Legal
Privacy Policy
Last updated: October 15, 2026
1Who we are
Physical Data (PHD PHYSICAL DATA ARTIFICIAL INTELLIGENCE DEVELOPING SERVICES – FZCO, IFZA Business Park, DDP, PO Box 342001, Dubai Silicon Oasis, Dubai, UAE – registration no. 76252) is the data controller for the personal data collected on this website.
- Data Protection Officer (DPO)
- The DPO function is outsourced to XXII GROUP SAS. Contact: dpo@xxii.fr
- EU representative (Art. 27 GDPR)
- XXII GROUP SAS, 23-25 Rue Delarivière Lefoullon, Défense Plaza, 92800 Puteaux, France – dpo@xxii.fr
Because we offer our services to organisations in the European Union, we apply the EU General Data Protection Regulation (GDPR). For residents of the United Arab Emirates, see also our UAE Data Protection Notice.
2Data we collect
| Form | Data collected |
|---|---|
| Get in touch | first name, last name, company, business email, message |
| Custom quote | first name, last name, company, business email, project details (sensor/robot options, volume, message) |
| Free sample | business email, company (optional) |
Plus: technical data (IP address, browser, pages viewed) only if you accept analytics cookies.
We do not collect sensitive data. Please do not include any in free-text fields.
3Why we use your data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Answering your request, sending a quote or a sample | Steps taken at your request prior to a contract (Art. 6(1)(b) GDPR) |
| Following up on your request and B2B commercial prospecting by email about similar services | Our legitimate interest in developing our business (Art. 6(1)(f)); you can object at any time via the unsubscribe link or by email |
| Newsletter and marketing communications | Your consent (Art. 6(1)(a)), given via the optional checkbox; withdrawable at any time |
| Audience measurement and visit history (HubSpot tracking and Google Analytics) | Your consent via the cookie banner |
| Managing disputes and legal obligations | Legitimate interest / legal obligation |
4Who receives your data
Your data is only accessible to authorised Physical Data staff and to the following service providers acting on our instructions:
- XXII GROUP SAS (Puteaux, France)
- Operates our CRM on our behalf, under a data processing agreement (Art. 28 GDPR)
- HubSpot
- CRM and email platform, data hosted in HubSpot's EU data centre (Germany)
- Netlify, Inc. (United States)
- Website hosting and content delivery
- Google (Google Drive)
- Storage and delivery of free samples
- Google (Google Analytics)
- Audience measurement, only if you accept analytics cookies
We never sell your data.
5International transfers
Your data is mainly stored in the European Union. Physical Data is established in the United Arab Emirates, and some of our service providers (Netlify and Google, both headquartered in the United States) may process data outside the EU. Where this happens, we put in place appropriate safeguards as required by Chapter V of the GDPR, such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework where the provider is certified.
6How long we keep your data
- Prospects
- 3 years from our last contact with you
- Customers
- Duration of the business relationship + 3 years
- Invoices and accounting documents
- As required by law
- Cookies
- 6 months maximum (see section 8)
7Free samples
Samples are provided for evaluation purposes only (no resale, and no use for training production models without our prior written agreement). After you submit the Free sample form, you get access to the samples via a Google Drive link. We record your request in order to follow up with you.
9Your rights
Right of access, rectification, erasure, restriction, data portability, objection (including to direct marketing at any time), withdrawal of consent, and to give instructions on what happens to your data after your death.
To exercise them, email our DPO at dpo@xxii.fr. We will reply within one month. We may ask for proof of identity if we have reasonable doubt about it.
You can also lodge a complaint with a supervisory authority, in particular the one in your EU country of residence (in France: CNIL, www.cnil.fr).
10Security
We use appropriate technical and organisational measures to protect your data (access control, encryption in transit, restricted access on a need-to-know basis, contractual commitments from our service providers).
11Changes to this policy
We may update this policy. The date at the top shows the latest version.