Privacy Notice for Dar Al Afkar Users

إشعار الخصوصية لمستخدمي دار الأفكار

Document ID: DAF-PN-001 Version: 1.0 Classification: Official - Public Effective Date: 12 May 2026 Last Updated: 12 May 2026 Owner: Center for Legislative Innovation (CLI), Supreme Legislation Committee

About This Notice / حول هذا الإشعار

This privacy notice explains how Dar Al Afkar ("DAF") collects, uses, stores, and protects your personal data. DAF is the Supreme Legislation Committee's innovation management platform, built and operated by the Center for Legislative Innovation (CLI).

This notice is written for you — the SLC staff member who uses DAF. If you have questions after reading it, contact the CLI team through the channels listed at the end.

هذا الإشعار يوضح كيف تقوم منصة دار الأفكار بجمع واستخدام وتخزين وحماية بياناتك الشخصية. دار الأفكار هي منصة إدارة الابتكار التابعة للجنة العليا للتشريعات، والتي يقوم ببنائها وتشغيلها مركز الابتكار التشريعي.

هذا الإشعار مكتوب لك — موظف اللجنة العليا للتشريعات الذي يستخدم المنصة. إذا كانت لديك أسئلة بعد قراءته، تواصل مع فريق مركز الابتكار التشريعي عبر القنوات المذكورة في نهاية الإشعار.

1. What Data We Collect / ما هي البيانات التي نجمعها

When you use DAF, we collect and process the following categories of personal data:

Your Profile / ملفك الشخصي

| What | Why |
|------|-----|
| Full name (English and Arabic) | To display your name on ideas, evaluations, and leaderboards |
| Username | To let you log in to the platform |
| Password | To verify your identity (stored as an irreversible hash — we never see your actual password) |
| Department and section | To organize ideas by organizational unit and enable department-level analytics |
| Role | To determine what features you can access (employee, department head, suggestion manager, innovation team, admin) |

Your Activity / نشاطك

| What | Why |
|------|-----|
| Ideas you submit | Core function of the platform — innovation management |
| Evaluations you perform | To assess and score ideas using the 4-pillar framework |
| Comments you write | To enable collaboration and discussion on ideas |
| Votes you cast | To enable community prioritization of ideas |
| Tasks assigned to you | To track idea implementation |
| Collaborative contributions | To support team-based innovation |
| **Voice explanations you record** | To let you explain an idea in your own words, so evaluators understand it as you meant it rather than as you managed to write it |
| **Supporting material you attach** | To give evaluators the documents, studies or images behind an idea |

> About voice recordings / بشأن التسجيلات الصوتية > > A voice explanation is a recording of your voice, and your voice identifies > you. We treat it as personal data and we are specific about what happens > to it: > > - It is optional. Every idea can be submitted without one. > - It is stored on SLC infrastructure in the UAE (Azure UAE North), alongside > the idea it belongs to. It does not leave that boundary. > - It is never sent to any AI provider — not the local model, not any > cloud model. It is not transcribed, not analysed, and not used to build a > voiceprint or to identify you by voice. > - It is heard by the same people who can already read the idea: the > evaluators, the Suggestion Manager, the implementing department, and > administrators. > - You can delete it yourself at any time, and deleting the idea deletes it.

Your Achievements / إنجازاتك

| What | Why |
|------|-----|
| Reputation points and level | To recognize your contributions |
| Badges earned | To celebrate milestones |
| Leaderboard ranking | To encourage healthy participation |

Technical Data / البيانات التقنية

| What | Why |
|------|-----|
| Session token | To keep you logged in securely for up to 24 hours |
| IP address (during session) | To protect against unauthorized access and enforce rate limits |
| Audit log entries | To maintain a security trail of significant actions |

2. How We Use AI / كيف نستخدم الذكاء الاصطناعي

DAF includes AI-assisted features to help analyze and enhance innovation ideas. Here is exactly what happens when AI is used:

Local AI (LM Studio) / الذكاء الاصطناعي المحلي

- Runs on SLC's own servers — your data never leaves our network - Your full text is processed as-is - No third-party company sees your data

Cloud AI (Anthropic Claude, OpenAI, Google Gemini, Groq) / الذكاء الاصطناعي السحابي

When a cloud AI provider is used, your data is anonymized before it leaves our servers. Specifically:

- All names of SLC staff are replaced with `[NAME]` - All email addresses are replaced with `[EMAIL]` - All phone numbers are replaced with `[PHONE]` - Words like "confidential", "secret", or "classified" are replaced with `[REDACTED]`

This means the AI provider receives the content of your idea for analysis but cannot identify who wrote it, who is mentioned in it, or any contact details.

