OSTADJI PRIVACY POLICY

1. Introduction

Ostadji respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, disclose and protect personal data when you:

• visit or use ostadji.com;
• submit an enquiry or application;
• purchase or participate in an Ostadji Program;
• engage Ostadji for professional Services;
• subscribe to our newsletter or marketing communications;
• communicate with us by email, telephone, SMS, WhatsApp or social media;
• attend an event, webinar, workshop or recorded session;
• interact with our advertisements;
• use our community groups or online platforms;
• click an affiliate or referral link;
• view Ostadji content on YouTube, social media, podcasts or other channels; or
• otherwise interact with Ostadji.

Ostadji is operated by [FULL LEGAL ENTITY NAME], a company licensed in the United Arab Emirates under Trade Licence No. [TRADE LICENCE NUMBER], issued by [LICENSING AUTHORITY], with its registered address at [FULL UAE ADDRESS].

In this Privacy Policy, “Ostadji”, “we”, “us” and “our” refer to the legal entity operating Ostadji.

“Website” means ostadji.com and any Ostadji-owned registration, payment, landing or service page.

“Programs” means Ostadji’s educational programs, workshops, masterclasses, mentoring, corporate training and related educational services.

“Services” means Ostadji’s professional marketing, consulting, creative, e-commerce, AI, automation and other business services.

2. Our Role in Processing Personal Data

For information collected directly through our Website, Programs, marketing, enquiries and customer relationships, Ostadji normally acts as the data controller. This means we determine why and how that personal data is processed.

When Ostadji processes customer, lead, employee or campaign data on behalf of a professional client, Ostadji may act as a data processor or service provider. In those circumstances:

• the client normally remains responsible for determining the lawful basis for processing;
• we process the information according to the client’s documented instructions;
• the applicable Service Agreement or Data Processing Agreement may contain additional privacy terms; and
• requests relating to that data may need to be directed to the relevant client.

3. Our Privacy Commitments

We aim to process personal data fairly, lawfully and transparently. We will seek to:

• collect only information reasonably necessary for a stated purpose;
• use personal data only for legitimate and disclosed purposes;
• keep personal data reasonably accurate and current;
• protect personal data through appropriate technical and organisational measures;
• limit access to people who reasonably require it;
• retain personal data only for as long as necessary;
• respect applicable privacy rights;
• obtain appropriate consent where consent is required; and
• respond appropriately to privacy and security incidents.

We do not sell or barter personal data for money.

We may share information with service providers, platforms, contractors and business partners where reasonably necessary for the purposes explained in this Policy.

4. Personal Data We May Collect

The information we collect depends on how you interact with Ostadji.

4.1 Identity and contact information

We may collect:

• full name;
• email address;
• telephone or WhatsApp number;
• country and city;
• postal or business address;
• job title;
• employer or organisation;
• social media profile details;
• preferred language; and
• communication preferences.

4.2 Enquiry and application information

We may collect:

• the Program or Service you are interested in;
• your professional background;
• your learning or business objectives;
• your availability;
• your experience level;
• your preferred schedule;
• your budget or service requirements;
• information included in your message; and
• any documents you voluntarily provide.

4.3 Program and participation information

We may collect:

• enrolment details;
• attendance records;
• assignments and submitted work;
• assessment results;
• participation and completion status;
• certificate information;
• questions and support requests;
• one-to-one mentoring notes;
• feedback and survey responses;
• community-group participation;
• session chat messages; and
• information necessary to administer your Program.

4.4 Client and business information

When you engage Ostadji for professional Services, we may collect:

• company and contact details;
• business objectives and requirements;
• proposals, contracts and order details;
• brand materials;
• product and service information;
• campaign and advertising information;
• website and e-commerce data;
• analytics and reporting information;
• account and platform access details;
• customer and lead information supplied by the client;
• meeting notes and approvals;
• deliverables and project communications; and
• billing and payment records.

You should provide account passwords through secure methods wherever possible and should not send highly sensitive credentials through ordinary email or unprotected messages.

