Atestan Atestan

Privacy Policy

Last updated: 2 November 2026.

This Privacy Policy explains how Alef Global Consulting FZ-LLC ("Atestan", "we", "us", "our") collects, uses, discloses and protects personal data in connection with the Atestan application and related services (together, the "Service").

We are Alef Global Consulting FZ-LLC, a Free Zone Limited Liability Company registered in Ras Al Khaimah, United Arab Emirates (Services Licence No. 47029993), with its registered address at VUET2814, Compass Building, Al Hulaila Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates.

This Policy is written to address the requirements of the EU/EEA and UK General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act as amended ("CCPA/CPRA"), other applicable U.S. state privacy laws, the Brazilian General Data Protection Law ("LGPD"), and comparable data protection frameworks. Section 10 sets out your rights by region.

1. Scope

This Policy applies to individuals who enrol in, or use, the Atestan Service on behalf of an organisation, and to visitors of any Atestan website or verification page that links to this Policy. It does not apply to information processed by Apple, Google or other third parties acting as independent controllers in their own right (for example your App Store account and payment details), which is governed by their own privacy notices.

2. Who we are

Alef Global Consulting FZ-LLC is the data controller (GDPR) / "business" (CCPA/CPRA) / "controller" (LGPD) responsible for personal data processed through the Service, except where stated otherwise.

  • General privacy inquiries: contact@atestan.com
  • Postal address: VUET2814, Compass Building, Al Hulaila Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates
  • EU representative (Article 27 GDPR): Deborah Leturque, dleturque@atestan.com
  • UK representative (Article 27 UK GDPR): Mickael Schekler, mschekler@atestan.com

3. Personal data we collect

3.1 Identity-verification data (at enrolment). To verify the organisation and the persons it designates, our verification provider (see Section 7) processes information about the organisation (for example its trade licence or registration details) and about each designated person (for example identity-document details and a facial/liveness check). Atestan receives the result of this verification and the verified identity attributes (such as name, role and organisation) needed to operate the Service.

3.2 Account and device data. When a device is enrolled, we process a device identifier and the public part of the signing key generated on that device. The private signing key, and any biometric used to unlock the device, remain on your device and are never collected by us.

3.3 Attestation data. When you create an attestation, we process the sealed record and its metadata (such as the type of instruction, timestamps, and the identity of the issuer). Depending on the type of attestation, the content of the instruction may be encrypted on your device before transmission, so that we hold a sealed record rather than the clear content.

3.4 Support communications. Your email address and the content of any message you send to our support team.

3.5 Technical data collected automatically. Device type, operating system, app version, language settings, and limited diagnostic data (crash logs and basic usage signals) used to maintain the stability and security of the Service.

4. Biometric data and your device

Where identity verification includes a facial or "liveness" check, that check is carried out by our verification provider and may constitute biometric or special-category data under applicable law; it is processed for the purpose of verifying identity and preventing impersonation and fraud, on the legal basis described in Section 6. Any biometric used to unlock your device (for example a fingerprint or face unlock built into your phone) is handled entirely by your device's operating system, stays on your device, and is never transmitted to or stored by us.

5. How we use your information

We use personal data to:

  • verify the organisation and its designated persons, and prevent impersonation and fraud;
  • create, administer and secure accounts, enrolled devices and attestations, and operate the verification function;
  • respond to support inquiries;
  • maintain the security, integrity and proper functioning of the Service;
  • understand aggregate usage in order to maintain and improve the Service; and
  • comply with our legal obligations.

We do not use your information to serve third-party advertising, and we do not sell your personal data.

6. Legal bases for processing (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

  • Providing the Service, managing accounts, devices and attestations, and the verification function — performance of a contract (Article 6(1)(b)).
  • Verifying identity and preventing impersonation and fraud, including the facial/liveness check — legitimate interests (Article 6(1)(f)) and, where the check involves special-category data, explicit consent (Article 9(2)(a)) obtained before the check, and/or compliance with a legal obligation (Article 6(1)(c)) where applicable.
  • Security, fraud prevention and service improvement based on aggregate, non-identifying signals — legitimate interests (Article 6(1)(f)), balanced against your rights and freedoms.
  • Responding to legal requests and complying with applicable law, tax and accounting obligations — legal obligation (Article 6(1)(c)).

