Privacy Policy

1. Introduction

Enrolia L.L.C-FZ (formerly VNSCO L.L.C-FZ) ("Enrolia", "we", "us" or "our") provides marketing, enquiry-management and admissions-support services to schools, universities, nurseries, training providers and other education organisations (each an "Educational Partner").

This Privacy Policy explains how we collect, receive, record, organise, store, use, analyse, disclose, transfer, restrict, delete and otherwise process Personal Data when you:

• access an Enrolia website or an admissions landing page operated by or with Enrolia;
• respond to an advertisement for an Educational Partner;
• submit an enquiry, request information, start an application or book a visit, tour, consultation, assessment or admissions call;
• communicate with Enrolia or an Educational Partner by telephone, WhatsApp, SMS, email, online form, social media or another channel;
• provide information about a prospective student; or
• otherwise interact with our marketing or admissions-support services.

This Privacy Policy applies to prospective students, parents, legal guardians, family members, authorised representatives, website visitors and other persons who communicate with us.

Enrolia is a marketing and admissions-support channel. Enrolia is not the Educational Partner and does not itself admit or enrol students, deliver the Educational Partner's educational services, determine official fees, decide grade or programme placement, or make final admissions decisions. Those matters remain the responsibility of the relevant Educational Partner under its own policies and procedures.

2. Who Is Responsible for Your Personal Data

Responsibility depends on the context in which Personal Data is processed.

2.1 Enrolia as Controller

Enrolia acts as a Controller when it determines why and how Personal Data is processed for its own legitimate business purposes, which may include:

• operating and securing Enrolia websites, landing pages, forms and communication systems;
• receiving and routing enquiries;
• maintaining records of consent and communication preferences;
• preventing fraud, spam and misuse;
• measuring and improving Enrolia's services;
• administering relationships with Educational Partners;
• complying with Enrolia's legal and regulatory obligations; and
• establishing, exercising or defending legal claims.

2.2 Educational Partner as Controller

The relevant Educational Partner generally acts as a separate Controller when it determines why and how Personal Data is processed for its admissions, enrolment, educational, safeguarding, financial or student-record purposes.

The identity of the relevant Educational Partner will normally be shown on the advertisement, landing page, enquiry form or communication through which you interact with us. The Educational Partner may provide its own privacy notice, admissions terms, consent forms and retention rules.

2.3 Enrolia as Processor or Service Provider

Where Enrolia processes Personal Data only for and on the documented instructions of an Educational Partner, Enrolia acts as that partner's Processor or authorised service provider. In that capacity, Enrolia may collect enquiries, contact prospective families, qualify enquiries, arrange appointments, maintain communication records and support the partner's admissions team within the agreed service scope.

In some activities, Enrolia and an Educational Partner may each have responsibilities under applicable law. You may contact either organisation about its own Processing. If a request primarily concerns an Educational Partner's admissions or student records, we may refer or transmit the request to that partner.

3. Scope

This Privacy Policy applies to Personal Data collected through or in connection with:

• Enrolia websites and partner-branded admissions landing pages operated by or with Enrolia;
• website and advertising lead forms;
• telephone calls and call records;
• WhatsApp, SMS, email, online chat and social-media communications;
• school tours, campus visits, consultations, assessments, appointments, admissions events and open days;
• customer relationship management and admissions-support systems;
• advertising, analytics and attribution platforms; and
• other authorised marketing or admissions channels.

This Privacy Policy does not replace the privacy terms of an Educational Partner or of third-party services that you independently use. Those organisations may process Personal Data under their own privacy notices.

If an enquiry progresses to a formal application or enrolment, additional terms, student privacy notices, safeguarding policies, consent forms and record-retention requirements of the Educational Partner may apply.

4. Applicable Law

We process Personal Data in accordance with laws and regulations that apply to the relevant Processing. These may include the laws of the United Arab Emirates, including Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data, applicable consumer-protection, telemarketing and electronic-communications requirements, and other applicable federal, Emirate-level or free-zone requirements.

An Educational Partner may be subject to additional education, safeguarding, student-record or sector-specific requirements. Where an enquiry concerns an Educational Partner or programme outside the UAE, the laws of another jurisdiction may also apply.

Nothing in this Privacy Policy excludes or restricts a right or obligation that cannot lawfully be excluded or restricted.

5. Definitions

For this Privacy Policy:

• "Controller" means a person or organisation that determines the purposes and means of Processing Personal Data.
• "Data Subject" means the identifiable individual to whom Personal Data relates.
• "Educational Partner" means the education organisation identified in the relevant advertisement, landing page, form or communication, or another education organisation that you ask Enrolia to help you contact.
• "Partner Page" means a partner-branded website, landing page, form or digital experience operated by or with Enrolia.
• "Personal Data" means information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on Personal Data, including collection, recording, organisation, storage, use, analysis, transfer, disclosure, restriction, deletion or destruction.
• "Processor" means a person or organisation that processes Personal Data on behalf of and under the instructions of a Controller.
• "Prospective Student" means a child or adult about whom an enquiry, application or request for information is made.
• "Sensitive Personal Data" means information afforded additional protection under applicable law, which may include health, disability, biometric, genetic, religious and other protected information.
• "Services" means Enrolia's marketing, enquiry-management and admissions-support services.

