Privacy policy
This policy explains what personal data Board Enhance collects, why we collect it, who we share it with, and the rights you have over your information.
01Who we are
Board Enhance is an executive education business based in Dubai, United Arab Emirates. We deliver the Board Diploma Programme and provide board candidate search and alumni services to senior executives across the UAE and GCC.
For the purposes of UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL"), Board Enhance is the controller of the personal data described in this policy.
Address: Level 3, Boulevard Plaza Tower One, Sheikh Mohammed bin Rashid Boulevard, Dubai, UAE
Email: board@boardenhance.ae
Phone: +971 56 409 6000
02What we collect
We collect personal data when you interact with our website, request information about our programmes, apply to participate, or engage with us as an alumnus.
Information you give us
- Name, email address, mobile number and postal address
- Job title, employer, professional background and CV
- Reasons for applying and motivations stated in application or meeting forms
- Messages and correspondence you send to us
- Payment and invoicing details for enrolled participants
Information collected automatically
- IP address, browser type, device type and operating system
- Pages visited, time on page, scroll depth and referring URL
- Marketing source data (UTM parameters, click identifiers from advertising platforms)
- Cookie identifiers as described in section 6
Information from third parties
- Public professional information (e.g. from LinkedIn) when assessing candidates for our Candidate Search service
- Referrals and introductions from existing alumni or business partners
03How we use it
We use personal data for the following purposes:
- To deliver our services: processing applications, scheduling meetings, delivering the programme, managing alumni membership, and providing candidate search services.
- To communicate with you: sending the brochure you requested, responding to enquiries, confirming bookings, sending programme logistics and follow-up communications.
- To send marketing: informing you about upcoming cohorts, alumni events, and new offerings, where you have opted in or have an existing relationship with us.
- To improve our website and marketing: understanding which content and channels are most useful to prospective participants, measuring advertising effectiveness, and improving site performance.
- To meet legal and regulatory obligations: maintaining records required under UAE law, including tax and accounting records.
- To protect our business: preventing fraud, securing our systems, and enforcing our terms.
04Legal basis for processing
Under PDPL Article 4, we process personal data on one or more of the following bases:
- Performance of a contract with you or steps taken at your request before entering one (e.g. processing your application, delivering the programme).
- Legitimate interests of Board Enhance (e.g. measuring marketing effectiveness, securing our systems, communicating with prospects who have engaged with us). We balance these interests against your privacy and only proceed where the impact on you is proportionate.
- Compliance with a legal obligation (e.g. record-keeping for tax and corporate compliance).
- Your consent, where required, for example for non-essential cookies and certain marketing communications. You can withdraw consent at any time.
07How long we keep your data
We keep personal data only as long as necessary for the purpose it was collected, in line with the storage limitation principle in PDPL Article 5.
| Data category | Retention period |
|---|---|
| Brochure requests and general enquiries (no further engagement) | 24 months from last contact |
| Applicants who did not enrol | 36 months from application |
| Enrolled participants and alumni | For the duration of the alumni relationship, then 7 years |
| Meeting requests not converted to enrolment | 12 months |
| Marketing email subscribers | Until you unsubscribe; we re-confirm engagement annually |
| Financial and tax records | 7 years (UAE Commercial Companies Law requirement) |
| Website analytics data | 26 months |
You can ask us to delete your data sooner — see section 10.
08International data transfers
Some of the service providers listed in section 5 are based outside the UAE, primarily in the United States and the European Union. When personal data is transferred to these providers, it is processed under the protections required by their own jurisdictions and our contractual arrangements with them.
Specifically:
- Google, LinkedIn and Meta process data primarily in the United States.
- Campaign Monitor processes data primarily in Australia and the United States.
- Brevo processes data primarily in the European Union.
- Netlify, Memberstack and Vimeo process data in the United States.
- MamoPay processes data primarily in the United Arab Emirates.
We rely on the data protection commitments these providers make in their data processing agreements, which include the security and confidentiality obligations required under PDPL Article 22 for cross-border transfers.
09How we protect your data
We use reasonable technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. These include:
- Encryption of data in transit (HTTPS) and at rest where supported by our providers
- Access controls — only personnel with a business need can access personal data
- Strong authentication on systems holding personal data
- Use of reputable, security-vetted service providers
- Regular review of who has access to what
No system can be guaranteed completely secure. If a personal data breach occurs that is likely to affect you, we will notify you and the UAE Data Office in line with PDPL Article 9.
10Your rights
Under PDPL Articles 13 to 19, you have the following rights in relation to your personal data:
- Right to be informed about how we use your data — this policy is part of how we meet that right.
- Right of access — to ask what data we hold about you and receive a copy.
- Right to correction — to ask us to correct inaccurate or incomplete data.
- Right to erasure — to ask us to delete your data, subject to our legal record-keeping obligations.
- Right to restrict or object to processing — particularly where we rely on legitimate interests, or for direct marketing.
- Right to data portability — to receive your data in a structured, commonly used format.
- Right to withdraw consent — where we rely on consent, you can withdraw it at any time without affecting prior processing.
- Right to lodge a complaint with the UAE Data Office if you believe we have not handled your data properly.
To exercise any of these rights, email board@boardenhance.ae. We will respond within 30 days. We may need to verify your identity before acting on a request.
11Children's data
Our services are intended for senior executives and we do not knowingly collect personal data from anyone under 18. If you believe we have collected data about a minor, please contact us and we will delete it.
12Changes to this policy
We may update this policy from time to time to reflect changes in our practices, services, or legal requirements. The date at the top of this page shows when it was last updated. For material changes, we will give prominent notice on the website or by email to people on our marketing list.
13Contact us
If you have any questions about this policy, or want to exercise any of your rights, please get in touch.
Privacy queries
Email: board@boardenhance.ae
Phone: +971 56 409 6000
Post: Level 3, Boulevard Plaza Tower One, Sheikh Mohammed bin Rashid Boulevard, Dubai, UAE