Website Privacy Policy

1. INTRODUCTION

2.1 Important information and who we are

Welcome to Rayify Limited trading as Atenai's Privacy and Data Protection Policy ("Privacy Policy").

At Rayify Limited (company number 137399C), trading as Atenai ("we", "us", or "our"), we are committed to protecting and respecting your privacy and Personal Data in compliance with the Isle of Man Data Protection Act 2018 and, where applicable, the United Kingdom General Data Protection Regulation (UK GDPR).

This Privacy Policy explains how we collect, process and keep your data safe. It also tells you about your privacy rights, how the law protects you, and informs our employees and staff members of their obligations when handling data.

The individuals from whom we may gather and use data can include:

• Customers
• Suppliers
• Business contacts
• Any other people that the organisation has a relationship with or may need to contact

This Privacy Policy applies to all our employees and staff members and to all Personal Data processed at any time by us.

1.2 Your Data Controller

Rayify Limited (company number 137399C), trading as Atenai, is your Data Controller and responsible for your Personal Data.

Our registered business address is:
031203B, 22 Stanley Mount, Peel, IM5 1NE, Isle of Man.

We are not obliged by law to appoint a Data Protection Officer and have not voluntarily appointed one at this time. Any inquiries about your data should be sent to us:

• support@atenai.ai
• 031203B, 22 Stanley Mount, Peel, IM5 1NE, setIsle of Man

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). However, we would appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

1.3 Processing data on behalf of a Controller and processors' responsibility to you

In discharging our responsibilities as a Data Controller, we have employees and partners who may process your data on our behalf (known as "Processors"). The Data Controller and our Processors have the following responsibilities:

• Ensure that all processing of Personal Data is governed by one of the legal bases laid out in the GDPR (see 2.2 below);
• Ensure that Processors authorised to process Personal Data are bound by confidentiality obligations;
• Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk;
• Obtain prior authorisation before engaging another Processor;
• Assist in fulfilling obligations to respond to data subject rights requests;
• Maintain records of processing activities;
• Cooperate with supervisory authorities;
• Notify the Controller without undue delay of any Personal Data Breach.

2. LEGAL BASIS FOR DATA COLLECTION

2.1 Types of data / Privacy policy scope

We may collect, use, store and transfer different kinds of Personal Data about you, including:

• Profile/Identity Data – e.g. name, gender, date of birth
• Contact Data – e.g. phone numbers, addresses, email addresses

We also collect, use and share Aggregated Data (e.g. anonymised statistics about site visitors). Aggregated Data is not considered Personal Data in law as it does not directly identify you, unless combined with identifiable data.

We do not collect Special Category Data (e.g. race, religion, health data, biometric data) or information about criminal convictions and offences.

2.2 The Legal Basis for Collecting That Data

The main legal bases we rely on are:

• Consent – e.g. when you opt in to receive newsletters
• Contractual Obligations – e.g. to deliver a service you signed up for
• Legal Compliance – e.g. to prevent fraud or meet regulatory obligations
• Legitimate Interests – e.g. maintaining records of customers and suppliers where it does not override your rights

3. HOW WE USE YOUR PERSONAL DATA

We will only use your Personal Data when the law allows us to.

We will use it only for the purpose collected, unless reasonably necessary for another compatible purpose.

If we need to use it for an unrelated purpose, we will notify you and explain the legal basis.

We may process your Personal Data without your knowledge or consent, where required or permitted by law.

4. YOUR RIGHTS AND HOW YOU ARE PROTECTED BY US

You have the following rights under data protection law:

• Right to be informed
• Right of access
• Right to rectification
• Right to erasure
• Right to object
• Right to restrict processing
• Right to data portability

Requests to exercise these rights should be sent to: privacy@atenai.ai

How we protect your data

We apply robust technical and organisational measures, including:

• Data encryption (in transit and at rest)
• Access controls and least privilege policies
• Data minimisation
• Continuous security monitoring
• Employee training
• Incident response procedures

While no transmission of data over the internet is entirely secure, we strive to apply industry-standard protections at all times.

5. YOUR DATA AND THIRD PARTIES

We may share Personal Data with subcontractors, affiliates, or service providers under confidentiality obligations.

In the event of a change in control, sale, or acquisition of Rayify Limited, your data may be transferred, subject to this Privacy Policy.

We may also share data if legally required or to enforce our terms.

6. HOW LONG WE RETAIN YOUR DATA

We will retain Personal Data only for as long as necessary to fulfil the purposes collected. In some cases (e.g. disputes or regulatory obligations), retention may be longer.

7. INTERNATIONAL TRANSFER OF DATA

Your data may be stored or processed outside the Isle of Man, including in the UK or other jurisdictions where our service providers operate. In such cases, safeguards will be applied to ensure compliance with applicable law.

8. NOTIFICATION OF CHANGES AND ACCEPTANCE OF POLICY

We keep this Privacy Policy under review and will place updates here. This version is dated 21 September 2025.

By using Atenai services, you consent to the collection and use of data by us as set out in this Privacy Policy. Continued access or use of Atenai will constitute your express acceptance of any updates.

9. INTERPRETATION

All uses of "including" mean "including but not limited to".

Emails listed in this policy may only be used for their specified purpose.

Staff are not authorised to waive rights, contract, or bind Rayify Limited unless explicitly stated by our legal department.