Privacy policy

1. Controller and contact

The controller for the processing of personal data on this website is:

This policy explains what personal data we collect, why we collect it, how we use it and what rights you have. It applies to all visitors to this website and its associated services.

It is aligned with the DIFC Data Protection Law 2020 (DIFC Law No. 5 of 2020) and, where applicable, with the EU General Data Protection Regulation (GDPR) and the UK GDPR.

2. What we collect and why

2.1 Server and access logs

When you visit this website our hosting provider Webflow, Inc. automatically collects technical data:

• IP address (anonymised after processing)
• Browser type and version
• Operating system
• Referrer URL
• Date and time of access
• Pages visited

Legal basis: legitimate interests (Art. 6(1)(f) GDPR / DIFC DP Law) — the security, stability and performance of the website. Logs are retained for a maximum of 30 days.

2.2 Pre-registration and enquiries

If you register your interest through the form on this website we process your name, your business email address and, where provided, your institution and the number of participants. We use these details solely to inform you about the presale, the terms and the cohort dates.

Legal basis: pre-contractual measures and consent (Art. 6(1)(a) and (b) GDPR). You may withdraw consent at any time by email to privacy@theclue.io. We retain this data for 24 months from the last contact.

2.3 Contact via WhatsApp

If you contact us through our WhatsApp link (wa.me/971568610024) your message and contact details are processed by WhatsApp (Meta Platforms Ireland Ltd) and passed to us. We use this data only to answer your enquiry.

Legal basis: pre-contractual measures and legitimate interests (Art. 6(1)(b) and (f) GDPR). Messages are retained for 24 months or until your enquiry is resolved, whichever is sooner.

2.4 Meeting scheduling via Calendly

If you book a meeting through our Calendly link, Calendly, Inc. (USA) collects your name, email address and chosen time and passes them to us so that the meeting can take place.

Legal basis: pre-contractual measures and consent (Art. 6(1)(a) and (b) GDPR). The transfer to the USA is covered by standard contractual clauses. Booking data is retained for 24 months.

2.5 Links to LinkedIn

This website links to LinkedIn (LinkedIn Ireland Unlimited Company). Clicking a link takes you off our site. We transmit no personal data to LinkedIn in doing so; any further processing is governed by LinkedIn's own privacy policy.

3. Hosting — Webflow

This website is hosted by Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA. Webflow acts as a data processor under a data processing agreement with TheClueX Education Platform Ltd. The transfer to the USA is covered by standard contractual clauses approved by the European Commission.

As part of its hosting services Webflow may process technical usage data including IP addresses and browser information.

4. Cookies and tracking

This website uses only technically necessary session data. We use no tracking cookies, no analytics scripts and no advertising pixels.

Webflow may set a technically necessary session cookie to maintain basic website functionality. This does not require consent.

If you contact us via Calendly or WhatsApp, those services may set their own cookies, governed by their respective privacy policies.

5. Data retention

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law:

• Server logs: a maximum of 30 days
• Registrations and enquiries: 24 months from the last contact, unless an ongoing engagement requires longer retention
• Contractual data: as required by commercial and tax law, typically seven years

6. International data transfers

TheClueX Education Platform Ltd is based in the Dubai International Financial Centre (DIFC), which maintains an adequate level of data protection under the DIFC Data Protection Law 2020 and is recognised as adequate for transfers from the EEA and the United Kingdom.

Where we engage service providers outside the DIFC or the EEA — such as Webflow and Calendly in the USA — we put appropriate safeguards in place before any transfer, in particular standard contractual clauses.

7. Your rights

Depending on where you are located, you have the following rights:

• Access — you may ask for confirmation of whether we process your personal data and receive a copy of it.
• Rectification — you may request correction of inaccurate or incomplete data.
• Erasure — you may request deletion where there is no compelling reason for continued processing.
• Restriction — in certain circumstances you may request that we restrict processing.
• Portability — where processing is based on consent or contract, you may receive your data in a structured, machine-readable format.
• Objection — you may object to processing based on legitimate interests.
• Withdrawal of consent — you may withdraw consent at any time without affecting the lawfulness of processing carried out beforehand.

To exercise any of these rights, write to privacy@theclue.io. We respond within 30 days.

If you believe we have not handled your data correctly, you may lodge a complaint with the DIFC Commissioner of Data Protection (difc.ae). People in the EEA may also contact their national supervisory authority.

8. Data security

We take appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration and disclosure, and review them regularly.

This website is served exclusively over encrypted HTTPS connections.

9. Children’s privacy

This offering is directed exclusively at working professionals and institutional clients. We do not knowingly collect data from anyone under 18. If you believe we hold data about a minor, write to privacy@theclue.io and we will delete it promptly.

10. Changes to this policy

We update this policy when our practices, the technology we use or the legal position change. The current version is published on this page with an updated date. We give prominent notice of material changes.

11. Governing law

This privacy policy is governed by the law of the Dubai International Financial Centre (DIFC), including the DIFC Data Protection Law 2020. Where applicable we additionally comply with the GDPR and the UK GDPR for users in those jurisdictions. The DIFC Courts have exclusive jurisdiction.