Legal
Privacy Policy
What we collect when you apply or get in touch, why we have it, who else sees it, how long we keep it, and how to get it back or have it deleted.
Last updated 18 September 2026
This document is in final review. Our registered company details are being confirmed against the trade licence, and are marked below wherever they appear. Everything else here is current and describes what we actually do with your information. Questions in the meantime: privacy@bedayat.ae.
1. Who we are
[Registered legal name — to be confirmed] (“Bedayat”, “we”, “us”) is a business incubator registered in the United Arab Emirates under licence number [Licence number — to be confirmed], with its registered office at [Registered address — to be confirmed]. We operate from The Sustainable City, Dubai, United Arab Emirates.
We are the controller of the personal data described here: we decide why it is processed and how.
This policy is written to the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL). Because we accept applications from anywhere in the world, the EU and UK GDPR also applies where you are in those regions, and the extra rights it gives you are set out below.
Privacy contact: privacy@bedayat.ae
2. What we collect
Only what you give us, plus a little technical data that keeps the forms working. We run no advertising trackers, no behavioural analytics and no profiling of any kind.
Living Lab application
Your name, role, phone number and email address; your start-up’s name, description, website and legal registration status; your product’s description, stage of development, features, the problem it addresses and its sustainability impact; the support you need during testing, what you expect to learn, your target customers, and whether you are on other programmes.
Climate Response Sprint 2026 application
Your start-up’s name, website, country and UAE presence; your name, role, email and phone number; your chosen priority theme, a description of your solution, the type and evidence of your market traction, its impact potential, your intended UAE pathway, and anything else you add.
Government, Universities and Industries enquiries
Your organisation’s name and type; your name, role, email, phone number and country; what you want to achieve, your timeline, and anything else you add.
General enquiries and the newsletter
For an enquiry: your name, email address and your question. For the newsletter: your email address, and nothing else.
Collected automatically
- Your IP address, recorded with each submission. We use it to rate-limit the forms and investigate abuse, and for nothing else. It is never used to identify or follow you around the site.
- An anti-bot token from Cloudflare Turnstile, which tells us a submission came from a person rather than a script.
What we deliberately do not collect
We never ask for government ID, passport or Emirates ID numbers, financial or payment details, health data or biometric data — none of the “sensitive personal data” under Article 1 PDPL or “special category data” under Article 9 GDPR. Please do not put any of it in a free-text box. We do not knowingly collect data from anyone under 18.
3. Why we process it, and our legal basis
| Purpose | Legal basis (PDPL) | Legal basis (GDPR) |
|---|---|---|
| Assessing and answering your application or enquiry | Steps taken at your request before an agreement | Art. 6(1)(b) |
| Contacting you about it | Your consent, given at submission | Art. 6(1)(b) / 6(1)(a) |
| Sending programme news, if you asked for it | Your consent, withdrawable at any time | Art. 6(1)(a) |
| Stopping spam, fraud and abuse of our forms | Our legitimate interest in protecting the service | Art. 6(1)(f) |
| Research and measuring our impact (see §4) | Our legitimate interest in understanding the ecosystem | Art. 6(1)(f), with Art. 89 safeguards |
| Meeting legal, audit or regulatory duties | Compliance with a legal obligation | Art. 6(1)(c) |
Where we rely on your consent you can withdraw it whenever you like; that does not undo processing already done. Where we rely on legitimate interests you can object, and we will stop unless we have compelling grounds that override your rights.
4. Research
We study what we learn from applications to understand the sustainability start-up ecosystem and to report on our own impact — how many ventures work in which sectors, what stage they reach, what support they need.
This work is quantitative and anonymous. Before anything is used for research it is aggregated into counts and statistics, with names, contact details and other identifying information removed. We do not produce research that identifies an individual applicant or venture. If we ever wanted to feature you by name, we would ask you first — see our Terms & Conditions.
5. Who else sees it
We do not sell personal data, and we never share it for anyone else’s marketing. We share it with:
- The partner delivering the programme you applied to, so we can evaluate your application together. Which partner depends on the programme and is named on that programme’s page. For the Climate Response Sprint 2026 they are the UAE Ministry of Climate Change and Environment (MOCCAE) and the SEE Institute.
