PDPL Compliance Statement

For tenant content, our customer is the controller and Resolv is the processor, acting on documented instructions. For website and prospect data, Resolv is the controller. A data-processing addendum reflecting PDPL requirements is available on request.

We process personal data only to deliver, secure and improve the contracted service, and as instructed by the controller. We do not repurpose tenant content, and we do not use it to train foundation AI models.

Regional data-residency options are available, and the Ops Platform Edition can run entirely within a customer’s own perimeter. Where data is transferred to subprocessors outside the UAE, transfers rely on the safeguards contemplated by the PDPL, documented in the data-processing addendum.

Tenant isolation enforced at the database layer; encryption in transit and at rest, with envelope encryption for integration credentials; role-based access; PII redaction in logs; and an append-only audit trail. Details are on our Security page.

We support controllers in responding to access, correction, deletion, restriction and objection requests within PDPL timelines, and provide export tooling for portability.

Our target is to notify affected customers without undue delay and in time for the controller to meet its regulatory notification obligations, with a written post-mortem after any incident affecting personal data.

Data-protection enquiries: hello@resolv.so. Security documentation and the isolation-test evidence pack are available under NDA via the Security page.