How we collect, use and protect personal data.
Last updated: 19 October 2026
This website and the Arkadia e-learning platform are operated by Arkadia Digital Training L.L.C (Trade Licence No. 1603405; KHDA Permit No. 633905), JLT Cluster V, JBC 2, Office 1504, Dubai, United Arab Emirates ("Arkadia", "we", "us"). We are the controller of the personal data described in this policy, except where we process learner data on behalf of an Institution under its instructions, as set out in our agreement with that Institution.
You can contact us about privacy at [email protected].
Enquiries. When you contact us or request a presentation: first and last name, institution, role, work email, phone number, approximate number of participants, your message and the version of this policy you were shown.
Learner and staff accounts. When you are enrolled on the platform: name, work email, institution, role, job title and phone number if you add them, login details, interface language, course progress, time spent on lessons, assessment attempts and results, certificates issued, notes you write, messages you send in course chats and to our staff, and your acceptance of our terms.
Emails we send. Records of the service emails we send you (invitations, welcome messages, certificates) and whether they were delivered.
Technical data. IP address, device and browser information, pages requested, and security logs, processed to deliver and protect the website and the platform. Each sign-in to the platform is recorded with its date and time, IP address and browser.
Analytics. With your consent only, Google Analytics measures how the public website is used (pages visited, approximate location from the IP address, device and browser). It never runs on the e-learning platform, and advertising and data-sharing features are switched off. You can withdraw consent at any time from "Cookie settings" in the footer.
Activity log. Sign-ins, enrolments, lessons completed, assessment results, certificates and acceptance of the terms appear in the platform's activity log. Arkadia administrators can see it; the contact of your institution sees the activity of the people of that institution only, without IP addresses or browser information.
We do not ask for special categories of personal data, such as data on health, religion or political opinions, and we ask you not to send them to us.
To answer your enquiry and prepare a proposal (our legitimate interest in responding to requests, or steps you asked us to take before a contract). To provide the training, track completion, assess learning and issue and verify certificates (performance of the contract with you or your Institution). To report completion and Continuing Professional Development (CPD) hours to your Institution and, where required, to the CPD accreditation body (contract and legitimate interest). To keep the Services secure, prevent fraud and misuse, and keep records of acceptance of our terms (legitimate interest and legal obligations). To comply with the law and with requests of competent authorities (legal obligation). Where we rely on your consent, you can withdraw it at any time.
We do not sell personal data and we do not use it for advertising. We share it only with: your Institution, for learners it has enrolled; the CPD accreditation body, where needed to evidence accredited training; our service providers, which process data on our behalf under written contracts that protect it, namely Cloudflare (website hosting, content delivery and security), Supabase (platform database, authentication and file storage), Resend (sending service emails), Zoho (our email mailboxes) and, with your consent, Google Ireland Ltd (website statistics through Google Analytics); professional advisers bound by confidentiality; and authorities, where the law requires it.
Platform data is stored by third-party providers bound by written contracts. You can ask us for the list of providers at any time. Our providers may also process data in other countries, including the United States and the European Union. Where data leaves the country in which it was collected, we transfer it only as permitted by the applicable law, for example to countries recognised as providing adequate protection or under standard contractual clauses or equivalent safeguards. You can ask us for a copy of the safeguards that apply.
Enquiry data: up to 24 months after our last contact. Learner records, results and certificates: for as long as the account is active. When access ends, the learner can still download their certificates for 90 days, after which the account, records and certificates are deleted, unless the law requires us to keep them longer. Sign-in records and security logs: 24 months. Data is then deleted or anonymised.
Subject to the law that applies to you, you can ask us to access your personal data, correct it, delete it, restrict or object to its processing, receive a copy of it in a portable format, and withdraw consent. You will not be subject to decisions based solely on automated processing that have legal or similarly significant effects on you. To exercise your rights write to [email protected]. We will reply within the time required by law, usually within one month. Where your Institution enrolled you, we may forward your request to it.
You can also complain to the competent data protection authority (see section 10).
We protect personal data with technical and organisational measures, including encryption in transit and at rest, access controls with least privilege, row-level access rules in our database, protection of administrative actions by multiple approvals, and providers with recognised security certifications. If a personal data breach is likely to put your rights at risk, we will notify you and the competent authorities as required by law.
We use strictly necessary cookies and local storage, and, with your consent, Google Analytics cookies for statistics. See our Cookie Policy, and change your choice any time from "Cookie settings" in the footer.
United Arab Emirates. We process personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and its implementing regulations.
Kingdom of Saudi Arabia. Where the Personal Data Protection Law applies to our processing of data of individuals in Saudi Arabia, you have the rights it grants, and you can complain to the Saudi Data and AI Authority (SDAIA).
European Economic Area. Where the General Data Protection Regulation (GDPR) applies, the legal bases in section 3 apply as stated. You can complain to the supervisory authority of the country where you live or work.
United Kingdom. Where the UK GDPR applies, the same rights apply. You can complain to the Information Commissioner's Office (ico.org.uk).
Switzerland. Where the Federal Act on Data Protection applies, you have the rights it grants, and you can complain to the Federal Data Protection and Information Commissioner (FDPIC).
We may update this policy. The date at the top shows when it was last changed, and we will tell you about material changes by email or on the platform.