GFAB privacy notice

Version: 2026.1-privacy · Effective: 26 October 2026

This notice explains how ProsperityLab Technology Ltd ("ProsperityLab", "we", "us"), Office IH-00-01-01-OF-01, Level 1, Innovation One, Dubai International Financial Centre, uses personal data when you take part in the Global Financial Adviser Benchmark ("GFAB"). We are the controller of this data. Contact: privacy@prosperitylab.ai.

1. What we collect

When you register

• Your email address.
• Your full name.
• Your practice details:
  • Required: country of practice, primary role, experience band, years in practice, primary specialty, primary client segment and firm type.
  • Optional: city, assets under advice band, employer type, employer name, secondary specialty, credentials, and client groups you commonly serve.
• Your acceptance of the terms, this notice and the assessment data processing notice, each with its version and date, and your choice about edition updates.

If a firm or institution invites you

• The email address it entered for your invitation.

When you take the assessment

• Your answers.
• The confidence levels you give.
• Any review flags you set.
• When you started, how long you spent on each situation (counted from regular signals your browser sends while the assessment is open) and when you submitted.
• Your choice of whether to include your professional context in your report. When you start, we keep a sealed copy of your practice details as they stood at that moment.
• Your time zone, as your browser reports it when you start or return to the assessment, so that reminder emails reach you at sensible local times.

What we produce

• Your score and readings, your private report, and the records of how your result was released.

What you choose to publish

• A completion record, which shows your name only if you allow it.
• A directory profile: display name, headline, organisation, country, an optional photo cropped in your browser, and an optional contact email.

For security

When you request a sign-in code, we store keyed, irreversible fingerprints (hashes) of your network address and browser type to limit misuse. We do not store your network address itself.

What we do not collect

We use no advertising, analytics or tracking tools, and no third-party cookies.

2. How we protect it

• Your email address, name and practice details are encrypted with a separate key for each record. Those keys are protected in Microsoft Azure Key Vault.
• We find your account using a keyed fingerprint of your email address rather than the address itself.
• Access by our staff is limited by role and needs two-step sign-in. Staff who review results for quality see them by reference number, not by name.
• Sessions use secure, HTTP-only cookies (see section 9).

3. Why we use it

Your practice details never change your questions or your score.

GFAB makes no decision about you that produces legal effects or similarly significant effects. Your score is calculated automatically from fixed rules; see the assessment data processing notice.

4. Who sees your data

• You. You see everything in your account, your results and your report.
• Our support and privacy staff. To help you and handle privacy requests, they can see your name, email address, practice details, when you registered and last signed in, and how far you are through the assessment. They do not see your answers or scores. Each time they view your details it is recorded.
• An institution that invited you. It sees your name, the email address it invited, and the progress of your invitation: when you accepted it, whether you have registered and completed, and whether you withdrew. It does not see your answers, scores or report. Your result enters its group report only if you allow it, and only when at least 10 people are included. Smaller cells are suppressed so that no individual can be identified.
• The public. The public sees only what you choose to publish. Public pages ask search engines not to index them.
• Our service providers, who act on our instructions:
  • Microsoft Azure (hosting, database, file storage, key management and service logs), in the UAE North region.
  • Twilio SendGrid, which sends our emails from the United States.
  • Microsoft Azure OpenAI Service, which writes the personal explanations in your report. It receives your overall index and your results for each judgment area, your confidence results, our approved observations and, only if you included it in your report, your role, experience band, years in practice, specialties, practice type and client segment. It never receives your name, email, credentials or answers, and it is not used to score you. The service runs on Microsoft's global deployment, so these requests may be processed outside the UAE. Under Microsoft's terms the data is not used to train AI models; Microsoft may keep it for up to 30 days to detect misuse.
• Authorities, where the law requires it.

We do not sell personal data.

5. International transfers

Your data is stored in Microsoft Azure's UAE North region. Email delivery by SendGrid involves transfer to the United States, and AI-assisted explanations may be processed outside the UAE. We rely on the safeguards required by the DIFC Data Protection Law 2020, such as standard contractual clauses, for these transfers.

6. How long we keep it

• Sign-in codes: expire after 9 minutes.
• Signed-in sessions: end after 24 hours of inactivity and at most 30 days.
• Your account and results: kept while your account is open.
• Data copies you request: available to download for 7 days.
• After deletion: see section 7. Records we must keep, for example to defend claims, prevent fraud or meet a legal obligation, are kept for as long as that need lasts, up to 10 years, and are then reviewed and deleted.
• Records of your choices: the consents you gave and the publishing and privacy choices you made are kept with your assessment record, so we can show what you agreed to and when.
• Backups: database backups keep copies for 35 days. Deleted report files can remain in storage recovery copies for up to 30 days.
• Service logs: kept for 30 days.

7. Your rights

You can, from Account → Privacy or by writing to privacy@prosperitylab.ai:

• Get a copy of your data. This covers your profile, your consent choices, your reminder time zone, your attempts with your answers, confidence ratings and timings, your results, your privacy requests and anything you have published. The questions, answer keys and scoring rules are not included, to protect the assessment.
• Correct your details. You can edit your name and practice details in your profile. Contact us to change your email address.
• Withdraw consent for publishing, institution group reports or updates at any time. This does not affect anything done before.
• Delete your account. When you ask, your sharing choices and updates are switched off straight away. When a privacy reviewer starts the deletion, your sessions end and your public profile is removed. Your email address, name, practice details and reminder time zone are then erased, and your report and data-copy files are deleted. We keep your assessment record only in a form that no longer identifies you, to protect the integrity of the benchmark, unless the law requires otherwise.
• Object to processing based on our legitimate interests.

We reply within 30 days. If you are unhappy with how we handle your data, you can complain to the DIFC Commissioner of Data Protection.

8. Children

GFAB is for professionals aged 18 and over. We do not knowingly collect data from anyone younger.

9. Cookies and browser storage

We use only cookies that are needed for the service:

Your browser also keeps a few short-lived items in session storage: which kind of account you signed in to, an invitation you are accepting, or an unfinished completion-record request. These are removed when you close the tab.

10. Changes

We will publish any new version of this notice with its date. If a change affects how we use data you have already given us, we will tell you before it applies.