This Privacy Policy explains how Assay handles personal data collected through the website assay.ae. Assay is a brand operated by SEEK AI AS (org.nr 936 860 060), Oslo, Norway, which is the data controller for the purposes of this policy and of the EU/EEA General Data Protection Regulation (GDPR).
Data controller: SEEK AI AS, org.nr 936 860 060, Oslo, Norway. Contact: hello@assay.ae.
We collect only what we need to operate the website and serve customers:
We do not knowingly collect data from children. See Cookies below for the cookies the site uses.
We use a small number of cookies. An essential sign-in cookie is set when you use the "My Kit" account portal; it keeps you signed in, and blocking it prevents sign-in. Google Ads conversion-measurement cookies are set when you arrive from one of our adverts, so we can measure which adverts lead to enquiries or purchases. We do not use any other tracking or analytics cookies. You can control or block cookies in your browser settings.
We use personal data to send you the Self-Assessment you requested; to notify you when a sector-specific kit becomes available, if you asked us to; to fulfil, support, and provide updates for kits you have purchased; to operate your "My Kit" account — letting you view your purchase, keep your firm profile up to date, re-generate your documents, and track your compliance calendar and obligations; to respond to your enquiries; to keep the website secure and functioning; and to comply with our legal and accounting obligations.
Where GDPR applies, we rely on: your consent, for the Self-Assessment and notify-me lists and for any optional updates or marketing, which you may withdraw at any time; the performance of a contract, to deliver and support a kit you bought and to operate your "My Kit" account; and our legitimate interests, to secure and operate the website and to communicate with people who have contacted us. Where you provide business-contact details for your firm's MLRO, compliance officer or senior approver so we can generate your kit, we process those details for our legitimate interest in producing and maintaining the kit you requested and administering the customer relationship. Where we are required to retain records for tax or accounting purposes, we rely on our legal obligation. Because we also process the personal data of individuals in the UAE, we comply with the UAE Personal Data Protection Law (PDPL) as well, applying the stricter requirement where the two regimes differ.
We do not sell personal data. We share it only with service providers that help us run the business, and only as far as they need it:
Because SEEK AI AS is established in Norway and our providers operate internationally, your data is processed and stored outside the UAE and, in some cases, outside the EEA (including in the United States). Where required, we put in place data-processing agreements, EU Standard Contractual Clauses and transfer-risk assessments, or equivalent safeguards, and we keep a documented assessment of each transfer.
We keep email-list data until you unsubscribe or ask us to delete it. If you have a "My Kit" account, we keep your firm profile for as long as your account is active, so you can update and re-generate your kit. Generated kit files (the downloadable .zip) are kept for 90 days after each generation and then deleted from our systems; you can always re-generate a fresh copy from your account. When you ask us to delete your data, we erase everything that identifies you from our systems — your firm profile, generated documents, your sign-in account, any marketing lists you're on, and any certificates issued to you. Our payment processor (Stripe), which handles your purchase as an independent controller, retains the transaction and invoice records it is legally required to keep; you can contact them to exercise your rights over that data. Deletion takes effect on our active systems immediately; any residual copies in routine backups expire on our normal backup cycle. We keep correspondence for as long as needed to handle your enquiry and any follow-up, and we do not keep personal data longer than necessary for the purposes above.
You have the right to access the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to its processing, and to receive it in a structured, commonly used, machine-readable format. If you have a "My Kit" account you can exercise several of these directly from the account: access and export your data (download a machine-readable copy of your account, orders and profile), correct it by editing your firm profile, and delete your data — your profile, generated files, account, marketing lists and any certificates — using "Delete my data" (Stripe retains the transaction records it is legally required to keep, as noted above). You can also exercise any right, or withdraw consent, by emailing hello@assay.ae. We respond within the time required by applicable law — under GDPR, within one month, extendable by up to two further months for complex or numerous requests. You also have the right to lodge a complaint with a supervisory authority — in the EEA, your local data-protection authority (for SEEK AI AS, the Norwegian Datatilsynet); in the UAE, the UAE Data Office.
We use reputable service providers and take reasonable technical and organisational measures to protect personal data, including encryption in transit, access controls and least-privilege practices. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal-data breach occurs, we will assess it promptly and notify the relevant authority where required by applicable law — under GDPR, without undue delay and, where feasible, within 72 hours of becoming aware of a notifiable breach. Where a breach is likely to result in a high risk to you, we will notify you without undue delay.
We may update this policy from time to time. The "last updated" date at the top shows when it last changed. Material changes will be reflected on this page.
For any privacy question or request, email hello@assay.ae.
Last updated 20 June 2026