Personal data protection policy

June 1st, 2023

The Company values data privacy and with the current Personal data protection policy (hereinafter referred to as the Policy) sets out how and why it collects, stores, processes Personal data.

The Company developed and will update Policy based on the UAE national laws and requirements for user privacy in order to regulate the processing of Personal data.

The Policy applies to all information that the Company can obtain about visitors, users to the website: https://academy.lacybird.com (hereinafter referred to as the website).

Main definitions

Data Subject is the natural person considered as Visitor, User of the website who is the subject of the Personal Data, to which personal data belongs (hereinafter referred to as the Subject).

Company and its contact details

Company's Website is a set of graphic and informational materials, as well as computer programs and databases, ensuring their availability on the Internet at the network address: www.academy.lacybird.com

Personal data is any information relating to an identified natural person or to a natural person who can be identified, directly or indirectly, by linking to an identifier such as name, voice, photo, image, identification number, online identifier, IP number, location data or to one or more factors specific to the physical, physiological, economic, cultural, or social identity of that natural person.

The Company may collect or process the following Subject's Personal data

1) Personal data, received from the Subject: last name, first name, patronymic, the content of communications: telephone number, e-mail address, account status.

The Company doesn't collect, store or share to any third parties credit/debit cards details and personally identifiable information. Thus, the Company doesn't have responsibility or direct control over credit or debit card account information.

In case of providing an installment payment option for Company services to Subject, Company additionally may collect or process the following Subject's Personal data: passport data, proof of domicile address such as rent/any communal services bills with Subject's last name, first name, address specified.

The purposes of processing and legal reason for collecting Personal data

• Registration on the website.
• Clarifying order details, services, or functionality.
• Responding to comments and questions.
• Sending marketing advertisements and newsletters.
• Providing an installment payment option the Company services, including communication with Subject in order to resolve possible installment payment issues in Subject's debts collection to Company.

2) Anonymized Personal data, received from the Cookies, Internet statistics services (Google Analytics and others): operating system, browser information (e.g., type, language, and history), pages and date of access, location when accessed, and IP address.

The purpose of processing and legal reason for collecting anonymized Personal data

• Providing operation and improvement, including quality improvement of the website and its content.
• Adapting user experience interaction on the website, including search results and displaying relevant promotions.
• Performing statistical data analysis

Sensitive personal data is any information that reveals, either directly or indirectly, such as a natural person's family, racial origin, political, philosophical or religious beliefs, criminal records, biometric data, or any information concerning the health of such person, including the physical, psychological, mental, genetic, or sexual status of such person, including the provision of health care services, which reveals information about his or her health status.

The Company doesn't process the sensitive personal data, including biometric and health data.

Processing personal data is defined broadly as any operation or set of operations which are performed on personal data including the collection, storage, recording, organisation, adaptation, modification, circulation, alternation, retrieval, exchanging, sharing, use, characterisation, disclosure by transmission, dissemination, distribution, or otherwise making available, alignment or combination, restriction, withholding, erasure, destruction, or creating models of personal data.

The Company processes Subject's Personal data, including automatic processing, in the following ways: collecting, storing, recording, adaptation, altering, using, distributing only in order to provide a service, updating or correcting, anonymizing, restricting, destructing.

Furthermore, the Company keeps record concerning received Personal data.

Automated Processing is processing that is carried out using an electronic program or system that is automatically operated, either completely independently without any human intervention, or partially independently with limited human supervision and intervention.

Controller is an establishment or natural person who has Personal Data and who, given the nature of his/her activity, specifies the method, criteria and purpose of Processing such Personal Data, whether individually or jointly with other persons or establishments.

The Company is considered as the Controller under the Policy hereof.

Processor is an establishment or natural person who processes Personal Data on behalf of the Controller, as directed and instructed by the Controller.

The Company and a third parties process Personal Data on behalf of the Company are considered as the Processor under the Policy hereof.

Data protection officer is natural or legal person appointed by the controller or processor to monitor the compliance of such officer's employer with the controls, requirements, procedures, and rules of the processing and protection of personal data provided for in the Law, and to ensure the integrity of the systems and procedures to ensure compliance with the provisions thereof.