What we guarantee about AI / ما نضمنه بشأن الذكاء الاصطناعي

- Your password, session data, and API keys are never sent to any AI provider - AI responses are always labeled as AI-assisted — you will see a disclosure badge - The audit system logs that AI was used (which provider, which model) but never stores the actual text of what was sent or received - You can submit and manage ideas without ever using AI features

عند استخدام مزود ذكاء اصطناعي سحابي، يتم إخفاء هوية بياناتك قبل أن تغادر خوادمنا. على وجه التحديد:

- يتم استبدال جميع أسماء موظفي اللجنة بـ `[NAME]` - يتم استبدال جميع عناوين البريد الإلكتروني بـ `[EMAIL]` - يتم استبدال جميع أرقام الهواتف بـ `[PHONE]` - يتم استبدال الكلمات مثل "سري" أو "مصنف" بـ `[REDACTED]`

هذا يعني أن مزود الذكاء الاصطناعي يتلقى محتوى فكرتك للتحليل ولكن لا يمكنه تحديد من كتبها أو من ذُكر فيها أو أي تفاصيل اتصال.

3. Your Rights / حقوقك

Under the UAE Personal Data Protection Law (PDPL), you have the following rights:

Right to Access / حق الوصول

You can view all your personal data through the DAF dashboard at any time. Your profile, ideas, evaluations, and achievements are all visible to you when logged in.

Right to Correct / حق التصحيح

If any of your data is incorrect (wrong name spelling, wrong department, etc.), you can request a correction by contacting the CLI team or asking your admin to update your profile.

Right to Delete / حق الحذف

You can request that your account be deleted. When deleted:

- Your name is replaced with "Deleted User" / "مستخدم محذوف" - Your department, section, and other identifying information are removed - Your ideas and contributions remain in the system (for organizational continuity) but are no longer linked to your real identity - All your active sessions are immediately terminated

Right to Export Your Data / حق نقل البيانات

You can export all your personal data at any time via the data portability endpoint (`/api/me/data`). This returns a JSON file containing your profile, ideas, evaluations, tasks, notifications, reputation, and audit log entries. This is your data — you have the right to receive a copy of it.

Right to Object / حق الاعتراض

You may object to specific types of processing, particularly AI-assisted analysis of your submissions. Contact the CLI team to exercise this right.

بموجب قانون حماية البيانات الشخصية في الإمارات، لديك الحقوق التالية:

- حق الوصول: يمكنك عرض جميع بياناتك الشخصية عبر لوحة التحكم في أي وقت - حق التصحيح: يمكنك طلب تصحيح أي بيانات غير صحيحة - حق الحذف: يمكنك طلب حذف حسابك — سيتم إخفاء هويتك فوراً - حق نقل البيانات: يمكنك تصدير جميع بياناتك كملف JSON - حق الاعتراض: يمكنك الاعتراض على معالجة محددة مثل التحليل بالذكاء الاصطناعي

4. How Long We Keep Your Data / كم من الوقت نحتفظ ببياناتك

| Data Type | How Long | What Happens After |
|-----------|----------|-------------------|
| Your account | As long as you work at SLC | Anonymized if you leave or request deletion |
| Deleted accounts | Anonymized records kept 2 years | Permanently purged |
| Your session (login) | 24 hours | Automatically deleted |
| Audit logs | 3 years | Permanently deleted |
| AI usage metadata | 1 year | Permanently deleted |
| Voice explanations | Kept with the idea they belong to | Deleted when you remove them, or when the idea is deleted |
| Supporting material (attachments) | Kept with the idea they belong to | Deleted when you remove them, or when the idea is deleted |

Your ideas and contributions are retained as part of SLC's organizational innovation record, but if your account is deleted, they will be attributed to "Deleted User" rather than to you.