4.5 Payment and transaction information

We may collect:

• billing name and address;
• invoice details;
• order and transaction number;
• payment status;
• payment method;
• refund information;
• applicable tax information; and
• limited payment-related identifiers supplied by the payment provider.

Payments may be processed by independent payment gateways, banks or Buy Now, Pay Later providers. Ostadji does not normally receive or store your complete credit or debit card number, card security code or complete banking credentials.

4.6 Communications

We may collect information when you communicate with us through:

• email;
• telephone;
• SMS;
• WhatsApp;
• website forms;
• live chat;
• video meetings;
• social media;
• community groups; or
• another communication channel.

This may include the content of your communication, attachments, dates, times and communication history. Telephone or video calls will only be recorded where participants are informed or where recording is otherwise permitted by applicable law.

4.7 Session recordings and media

Live Programs, webinars, meetings and events may be recorded for participant access, Program delivery, quality control, internal training, record keeping, transcription or service administration. A recording may contain your:

• name;
• display image;
• voice;
• video image;
• screen sharing;
• chat messages;
• questions; and
• comments.

Where a session will be recorded, participants will be notified. We will not use identifiable participant footage, photographs, voice recordings, comments or testimonials in public advertising or promotional materials without the participant’s separate, express consent.

4.8 Technical and usage information

We may collect:

• internet protocol address;
• device type;
• browser type and version;
• operating system;
• approximate location derived from an IP address;
• device identifiers;
• referral source;
• pages viewed;
• links clicked;
• time spent on pages;
• session dates and times;
• navigation paths;
• error information;
• cookie identifiers; and
• advertising or campaign-attribution information.

4.9 Marketing and preference information

We may collect:

• newsletter subscriptions;
• marketing consent;
• communication preferences;
• unsubscribe requests;
• interests inferred from Website activity;
• campaigns or advertisements viewed;
• email opens and link clicks, where enabled; and
• preferred Programs, Services or subjects.

4.10 Social media information

When you interact with Ostadji through YouTube, Instagram, Facebook, LinkedIn, TikTok, X or another platform, we may receive information such as:

• your public profile name;
• username;
• comments;
• messages;
• reactions;
• shares;
• public posts;
• content you tag us in; and
• advertising or audience information made available by the platform.

The social media platform separately processes your information under its own privacy policy.

4.11 Affiliate and referral information

Where you click an affiliate, referral or tracked link, Ostadji or an affiliate network may process:

• the link clicked;
• referral source;
• campaign identifier;
• cookie or device identifier;
• date and time of the click;
• approximate location;
• whether a registration or purchase occurred; and
• commission or attribution information.

We do not normally receive complete payment details relating to a purchase made from an affiliate partner.

4.12 Recruitment information

Where you apply to work with Ostadji, we may collect:

• your CV or resume;
• work history;
• qualifications;
• portfolio;
• professional profiles;
• references;
• expected compensation;
• interview notes; and
• information necessary to assess your application.

4.13 Sensitive personal data

We do not intentionally request sensitive personal data unless it is reasonably necessary, permitted by law and protected appropriately.

Please do not provide medical, biometric, financial-account, government-identification or other highly sensitive information unless we specifically request it for a legitimate purpose.

5. How We Collect Personal Data

Directly from you

For example, when you:

• complete a form;
• register for a Program;
• purchase a Service;
• accept a proposal;
• attend a session;
• communicate with us;
• submit an assignment;
• subscribe to marketing;
• provide feedback; or
• apply for a role.

Automatically

Through:

• cookies;
• pixels;
• analytics;
• server logs;
• advertising technologies;
• affiliate tracking;
• email-measurement tools; and
• similar technologies.

From third parties

Including:

• payment providers;
• website and e-commerce platforms;
• advertising platforms;
• analytics providers;
• affiliate networks;
• social media platforms;
• event or training partners;
• corporate clients;
• referral partners;
• publicly available sources; and
• people authorised to provide information on your behalf.