Where we rely on consent, you may withdraw it at any time with effect for the future, without affecting the lawfulness of processing carried out before withdrawal.

7. Service providers and recipients of your data

We share the minimum data necessary with a limited number of service providers who process data on our behalf, under contractual, confidentiality and security obligations:

  • Didit — identity and business verification at enrolment.
  • Fly.io — hosting of the Service and storage of sealed records (object storage is provided through Fly's Tigris; this is a single provider, not two).
  • Apple (App Store) — distribution of the iOS application (independent controller for your store account and payment details).
  • Google (Google Play) — distribution of the Android application (independent controller for your store account and payment details).

We do not sell personal data to third parties, and we have not sold or "shared" (as defined under the CCPA/CPRA) personal data in the preceding twelve months.

8. International data transfers

We are established in the United Arab Emirates, and certain service providers may process data outside your country of residence. Where we transfer personal data out of the EEA, the UK or Switzerland to a third country that is not subject to an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (2021 version, with the UK International Data Transfer Addendum where applicable), supplemented where necessary by additional technical and organisational measures. A copy of the relevant safeguards is available on request at contact@atestan.com. For users in Brazil and other jurisdictions with cross-border transfer requirements, we apply contractual and technical safeguards designed to provide a comparable level of protection.

9. Data retention

We retain personal data only for as long as necessary for the purposes described in this Policy.

  • The seal itself (the cryptographic fingerprint and the verification code) is permanent and indelible by design. It contains no personal data — it is only a fingerprint — and is kept so that an attestation remains verifiable over time.
  • The content of an instruction, where it is stored, is kept for up to ten (10) years — the period during which a related commercial dispute may still arise — and is then deleted, unless a longer retention period is required by law.
  • Identity-verification data (Didit): we keep the result of the verification and the verified identity attributes needed to operate the Service. We do not keep the underlying evidence (such as the identity document or the facial/liveness capture), which is handled by our verification provider under its own retention policy.

10. Your privacy rights by region

10.1 European Economic Area, United Kingdom and Switzerland. If the GDPR, UK GDPR or Swiss FADP applies to you, you have the right to: access your personal data; request rectification or erasure; restrict or object to certain processing; request data portability; and withdraw consent at any time without affecting prior processing. You may also lodge a complaint with the supervisory authority of your habitual residence, place of work or place of the alleged infringement (for example the CNIL in France or the ICO in the United Kingdom). We aim to respond to verified requests within one month, extendable where necessary under applicable law.

10.2 California (CCPA/CPRA). If you are a California resident, you have the right to know, delete, correct, and limit the use and disclosure of sensitive personal information, and not to be discriminated against for exercising these rights. We do not sell or "share" personal information as those terms are defined under California law. Verified requests are processed within 45 days (extendable once where permitted).

10.3 Other U.S. states. Residents of other U.S. states with comprehensive privacy laws have similar rights to access, correct, delete and obtain a copy of their personal data, and to appeal a denied request. Contact us and we will apply the framework relevant to your state of residence.

10.4 Brazil and other Latin American jurisdictions. If the LGPD or a comparable law applies, you generally have the right to confirm processing, access your data, correct it, request anonymisation, blocking or deletion of unnecessary data, request portability, obtain information about recipients, revoke consent, and lodge a complaint with the competent authority (for example the ANPD in Brazil).

10.5 Other jurisdictions. If you are located elsewhere, we will endeavour to honour requests consistent with the principles in this Policy and any locally applicable law. Contact us at contact@atestan.com.

11. Security

We implement appropriate technical and organisational measures to protect personal data and restrict access to personnel and service providers who need it to perform their functions. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Data breach notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authorities and affected individuals in accordance with applicable law, including, where applicable, the 72-hour notification requirement under Article 33 GDPR.

13. Children's privacy

The Service is intended for adults acting in a professional capacity and is not directed to children. We do not knowingly collect personal data from individuals under 18 years of age. If you believe a minor has provided us with personal data, please contact contact@atestan.com and we will delete it.

14. Changes to this Policy

We may update this Policy from time to time. A revised version will bear a new "Last updated" date and take effect upon posting. Where changes are material, we will provide additional notice (for example through the app) before they take effect.

15. Contact us

Alef Global Consulting FZ-LLC VUET2814, Compass Building, Al Hulaila Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates Email: contact@atestan.com