Privacy Policy

Effective date: 6 February 2026 Data controller: ITHR Technologies Consulting LLC (Dubai, UAE), operator of the Enterprise Agentic AI Academy at ithr.online.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have under the EU GDPR, the UAE Personal Data Protection Law (Federal Decree-Law 45/2021), and equivalent frameworks.

1. Data We Collect

• Account data: name, email address, password hash, professional title, organisation, and profile details you provide.
• Learning data: course enrolments, lesson progress, quiz attempts, certificates earned, and streak/goal activity.
• AI interaction data: messages you send to the AI Tutor (Aletheia) and AI Career Mentor (Solon), retained for quality review.
• Payment data: processed by Stripe. Card details never touch ITHR infrastructure; we retain only the transaction reference and plan.
• Technical data: IP address (hashed for abuse-prevention), device/browser type, and application logs.

2. How We Use Your Data

• To deliver courses, track progress, and issue verifiable certificates.
• To operate AI tutoring and mentoring features.
• To process payments and manage enterprise seats.
• To send transactional email and, with consent, product updates.
• To secure the platform, prevent abuse, and comply with legal obligations.

3. Legal Bases (GDPR)

We rely on: contract (to provide the service you signed up for), legitimate interests (security, service improvement), consent (marketing, optional WhatsApp updates), and legal obligation (tax, accounting).

4. Your Rights

Under UAE PDPL, GDPR, and equivalent frameworks you may:

• Access — request a copy of the personal data we hold about you.
• Correction — update your profile in the dashboard or via privacy@ithr.online.
• Deletion — request account deletion. Certificates remain publicly verifiable unless you also request revocation.
• Portability — request a machine-readable export of your enrolments, quiz attempts, and certificates.
• Objection — object to a specific processing purpose (e.g. marketing) with immediate effect.
• Withdraw consent — where processing relies on consent.

Response SLA: 30 days from receipt (extendable to 60 days for complex requests, with notice). To exercise any right, contact privacy@ithr.online.

5. Data Retention

6. Sharing & Sub-Processors

We share data only with vetted sub-processors needed to run the service: cloud compute & storage, CDN, transactional email, payments (Stripe), and LLM inference providers (OpenAI, Anthropic, Google) under their zero-training data-processing terms. The current sub-processor list is published on /trust and updated with 30 days' notice for enterprise customers.

7. International Transfers

Where a sub-processor operates outside the UAE / EEA, transfers rely on Standard Contractual Clauses (GDPR Chapter V) or an equivalent PDPL adequacy mechanism.

8. Cookies

We use strictly-necessary cookies for authentication (an httpOnly + Secure refresh-session cookie). We do not use third-party advertising cookies.

9. Children

The Academy is not directed at children. Individual learner accounts require a minimum age of 16.

10. Changes

We may update this Policy from time to time. Material changes will be announced via email and an on-site banner at least 30 days before taking effect.

11. Contact

• Privacy / data-subject requests: privacy@ithr.online
• General enquiries: hello@ithr.online
• Data controller: ITHR Technologies Consulting LLC, Dubai, United Arab Emirates.