Privacy Policy

1. About This Privacy Policy

Your privacy is important to us. This Privacy Policy sets out the basis on which Core Alpha Services FZ-LLC ("Core Alpha," "we," "our," or "us") collects, uses, discloses, and safeguards your personal information.

This Privacy Policy explains how we handle personal information collected through your interactions with us, including through our website corealphaservices.com (the "Site"), our contact and inquiry channels, and any consulting or development engagement you enter into with us. It applies globally and is designed to align with major data protection frameworks, including the EU General Data Protection Regulation (GDPR), the UK Data Protection Act 2018 / UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), Brazil's LGPD, India's DPDP Act, South Africa's POPIA, Australia's Privacy Act, and, as our home jurisdiction, the United Arab Emirates Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE PDPL").

If you have questions or concerns about this Privacy Policy, please contact us using the details in Section 17.

2. About Us

Core Alpha Services FZ-LLC is a technology consulting firm registered in the United Arab Emirates, designing, developing, and deploying digital education platforms and intelligent learning systems for institutions and organizations globally. For the purposes of this Privacy Policy, we act as the data controller for personal information described in this document, unless expressly stated otherwise (see Section 7 regarding client-engagement data, where we may act as a processor).

3. Personal Information We Collect

3.1 Information you provide directly. We collect personal information when you submit our Site's contact form, email us directly, request a proposal, register interest in a project, or otherwise communicate with us. This typically includes your full name, email address, organization name, job title, and the content of your message.

3.2 Client and engagement information. Where you or your organization engage us for a project, we collect additional information under a separate Master Services Agreement (MSA) or Statement of Work (SOW), including business contacts, technical specifications and, where a client authorizes it, limited end-user data necessary to build, test, or support a platform.

3.3 Information collected automatically. Our Site automatically collects certain technical and usage information through cookies and similar tools, including IP address, browser type and language, operating system, device information, referring URL, time zone, timestamps, and general page-view and traffic statistics. See Section 6 for more detail on cookies.

3.4 Information from third parties. We may receive limited information about you from professional or business contacts, referral partners, or publicly available business sources (for example, a colleague introducing us for a project).

We do not collect voice recordings, biometric data, or social/video content through this Site. Those categories, where applicable to a specific product, are governed by that product's own privacy policy (see Section 8).

4. How We Use Your Personal Information

We use personal information to fulfil the following purposes:

• To respond to inquiries and requests submitted through our contact form or by email.
• To evaluate, scope, and prepare proposals for potential consulting or development engagements.
• To perform and administer our obligations under an MSA/SOW with an existing client.
• To maintain business records for active and prior client and partner relationships.
• To operate, secure, and improve our Site, including through aggregated analytics.
• To send occasional updates about our services or portfolio, where you have opted in, and which you may opt out of at any time.
• To comply with applicable legal, tax, contractual, and regulatory obligations.

We do not sell personal information to third parties, and we do not use Site-visitor data to train artificial intelligence models.

5. Legal Bases for Processing

We rely on the following legal bases to process your personal information: (i) consent, where you have agreed to receive marketing communications; (ii) performance of a contract, where processing is necessary to respond to your inquiry or to deliver services under an MSA/SOW; (iii) legitimate interest, such as securing and improving our Site or maintaining business records; and (iv) legal obligation, such as statutory recordkeeping or responding to a lawful request from a public authority. In accordance with the UAE PDPL, we establish a specific legal basis for each processing activity before it begins.

6. Cookies and Other Technologies

Our Site uses cookies and similar technologies to recognize your browser, remember preferences, and understand aggregate traffic patterns.

Strictly necessary cookies: required for the Site to function correctly.

Performance / analytics cookies: collect anonymized information about how visitors use the Site, such as page views and traffic sources, so we can improve performance and content.

We do not run third-party advertising networks or targeted-advertising cookies on this Site. Where required by your jurisdiction (e.g., EU/UK/EEA), we present a cookie banner before loading non-essential cookies. You can manage or withdraw cookie consent at any time through your browser settings; please note that blocking strictly necessary cookies may affect Site functionality.

7. How We Share Your Personal Information

We do not sell your personal information. We may share it in the following circumstances:

• With our corporate affiliates, to coordinate business operations.
• With vendors and service providers who support our infrastructure (e.g., website hosting, email delivery, analytics), bound by confidentiality obligations.
• With a client, where information you submit relates specifically to a proposed or active engagement with that client.
• For business transfers, in the event of a merger, acquisition, or sale of assets, subject to continued protection of your information.
• Where required by law, regulation, court order, or governmental request.

Where a project is delivered for a third-party client, Core Alpha may act as a data processor or sub-processor for that platform's end-user data under the terms of the governing MSA/SOW, rather than as controller under this Policy.

8. Third-Party Links and Affiliated Products

Our Site may reference or link to digital products we have designed, built, or independently operate, including Malegado (language learning) and Scolarai (AI-powered e-learning), as portfolio examples of our work. Each such product maintains its own separate Privacy Policy governing its end users; this Policy does not apply to those products. Our Site may also link to other third-party websites for your convenience; we do not control and are not responsible for their privacy practices, and we encourage you to review their policies independently.

9. Your Rights as a Data Subject

Subject to applicable law, you have the right to:

• Know what personal information we hold about you and request access to it.
• Request correction of inaccurate or incomplete personal information.
• Request deletion of your personal information, subject to legal or contractual retention requirements.
• Object to, or request restriction of, certain processing activities.
• Request a portable copy of personal information you have provided to us.
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Not be discriminated against for exercising any of these rights.

10. How to Exercise Your Rights

You may exercise any of the rights above by emailing privacy@corealphaservices.com. To protect your information, we may need to verify your identity before completing certain requests. We will respond within the timeframe required by applicable law or, where none is specified, within 30 days of receiving a verifiable request. Some rights may be subject to exceptions or limitations under applicable law.

11. Data Retention and Deletion

We retain personal information only as long as necessary to fulfil the purposes described in this Policy, including satisfying legal, accounting, or reporting requirements. Contact and inquiry data is generally retained for as long as needed to respond to and follow up on your request. Client engagement data is retained per the terms of the applicable MSA/SOW. Upon a valid deletion request, we will delete or anonymize your personal information unless we are legally required or permitted to retain it.

12. How Secure Is Your Personal Information

We design our systems with your security and privacy in mind and implement technical and organizational measures, including HTTPS/TLS encryption, role-based access controls, and routine security review, intended to protect personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Data Breaches

In the event of a data breach affecting your personal information, we will take reasonable steps to contain and remediate the incident and will notify affected individuals and relevant authorities where required by applicable law, including the UAE PDPL and, where applicable, the GDPR.

14. Children's Privacy

Our Site and services are directed at businesses, institutions, and professional partners, and are not intended for use by children. We do not knowingly collect personal information from individuals under 16 years of age. If you believe a child has submitted personal information to us, please contact us at privacy@corealphaservices.com so we can promptly delete it.

15. Where We Store Your Personal Information

Personal information is stored in secured databases and servers, which may be located in the United Arab Emirates or other jurisdictions where we or our service providers operate. Where personal information is transferred across borders, we rely on appropriate safeguards, such as Standard Contractual Clauses (SCCs) and, where applicable, Transfer Impact Assessments (TIAs), consistent with the UAE PDPL and other applicable frameworks.

16. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be reflected by an updated "Last Reviewed" date at the top of this page, and, where appropriate, communicated to you directly. We encourage you to review this page periodically.

17. How to Contact Us