Privacy Policy

1. Introduction

ESM Business School ("ESM", "we", "us", or "our") is committed to protecting the privacy and personal data of all individuals who interact with our website at www.esmbusinessschool.com (the "Website"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit or interact with the Website.

We operate under the laws of the United Arab Emirates (UAE), including the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE PDPL"). We also recognise the privacy rights of international visitors, including those protected under the European Union General Data Protection Regulation ("GDPR") and similar data protection legislation in other jurisdictions. Where relevant, we apply the higher applicable standard.

By using the Website, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with its terms, please do not use the Website.

2. Who We Are

Data Controller / Data Fiduciary:

• Name: ESM Business School
• Location: United Arab Emirates
• Website: www.esmbusinessschool.com
• Contact for Privacy Matters: privacy@esmbusinessschool.com (or via the contact form on the Website)

ESM Business School is an education services provider offering information about university programmes, partnerships with academic institutions, and related educational guidance. Enrolment, tuition fees, and payment transactions are handled entirely offline and are outside the scope of this Website.

3. Scope of This Policy

This Privacy Policy applies exclusively to personal data collected through or in connection with the Website, including:

• Submitting enquiry forms on the Website
• Communicating with us via WhatsApp links or buttons embedded on the Website
• Browsing or navigating any page of the Website
• Any automated data collected through cookies or similar tracking technologies

This Policy does not cover:

• Personal data collected during offline enrolment or consultation processes
• Data shared via telephone calls, in-person meetings, or email initiated outside the Website
• Third-party websites linked to from the Website (see Section 14 below)

4. Personal Data We Collect

4.1 Data You Provide Directly

When you submit an enquiry through the contact form on the Website, we collect the information you enter, which may include:

• Full name
• Email address
• Phone number (if provided)
• Subject or programme of interest
• Your message or enquiry

When you initiate contact via a WhatsApp button or link on the Website, you are redirected to the WhatsApp messaging platform. Any data you share within WhatsApp is governed by WhatsApp's (Meta Platforms Ireland Limited) own privacy policy. We receive and retain the messages you send to us, including your WhatsApp display name and phone number.

4.2 Data Collected Automatically

When you visit the Website, certain technical information is collected automatically, including:

• IP address and approximate geographic location (country/city level)
• Browser type and version
• Operating system and device type
• Pages visited, time spent on pages, and navigation paths
• Referring URL (the page you visited before arriving at our Website)
• Date and time of your visit

This data is collected through server logs, our hosting provider (Vercel), and any analytics tools we use. It is used in aggregate form to understand how users interact with the Website and to improve the quality and performance of our service.

4.3 Cookies and Similar Technologies

The Website uses cookies and similar technologies. Please refer to Section 10 (Cookie Policy) for full details.

4.4 Data We Do Not Collect

We do not collect the following categories of sensitive personal data through the Website:

• Payment card numbers or banking information (no online payments are processed through the Website)
• Government-issued identification numbers
• Biometric data, health data, or genetic data
• Racial or ethnic origin, political opinions, religious beliefs, or trade union membership
• Criminal conviction or offence data

5. Legal Basis for Processing

We process your personal data only where we have a valid legal basis to do so. Depending on the data and the purpose, the legal basis may be one or more of the following:

• Consent: You have freely given, specific, informed, and unambiguous consent to the processing of your personal data for one or more specific purposes. You may withdraw consent at any time.
• Legitimate Interests: Processing is necessary for the purposes of the legitimate interests pursued by ESM Business School, such as responding to your enquiry, improving our Website, and communicating information about our programmes, provided these interests are not overridden by your fundamental rights and freedoms.
• Legal Obligation: Processing is necessary for compliance with a legal obligation to which ESM is subject under UAE law or applicable international law.

For visitors from the European Economic Area (EEA) or the United Kingdom, the legal bases above correspond to Articles 6(1)(a), 6(1)(f), and 6(1)(c) of the GDPR respectively.

6. How We Use Your Personal Data

We use the personal data we collect for the following purposes:

1. To respond to your enquiries: We process your name, email address, phone number, and message to respond to questions you submit through the contact form or WhatsApp.
2. To improve the Website: We use automatically collected technical data and analytics to understand how users interact with the Website, identify issues, and enhance the user experience.
3. To maintain security and prevent fraud: We may process IP addresses and usage data to detect and respond to suspicious or malicious activity.
4. To comply with legal obligations: We may process data where required to do so by applicable law, regulation, court order, or governmental authority.
5. To communicate educational information: With your consent, we may send you follow-up information about programmes, events, or updates relevant to your enquiry. You may opt out at any time.

7. Sharing of Personal Data

We do not sell, rent, or trade your personal data to third parties. We may share your data in the following limited circumstances:

7.1 Service Providers (Data Processors)

We engage trusted third-party service providers who process data on our behalf, strictly under our instructions and in accordance with data processing agreements:

Formspree, Inc. Purpose: Receives and transmits enquiry form submissions to us. Data shared: Name, email, phone, message content. Privacy policy: https://formspree.io/legal/privacy-policy/

Sanity AS : Purpose: Content management system powering Website content. Data shared: No personal visitor data is stored in our Sanity CMS. Privacy policy: https://www.sanity.io/legal/privacy

Meta Platforms (WhatsApp) : Purpose: Communication via WhatsApp when you choose to contact us through WhatsApp links. Data shared: Governed by WhatsApp's privacy policy; we receive and retain messages you send. Privacy policy: https://www.whatsapp.com/legal/privacy-policy

7.2 Legal Disclosure

We may disclose your personal data to law enforcement agencies, regulatory authorities, courts, or other government bodies where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of ESM Business School, our users, or others.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or a portion of ESM Business School's assets, your personal data may be transferred to the relevant successor entity, subject to the same protections described in this Policy.

