Sandoz Spa LLC ("Sandoz Academy", "we", "us") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect when you visit sandozacademy.com, enroll in our courses or contact us, how we use it, who we share it with, and your rights. We process personal data in line with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and, where applicable to students in the European Economic Area or United Kingdom, the General Data Protection Regulation (GDPR).
1. Data controller
Sandoz Spa LLC, Sharjah Media City, Sharjah, United Arab Emirates, is the controller of your personal data. Contact: support@sandozacademy.com.
2. Information we collect
Information you give us
- Identity and contact data: name, email address, phone number, country, and date of birth where needed for eligibility.
- Enrollment data: course selected, schedule, educational background, attendance, assessments and certificates.
- Billing data: billing name and address, and transaction records (amount, date, currency, course purchased).
- Communications: messages, support requests, feedback and survey responses.
Payment information
Card and payment details are collected and processed directly by Stripe, Inc. and its affiliates. We never see or store your full card number or security code. Stripe may share limited information with us, such as the last four digits of your card, card brand, expiry date and payment status. Stripe's use of your data is governed by the Stripe Privacy Policy (stripe.com/privacy). Stripe may also use your data for fraud prevention.
Information collected automatically
- Device and log data: IP address, browser type, operating system, pages viewed, referring URL and time of visit.
- Cookies and similar technologies, as described in our Cookie Policy.
Information from third parties
We may receive data from payment processors, video-conferencing or learning platforms we use to deliver courses, and employers or sponsors who enroll you.
3. How we use your information and legal bases
- To provide the Services — process enrollments, deliver classes, issue certificates (performance of a contract).
- To process payments and send receipts and invoices (contract; legal obligation).
- To prevent fraud and secure our Website and payments (legitimate interests; legal obligation).
- To communicate with you about schedules, changes and support requests (contract).
- To send marketing about new courses — only with your consent, which you can withdraw at any time via the unsubscribe link or by emailing us.
- To improve our courses and Website using aggregated analytics (legitimate interests).
- To comply with law — tax, accounting, regulatory and law-enforcement requests (legal obligation).
4. Sharing your information
We do not sell or rent your personal data. We share it only with:
- Payment processors (Stripe) to process payments and prevent fraud;
- Service providers such as hosting, email, video-conferencing, learning-management and analytics providers, under contracts requiring confidentiality and security;
- Instructors delivering your course, limited to what they need;
- Professional advisers such as auditors, lawyers and accountants;
- Authorities where required by law, court order or to protect rights and safety;
- A successor in the event of a merger, acquisition or sale of assets, subject to this policy.
5. International transfers
Some of our service providers, including Stripe, may process data outside the UAE (for example in the United States or European Union). Where this happens we take steps to ensure appropriate safeguards, such as contractual clauses, in accordance with applicable law.
6. Data retention
- Enrollment and certificate records: kept for up to 7 years so we can verify certificates.
- Payment and invoice records: kept as required by UAE tax and commercial law (normally at least 5 years).
- Marketing data: until you unsubscribe or withdraw consent.
- Website logs: normally no longer than 12 months.
After these periods, data is securely deleted or anonymised.
7. Security
We use reasonable technical and organisational measures to protect your data, including HTTPS encryption, access controls and PCI-DSS compliant payment processing through Stripe. No method of transmission over the internet is completely secure, but we work to protect your data and will notify you and relevant authorities of a data breach where required by law.
8. Your rights
Subject to applicable law, you have the right to:
- access the personal data we hold about you;
- correct inaccurate or incomplete data;
- request deletion of your data;
- restrict or object to certain processing, including direct marketing;
- receive your data in a portable format;
- withdraw consent at any time, without affecting earlier processing;
- lodge a complaint with the UAE Data Office or your local data protection authority.
To exercise your rights, email support@sandozacademy.com. We will respond within 30 days and may need to verify your identity.
9. Children
Our Services are intended for adults aged 18 and over. We do not knowingly collect data from children under 18 without parental or guardian consent. If you believe a child has given us data, contact us and we will delete it.
10. Third-party links
Our Website may link to third-party websites. We are not responsible for their privacy practices; please review their policies.
11. Changes to this policy
We may update this policy from time to time. Changes will be posted on this page with an updated date, and significant changes will be notified by email where appropriate.
12. Contact
Questions about this policy: Sandoz Spa LLC, Sharjah Media City, Sharjah, United Arab Emirates. Email: support@sandozacademy.com.