6. Personal Data We May Collect

The Personal Data we collect depends on the way you interact with us and what is reasonably necessary for the relevant enquiry.

6.1 Parent, guardian, applicant or enquirer information

We may collect:

• name, telephone number, WhatsApp number and email address;
• country, city or area of residence, nationality, preferred language and time zone;
• relationship to the Prospective Student and authority to act for them;
• preferred Educational Partner, programme, location and communication channel;
• employer or corporate-affiliation information where relevant to an authorised benefit;
• tour, appointment and intake preferences;
• communication and marketing preferences; and
• other information you voluntarily provide.

6.2 Prospective Student information

We may collect:

• name, age or date of birth;
• gender where relevant and lawfully requested;
• nationality and current country, city or Emirate of residence;
• intended academic year, intake, start date, grade, year group, course or programme;
• current or previous school and curriculum;
• language information and general academic background;
• sibling information;
• information needed to understand basic eligibility or arrange an assessment, meeting or tour;
• general information about educational or support needs where voluntarily disclosed; and
• other information relevant to the initial enquiry.

We do not generally require detailed medical records, psychological assessments, biometric data, passport or identity-document copies, visa documents or financial information through a general marketing enquiry form. Such information should be submitted only when specifically requested through an authorised and appropriately secured formal admissions channel.

6.3 Enquiry and admissions-support information

We may collect:

• date, time and source of the enquiry;
• advertisement, campaign, page, form, programme or Educational Partner connected to the enquiry;
• questions, notes, call outcomes and follow-up history;
• appointment, event and tour status;
• requested actions and documents;
• application, offer and enrolment status where supplied by you or the Educational Partner;
• reasons for postponing or not progressing, where provided; and
• attribution information used to evaluate marketing and admissions-support performance.

6.4 Communications information

We may collect and retain:

• emails, messages, web-form submissions and correspondence attachments;
• telephone call logs, dates, duration, outcomes and voicemail messages;
• admissions-support notes, confirmations and reminders;
• consent records, withdrawals, opt-outs and do-not-contact requests; and
• complaint, privacy-request or dispute correspondence.

Where permitted by law and after any legally required notice, calls may be recorded for training, quality assurance, record-keeping, complaint handling, safeguarding, security, fraud prevention and legal compliance.

6.5 Technical, advertising and referral information

When you access a website, Partner Page or advertisement, we or authorised providers may collect:

• IP address and approximate location derived from it;
• browser, device, operating-system, language, screen and time-zone information;
• referring page or application, pages viewed, links selected and visit duration;
• form interactions, submissions, errors and diagnostic information;
• cookie, device, advertising, campaign, click and conversion identifiers;
• advertisement, search term, campaign and traffic-source information;
• security, anti-spam and access logs; and
• aggregated advertising and audience-performance information.

6.6 Information from third parties

We may receive Personal Data from:

• an Educational Partner;
• advertising and lead-generation platforms;
• a parent, guardian, spouse, family member or other authorised representative;
• an employer, relocation adviser or education consultant;
• technology, communications and analytics providers; or
• public or official sources where verification is reasonably necessary and lawful.

If you provide Personal Data about another person, you confirm that you are authorised to do so and to permit its use as described in this Privacy Policy.

7. Children's Personal Data

Our general enquiry channels are intended primarily for parents, legal guardians and adults authorised to make an education enquiry. Children should not independently submit Personal Data without the knowledge and involvement of a parent or legal guardian.

By providing Personal Data about a child, you confirm that you are the child's parent or legal guardian, or are otherwise properly authorised to provide the information and communicate about the child.

If we reasonably believe that a child submitted Personal Data without appropriate adult involvement, we may restrict its use, seek confirmation from a parent or guardian, delete it, discontinue communication or take another appropriate protective step.

8. Sensitive Personal Data

Do not submit Sensitive Personal Data through a general enquiry form unless it is directly relevant and specifically requested through an authorised channel.

If Sensitive Personal Data is provided before it is requested, Enrolia may restrict access, transfer it to the appropriate Educational Partner, request resubmission through a secure channel, delete unnecessary copies, or retain it where required by law or reasonably necessary to protect the relevant person.

Formal applications may be governed by additional notices issued by the Educational Partner.