8. International Data Transfers

ESM Business School is based in the UAE. Our service providers, including Formspree, Vercel, and Sanity, are headquartered in the United States and Norway respectively. By submitting data through the Website, your information may be transferred to and processed in countries outside your country of residence.

Where data is transferred outside the UAE, we ensure that adequate safeguards are in place as required under the UAE PDPL. Where data is transferred outside the EEA (for EEA-based visitors), we rely on appropriate legal mechanisms such as Standard Contractual Clauses (SCCs) approved by the European Commission, or the equivalent safeguards maintained by our processors.

9. Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law:

• Enquiry form submissions : Up to 3 years from last contact (legitimate interest in follow-up; limitation periods)
• WhatsApp messages : Up to 3 years from last contact (maintaining communication records)
• Website usage / server logs : Up to 90 days via Vercel (security and performance monitoring)
• Cookie data : Per cookie type (see Section 10 for details)

After the applicable retention period, personal data is securely deleted or anonymised.

10. Cookie Policy

10.1 What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work efficiently, to remember your preferences, and to provide information to website owners about how their sites are used.

10.2 Cookies We Use

The Website may use the following categories of cookies:

• Strictly Necessary Cookies: These are essential for the Website to function correctly and cannot be switched off. They do not require your consent.
• Analytics / Performance Cookies: These help us understand how visitors interact with the Website by collecting and reporting information in aggregate, anonymised form. If used, these may include tools such as Google Analytics or Vercel Analytics. These cookies require your consent where applicable.
• Functionality Cookies: These allow the Website to remember choices you make to provide a more personalised experience.

10.3 Managing Cookies

You can control and/or delete cookies at any time through your browser settings. Most browsers allow you to view, delete, or block cookies. Please note that restricting cookies may impact the functionality of the Website. For more information, visit www.aboutcookies.org or your browser's help documentation.

11. Your Privacy Rights

Depending on your country of residence, you may have the following rights with respect to your personal data. We will respond to verified requests within 30 days, or as required by applicable law.

11.1 Rights Under UAE PDPL

Under UAE Federal Decree-Law No. 45 of 2021, you have the right to:

1. Access: Request a copy of the personal data we hold about you.
2. Correction: Request correction of inaccurate or incomplete personal data.
3. Deletion: Request deletion of your personal data, subject to our legal obligations to retain it.
4. Restriction: Request restriction of processing of your personal data in certain circumstances.
5. Withdrawal of Consent: Where processing is based on your consent, withdraw that consent at any time without affecting the lawfulness of prior processing.
6. Object: Object to processing based on legitimate interests where your interests override ours.

11.2 Rights Under GDPR (for EEA / UK Visitors)

In addition to the rights above, visitors from the EEA or the United Kingdom have the following additional rights:

1. Data Portability: Receive your personal data in a structured, machine-readable format and transmit it to another controller, where technically feasible.
2. Lodge a Complaint: File a complaint with your local data protection supervisory authority. EU authorities: https://edpb.europa.eu/ UK residents: https://ico.org.uk/

11.3 How to Exercise Your Rights

To exercise any of these rights, please contact us at:

• Email: privacy@esmbusinessschool.com
• Contact Form: Available on our Website at /contact

We may ask you to verify your identity before processing your request. We will not charge a fee for reasonable requests but reserve the right to refuse manifestly unfounded or excessive requests.

12. Data Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

• HTTPS encryption on all Website communications (SSL/TLS)
• Secure hosting on Vercel's enterprise-grade infrastructure
• Form submission data transmitted securely via Formspree's encrypted endpoints
• Access controls limiting who within ESM Business School can access personal data
• Regular review of our information security practices

However, no method of transmission over the Internet or electronic storage is 100% secure. If you have reason to believe that your interaction with us is no longer secure, please notify us immediately.

13. Children's Privacy

The Website is not directed at children under the age of 18. We do not knowingly collect personal data from children under 18. If you believe we have inadvertently collected data from a minor, please contact us immediately at privacy@esmbusinessschool.com and we will take prompt steps to delete such data.

14. Third-Party Links

The Website may contain links to websites and services operated by third parties, including partner university websites, social media platforms, and educational resources. We have no control over the content, privacy practices, or policies of those third-party sites and accept no responsibility or liability for them. We encourage you to read the privacy policies of any third-party websites you visit.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this Policy and post the revised Policy on the Website. Where required by law or where changes are material, we will notify you by email or through a prominent notice on the Website. Your continued use of the Website after changes are posted constitutes your acceptance of the updated Policy.

16. Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of the United Arab Emirates, including the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Any disputes arising in connection with this Policy shall be subject to the exclusive jurisdiction of the competent courts of the UAE. This does not limit the rights of data subjects resident in other jurisdictions to seek remedies before their local supervisory authorities or courts where applicable law so permits.

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way we handle your personal data, please contact us:

• Privacy Enquiries: privacy@esmbusinessschool.com
• Website: www.esmbusinessschool.com
• Contact Form: www.esmbusinessschool.com/contact
• Location: United Arab Emirates

This Privacy Policy was prepared in good faith and does not constitute legal advice. ESM Business School recommends seeking qualified legal counsel to verify compliance with all applicable data protection laws.