Privacy Notice

The Risk Labs (“we”, “our”, “us”) is a cybersecurity and AI assurance consulting firm headquartered in Abu Dhabi, United Arab Emirates. This Privacy Notice explains how we collect, use, and protect personal information gathered through our website, therisklabs.com, and in connection with our consulting engagements.

What information we collect

We collect information you provide directly to us via our contact form — full name, work email, organization, country, enquiry type, and the content of your message. Where an engagement proceeds, we collect additional information necessary to deliver the agreed scope of work, as set out in the governing engagement contract. We also collect limited technical information through standard web analytics, including IP address, browser type, pages visited, and referring site.

How we use your information

We use the information you provide to respond to your enquiry, scope and deliver services you have engaged us for, maintain the security and integrity of our systems, and — where you have consented — send occasional updates about our work, research, and regulatory developments relevant to your sector. We do not sell, rent, or trade your personal information to third parties.

Lawful basis for processing (GDPR)

Where the EU General Data Protection Regulation or the UK GDPR applies, we process personal data on the basis of your consent (for contact enquiries and marketing communications), contractual necessity (for engagement delivery), or our legitimate business interests (for service improvement, security monitoring, and fraud prevention).

Data retention

We retain enquiry and engagement data for as long as necessary to fulfil the purposes described in this notice, to comply with our legal and regulatory obligations (including those arising from financial, audit, and professional services record-keeping requirements), and to resolve any disputes. Contact form enquiries that do not proceed to an engagement are retained for no longer than 24 months.

Data sharing

We do not sell personal data. We may share information with subcontractors and affiliate assessors engaged to deliver a specific scope of work, under written confidentiality and data protection obligations, and with regulators or certification bodies where disclosure is required as part of an engagement you have requested.

Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or restrict the processing of your personal data, and to object to processing carried out on the basis of legitimate interests. To exercise these rights, contact us at hello@therisklabs.com. We will respond within the timeframe required by applicable law.

Security

We maintain technical and organizational measures appropriate to the sensitivity of the data we hold, consistent with the standards we advise our own clients to adopt, including access controls, encryption of data in transit, and periodic review of our own control environment.

Contact

For privacy-related questions or to exercise your data protection rights, email hello@therisklabs.com.

Last updated: October 2026