6. How We Use Personal Data

6.1 Respond to enquiries

We may use information to:

• respond to questions;
• assess your requirements;
• recommend an appropriate Program or Service;
• schedule calls;
• prepare proposals; and
• provide requested information.

6.2 Deliver Programs

We may use information to:

• process enrolments;
• confirm attendance;
• provide session links;
• deliver learning materials;
• administer assessments;
• provide participant support;
• manage community access;
• issue eligible certificates;
• provide recordings;
• arrange mentoring;
• communicate schedule changes; and
• maintain Program records.

6.3 Deliver professional Services

We may use information to:

• onboard clients;
• plan and deliver projects;
• create and manage campaigns;
• develop content or websites;
• conduct audits and research;
• manage marketplace or e-commerce work;
• provide AI and automation services;
• communicate with clients;
• obtain approvals;
• prepare reports; and
• fulfil contractual obligations.

6.4 Process payments

We may use information to:

• accept and verify payments;
• issue invoices and receipts;
• administer instalments;
• process eligible refunds;
• prevent fraud;
• maintain financial records; and
• meet tax, accounting and legal requirements.

6.5 Provide customer support

We may use information to:

• answer support questions;
• resolve technical issues;
• handle complaints;
• maintain service records;
• investigate disputes; and
• improve customer service.

6.6 Operate and improve our Website

We may use information to:

• operate Website functionality;
• remember settings;
• understand how the Website is used;
• identify technical issues;
• improve navigation and content;
• test new features;
• measure page and campaign performance;
• prevent abuse; and
• protect our systems.

6.7 Marketing and communications

We may use information to:

• send newsletters;
• share educational content;
• announce Programs;
• inform you of Services;
• send offers or promotions;
• invite you to events;
• conduct surveys; and
• personalise marketing communications.

Operational communications necessary to deliver a Program or Service are separate from optional marketing communications.

6.8 Analytics and advertising

We may use information to:

• measure Website traffic;
• understand audience interests;
• assess advertising performance;
• create advertising audiences;
• limit repeated advertisements;
• measure conversions; and
• improve our marketing.

Advertising partners may process information according to their own privacy policies.

6.9 Security and fraud prevention

We may use information to:

• verify transactions;
• prevent unauthorised access;
• detect fraud or misuse;
• maintain security logs;
• investigate suspicious activity;
• enforce our Terms and Conditions; and
• protect Ostadji, our clients, participants and third parties.

6.10 Legal and regulatory purposes

We may use information to:

• comply with legal obligations;
• respond to lawful authority requests;
• establish or defend legal claims;
• enforce agreements;
• maintain records;
• respond to consumer or regulatory complaints; and
• protect legal rights and safety.

6.11 Internal administration

We may use information for:

• accounting;
• business planning;
• audits;
• quality assurance;
• staff and contractor management;
• record keeping;
• risk management;
• service development; and
• corporate administration.

7. Grounds for Processing

Depending on the circumstances and applicable law, we may process personal data based on:

• your consent;
• steps requested by you before entering into a contract;
• performance of a contract with you;
• compliance with a legal or regulatory obligation;
• protection of our rights or the rights of another person;
• legitimate business interests, where permitted and appropriately balanced against your rights;
• prevention of fraud and security threats;
• establishment or defence of legal claims;
• protection of public interest or safety; or
• another lawful basis recognised under applicable law.

Where processing depends on consent, you may withdraw your consent at any time. Withdrawal will not normally affect processing that lawfully occurred before withdrawal.

8. Marketing Communications

We may send marketing communications only where we have an appropriate basis to do so.

Where consent is required:

• the marketing option should be clearly presented;
• consent should not be assumed from silence;
• marketing consent should be separate from communications necessary to provide a Program or Service; and
• you may withdraw consent without charge.

You may unsubscribe by:

• selecting the unsubscribe link in an email;
• replying with an unsubscribe request where appropriate;
• changing your communication preferences;
• contacting us at privacy@ostadji.com; or
• contacting us through our official communication channels.

