TACANS Privacy Notice

1. Scope of this notice

Tacans Technologies Ltd (“TACANS”, “we”, “us”) is a cybersecurity company registered in the Dubai International Financial Centre (DIFC) under number 13214, with its office at Unit IH-00-01-02-OF-01, Level 02, Innovation One, DIFC, Dubai, United Arab Emirates. We run tacans.com (the “Site”) and the TACANS platform (the “Platform”), which uses autonomous AI agents to test the security of travel and fintech businesses.

For data about our website visitors, prospects, account users and business contacts, we decide how the data is used and are its controller. For personal data that our agents come across inside a customer’s systems during testing, we act only on that customer’s instructions, as their processor. Section 4 explains how that second category works.

Our primary framework is the DIFC Data Protection Law No. 5 of 2020, as amended (the “DIFC DPL”). Where the EU GDPR or UK GDPR applies to you, we meet its requirements as well.

2. Who to contact

For any privacy question, to exercise your rights, or to report a security concern, write to legal@tacans.com.

3. What we collect and where it comes from

Details you share with us

This includes your name, job title, company, work email, phone number and anything you write to us. We collect it when you request the free surface map or an assessment, register an account, meet us at an event, or message us through the Site or Platform. If you submit domains, hosts or endpoints for testing (“Targets”), we also keep that list together with the evidence you give us of ownership or authorization.

Technical and usage data

On the Site we record technical information such as your IP address, device, operating system and browser, the pages you open, the time of your visit, how you navigate, and cookie identifiers. On the Platform we keep account activity logs so that we can secure the service and keep an audit trail. Section 10 covers cookies.

Data from other sources

We may obtain business contact details from B2B data providers, professional networks such as LinkedIn, event organisers and our analytics providers.

4. Data inside customer systems during testing

To test a customer’s booking flows, payment rails, APIs or AI agents, our agents handle security data: findings, evidence, request and response samples, API specifications and endpoint inventories. Sometimes this contains personal data that the customer holds, such as traveller names, booking references or account identifiers.

We process this data as the customer’s processor, under the customer agreement and our Data Processing Agreement (“DPA”). In practice this means we:

• capture only the evidence needed to prove a finding;
• mask personal data in reports wherever we can;
• never use identifiable customer data to train AI models, and require the same of our AI providers;
• delete test evidence at the end of the retention period agreed with the customer.

If you are a customer of one of our clients and want to exercise your privacy rights, please contact that company directly. It controls your data, and we will help it respond.

5. Why we use personal data and our lawful grounds

Each use below is listed with the lawful ground we rely on under the DIFC DPL and, where it applies, the GDPR.

• Providing the Platform and your account (contract): setting up and managing accounts, delivering the free surface map, running agreed testing cycles, and producing findings, evidence and business-impact reports.
• Checking that testing is authorized (legitimate interests and legal obligation): verifying that you own each Target or have permission to test it.
• Support and service messages (contract): answering enquiries and tickets and sending service notices and security alerts.
• Improving our service (legitimate interests): analysing how the Site and Platform are used and improving our agents and attack libraries, using de-identified and aggregated data wherever possible.
• Marketing to business contacts (legitimate interests, or consent where the law requires it): telling you about our services and events.
• Protecting the Platform (legitimate interests): preventing misuse, fraud and attacks on us and our customers.
• Meeting legal duties (legal obligation): tax, accounting, sanctions and regulatory requirements.
• Newsletters and analytics cookies (consent): you can withdraw consent at any time.

We do not sell personal data. We do not make decisions that have legal or similarly significant effects on individuals based solely on automated processing.

6. Who receives personal data

Personal data is shared only with the following recipients.

• Sub-processors that host, operate or support the Platform, such as cloud hosting, AI model inference, analytics, email, CRM and payment providers. Each one is bound by a written data processing agreement. AI inference providers may not use our data to train their models or retain it beyond what is needed to return a result.
• Integrations you switch on, such as Jira, Linear or Slack. They receive only the findings you choose to send to them.
• Professional advisers, such as our lawyers, accountants, auditors and insurers.
• Authorities, regulators or law enforcement, but only where the law requires it.
• A buyer or successor, if TACANS is involved in a merger, acquisition or sale of assets.
• Other recipients you approve in advance.

A customer’s findings, vulnerability data and test results are never disclosed to anyone else unless the law requires it or the customer’s agreement allows it.

7. Where data is stored and transferred

The Platform runs on bare-metal infrastructure in Germany, and some sub-processors may operate elsewhere. Data may be transferred outside the DIFC, or outside the EEA or UK for data covered by the GDPR. When that happens, we rely on a destination recognised as adequate by the DIFC Commissioner of Data Protection, the European Commission or the UK government. Where no adequacy decision applies, we use the DIFC or EU Standard Contractual Clauses (with the UK addendum) or another lawful transfer mechanism. You can ask us for a copy of the relevant safeguards.

8. How we protect data and handle incidents

Our safeguards include encryption in transit and at rest, role-based access controls, multi-factor authentication, separated customer environments, and continuous testing of our own Platform. No system is immune to attack, so while we work hard to protect your data, we cannot promise absolute security.

If a personal data breach occurs, we report it to the DIFC Commissioner of Data Protection, and to any other supervisory authority, where the law requires it and within the time it sets (for example, 72 hours under the GDPR). If a breach is likely to result in a high risk to you, we will tell you as soon as practicable. Where we act as a processor, we inform the affected customer without undue delay so that it can meet its own obligations.

9. How long we keep data

Personal data is retained only for as long as its purpose requires, and longer only where we need it to comply with the law or to enforce our agreements. Test evidence is kept for the period set in the customer’s agreement. After that, we securely delete or anonymise the data.

10. Marketing and cookies

Every marketing email includes an unsubscribe link, and you can also opt out by writing to legal@tacans.com.

The Site uses strictly necessary cookies, which it needs in order to work. It uses analytics cookies only if you agree to them, and you can change that choice at any time through the cookie settings on the Site. We do not use advertising or retargeting cookies. If we ever add them, we will ask for your consent first and update this notice.

11. Your choices and rights

Depending on the law that applies to you, you can:

• see your data: obtain a copy of the personal data we hold about you;
• correct it: have inaccurate or incomplete data put right;
• delete it: have your data erased in certain circumstances;
• limit its use: ask us to restrict processing;
• take it with you: receive your data in a machine-readable format;
• object: object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent: wherever we rely on your consent.

To use any of these rights, email legal@tacans.com. We answer within one month, and the law allows this to be extended for complex requests. We may need to confirm your identity before we act.

If you are unhappy with how we handle your data, you can complain to the DIFC Commissioner of Data Protection. If you are in the EU or UK, you can also complain to your local supervisory authority. Under the DIFC DPL, you may also bring a claim before the DIFC Courts.

12. Business use only

The Site and Platform are made for businesses and are not directed at anyone under 18.

13. Updates to this notice

We will revise this notice when our practices or the law change, and update the date at the top. If a change is material, we will give clear notice through the Platform or by email before it takes effect.