- Our service providers (§6), who act only on our written instructions.
- Authorities, where the law requires it.
Investors are not on that list. We may introduce you to investors, but only with your agreement, and what you share with them after that is between you and them.
6. Our service providers
| Provider | What they do | Where |
|---|---|---|
| Microsoft Azure | Hosts the website and the database | UAE North (Dubai) |
| Microsoft 365 / Graph | Sends our team the alert for each submission | Microsoft data centres |
| Cloudflare | Turnstile anti-bot check on the forms | Global network |
| The map on our contact section and footer | Global network |
About the map. Our contact section and footer embed a Google Maps frame. When it loads, Google receives your IP address and may set cookies under its own policy, which we do not control. See Google’s privacy policy.
7. Sending data outside the UAE
We accept applications from anywhere, so we receive personal data from many countries, and some providers above process it outside the UAE.
Under Articles 22 and 23 PDPL we transfer personal data abroad only to a country with an adequate level of protection, or under contractual safeguards binding the recipient to equivalent standards. For data coming from the EEA or the UK, the UAE has no EU adequacy decision, so those transfers rely on the Standard Contractual Clauses (with the UK Addendum where relevant) together with a transfer risk assessment.
8. Your rights
Under Articles 13 to 17 PDPL — and Articles 15 to 22 GDPR where it applies to you — you can:
- Be told how your data is processed. That is this document.
- Get a copy of the personal data we hold about you.
- Receive it in a portable form — structured, commonly used and machine-readable.
- Have inaccurate or incomplete data corrected.
- Have it deleted, subject to any legal duty to keep it.
- Restrict or object to processing, including anything we do on the basis of legitimate interests.
- Withdraw consent at any time, including for the newsletter.
Email privacy@bedayat.ae. We reply within 30 days — under GDPR, within one month, which we may extend by two further months for a complex request, telling you if we need to. We may ask you to confirm your identity first, so we do not hand your data to someone else. Exercising these rights is free.
If you are unhappy with how we handled it, tell us at privacy@bedayat.ae and we will look again. You can also complain to the UAE Data Office, or — if you are in the EEA or the UK — to your national supervisory authority or the UK Information Commissioner’s Office.
To leave the newsletter, use the unsubscribe link in any email we send, or the unsubscribe page.
9. How long we keep it
| What | How long |
|---|---|
| Accepted applicants — application and programme records | 2 years after the programme ends |
| Unsuccessful or withdrawn applications | 12 months from the decision |
| Applications we never reached a decision on | 12 months from when you sent them |
| General enquiries | 3 months from when you sent them |
| Newsletter | Until you unsubscribe, then removed within 30 days |
| IP addresses | 90 days, then cleared from the record |
These are enforced automatically. A job runs every night and removes whatever has passed its date — retention here does not depend on somebody remembering.
Two details worth stating plainly. An IP address is cleared from an application without deleting the application itself, because the address has a 90-day life and the application has a longer one. And an application nobody ever decided on is removed on the same 12-month clock as an unsuccessful one, rather than being kept indefinitely just because no decision was recorded.
10. Keeping it safe
Everything you submit travels over HTTPS. Only our server writes to the database — your browser never holds a key that could — and access is limited to authorised Bedayat staff. Every form is protected by Cloudflare Turnstile and rate limiting.
No system is perfectly secure. If a breach is likely to prejudice your privacy or confidentiality we will tell the UAE Data Office and, where required, you, without undue delay, as Article 9 PDPL requires. Where GDPR applies we will notify the relevant supervisory authority within 72 hours, and you without undue delay where the risk to you is high.
11. Cookies
We set no cookies for analytics, advertising or tracking. Our fonts are served from our own servers rather than a third party. The only third-party content that may set a cookie in your browser is the embedded Google Map described in §6.
12. Changes to this policy
We may update this policy. We will change the “last updated” date at the top and, where a change is significant, tell you directly.
13. How to reach us
[Registered legal name — to be confirmed]
[Registered address — to be confirmed]
Privacy: privacy@bedayat.ae
General: info@bedayat.ae
Phone: +971 54 584 2484