Digital Citizenship UAE (the “Platform”) is operated by the designated UAE government authority responsible for national digital literacy and online safety education. We act as the Data Controller for all personal data processed through the Platform.

This Privacy Policy applies to all users, including registered learners, guest visitors, organisational administrators, and government employees accessing the Platform in a professional capacity.

We collect only the data necessary to provide a safe, functional, and personalised learning experience:

Your personal data is used exclusively for the following purposes:

• Platform operation: To create and manage your Account, authenticate your identity, and provide access to appropriate learning modules.
• Learning personalisation: To recommend modules, assign learning pathways, and track your progress against national digital citizenship objectives.
• Certification: To issue, verify, and maintain records of digital certificates earned on the Platform.
• Organisational reporting: To provide aggregate completion and compliance data to your employer or government entity where you are enrolled through an organisational account.
• Platform improvement: To analyse anonymised usage patterns and improve course content, user experience, and accessibility.
• Legal compliance: To respond to lawful requests from UAE government authorities and comply with applicable UAE laws.
• Communications: To send you service notifications, certificate confirmations, and — where consented — platform updates.

Under the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“PDPL”), we process your personal data on the following lawful bases:

• Consent: Where you have provided clear, informed consent, such as for optional marketing communications or additional profile information.
• Contractual necessity: Processing required to operate your Account and deliver the Platform services you have enrolled in.
• Legal obligation: Where processing is required to comply with UAE law, including reporting obligations to relevant government authorities.
• Public interest: Processing carried out in the execution of official national digital literacy.
• Public interest: Processing carried out in the execution of official national digital literacy and public safety programmes as authorised by UAE government mandate.
• Legitimate interests: For Platform security, fraud prevention, and anonymised analytics, where these do not override your fundamental rights.

We do not sell, rent, or trade your personal data. Data may be shared only in the following limited circumstances:

• Your organisation: If you enrolled through an employer or government entity, that organisation may access aggregate progress data and completion reports. They will not receive your individual assessment responses.
• Service providers: Trusted third-party technology providers (e.g. cloud hosting, email delivery) who process data strictly on our behalf under data processing agreements.
• UAE government authorities: Where required by law, court order, or formal regulatory request under applicable UAE legislation.
• National cybersecurity operations: Anonymised or aggregated threat intelligence data may be shared with UAE national security bodies for the purposes of protecting critical digital infrastructure.

We retain your personal data only for as long as necessary to fulfil the purposes described in this Policy or as required by UAE law:

• Active Account data: Retained for the duration of your Account and for 3 years following last login activity.
• Learning records & certificates: Retained for 7 years to support verification requests and compliance audits.
• Technical logs: Retained for 90 days, unless required for an active security investigation.
• Support communications: Retained for 2 years following resolution of the relevant enquiry.

When your data is no longer required, it will be securely deleted or anonymised in accordance with our data disposal procedures.

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• Data encryption in transit (TLS 1.2+) and at rest (AES-256).
• Multi-factor authentication for Platform administrators.
• Role-based access controls limiting staff access to personal data on a need-to-know basis.
• Regular security assessments, penetration testing, and vulnerability scanning.
• 24/7 monitoring aligned with UAE national cybersecurity standards.

We use cookies and similar technologies to operate and improve the Platform. We do not use third-party advertising cookies.

• Essential cookies: Required for the Platform to function, including session management and authentication. Cannot be disabled.
• Functional cookies: Remember your preferences such as language settings and display options.
• Analytics cookies: Collect anonymised data about how users navigate the Platform so we can improve the user experience. You may opt out via your Account Settings.

You can manage non-essential cookies at any time through the Cookie Preferences panel in your Account Settings or via your browser settings.

Under the UAE PDPL and applicable law, you have the following rights regarding your personal data:

To exercise any of these rights, contact our Data Protection Officer (Section 12). We will respond within 30 days. Some requests may be subject to identity verification.

The Platform offers educational content for users aged 13 and above. For users under 18, we apply additional protections:

• Parental or guardian consent is required at registration for users under 18.
• We do not knowingly collect personal data from children under 13. If we become aware that data has been collected from a child under 13 without appropriate consent, we will delete it promptly.
• Student-specific modules deployed through schools or educational institutions are subject to additional data minimisation requirements.
• Parents and guardians may contact our Data Protection Officer to review, correct, or delete their child’s data.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the “Effective” date at the top of this page.
• Display a notification banner on the Platform for registered users.
• Send an email notification to the address registered with your Account, where the change is significant.

Your continued use of the Platform after the effective date of any updated Policy constitutes your acceptance of those changes.