5. How We Protect Your Data / كيف نحمي بياناتك

We take the security of your data seriously. Here are the measures in place:

Authentication Security / أمن المصادقة

- Your password is hashed using bcrypt with a high cost factor (13 rounds) — even if the database were compromised, your actual password cannot be recovered - Passwords must be at least 12 characters with uppercase, lowercase, numbers, and special characters - Sessions use 256-bit cryptographically random tokens - Login is locked after 5 failed attempts for 15 minutes - Session cookies are HttpOnly (cannot be read by JavaScript), Secure (only sent over HTTPS), and SameSite=Strict (blocks cross-site requests)

Data Security / أمن البيانات

- AI API keys are encrypted with AES-256-GCM — military-grade encryption - All communication with external services uses TLS encryption - Security headers protect against clickjacking, content sniffing, and cross-site scripting - Rate limiting prevents abuse on all API endpoints - CSRF protection validates the origin of all state-changing requests

Access Control / التحكم في الوصول

- You can only access features appropriate to your role - Admin functions (user management, settings, audit logs) are restricted - Every significant action is logged for accountability

6. Who Can See Your Data / من يمكنه رؤية بياناتك

| Who | What They Can See |
|-----|------------------|
| **You** | Your full profile, your ideas, your evaluations, your achievements |
| **Other logged-in users** | Your name on ideas you submit, your leaderboard position, your comments |
| **Evaluators** (innovation team, suggestion managers, department heads) | Your ideas for evaluation purposes |
| **Admins** | All user profiles (excluding passwords), audit logs, system settings |
| **External AI providers** | Anonymized text only — never your name, email, phone, or any identifying information |
| **CLI development team** | System logs for debugging (no passwords, no prompt content) |

Nobody at any level can see your actual password. It is stored as an irreversible hash.

7. Cookies and Sessions / ملفات تعريف الارتباط والجلسات

DAF uses a single cookie:

| Cookie Name | Purpose | Duration | Type |
|-------------|---------|----------|------|
| `afkar_session` | Keeps you logged in | 24 hours | HttpOnly, Secure, SameSite=Strict |

We do not use tracking cookies, analytics cookies, or any third-party cookies. The single session cookie is strictly necessary for the platform to function.

8. Changes to This Notice / التغييرات على هذا الإشعار

We may update this privacy notice from time to time to reflect changes in the platform, legal requirements, or our data practices. When we make significant changes:

- The updated notice will be posted on the DAF platform - The "Last Updated" date at the top will be changed - For material changes, we will notify users through the platform's notification system

9. Contact Us / اتصل بنا

If you have questions about this privacy notice, your data, or your rights, contact the CLI team:

Center for Legislative Innovation (CLI) Supreme Legislation Committee Government of Dubai United Arab Emirates

- Internal: Contact the CLI team through SLC internal communication channels - Data Protection Inquiries: Raise a request through your department head or directly with the CLI team lead - Urgent Security Concerns: Report immediately to CLI team and SLC IT Security

Response Time: We aim to respond to all data protection inquiries within 15 business days, and no later than 30 calendar days as required by the PDPL.

للتواصل مع فريق مركز الابتكار التشريعي بشأن أي أسئلة حول هذا الإشعار أو بياناتك أو حقوقك:

- داخلياً: تواصل مع فريق مركز الابتكار التشريعي عبر قنوات الاتصال الداخلية - استفسارات حماية البيانات: ارفع طلباً عبر رئيس قسمك أو مباشرة مع قائد فريق مركز الابتكار التشريعي - مخاوف أمنية عاجلة: أبلغ فوراً فريق مركز الابتكار التشريعي وأمن تقنية المعلومات في اللجنة

وقت الاستجابة: نهدف للرد على جميع استفسارات حماية البيانات خلال 15 يوم عمل، وبحد أقصى 30 يوماً تقويمياً كما يتطلب قانون حماية البيانات الشخصية.

Document Control

| Version | Date | Author | Changes |
|---------|------|--------|---------|
| 1.0 | 12 May 2026 | Center for Legislative Innovation | Initial version |