The Company appoints an individual with sufficient skills and expert knowledge in Data Protection as a Data Protection Officer in cases indicated by the legislation in force.

Cookies is a small text file saved on a computer or mobile device.
It has a unique ID assigned to a device and enables the website to remember Subject's actions and preferences (such as location, language, font size and other display preferences) over a period of time, also it helps customise browsing experience.

Types of cookies

Strictly necessary cookies

Are needed to the Company to be able to provide a proper functioning website.
The Company uses these cookies to provide the functionality of the website, moreover there are cookies that the Subject can opt out of or block of use manually.
Any Subject can allow or disallow the use of cookies on their computer or device.

Persistent cookies

Are on device until they will be deleted manually or automatically.

Session cookies

Are on device as long as browser is opened and afterwards they are automatically deleted.

Analytics and performance-related cookies

Help to the Company to measure traffic patterns, a visitor's habits, to analyse trends, administer the website, track visitor's movements, and gather broad demographic information to determine which areas of the website have been visited so that the Company may improve its online products and services.
These cookies are not considered as essential to the website and the Company would always ask for Subject's consent before placing these cookies.

External Links

The Company applies all measures to provide safe and relevant external links, despite of that, Subject is advised adopt a caution before clicking any external web links mentioned throughout the website.
Subject should therefore note the click on external links at their own risk.

Social Media Platform

The website contains social sharing buttons which help share web content directly from web pages to the social media platform.
Subject is informed before using such social sharing buttons that the social media platform may track Subject's requests through the social media platform account.

Reasons for using cookies

• They are necessary for the website to function and to enable the user to make use of the online products and services provided by the Company.
• They help to personalise and optimise user's experience on the website (such as text size, language and screen resolution).

Data breach is a breach of information security and Personal Data by illegal or unauthorized access, including copying, sending, distributing, exchanging, transmitting, circulating or Processing data in a way that leads to disclosure thereof to third parties, or damage or alteration thereof during the storage, transmission and processing.

Key principles of processing Personal data

There are the fundamental conditions that the Company follows when processing Personal data for good data protection:

1. Process personal data in a fair, lawful and transparent manner.
2. Collect and process Personal data for a specified and lawful purpose, also when the purpose of processing is similar or close to the purpose for which such data is collected.
3. Process personal data which the Company really needs.
4. Keep personal data accurate, correct, updated whenever necessary and for as long as required.
5. Correct or delete, anonymize inaccurate personal data.
6. Keep personal data secure. Provide security controls for protection against any breach, infringement, or illegal or unauthorized processing.
7. Keep Personal data after fulfilling the purpose of Processing thereof in the event that the identity of Data Subject is anonymized.

Territorial scope

The Company is a worldwide business, which means Personal data may be transferred and stored as in the UAE as in the other countries which may be outside Subject's country of residence.
Prior to any transferring Company will take appropriate provisions, measures, controls, requirements and rules for protecting the privacy and confidentiality of the Personal Data as well as the Company will control that the country or territory to which the Personal Data is to be transferred has special legislation on Personal Data Protection.

Term of Personal Data Processing

The Company processes Personal data till:

• The purposes of collecting and processing will have been fulfilled, or
• Subject has requested for destruction of the processing, or
• Term of the Subject's consent has expired.

Consent of Data Subject

Consent is a clear, simple and unambiguous and easily accessible agreement provided by a Subject in written or electronic form.
Each time accessing or using the Website, providing the Company with information, including Personal Data, filling the forms located on the website www.academy.lacybird.com, Subject accepts, acknowledges and confirms the provisions described in the Policy.

The Company may process personal data without the consent of the data Subject when:

1. Processing is necessary to conclude, perform, amend and terminate a contract to which Data Subject is a party.
2. Processing is necessary for the fulfilment of specific obligations prescribed by the UAE law.
3. Processing is necessary to initiate or defend against any actions to claim rights or legal proceedings, or related to judicial or security procedures.

Subject of Personal data has the right to request for corrections of inaccurate Personal data and to restrict, erasure or destruct the processing of the Personal data at anytime in way allows to identify Subject, by sending to the Company a clear notification to the email address: lba@lacybird.ae or to its legal address.

