIA approval obtained or appropriate safeguards implemented
Data localization requirements respected
Transfers limited to what is necessary for service provision

From UAE:

Transfers only to adequate countries or with approved safeguards
UAE Data Office notification where required
Standard Contractual Clauses implemented

From Egypt:

Egyptian Data Protection Center license obtained where required
Written consent for certain transfers
Strict limitations on international transfers

From EU:

Compliance with GDPR Chapter V requirements
EU Commission-approved transfer mechanisms
Supplementary measures implemented

Your Rights Regarding Transfers

You have the right to:

Be informed about international data transfers
Obtain information about transfer safeguards
Object to transfers in certain circumstances
Request copies of relevant transfer agreements (with confidential information redacted)

AUTOMATED DECISION-MAKING AND AI

Use of AI in Our Services

GenuDo uses artificial intelligence (AI) and machine learning (ML) technologies to:

Power conversational AI agents for customer engagement
Generate automated responses based on customer configurations
Route conversations and qualify leads
Provide recommendations and insights
Optimize conversation flows

No Solely Automated Decisions with Legal Effect

Important: We do not make solely automated decisions that produce legal effects or similarly significantly affect individuals, except where:

Necessary for contract performance
Authorized by applicable law
Based on your explicit consent

Your Rights Regarding AI

You have the right to:

Be informed about the use of AI in processing your data
Object to automated decision-making
Request human intervention in automated processes
Obtain explanations of automated decisions
Challenge automated decisions that affect you

AI Transparency

For customers using AI agents:

You control AI agent instructions and behaviors
You are responsible for monitoring AI agent outputs
You must ensure AI agents comply with applicable laws
You should implement human oversight where appropriate

For end users interacting with AI agents:

It should be clear when interacting with an AI agent (not a human)
AI agents should be configured to identify themselves
Human escalation should be available when needed

BUSINESS CUSTOMER RESPONSIBILITIES

Customers using GenuDo platform are data controllers for the personal data they process through our services. As a controller, you are responsible for:

Legal Compliance

Ensuring your use of GenuDo complies with all applicable data protection laws
Obtaining all necessary consents and authorizations from end users
Providing clear privacy notices to end users
Honoring end-user data protection rights
Conducting DPIAs where required
Obtaining necessary licenses or approvals from regulatory authorities

Data Quality and Accuracy

Ensuring personal data uploaded to GenuDo is accurate and lawfully obtained
Maintaining updated contact information
Correcting or deleting inaccurate information
Limiting data collection to what is necessary

Third-Party Communications

Complying with terms of service of communication channels (WhatsApp Business Policy, etc.)
Obtaining opt-in consent before sending marketing messages
Providing opt-out mechanisms in all automated communications
Respecting do-not-contact preferences
Complying with anti-spam and telecommunications regulations

AI Agent Configuration

Configuring AI agents responsibly and ethically
Monitoring AI agent conversations for inappropriate content
Implementing safeguards against harmful or discriminatory outputs
Not using AI agents for prohibited purposes (providing medical/legal advice without qualifications, impersonation, fraud, etc.)
Ensuring AI agents identify themselves as automated systems

End-User Rights

Responding to end-user data subject requests
Facilitating end-user rights (access, deletion, rectification, etc.)
Maintaining records of consent
Providing end-users with your privacy notice

GenuDo's Role: We act as a data processor providing the technical platform. We will assist you in meeting your obligations as a controller, including:

Providing data export and deletion tools
Assisting with data subject requests where technically feasible
Implementing appropriate technical and organizational measures
Notifying you of data breaches affecting your data
Providing documentation for DPIAs and audits

UPDATES TO THIS PRIVACY POLICY

Right to Modify

GenuDo reserves the right to update or modify this Privacy Policy at any time to reflect:

Changes in applicable laws and regulations
New features or services
Changes in data processing practices
Feedback from regulators or data protection authorities
Best practices and industry standards

Notification of Changes

Material Changes: For significant changes that affect your rights or how we process your data:

30 days' advance notice via email to your registered email address
Prominent notice on our website and platform
In-app notifications for active users
Option to review and accept updated policy

Non-Material Changes: For minor updates, clarifications, or administrative changes:

Updated policy posted on our website with "Last Updated" date
Notification via our changelog and release notes

For Saudi Arabia, UAE, and Egypt Users: We will comply with local notification requirements, which may include:

Obtaining fresh consent for material changes
Arabic language notifications where required
Regulatory authority notification where required

Your Options

If you do not agree with changes to this Privacy Policy:

You may terminate your account before changes take effect
You may object to changes and request data deletion
You may contact us to discuss concerns

Continued use of our services after the effective date of changes constitutes acceptance of the updated Privacy Policy.

