Privacy Policy

1. Who we are and what this notice covers

rogaai.com is operated by ROGA AI LIMITED, a company registered in Gibraltar under Company No. 125994, Unit G02, Eurocity, Europort Avenue, Gibraltar GX11 1AA (“ROGA”, “we”, “us”). ROGA is a group of three divisions: ROGA Marketing (a full-service marketing agency), ROGA Technology (AI-native software engineering), and ROGA Labs (our products, including The AI CMO).

This notice covers rogaai.com and the services our Marketing and Technology divisions deliver to clients. ROGA Labs products, including The AI CMO, have their own privacy notices, published on each product's site.

We process personal data under the General Data Protection Regulation as it applies in Gibraltar (the Gibraltar GDPR and the Data Protection Act 2004) and, where our clients or the people concerned are in the European Economic Area or the United Kingdom, under the EU GDPR and the UK GDPR. Every purpose in this notice rests on a specific legal basis (Section 4). Where that basis is consent, it is asked for separately and can be withdrawn as easily as it was given.

2. Your data, or your organisation's data: our role

Which of these applies to you decides who is responsible for what.

3. Information we collect

4. How we use it, and on what legal basis

Where we are the controller (Sections 2.1, 2.2 and 2.4):

Where we are a processor (Section 2.3), we use the data for one purpose only: performing the services the client has instructed, as documented in the Statement of Work and the DPA. The legal basis is the client's to establish. We never process a client's data for our own purposes, and we do not sell personal data.

5. AI tools and your information

AI is part of how we work. Our teams use AI models to research, draft, analyse and build. When personal data is involved, these rules apply:

• Client personal data is sent to a model provider only when the Statement of Work calls for it, only the fields the task needs, and only to providers engaged under terms that exclude retention beyond the request and any use for training.
• We do not use client data, or content generated from it, to train, fine-tune or improve any model — ours or a third party's — unless a client has agreed to a specific training arrangement in writing. Custom models built for a client are the client's, trained on the client's data alone.
• AI output that affects people is reviewed by a person before it is acted on. We do not use AI to make decisions with legal or similarly significant effects on individuals, and we do not instruct models to infer special categories of data.
• Enterprise clients may fix the provider, the model, the processing region and zero-retention routing for their engagement (DPA, Annex IV).

6. How we share information; sub-processors

We do not sell, rent or trade personal data. We share it with the service providers below, which act on our instructions; with advisers under confidentiality; where the law requires it; and in a merger, acquisition or sale of assets, in which case we notify you before your data is transferred.

7. International data transfers

We are established in Gibraltar. Some of our providers process data in the United States. Where personal data originating in the EEA, the United Kingdom or Gibraltar is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum where relevant) or, for recipients certified under the EU–US Data Privacy Framework, on that certification, together with the safeguards in Section 9. Our Information Sharing & Transfer policy requires a recorded transfer basis for every cross-border flow. Copies of the mechanisms in use are available to clients on request.

8. How long we keep information

Our Retention & Secure Disposal policy runs a quarterly review; anything past its period is queued for disposal within 30 days, and disposal is logged.

9. How we protect information

We operate a security programme under SOC 2 Type II and GDPR-aligned policies covering information security governance, access control, encryption, secure development, vendor management, incident response, business continuity, and data classification, retention and disposal. The measures that matter most to you:

• Encryption: TLS 1.2 or higher for all data in transit, with weak ciphers disabled; provider-managed encryption at rest for storage, databases and backups; keys held in a managed key service, rotated at least annually, with access logged.
• Access control: least-privilege access protected by multi-factor authentication; access to client data granted on need, reviewed quarterly and logged; revoked within 48 hours at offboarding.
• Data classification: four levels (Public, Internal, Confidential, Restricted); client personal data is handled as Confidential or Restricted, encrypted, shared only over approved channels, and only under contract.
• Secure development: code review, dependency and vulnerability scanning in the pipeline, severity-based patch timelines (critical within 7 days), and penetration testing at least annually.
• Resilience: daily encrypted backups retained 30 days online, restore tests quarterly, and a maintained business continuity plan.
• Incident response: a documented process with named roles; where a personal data breach affects a client's data we notify that client without undue delay and within 48 hours of confirming it, so it can meet its own 72-hour duty; where the breach concerns data we control, we notify the Gibraltar Regulatory Authority within 72 hours where the law requires.
• People: confidentiality undertakings, background screening proportionate to role, and security and privacy training on joining and annually.
• Vendors: providers that touch client or Restricted data must hold a current SOC 2 Type II report or equivalent, reviewed annually.

Our Trust Center, with the live status of the SOC 2 Type II examination and the policies in force, is at trust.inc/roga-ai-limited. A fuller description of the technical and organisational measures is Annex II of the Data Processing Agreement. No method of transmission or storage is perfectly secure; if you believe data you gave us has been compromised, contact us at once.

10. Your rights

11. Cookies and consent

rogaai.com sets one strictly necessary cookie to remember your consent choices. Optional analytics run only if you opt in and are off by default. The full inventory — name, purpose, duration and recipient — is in our Cookie Policy, where you can also change or withdraw your consent at any time. Your choice is recorded with a timestamp, its scope and the method used.

12. Children

Our services are for businesses and professionals and are not directed at anyone under 18. We do not knowingly collect personal data from children; if we learn that we have, we delete it. Clients are responsible for the age rules that apply to their own audiences.

13. Changes to this notice

We update this notice when our practices, the law or our sub-processors change, and within 30 days of any significant change in processing. Each version is dated at the top and archived, so you can see what applied at any time. For material changes — a new purpose, a new category of data, a new sub-processor of client data — we notify affected clients before the change takes effect and, for clients under a DPA, as that agreement provides.

14. Contact