1. Who we are
Agent Red is a product of GK Code (“GK Code”, “we”, “us”, or “our”), a company based in the United Arab Emirates. GK Code is the controller of the personal data described in this policy, except where we process data on behalf of our customers as described in Section 7.
We process personal data in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“PDPL”) and, where they apply to you, other data protection laws such as the EU and UK General Data Protection Regulation (“GDPR”).
Use of the Site and Platform is also governed by our Terms of Use. For any privacy question or request, contact us at info@gkcode.co.
2. Scope of this policy
This policy applies to:
- The website: agent-red.com and its subpages (the “Site”).
- Pilot and sales enquiries: information you send us through the pilot request form, by email, or in calls and meetings.
- The Agent Red platform: the AI-powered security validation service we provide to organizations (the “Platform”), including account and usage data of the people who use it.
Where a written agreement with a customer, such as a pilot agreement, terms of service, or data processing agreement, contains terms that conflict with this policy, that agreement governs the data it covers.
3. Personal data we collect
Information you give us
- Pilot requests: your full name, work email address, organization, job role, a description of what you want to validate, and your confirmation that testing will be limited to systems your organization is authorized to assess.
- Correspondence: the content of emails, messages, and meeting notes when you communicate with us.
- Platform accounts: name, work email, organization, role, login credentials, and the settings you configure.
Information collected automatically
- Technical data: IP address, browser type and version, device type, operating system, referring URL, and the date and time of your visit. Our hosting and security provider processes this data to deliver the Site and protect it from abuse.
- Usage data: pages viewed, time on page, clicks, and how you arrived at the Site, collected through the analytics and advertising tools described in Section 6.
- Platform activity: logs of actions taken in the Platform, such as scope approvals, test runs, and report access. We keep these for security, auditing, and accountability.
Information from third parties
We may receive business contact details from advertising platforms (for example, when you interact with one of our ads on LinkedIn, Google, or Meta), event organizers, or publicly available professional sources.
We do not intentionally collect special categories of personal data, such as health, biometric, or religious data, through the Site. Please do not include such data in the pilot request form.
4. How we use personal data
- To review and respond to pilot requests, assess eligibility, and confirm that requested testing is authorized.
- To set up, operate, support, and secure Platform accounts and pilots.
- To communicate with you about your request, your pilot, service updates, and security notices.
- To send you product news, event invitations, and other B2B marketing about Agent Red (see Section 13).
- To measure Site performance, understand how visitors use the Site, and improve our content and product.
- To measure the effectiveness of our advertising and show relevant ads to people who have visited the Site.
- To detect, prevent, and investigate fraud, abuse, spam, unauthorized testing, and security incidents.
- To comply with legal obligations, enforce our agreements, and establish, exercise, or defend legal claims.
5. Legal bases for processing
Depending on the context, we rely on the following legal bases under the PDPL and, where applicable, the GDPR:
- Contract: to take steps at your request before entering into a pilot or service agreement, and to perform that agreement.
- Legitimate interests: to run and secure our business, respond to enquiries, conduct B2B marketing, understand Site usage, and prevent abuse. We balance these interests against your rights and freedoms.
- Consent: for non-essential cookies and similar technologies, advertising tracking, and any marketing that requires consent where you live. You can withdraw consent at any time.
- Legal obligation: where we must process data to comply with applicable law or a lawful request from a public authority.
7. Data processed through the Agent Red platform
When an organization uses Agent Red, it defines the scope of testing: the web applications, APIs, source code repositories, cloud environments, and mobile applications to be assessed. In doing so, the Platform may encounter personal data contained in those systems, for example user records exposed by a vulnerability or personal data within source code or configuration files (“Customer Data”).
- Processor role: for Customer Data, GK Code acts as a processor on behalf of the customer, which is the controller. We process Customer Data only to provide the services, according to the customer’s documented instructions and our agreement with them.
- Authorized scope only: testing is limited to systems the customer confirms it is authorized to assess and that are agreed in writing before testing begins.
- Data minimization: where a test demonstrates access to personal data, we aim to capture only the minimum evidence needed to verify and report the finding, and we redact sensitive values in reports where practical.
- Credentials and secrets: credentials provided for testing are stored encrypted, used only for the agreed scope, and deleted or revoked at the end of the engagement.
- AI processing: the Platform uses AI models, which may include models from third-party providers acting as our sub-processors, to analyze in-scope assets and findings. We do not use Customer Data to train AI models made available to other customers or third parties.
If you are an individual whose data may be included in Customer Data, please direct privacy requests to the organization that engaged us. We will assist that organization in responding.
9. International data transfers
We are based in the UAE, and some of our service providers process data in other countries, including the United States and the European Union. When we transfer personal data outside the UAE or, where applicable, outside the EU or UK, we do so in accordance with the PDPL and other applicable law. Where required, we rely on safeguards such as adequacy decisions, standard contractual clauses, or contractual commitments that provide an adequate level of protection.
10. Data retention
- Pilot requests that do not lead to an engagement: deleted within 6 months of your last interaction with us.
- Customer and pilot accounts: kept for the duration of the relationship and then deleted or anonymized, unless we need to keep it longer to meet legal, accounting, or contractual obligations.
- Customer Data and test evidence: kept as set out in the customer agreement, and deleted or returned at the end of the engagement unless the customer instructs otherwise.
- Marketing data: kept until you unsubscribe or object, after which we keep only the minimum needed to honor your choice.
- Analytics data: kept according to the retention settings of each analytics provider, which we set to no more than 14 months for Google Analytics.
- Security and audit logs: kept for as long as reasonably needed for security, abuse prevention, and accountability.
11. Security
As a security company, we take protecting data seriously. We use technical and organizational measures appropriate to the risk, including encryption in transit and at rest, access controls based on least privilege, logging and monitoring, and segregation of customer environments. No system is completely secure. If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities where required by law.
12. Your rights
Subject to applicable law, you may have the right to:
- Access the personal data we hold about you and receive a copy of it.
- Correct inaccurate or incomplete personal data.
- Request deletion of your personal data.
- Restrict or object to processing, including processing based on legitimate interests and direct marketing.
- Receive your personal data in a portable format and have it transmitted to another controller.
- Withdraw consent at any time, without affecting processing that took place before withdrawal.
- Object to decisions based solely on automated processing that produce legal or similarly significant effects for you. We do not make such decisions about visitors or pilot applicants.
- Lodge a complaint with a data protection authority. In the UAE, this is the UAE Data Office. If you are in the EU or UK, you may also contact your local supervisory authority.
To exercise any of these rights, email info@gkcode.co. We may need to verify your identity before acting on your request, and we will respond within the timeframe required by applicable law.
13. Marketing communications
If you submit a pilot request or otherwise share your business contact details with us, we may send you emails about Agent Red, such as product updates, security research, and event invitations, based on our legitimate interest in B2B marketing. Where local law requires prior consent, we will ask for it first.
Every marketing email includes an unsubscribe link. You can also opt out at any time by emailing info@gkcode.co. Opting out of marketing does not stop service-related messages about an active pilot or account.
14. Children
Agent Red is a business service intended for security professionals. The Site and Platform are not directed at anyone under 21, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
15. Changes to this policy
We may update this policy from time to time to reflect changes to our services or legal requirements. We will post the updated version on this page with a new “last updated” date and, where the changes are significant, notify customers by email or through the Platform.
16. Contact us
For questions about this policy or how we handle personal data, contact:
GK Code, Agent RedUnited Arab Emirates
info@gkcode.co