Privacy Policy

Planaletix Management Consultancies · Dubai, United Arab Emirates

Version 2.0 · Effective 13-Aug-2026 · Replaces the version published prior to August 2026

1. Who we are

Planaletix Management Consultancies ("Planaletix", "we", "us") is a management consultancy registered in Dubai, United Arab Emirates, with its registered office at SAHA Offices C202, Palace Downtown, PO Box 282615, Dubai, UAE.

We are the controller of the personal data described in this policy. For personal data contained in documents that clients upload to our platforms, we act as a processor on the client's instructions under the terms of the relevant engagement.

This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights available to you.

2. What this policy covers

This policy applies to planaletix.com, plxdocs.planaletix.com, the online assessments we publish, and personal data we process in the course of our consulting engagements and business operations.

We do not collect genetic information, laboratory or diagnostic test results, biometric data, or health data of any kind. A previous version of this policy described such processing in connection with a product that is no longer part of our portfolio. That description was withdrawn in August 2026 and does not reflect any current or planned activity.

3. What we collect

We collect the following categories, grouped by how they reach us.

Website visitors. Server logs including IP address, browser type, pages viewed, referring page and timestamps. Search-performance data through Bing Webmaster Tools and Google Business Profile, which is aggregated and does not identify individuals.

Enquiries and prospective clients. Name, business email address, telephone number, employer, job title, and whatever you choose to tell us about your requirement, whether submitted through the website, sent to info@planaletix.com, booked through Cal.com, or given in a meeting.

Assessment participants. Where you complete one of our online readiness assessments, we collect your name, business email address, organisation and role, together with your responses to the assessment questions. Responses describe an organisation's capabilities and are not intended to contain personal data about individuals.

Clients and engagements. Contact details for the individuals we work with, correspondence, meeting notes, contractual documents, and the deliverables produced during the engagement.

PLXDocs users. Account details, and the documents you upload for processing. Those documents belong to you. We process them to provide the service and for no other purpose.

Billing. Where an engagement is paid by card, payment is processed by Stripe. We receive confirmation of payment and the associated invoice record. We do not receive or store full card numbers.

Suppliers and applicants. Contact and contractual details for suppliers, and the information contained in any application for a role with us.

4. Why we process it, and on what basis

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where it applies, the EU and UK General Data Protection Regulation, we rely on the following bases.

To respond to an enquiry and prepare a proposal — because it is necessary to take steps at your request before entering a contract.
To deliver an engagement, including operating PLXDocs and producing assessment reports — because it is necessary to perform our contract with you or your organisation.
To operate, secure and improve our website and platforms, to keep records of our business, and to understand how our content performs — because it is in our legitimate interests to run and protect the business, balanced against your interests and rights.
To send marketing communications to individuals who are not existing clients — on the basis of consent, which you may withdraw at any time.
To meet accounting, tax, licensing and other legal obligations in the UAE — because we are required to.

5. Automated processing and artificial intelligence

Some of our services use artificial intelligence. We think you are entitled to know exactly where, because we sell assessments of other organisations' data governance and it would be inconsistent to be vague about our own.

PLXDocs uses large language models to analyse, draft and check documents. Content you upload is transmitted to our model provider for processing and returned to the platform. The provider processes it to deliver the service.

Our online assessments score responses against a defined, weighted framework. Scoring is deterministic. Any narrative commentary generated alongside a score is reviewed before it forms part of a report delivered to a client.

We do not make decisions producing legal or similarly significant effects about individuals by automated means alone.

We do not use client documents, assessment responses or engagement material to train artificial-intelligence models, and we do not permit our providers to do so for their own purposes.

6. Who we share it with

We do not sell personal data. We share it only with service providers that help us operate, each bound by contract to process it solely on our instructions.

Anthropic — large language model processing for PLXDocs and internal tooling.
Supabase — application database and file storage, hosted in Frankfurt, Germany.
Vercel and Netlify — application and website hosting.
Cloudflare — network security and content delivery.
Stripe — payment processing.
Resend — transactional email.
HubSpot — customer relationship management.
Google Workspace — email, calendar and document storage.
Cal.com — meeting scheduling.
n8n — internal workflow automation.

We also share personal data with our professional advisers, and with regulators, courts or public authorities where we are required to by law.

7. International transfers

We are established in the UAE. Several of the providers listed above are established in the European Union, the United Kingdom or the United States, so personal data is transferred outside the UAE in the ordinary course of providing our services.

Where we transfer personal data internationally we rely on the mechanisms permitted under Article 22 and Article 23 of the UAE Personal Data Protection Law, including transfers to jurisdictions recognised as providing an adequate level of protection and, where no such recognition applies, contractual safeguards with the receiving party.

Our primary application database and document storage is located in Frankfurt, Germany.

8. How long we keep it

Enquiries that do not become engagements — 24 months from the last contact.
Client and engagement records, including contracts and deliverables — 7 years from the end of the engagement, to meet UAE commercial and tax record-keeping requirements.
Documents uploaded to PLXDocs — for the life of the account and 90 days thereafter, unless you delete them sooner. You can delete them at any time.
Assessment responses and reports — 36 months, so that a repeat assessment can be compared against the earlier baseline.
Website server logs — 12 months.
Marketing contacts — until consent is withdrawn, and reviewed every 24 months.

Where a longer period is required by law, or a record is relevant to an actual or anticipated dispute, we keep it for as long as necessary and no longer.

9. Your rights

Subject to the conditions and exemptions in the applicable law, you have the right to be told what personal data we hold about you and to receive a copy of it; to have inaccurate data corrected; to have data erased where we no longer have a basis to hold it; to restrict or object to processing, including objecting to direct marketing at any time; to receive data you gave us in a portable format; and to withdraw consent where consent is the basis on which we process.

To exercise any of these rights, write to info@planaletix.com. We will respond within 30 days. We may ask you to verify your identity before we act, so that we do not disclose your data to someone else.

If you are not satisfied with how we have handled your request, you may complain to the UAE Data Office, or to the supervisory authority in your country of residence where one has jurisdiction.

10. How we protect it

Access to client data is restricted to the individuals who need it to deliver the engagement. Credentials are held in managed credential storage and are not shared. Our platforms are encrypted in transit and at rest by the underlying providers. Application and database infrastructure is operated by established providers with their own security programmes.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the relevant authority and, where the law requires it, you.

11. Cookies

We use cookies that are necessary for the website and platforms to function, including session and authentication cookies. We use aggregated search-performance reporting through Bing Webmaster Tools and Google Business Profile, which does not identify individual visitors.

You can block or delete cookies through your browser settings. Blocking essential cookies will prevent parts of our platforms from working.

12. Children

Our services are for organisations and the people who work in them. They are not directed at children, and we do not knowingly collect personal data from anyone under 18.

13. Changes to this policy

We will update this policy when our processing changes. The date of the current version appears at the top. Where a change materially affects how we handle your personal data, we will take reasonable steps to tell you.

14. Contact

Questions about this policy, or about how we handle personal data, should go to info@planaletix.com, or by post to Planaletix Management Consultancies, SAHA Offices C202, Palace Downtown, PO Box 282615, Dubai, United Arab Emirates.