9. Why We Process Personal Data

We may process Personal Data to:

• identify and communicate with you;
• respond to enquiries and provide requested information;
• identify the relevant Educational Partner, programme, grade, year group, intake or location;
• explain the relevant enquiry or application process;
• create, maintain, route and update enquiry records;
• qualify enquiries and request relevant additional information;
• arrange calls, tours, consultations, assessments, appointments, events or open days;
• support progression to an Educational Partner's formal application process;
• coordinate with the Educational Partner's authorised admissions team;
• provide reminders and directly related follow-up;
• avoid duplicate records and maintain communication history;
• attribute enquiries and enrolments to campaigns and measure performance;
• improve advertisements, websites, forms, communications and admissions-support workflows;
• train and supervise authorised representatives and service providers;
• create aggregated or anonymised reports, forecasts and analysis;
• prevent spam, fraud, misuse, impersonation and unauthorised access;
• maintain system, network and information security;
• protect prospective students, families, staff and other persons;
• administer Educational Partner and supplier relationships;
• comply with legal, regulatory, audit and record-keeping requirements;
• investigate complaints, privacy requests and disputes; and
• establish, exercise or defend legal claims.

Submitting an enquiry does not guarantee admission, availability, assessment, an offer, enrolment, a particular fee, scholarship, discount, visa or any other outcome.

10. Legal Grounds for Processing

Depending on the context and applicable law, we may process Personal Data where:

• you have consented;
• you requested information, contact or another action;
• Processing is necessary to take steps at your request before a possible contract;
• Processing is necessary to perform a contract;
• Processing is necessary to comply with a legal or regulatory obligation;
• Processing is necessary to protect legal rights, security, safety or the interests of a relevant person;
• Processing is permitted for operational, statistical, research, fraud-prevention or other lawful purposes subject to applicable safeguards; or
• another legal ground or exception applies.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect Processing already carried out lawfully, and it does not require deletion where another lawful ground for Processing or retention applies.

11. Enquiries, Contact and Sharing with Educational Partners

When you submit an enquiry about an identified Educational Partner, you request and authorise Enrolia to:

• receive and process the enquiry;
• contact you using the details and channels you provide;
• share the enquiry and relevant follow-up information with that Educational Partner; and
• support communications between you and that Educational Partner for admissions, application, tour, assessment and enrolment purposes.

The information shared may include contact details, Prospective Student information, enquiry content, communication records, call notes, appointment or tour status, application status, enrolment status and information needed to resolve service-quality or attribution issues.

If you submit a general request for education options without identifying a partner, we may use your information to understand your preferences and suggest potentially relevant Educational Partners. We will not send identifiable enquiry information to a partner unless you have asked us to contact that partner, agreed to the introduction, or another lawful basis permits the disclosure.

Enrolia may contact you a reasonable number of times about an active or recent enquiry, requested information, an appointment, an incomplete application, a relevant intake or an admissions event connected to your request.

12. Direct Marketing and Communication Preferences

Subject to applicable law and consent requirements, Enrolia or the relevant Educational Partner may send information about admissions opportunities, programmes, tours, open days, deadlines, scholarships, fee arrangements, availability and other relevant education services.

You may opt out of general promotional communications at any time by using an unsubscribe facility, replying "STOP" or "UNSUBSCRIBE" where appropriate, informing the caller or representative, or contacting us using Section 25.

An opt-out from general marketing does not prevent responses to an active enquiry, appointment or tour confirmations, requested information, application-related messages, safeguarding communications, legally required notices or other necessary service messages.

We may retain a limited suppression record to ensure that your opt-out is respected. Enrolia and an Educational Partner may maintain separate marketing lists, so you may need to direct an opt-out request to both organisations.

Marketing calls and messages will be managed subject to applicable requirements concerning consent, permitted times, caller identification, frequency, transparency, record-keeping and do-not-call or opt-out controls.

13. Cookies and Similar Technologies

Websites and Partner Pages may use cookies, pixels, tags, web beacons, scripts, local storage, software development kits and similar technologies to:

• provide the website, forms and requested functionality;
• maintain security and prevent spam;
• remember language, privacy and interface choices;
• measure visits, traffic sources, form completion and technical performance;
• attribute enquiries and enrolments to campaigns;
• measure and improve advertising; and
• build, use or exclude advertising audiences where permitted.

Depending on the actual configuration, providers may include Google, Google Analytics, Google Ads, Google Tag Manager, Meta, Facebook, Instagram, CRM providers, hosting providers, form providers, anti-spam providers and other authorised technology providers. A provider's inclusion in this Policy does not mean it is active on every page at all times.

Where a consent tool is available, you can use it to accept, reject or change preferences for non-essential technologies. You may also manage cookies through your browser. Blocking technologies may affect form operation, preferences, campaign attribution, security checks or other functionality.

