Abgalis Limited, a UK private limited company registered in England and Wales. Registered office: Flat 2, 38 Harcourt Terrace, London SW10 9JR. Company registration number: 17247499. For all data protection enquiries: [email protected].
| Data Category | Lawful Basis (UK GDPR) | Purpose |
|---|---|---|
| Name, email, company, role (contact form) | Legitimate interests (Art. 6(1)(f)) | Responding to your enquiry; scheduling a consultation |
| IP address, browser type, pages visited | Legitimate interests | Website security, analytics, performance monitoring |
| Client portfolio/exposure data (platform users) | Contract performance (Art. 6(1)(b)) | Delivering the Abgalis platform service |
| Cookies and similar technologies | Consent (PECR Reg. 6) | See our Cookie Policy |
We process personal data to respond to enquiries, deliver platform services under contract, improve our platform through aggregated and anonymised analytics, comply with legal obligations, and communicate service updates. We do not sell personal data. We do not use personal data for automated decision-making that produces legal effects on individuals.
We share personal data only with cloud infrastructure providers (Microsoft Azure, with data processing agreements in place), professional advisers (legal, audit) under confidentiality obligations, and regulatory authorities where required by law. Where client data is processed through AI/ML models, outputs are analytical only and no personal data is used to train general-purpose models without explicit consent.
Abgalis Limited is a UK private limited company. Where personal data is transferred from the UK or EEA to the United States, we rely on the UK–US Data Bridge (extension of the EU–US Data Privacy Framework) or the ICO’s International Data Transfer Agreement (IDTA) where the Data Bridge does not apply. For transfers to other jurisdictions, we use appropriate safeguards under UK GDPR Article 46.
Contact form submissions: 24 months from last interaction. Platform client data: duration of service agreement plus 12 months. Website analytics: 26 months (aggregated). We delete or anonymise personal data when it is no longer necessary for the purposes for which it was collected.
Under UK GDPR and the Data (Use and Access) Act 2025 (DUA), you have the right to access your data, rectify inaccuracies, request erasure, restrict processing, data portability, and object to processing. To exercise any right, email [email protected]. We will respond within one calendar month. If you are dissatisfied with our response, you may lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides additional rights including the right to know, delete, correct, and opt out of the sale or sharing of personal information. Abgalis does not sell personal information. For Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), and other US state privacy law residents: equivalent rights apply. Contact [email protected] to exercise your rights.
If you are a Canadian resident, the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial legislation (including Quebec’s Law 25) provide you with the right to access, correct, and withdraw consent for processing of your personal information. Contact our privacy team for requests.
For residents of Australia, the Privacy Act 1988 and Australian Privacy Principles (APPs) apply. For Singapore, the Personal Data Protection Act 2012 (PDPA) applies. For India, the Digital Personal Data Protection Act 2023 (DPDPA) applies. For Japan, the Act on the Protection of Personal Information (APPI) applies. Contact [email protected] for jurisdiction-specific requests.
For residents of the UAE, the Federal Decree-Law No. 45/2021 on Personal Data Protection applies. For DIFC, the DIFC Data Protection Law (Law No. 5 of 2020) applies. For ADGM, the ADGM Data Protection Regulations 2021 apply. For Saudi Arabia, the Personal Data Protection Law (PDPL) applies. For Bahrain, the Personal Data Protection Law (Law 30 of 2018) applies.
Abgalis services are intended for business professionals. We do not knowingly collect personal data from individuals under 18 years of age. If you believe we have inadvertently collected such data, please contact us immediately.
We implement technical and organisational measures aligned to ISO 27001 and SOC 2 Type II standards, including encryption in transit (TLS 1.3) and at rest (AES-256), access controls, regular penetration testing, and incident response procedures.
We will update this policy as necessary. Material changes will be communicated via the website. The “Last updated” date above reflects the most recent revision.