Legal
Privacy Policy
What we collect when you apply or get in touch, why we have it, who else sees it, how long we keep it, and how to get it back or have it deleted.
Last updated 21 September 2026
1. Who we are
Bedayat Business Incubator LLC (“Bedayat”, “we”, “us”) is a business incubator registered on Dubai mainland in the United Arab Emirates, licensed by the Dubai Department of Economy and Tourism, with its registered office at SEE Institute, The Sustainable City, Dubai, United Arab Emirates.
We are the controller of the personal data described here: we decide why it is processed and how.
This policy is written to the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL). Because we accept applications from anywhere in the world, the EU and UK GDPR also applies where you are in those regions, and the extra rights it gives you are set out below.
Privacy contact: privacy@bedayat.ae
2. What we collect
Only what you give us, plus a little technical data that keeps the forms working. We do not currently use advertising trackers or behavioural analytics, and we do not build profiles of individual visitors. If we introduce analytics in future we will update this policy and ask for your consent before any tracking starts.
Living Lab application
Your name, role, phone number and email address; your start-up’s name, description, website and legal registration status; your product’s description, stage of development, features, the problem it addresses and its sustainability impact; the support you need during testing, what you expect to learn, your target customers, and whether you are on other programmes.
Climate Response Sprint 2026 application
Your start-up’s name, website, country and UAE presence; your name, role, email and phone number; your chosen priority theme, a description of your solution, the type and evidence of your market traction, its impact potential, your intended UAE pathway, and anything else you add.
This application also asks for a pitch deck and a short video about your start-up. Both are required, and for each you choose how to give it to us: upload the file, or paste a link to one you already host. If you upload, we store the file itself and its filename; if you paste a link, we store only the link and never fetch or copy what is behind it. Whatever is in those files — faces and voices in a video, commercial detail in a deck — is treated exactly like the rest of your application, and kept for no longer.
Uploaded files are held in private storage that is not reachable from the public internet and is not linked from anywhere on this site. Only the people assessing your application can open them. If you would rather keep control of the file, paste a link instead — you can revoke a link whenever you like, which is not something we can do on your behalf.
Government, Universities and Industries enquiries
Your organisation’s name and type; your name, role, email, phone number and country; what you want to achieve, your timeline, and anything else you add.
General enquiries and the newsletter
For an enquiry: your name, email address and your question. For the newsletter: your email address, and nothing else.
Collected automatically
- Your IP address, recorded with each submission. We use it to rate-limit the forms and investigate abuse, and for nothing else. It is never used to identify or follow you around the site.
- An anti-bot check. Before a form can be submitted, your browser solves a small computational puzzle we issue. It runs entirely between your browser and our server, sets no cookie, and tells us nothing about you — only that real work was done, which is what makes bulk automated submissions expensive.
What we deliberately do not collect
We never ask for government ID, passport or Emirates ID numbers, financial or payment details, health data or biometric data — none of the “sensitive personal data” under Article 1 PDPL or “special category data” under Article 9 GDPR. Please do not put any of it in a free-text box. We do not knowingly collect data from anyone under 18.
3. Why we process it, and our legal basis
| Purpose | Legal basis (PDPL) | Legal basis (GDPR) |
|---|---|---|
| Assessing and answering your application or enquiry | Steps taken at your request before an agreement | Art. 6(1)(b) |
| Contacting you about it | Your consent, given at submission | Art. 6(1)(b) / 6(1)(a) |
| Sending programme news, if you asked for it | Your consent, withdrawable at any time | Art. 6(1)(a) |
| Stopping spam, fraud and abuse of our forms | Our legitimate interest in protecting the service | Art. 6(1)(f) |
| Research and measuring our impact (see §4) | Our legitimate interest in understanding the ecosystem | Art. 6(1)(f), with Art. 89 safeguards |
| Meeting legal, audit or regulatory duties | Compliance with a legal obligation | Art. 6(1)(c) |
Where we rely on your consent you can withdraw it whenever you like; that does not undo processing already done. Where we rely on legitimate interests you can object, and we will stop unless we have compelling grounds that override your rights.
4. Research
We study what we learn from applications to understand the sustainability start-up ecosystem and to report on our own impact — how many ventures work in which sectors, what stage they reach, what support they need.
This work is quantitative and anonymous. Before anything is used for research it is aggregated into counts and statistics, with names, contact details and other identifying information removed. We do not produce research that identifies an individual applicant or venture. If we ever wanted to feature you by name, we would ask you first — see our Terms & Conditions.