Subject is guaranteed protection of the privacy and security of their data and not use it exclusively for promotional and marketing purposes.

The Company has the right to send to the Subject notifications about new products and services, special offers, various events or other marketing communications.

The Subject might always refuse to receive informational messages by sending a letter with clear ask to the Company to the following address: www.academy.lacybird.com.

Manage third parties

The Company doesn't share Subject information with third parties other than as to provide services and in cases described within the legislation in force.

The Company guarantees that when and if the Company directly involving a third party - service provider, the Company concludes a contract and includes into it clauses about obligations of applying reasonable and appropriate measures to protect the confidentiality and personal data (scope, subject-matter, purpose and nature of the processing, the type of personal data, and categories of data subjects) within the requirements of the UAE Data Protection Law and using the personal information only to provide the relevant service.

In case of providing an installment payment option for Company services to Subject, Subject agrees and stays notified that Company could share with third parties Subject's Personal data, such as last name, first name, patronymic and provided communications data, such as telephone number, e-mail address, passport data, proof of domicile address such as rent/any communal services bills with Subject's last name, first name, address in order to further communication with Subject necessary to resolve possible installment payment issues in Subject's debts collection to Company.

Subject right to obtain information

Data Subject, based on a request submitted thereby to the Company has the right to obtain the following information without charge:

• The types of Personal Data that is processed.
• Purposes of Processing.
• Decisions made based on Automated Processing, including Profiling.
• Targeted sectors or establishments with which Personal Data is to be shared, whether inside or outside the State.
• Controls and standards for the periods of storing and keeping Personal Data.
• Procedures for correcting, erasing or limiting Processing and objection to Personal data.
• Protection measures for Cross-Border Processing made.
• Procedures to be taken in the event of a breach or infringement of Personal Data, especially if the breach or infringement poses a direct and serious threat to the privacy and confidentiality of Personal Data.
• The process of filing complaints with the Office.

Subject right to fill a complaint

Data Subject may file a complaint with the Office if any violation of the Policy hereof or the procedures and rules established by the Office in this regard has occurred.

Personal Data Security

The Company establishes and takes appropriate technical and organizational measures and procedures to protect Subject information from loss, misuse, unauthorised access, disclosure, alteration, and destruction, including the following measures:

• Encryption of Personal Data and application of Pseudonymization.
• When a credit or debit card account information is being transmitted through the website, it will be protected by cryptographic protocols.
• Application of procedures and measures that ensure the confidentiality, safety, validity and flexibility of Processing systems and services.
• Application of procedures and measures that ensure the timely retrieval and access of Personal Data in the event of any physical or technical failure.
• Application of procedures that ensure a smooth testing, evaluation and assessment of the effectiveness of technical and organizational measures so as to ensure the security of Processing.

Data Breach

Once a data breach has been discovered, the Company:

• Assesses the nature of the breach and confirm if personal data is involved.
• Identifies what personal data has been impacted and how.
• Determines if the breach impacts the privacy, confidentiality or security of Data Subject.
• Notifies the Office and data Subject of Personal Data Breach relating to a data subject by providing information and documents: nature, form, reasons of breach; what caused the breach; approximate number of records or data subjects affected; details of the Data Protection Officer; the potential and expected effects of the data breach; a description of the actions and measures taken to rectify the data breach and minimise its effects; documentation of the infringement or breach and the corrective actions taken thereby.
• Carries out a thorough investigation to identify the source of the breach.

Changes to the Policy

The Company reserves the right to update the Policy hereof by posting notification of the update on the website, if required, obtaining Subject's consent.
Any updates will become effective immediately after posting the updates to Policy hereof.
All Subjects, visitors, users agree that the Policy to be reviewed periodically by them.
In case of Subject's disagreement to the updated Policy terms, the Company kindly asks them to terminate using of the website.

Contact us

If you have any questions about Policy hereof or information the Company have collected about a personal data, please Contact Us directly so the Company would be able to resolve any problem or request.
The Company saves the right to respond within 30 days.

June 1st, 2023