We may retain limited information on a suppression list to ensure that we respect your unsubscribe request.

Unsubscribing from marketing will not stop necessary operational messages relating to an active order, Program, payment, account, contract or support request.

9. Cookies and Similar Technologies

Our Website may use cookies, pixels, tags, local storage and similar technologies.

Essential cookies

Required for Website security, checkout, navigation, forms, account access and core functionality.

Functional cookies

Used to remember preferences such as language, location or display settings.

Analytics cookies

Used to understand Website activity, visitor behaviour and performance.

Advertising cookies

Used to measure campaigns, build audiences, personalise advertisements and track conversions.

Affiliate cookies

Used to identify whether a user clicked an affiliate link and whether a qualifying action occurred.

Where required, non-essential cookies will be used only after you provide consent through our cookie settings.

You can manage cookies through:

• our cookie banner or preference centre, where available;
• your browser settings;
• your device settings; and
• third-party opt-out tools.

Blocking essential cookies may prevent parts of the Website or checkout from functioning correctly. Further information should be provided in our separate Cookie Policy.

10. Analytics and Advertising Providers

We may use third-party analytics and advertising providers, including, where enabled:

• Google Analytics;
• Google Ads;
• Meta advertising technologies;
• TikTok advertising technologies;
• LinkedIn advertising technologies;
• website and e-commerce analytics;
• email analytics; and
• affiliate or conversion-tracking platforms.

These providers may receive device, cookie, usage, advertising and conversion information.

11. Artificial Intelligence and Automated Tools

Ostadji may use artificial intelligence and automation tools to support:

• content drafting;
• research;
• analysis;
• summarisation;
• transcription;
• customer support;
• campaign development;
• reporting;
• workflow automation;
• design and creative production; and
• delivery of client Services.

Where we use AI tools:

• we aim to provide only the information reasonably necessary for the task;
• we seek to avoid submitting unnecessary sensitive personal data;
• output may be reviewed by a person before being used for important decisions;
• AI-generated output may contain errors or inaccuracies;
• third-party AI providers may process information under their own contractual and privacy terms; and
• information may be processed outside the UAE.

We do not intentionally use confidential client information or personal data to train publicly available AI models unless this has been clearly authorised, contractually agreed or otherwise permitted by law.

Ostadji does not normally use solely automated decision-making to make decisions that produce legal or similarly significant effects on an individual. Where such processing is introduced, we will provide additional information and safeguards where required.

12. Program Recordings, Photographs and Testimonials

We may record Program sessions or events where participants have been notified.

Recordings may be shared with:

• the relevant cohort;
• authorised trainers;
• Ostadji staff or contractors;
• corporate clients for whom the session was delivered; or
• service providers necessary to host or process the recording.

Participants may ordinarily:

• keep their camera turned off;
• adjust their display name;
• avoid sharing unnecessary personal information; and
• contact us in advance regarding a privacy concern.

We will request separate permission before using an identifiable participant’s photograph, video image, voice, testimonial, personal story or identifiable Program contribution in public marketing or advertising, unless another lawful basis clearly applies.

13. Client Data and Marketing Services

Clients may provide Ostadji with access to:

• customer records;
• sales leads;
• website enquiries;
• mailing lists;
• CRM information;
• advertising audiences;
• analytics;
• chatbot conversations; and
• campaign data.

The client confirms that it has an appropriate lawful basis and authority to provide this information to Ostadji.

When acting on the client’s instructions, Ostadji will:

• use the information only for the agreed Services;
• limit access to people involved in delivery;
• apply reasonable security measures;
• not use the information for unrelated independent purposes;
• assist the client with reasonable privacy requests where contractually required; and
• delete or return information when required by the applicable agreement, subject to legal retention obligations.

A separate Data Processing Agreement may be required for engagements involving substantial personal data.

14. Community Groups and Public Areas

Ostadji may operate WhatsApp groups, forums, social communities, chat rooms or group-learning environments. Information you post may be visible to other participants.