5. Who else sees it
We do not sell personal data, and we never share it for anyone else’s marketing. We share it with:
- The partner delivering the programme you applied to, so we can evaluate your application together. Which partner depends on the programme and is named on that programme’s page. For the Climate Response Sprint 2026 they are the UAE Ministry of Climate Change and Environment (MOCCAE) and the SEE Institute.
- Our service providers (§6), who act only on our written instructions.
- Authorities, where the law requires it.
Investors are not on that list. We may introduce you to investors, but only with your agreement, and what you share with them after that is between you and them.
6. Our service providers
| Provider | What they do | Where |
|---|---|---|
| Microsoft Azure | Hosts the website and the database | UAE North (Dubai) |
| Microsoft 365 / Graph | Sends our team the alert for each submission | Microsoft data centres |
| The map on our contact section and footer | Global network |
About the map. Our contact section and footer embed a Google Maps frame. When it loads, Google receives your IP address and may set cookies under its own policy, which we do not control. See Google’s privacy policy.
7. Sending data outside the UAE
We accept applications from anywhere, so we receive personal data from many countries, and some providers above process it outside the UAE.
Under Articles 22 and 23 PDPL we transfer personal data abroad only to a country with an adequate level of protection, or under contractual safeguards binding the recipient to equivalent standards. For data coming from the EEA or the UK, the UAE has no EU adequacy decision, so those transfers rely on the Standard Contractual Clauses (with the UK Addendum where relevant) together with a transfer risk assessment.
8. Your rights
Under Articles 13 to 17 PDPL — and Articles 15 to 22 GDPR where it applies to you — you can:
- Be told how your data is processed. That is this document.
- Get a copy of the personal data we hold about you.
- Receive it in a portable form — structured, commonly used and machine-readable.
- Have inaccurate or incomplete data corrected.
- Have it deleted, subject to any legal duty to keep it.
- Restrict or object to processing, including anything we do on the basis of legitimate interests.
- Withdraw consent at any time, including for the newsletter.
Email privacy@bedayat.ae. We reply within 30 days — under GDPR, within one month, which we may extend by two further months for a complex request, telling you if we need to. We may ask you to confirm your identity first, so we do not hand your data to someone else. Exercising these rights is free.
If you are unhappy with how we handled it, tell us at privacy@bedayat.ae and we will look again. You can also complain to the UAE Data Office, the federal supervisory authority for the PDPL. It is still being stood up and its implementing regulations have not yet been issued, so in practice the Telecommunications and Digital Government Regulatory Authority (TDRA) is the working point of contact for federal data protection questions in the meantime. If you are in the EEA or the UK you can instead complain to your national supervisory authority or the UK Information Commissioner’s Office.
To leave the newsletter, use the unsubscribe link in any email we send, or the unsubscribe page.
9. How long we keep it
| What | How long |
|---|---|
| Accepted applicants — application and programme records | 2 years after the programme ends |
| Unsuccessful or withdrawn applications | 12 months from the decision |
| Uploaded pitch decks and videos | Deleted with the application they belong to |
| Applications we never reached a decision on | 12 months from when you sent them |
| General enquiries | 3 months from when you sent them |
| Newsletter | Until you unsubscribe, then removed within 30 days |
| IP addresses | 90 days, then cleared from the record |
These are enforced automatically. A job runs every night and removes whatever has passed its date — retention here does not depend on somebody remembering.
Two details worth stating plainly. An IP address is cleared from an application without deleting the application itself, because the address has a 90-day life and the application has a longer one. And an application nobody ever decided on is removed on the same 12-month clock as an unsuccessful one, rather than being kept indefinitely just because no decision was recorded.
10. Keeping it safe
Everything you submit travels over HTTPS. Only our server writes to the database — your browser never holds a key that could — and access is limited to authorised Bedayat staff. Every form is protected by a proof-of-work check and rate limiting, both of which run on our own infrastructure.
No system is perfectly secure. If a breach is likely to prejudice your privacy or confidentiality we will tell the UAE Data Office and, where required, you, without undue delay, as Article 9 PDPL requires. Where GDPR applies we will notify the relevant supervisory authority within 72 hours, and you without undue delay where the risk to you is high.
11. Cookies
We do not currently set cookies for analytics, advertising or tracking. Our fonts are served from our own servers rather than a third party. The only third-party content that may set a cookie in your browser is the embedded Google Map described in §6.
Should we add analytics or anything similar, we will ask for your consent before it runs and update this section to say what it does.
12. Changes to this policy
We may update this policy. We will change the “last updated” date at the top and, where a change is significant, tell you directly.
13. How to reach us
Bedayat Business Incubator LLC
SEE Institute, The Sustainable City, Dubai, United Arab Emirates
Privacy: privacy@bedayat.ae
General: info@bedayat.ae
Phone: +971 54 584 2484