Shared Website Privacy Notice
Company and scope
Enigma Labs Technology Limited (DIFC) is the controller for the shared website before a region is chosen. Address: IH-00-01-01-OF-01, Level 1, Innovation One, Dubai International Financial Centre, Dubai, United Arab Emirates. DIFC licence CL13349. Privacy: privacy@getenigmalabs.com. Support: support@getenigmalabs.com. General enquiries: hello@getenigmalabs.com.
Regional business enquiries have their own notices: EU, Middle East and Asia, and Americas. Visiting the selector does not itself enrol you in marketing or create a customer enquiry.
Information and purposes
We process request/network information to deliver and secure the site, a country signal from our hosting service to suggest a region, and privacy-choice information to remember your choices. A country suggestion applies only before you select a regional URL. We do not use a region-preference cookie, browser time-zone collection or external IP lookup for routing.
We rely on our legitimate interests in delivering and securing the website, providing a useful regional suggestion and remembering your privacy choices. We keep evidence needed to meet our data-protection obligations.
Recipients and international processing
We use providers of cloud hosting, website security and privacy-preference services. Our privacy-preference service uses self-hosted c15t software on Vercel in the United States. The regional notices explain the separate customer-management, email, helpdesk and AI services used for business enquiries.
The United States is not recognised as adequate under the DIFC Data Protection Regulations (other than California). For the hosting and consent-service processing there we rely on standard contractual clauses providing appropriate safeguards under DIFC Data Protection Law Article 27(1)(a) with our providers. You can obtain a copy, with commercial details removed, from privacy@getenigmalabs.com.
Retention
Browser-storage durations are listed below. The server-side periods in this paragraph apply to active records; residual backups follow the separate limit below. Routine website access, delivery and security logs are retained for up to 6 months from collection, and less if no longer needed or an earlier deletion duty applies. Necessary incident or dispute evidence is retained separately for that purpose and the applicable period. Minimal consent evidence is retained while we rely on the consent, then for up to 36 months after we last rely on it. Minimal privacy-request records are retained while handling the request, then for up to 36 months after closure. Both are deleted sooner if no longer needed or an earlier deletion duty applies. Only necessary evidence is kept separately for a legal obligation or specific claim. Minimal records of refusals and withdrawals remain for as long as needed to respect those choices.
Routine backup copies are retained for up to 12 months from each copy’s creation, shorter when no longer needed or an earlier legal or contractual deletion duty applies. Deleted records stay outside normal use until the backup copy expires.
Browser choices
Choices use the enigma-consent-{entity}-{policyVersion} cookie and corresponding local storage, separately for each company and policy version. The cookie lasts 365 days from creation or update unless cleared earlier; local storage remains until cleared or replaced. Local storage also holds the latest undelivered choice in a company/version-scoped pending entry until successful delivery, replacement by a newer choice or clearing. The consent service address is included in that entry’s name. The c15t-storage-test-key entry checks storage availability and is removed immediately after the check.
Use privacy settings to change choices. Clearing cookies and local storage removes the local records; it does not itself delete records already sent to our servers. Contact privacy@getenigmalabs.com for privacy requests. Choices are not copied between companies or policy versions.
The shared site before regional selection does not load chat, advertising or analytics scripts. Optional Intercom chat is available on regional pages after a separate functionality choice for the relevant company; the regional privacy and cookie notices describe it.
Applicable law and rights
DIFC Data Protection Law No. 5 of 2020, as amended, and applicable DIFC Data Protection Regulations apply within their scope. DIFC transfer requirements and other mandatory territorial laws remain applicable.
You may request access to your personal information, correction, deletion or restriction, and portability where the legal conditions apply. You may object to processing based on legitimate interests and may object to direct marketing at any time. You may withdraw consent without affecting processing that was lawful before withdrawal.
Email privacy@getenigmalabs.com or write to the company address above, marked “Privacy”. Identify the company concerned. We may request proportionate information to verify your identity or a representative’s authority. We will respond within the applicable legal deadline and explain any refusal. Choosing a region does not remove mandatory rights.
You may complain to the DIFC Commissioner of Data Protection and exercise available court remedies. You have applicable rights against discriminatory treatment for exercising privacy rights and to challenge and obtain manual review of qualifying automated decisions.
Changes and regional notices
We publish revisions here and update the effective date. We notify you of material changes through a prominent website notice or direct communication, as required by law.
This shared notice does not replace a regional business notice, signed agreement or historical responsibility. The legal directory contains regional and archived documents.