You should not post:

• passwords;
• payment information;
• confidential business information;
• private customer information;
• government-identification documents;
• health information; or
• personal information about another person without permission.

Ostadji may moderate, restrict or remove content that violates our rules, another person’s rights or applicable law.

15. Affiliate Links and Third-Party Purchases

Our Website, blogs, videos, newsletters and social content may include affiliate, referral or sponsored links.

When you follow an affiliate link:

• the third party or affiliate network may use tracking technologies;
• the third party may collect information directly from you;
• the transaction is between you and the third party;
• the third party’s privacy policy applies to its processing; and
• Ostadji may receive commission or attribution information.

Ostadji does not control how an independent third-party provider processes information collected through its website, product or checkout. You should review the provider’s privacy policy before submitting personal information or making a purchase.

16. When We Share Personal Data

We may disclose personal data to the following categories of recipients where reasonably necessary.

Staff and contractors

Authorised employees, trainers, consultants, lecturers, freelancers and contractors who require information to perform their work.

Website and technology providers

Providers of website hosting, e-commerce services, cloud storage, databases, email, CRM systems, forms, analytics, cybersecurity, automation and technical support.

Payment and financial providers

Banks, card processors, payment gateways, instalment providers and accounting platforms.

Program-delivery providers

Video-conferencing, learning, scheduling, file-sharing, transcription and community-management platforms.

Advertising and analytics providers

Search engines, social networks, analytics providers, advertising platforms, affiliate networks and conversion-measurement partners.

Professional advisers

Lawyers, accountants, auditors, insurers and other advisers subject to appropriate confidentiality obligations.

Corporate clients

Where you participate in a corporate Program or where disclosure is necessary to fulfil an agreement with the organisation arranging the Program.

Authorities and legal recipients

Courts, regulators, government entities, law-enforcement agencies or other recipients where disclosure is legally required or reasonably necessary to protect rights and safety.

Business transactions

If Ostadji is involved in a proposed or completed merger, acquisition, investment, restructuring, financing or sale of all or part of its business, personal data may be disclosed to potential buyers, investors, successor entities and their professional advisers where reasonably necessary to evaluate or complete the transaction. Such recipients will be required, where appropriate, to keep the information confidential and use it only for purposes connected with the transaction.

We require service providers that process personal data on our behalf to use it only for authorised purposes, protect it appropriately and comply with applicable contractual and legal data-protection obligations.

17. International Data Transfers

Ostadji operates from the UAE, but some service providers, cloud platforms, trainers, contractors and technology systems may process information in other countries. Those countries may have privacy laws different from those of the UAE.

Where required, we will seek to use appropriate measures for international transfers, which may include:

• transferring information to a jurisdiction recognised as providing adequate protection;
• contractual data-protection terms;
• confidentiality and security obligations;
• transfer-risk assessments;
• your express consent where legally appropriate; or
• another transfer mechanism permitted by applicable law.

18. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and for any related legal, accounting, security or dispute-resolution requirements.

Our retention period may depend on:

• whether you remain an active customer or participant;
• the duration of the Program or Service;
• contractual requirements;
• certificate and attendance records;
• accounting and tax obligations;
• legal limitation periods;
• complaints or disputes;
• consent status;
• security requirements; and
• whether information can be securely anonymised.

Unless a different period is required or justified, our general retention approach is:

• Enquiries: normally up to 24 months after the last meaningful interaction;
• Program and client records: for the duration of the relationship and normally for up to seven years afterward where required for contractual, financial, legal or dispute purposes;
• Invoices and transaction records: for the period required under applicable financial, tax and accounting laws;
• Marketing information: until you withdraw consent or object, subject to retaining limited suppression information;
• Session recordings: for the announced access period and a limited administrative period afterward, unless longer retention is agreed or consented to;
• Website and security logs: normally for up to 12 months, unless needed for investigation or security;
• Recruitment records: normally for up to 12 months after an unsuccessful application, unless you agree to a longer period; and
• Client-controlled data: as directed by the relevant client agreement.

When information is no longer required, we will seek to delete, anonymise or securely isolate it.