Version History

We maintain a version history of this Privacy Policy available at: https://genudo.ai/legal/privacy-history

REGULATORY COMPLIANCE AND CERTIFICATIONS

GenuDo is committed to maintaining the highest standards of data protection and regulatory compliance.

Current Compliance Status

MENA Region:

✓ UAE Federal Data Protection Law (Federal Decree-Law No. 45 of 2021)
✓ Saudi Arabia Personal Data Protection Law (PDPL) - In progress for full compliance including data localization
✓ Egypt Data Protection Law (Law No. 151 of 2020)
✓ Bahrain Personal Data Protection Law (Law No. 30 of 2018)

International:

✓ European Union GDPR (General Data Protection Regulation)
◐ ISO 27001 Information Security Management (Certification in progress)
◐ SOC 2 Type II (Audit in progress)

Sector-Specific (Where Applicable):

Saudi Arabia Essential Cybersecurity Controls (ECC)
Saudi Arabia Cloud Cybersecurity Controls (CCC)
National Cybersecurity Authority (NCA) standards
Telecommunications regulatory requirements (CITC, TDRA, NTRA)

Ongoing Compliance Activities

Regular internal privacy audits
Third-party security assessments
Vulnerability scanning and penetration testing
Employee training and awareness programs
Incident response drills and tabletop exercises
Regulatory monitoring and legal updates
Data protection impact assessments
Privacy by design and by default implementation

Audit Rights

For Enterprise Customers: Upon reasonable notice and subject to confidentiality obligations, enterprise customers may audit or have a qualified third party audit our compliance with this Privacy Policy and applicable data protection agreements.

For Regulatory Authorities: We will cooperate fully with regulatory authorities in the UAE, Saudi Arabia, Egypt, and other jurisdictions, including:

Responding to information requests
Facilitating regulatory audits and inspections
Providing compliance documentation
Implementing corrective actions when required

JURISDICTION-SPECIFIC PROVISIONS

For Saudi Arabia Data Subjects

Language: This Privacy Policy is available in both English and Arabic. For Saudi Arabia users, the Arabic version shall prevail in case of any conflict.

SDAIA Contact: Saudi Data & Artificial Intelligence Authority - https://sdaia.gov.sa / +966-11-834-8888

Data Localization: Please see "Data Storage, Residency, and Cross-Border Transfers" section for important information about data localization requirements.

Representative: For matters related to PDPL, contact our Saudi Arabian representative at: [email protected]

For UAE Data Subjects

UAE Data Office Contact: https://www.tdra.gov.ae / [email protected]

Free Zone Regulations: If your business operates in DIFC or ADGM, additional data protection regulations may apply. Please contact us for specific guidance.

For Egypt Data Subjects

PDPC Contact: Egyptian Data Protection Center - https://www.dpa.gov.eg

Data Protection Supervisor: We have appointed a Data Protection Supervisor as required by Egyptian law.

For EU Data Subjects

EU Representative: For GDPR matters, contact our EU representative at: [email protected]

Lead Supervisory Authority: [To be determined based on primary EU establishment]

Right to Lodge Complaint: You may lodge a complaint with your local supervisory authority or the lead supervisory authority.

