Regional Privacy Addendum: UAE & Saudi Arabia

1. Purpose and Relationship to the Privacy Policy

This Regional Addendum supplements the Forward Labs, Inc. Website Privacy Policy and applies specifically to visitors located in the United Arab Emirates ("UAE") and the Kingdom of Saudi Arabia ("KSA"). Where this Addendum conflicts with the general Privacy Policy for these visitors, this Addendum controls.

2. Data Controller Identity

Forward Labs, Inc., a Delaware corporation, is the data controller for personal data collected through forwardlabsai.com. Contact: hello@forwardlabsai.com. A regional representative may be designated separately if required by the UAE Data Office or SDAIA as our presence in the region grows.

3. UAE: Federal Decree-Law No. 45 of 2021 (PDPL)

This notice is provided to you at or promptly after your first visit to the Site, consistent with PDPL transparency requirements.

• Legal bases for processing: your explicit consent, or performance of a contract, or our legitimate interest in operating and securing the Site.
• Your rights: access, rectification, erasure, restriction, objection to direct marketing/profiling, and data portability, exercisable via hello@forwardlabsai.com.
• Note: if you are located within the DIFC or ADGM free zones, a separate free-zone data protection regime (not the federal PDPL) may apply to you; we honor the higher standard where jurisdictions differ.
• Cross-border transfer: your data may be transferred to our teams in the United States and Türkiye. We rely on standard contractual clauses or your explicit consent as the transfer mechanism, consistent with PDPL Article 21 and its Executive Regulations.

4. Saudi Arabia: Personal Data Protection Law (PDPL, SDAIA)

This notice discloses, before or at the time of data collection: our identity, the purposes of processing, the legal basis, categories of data collected, recipients, cross-border transfer arrangements, retention periods, and your rights.

• Legal basis: consent is the default basis; we may also rely on legitimate interest or contractual necessity where permitted under the 2023 PDPL amendment.
• Your rights: access, correction, deletion, and data portability, exercisable via hello@forwardlabsai.com. We aim to respond within the timelines set by SDAIA's Implementing Regulations.
• Cross-border transfer: your data may be transferred to the United States and Türkiye. As SDAIA has not published an adequacy list, transfers rely on SDAIA-approved Standard Contractual Clauses. A copy is available on request.
• Registration: if our processing volume or activities trigger mandatory registration on SDAIA's National Data Governance Platform, we will complete and maintain that registration.

5. Sensitive Data

We do not knowingly collect sensitive personal data (health, biometric, religious, or similar special-category data) through the Site. If you submit such data through a contact or careers form, you consent to its processing solely for the purpose you submitted it.

6. Complaints

UAE visitors may lodge a complaint with the UAE Data Office. KSA visitors may lodge a complaint with SDAIA via its National Data Governance Platform. We ask that you contact us first at hello@forwardlabsai.com so we can address your concern directly.