19. Data Security

We use reasonable technical and organisational safeguards intended to protect personal data against:

• unauthorised access;
• accidental loss;
• alteration;
• misuse;
• disclosure;
• destruction; and
• unlawful processing.

Measures may include:

• access controls;
• password protection;
• multifactor authentication where available;
• restricted permissions;
• encryption where appropriate;
• secure cloud services;
• staff and contractor confidentiality duties;
• backups;
• software updates;
• monitoring;
• vendor assessment; and
• incident-response procedures.

No online system, email, internet transmission or cloud platform can be guaranteed to be completely secure. You are also responsible for protecting your passwords, devices and account access.

20. Personal Data Breaches

Where we become aware of a personal-data breach, we may:

• investigate the incident;
• take steps to contain and remedy it;
• assess the likely risks;
• preserve relevant evidence;
• notify affected clients;
• notify individuals where required; and
• notify a competent authority where required by applicable law.

If you believe personal data connected with Ostadji has been compromised, contact us promptly at privacy@ostadji.com.

21. Your Privacy Rights

Subject to applicable law and relevant exceptions, you may have the right to:

• receive information about how your personal data is processed;
• request access to personal data held about you;
• request correction of inaccurate or incomplete information;
• request deletion of personal data;
• request restriction or suspension of certain processing;
• object to certain processing;
• withdraw consent;
• request transfer or portability of eligible information;
• object to direct marketing;
• request information about automated processing;
• request review of a significant automated decision; and
• submit a complaint to a competent authority.

These rights are not absolute. We may be permitted or required to retain or continue processing information for reasons such as contractual obligations, legal compliance, financial record keeping, fraud prevention, security, legal claims or protection of another person’s rights.

22. Exercising Your Rights

Please provide:

• your full name;
• relevant contact information;
• your relationship with Ostadji;
• a clear explanation of your request; and
• information reasonably necessary to locate the relevant records.

We may request reasonable proof of identity before acting on a request. We may also need to verify the authority of anyone submitting a request on another person’s behalf.

We will respond within the period required by applicable law. Where a request is complex or extensive, we may contact you for clarification or explain any permitted extension.

23. Children and Participants Under 18

Our Website and Services are not intended for children to independently purchase or enter into contracts.

A participant under 18 may join an eligible Program only where:

• a parent or legal guardian completes or authorises the enrolment;
• the guardian accepts the applicable Terms;
• payment is authorised by the guardian;
• necessary consent is obtained; and
• appropriate supervision or safeguarding arrangements are followed.

Where we process children’s information, we aim to:

• collect only what is reasonably necessary;
• provide age-appropriate information where relevant;
• obtain guardian involvement where required;
• apply suitable privacy and security protections;
• limit promotional use of a child’s image or voice; and
• avoid behavioural advertising directed specifically at children.

If you believe a child has provided personal data without appropriate authority, contact privacy@ostadji.com.

24. Third-Party Websites and Platforms

Our Website and Content may link to:

• software providers;
• payment gateways;
• certification platforms;
• social networks;
• affiliate partners;
• advertisers;
• client websites; and
• other third-party services.

Ostadji is not responsible for the privacy practices of an independent third party. A link does not mean that Ostadji controls or guarantees that party’s privacy or security practices. You should review the third party’s privacy policy before providing information.

25. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

• changes to our Programs or Services;
• new technology or platforms;
• changes to our processing activities;
• legal or regulatory changes;
• security improvements; or
• business developments.

The updated version will be published with a revised “Last updated” date. Where a change materially affects how we use personal data, we may provide additional notice where reasonably appropriate or legally required.

26. Complaints

If you have a concern about our handling of personal data, contact us first so that we can investigate it.

Please send complaints to privacy@ostadji.com and include:

• your name;
• your relationship with Ostadji;
• a description of the concern;
• relevant dates or communications; and
• the resolution you are requesting.

You may also have the right to complain to the competent UAE data-protection or regulatory authority or another authority applicable to your location.

27. Contact Information