SPECIAL CATEGORIES OF PERSONAL DATA

Sensitive Personal Data

We generally do not process special categories of personal data (sensitive data) unless:

You explicitly provide such data in AI agent configurations or conversations
Processing is necessary for legal compliance
You have provided explicit consent

Sensitive data includes:

Racial or ethnic origin
Political opinions
Religious or philosophical beliefs
Trade union membership
Genetic data
Biometric data for identification purposes
Health data
Data concerning sex life or sexual orientation
Criminal convictions and offenses

Additional Protections for Sensitive Data

When sensitive data is processed:

Enhanced security measures applied
Stricter access controls and need-to-know basis
Additional consent requirements (written consent in some jurisdictions)
Mandatory DPIAs conducted
Limited retention periods
Special audit and monitoring procedures

Customer Responsibilities for Sensitive Data

If you configure AI agents to collect or process sensitive data:

Obtain explicit/written consent from data subjects
Implement additional security measures
Conduct DPIA before processing
Notify us that sensitive data will be processed
Comply with additional legal requirements in your jurisdiction
Consider whether less intrusive alternatives exist

CONTACT INFORMATION AND COMPLAINTS

Privacy Inquiries

For any questions about this Privacy Policy or our data practices:

Email: [email protected]

Data Protection Officer: [email protected]

General Inquiries: [email protected]

Website: https://genudo.ai

Data Subject Requests

To exercise your data protection rights:

Email: [email protected] with subject line "Data Subject Request"

Portal: https://genudo.ai/privacy/requests (coming soon)

Complaints and Concerns

If you have complaints or concerns about how we handle your personal data:

Step 1: Contact our Privacy Team at [email protected]

We will acknowledge your complaint within 3 business days
We will investigate and respond within 30 days

Step 2: If not satisfied, escalate to our Data Protection Officer at [email protected]

Step 3: Contact the relevant regulatory authority:

Saudi Arabia:

Saudi Data & Artificial Intelligence Authority (SDAIA)
Website: https://sdaia.gov.sa
Phone: +966-11-834-8888
Email: [email protected]

UAE:

UAE Data Office
Website: https://www.tdra.gov.ae
Email: [email protected]

Egypt:

Egyptian Data Protection Center (PDPC)
Website: https://www.dpa.gov.eg
Email: [email protected]

European Union:

Your local Data Protection Authority
List: https://edpb.europa.eu/about-edpb/board/members_en

Response Commitment:

We take all complaints seriously
We will investigate thoroughly and impartially
We will implement corrective actions where appropriate
We will notify you of investigation outcomes

DEFINITIONS

For purposes of this Privacy Policy:

"Personal Data" means any information relating to an identified or identifiable natural person, as defined under applicable data protection laws.

"Sensitive Personal Data" means special categories of personal data requiring enhanced protection, including health data, biometric data, religious beliefs, etc.

"Processing" means any operation performed on personal data, including collection, storage, use, disclosure, deletion, etc.

"Controller" means the entity that determines the purposes and means of processing personal data.

"Processor" means an entity that processes personal data on behalf of a controller.

"Data Subject" means an identified or identifiable natural person whose personal data is processed.

"Consent" means freely given, specific, informed, and unambiguous indication of agreement to processing of personal data.

"Data Breach" means unauthorized access, disclosure, alteration, or destruction of personal data.

ACKNOWLEDGMENT AND ACCEPTANCE

BY USING GENUDO'S SERVICES, YOU ACKNOWLEDGE THAT:

You have read and understood this Privacy Policy
You consent to the collection, use, and processing of your personal data as described
You understand your rights and how to exercise them
You accept the terms of this Privacy Policy

FOR BUSINESS CUSTOMERS:

By creating a GenuDo account, you represent and warrant that:

You have authority to bind your organization to this Privacy Policy
You will comply with all applicable data protection laws
You will obtain necessary consents from end users
You will fulfill your obligations as a data controller

EFFECTIVE DATE

This Privacy Policy is effective as of [Date] and was last updated on [Date].

Version: 1.0

END OF PRIVACY POLICY

ADDITIONAL RESOURCES

Related Legal Documents:

Terms of Service: https://genudo.ai/legal/terms
Data Processing Agreement: https://genudo.ai/legal/dpa
Cookie Policy: https://genudo.ai/legal/cookies
Sub-Processors List: https://genudo.ai/legal/subprocessors
Security Documentation: https://genudo.ai/security

Helpful Resources:

Privacy FAQs: https://genudo.ai/privacy/faq
Data Subject Request Form: https://genudo.ai/privacy/requests
Security Whitepaper: https://genudo.ai/security/whitepaper
Compliance Certifications: https://genudo.ai/compliance

For Media and Press:

Press Kit: https://genudo.ai/press
Media Contact: [email protected]