14. Recipients of Personal Data

We may disclose Personal Data where reasonably necessary to:

• the Educational Partner identified in or selected through your enquiry;
• Enrolia personnel and authorised representatives who need access for their work;
• authorised admissions, call-centre, communications and appointment-support providers;
• website, hosting, cloud, CRM, forms, email, messaging, telephone, scheduling, storage, backup, security and technical-support providers;
• advertising, analytics and attribution providers, subject to applicable law and consent choices;
• professional advisers, including lawyers, auditors, insurers, accountants, consultants and cybersecurity advisers;
• courts, regulators, law-enforcement bodies, education authorities and other competent authorities where required or permitted by law;
• a purchaser, successor, investor, lender or adviser involved in a genuine corporate transaction, subject to appropriate safeguards; and
• another person where you request the disclosure or where another lawful basis applies.

An Educational Partner is not authorised by Enrolia to use enquiry data for purposes incompatible with the relevant introduction, its own privacy notice or applicable law. Once the Educational Partner receives Personal Data as a separate Controller, its own privacy practices also apply.

15. Enrolia's Limited Admissions Role

Enrolia may assist with advertising, Partner Pages, enquiry collection, initial responses, enquiry qualification, appointment scheduling, follow-up, admissions-team coordination, reporting and campaign measurement.

Unless expressly stated in writing by the Educational Partner, Enrolia:

• does not make final admissions or enrolment decisions;
• does not guarantee admission, an offer, availability, a visa or enrolment;
• does not determine official tuition fees, discounts or scholarships;
• does not determine grade, year-group or programme placement;
• does not conduct the Educational Partner's formal academic, safeguarding or eligibility assessment;
• does not provide the Educational Partner's educational services; and
• cannot waive or vary the Educational Partner's formal requirements or policies.

Final decisions and official information must be confirmed by the relevant Educational Partner.

16. No Sale of Personal Data

We do not sell Personal Data submitted through our general enquiry channels. We do not intentionally disclose identifiable enquiry data to unrelated third parties for their independent marketing without consent or another appropriate legal ground.

Use of Educational Partners and authorised service, advertising, analytics, communications and cloud providers for the purposes described in this Policy is not treated by us as a sale of Personal Data.

17. International and Cross-Border Processing

Enrolia, an Educational Partner or an authorised provider may be established in, store information in, route communications through, or permit remote access from a country other than the country where you are located. Personal Data may therefore be transferred to or accessed from other jurisdictions.

Where cross-border Processing occurs, Enrolia will take measures required or reasonably appropriate under applicable law. These may include evaluating the recipient and destination, relying on a lawful transfer mechanism, using contractual protections, limiting purpose and access, applying confidentiality and security safeguards, obtaining consent where required, and taking additional measures where appropriate.

Privacy laws in another country may differ from those in your country.

18. Security

We use reasonable and proportionate technical and organisational measures designed to protect Personal Data against unauthorised access, unlawful Processing, accidental loss, destruction, alteration, disclosure, misuse and other security threats.

Measures may include access controls, authentication, encryption in transit, logging, monitoring, backups, system updates, confidentiality obligations, provider review, incident-response procedures, data minimisation and secure deletion.

No internet transmission, electronic communication or storage method is completely secure. You are responsible for securing your devices, accounts, telephone number, passwords and communication channels.

19. Personal Data Breaches

If we become aware of a Personal Data breach, we may investigate and contain it, preserve evidence, assess affected information and potential consequences, take remedial measures, cooperate with relevant providers and Educational Partners, and notify competent authorities or affected persons where required by law.

20. Accuracy

You are responsible for ensuring that information you provide is accurate, complete and not misleading. Please notify Enrolia or the relevant Educational Partner if your contact details, preferences, relationship to a Prospective Student, requested intake or other material information changes.

21. Retention

We retain Personal Data only for as long as reasonably necessary for the relevant purpose and for legal compliance, security, audit, complaint handling, safeguarding, dispute resolution and legal claims.

Unless a longer period is required or justified:

• general enquiries that do not progress may ordinarily be retained for up to 24 months after the last meaningful interaction;
• active enquiries may be retained throughout the relevant admissions cycle and reasonable follow-up period;
• information transferred to a formal application or student-record system may be retained by the Educational Partner under its own policies and legal obligations;
• consent, preference and suppression records may be retained as needed to demonstrate compliance and respect opt-outs;
• call recordings, technical logs and analytics information may be retained for a reasonable period appropriate to their purpose and configured provider settings; and
• information relevant to an actual or anticipated complaint, investigation or dispute may be retained until the matter and applicable limitation or enforcement periods have ended.

At the end of the relevant period, information may be deleted, securely destroyed, anonymised or irreversibly aggregated.

22. Automated Processing and Aggregated Information

We may use limited automated tools to route enquiries, identify sources, detect duplicates, fraud or spam, categorise enquiries, create reminders, measure conversion and attribution, and prioritise administrative follow-up using objective enquiry information.

Enrolia does not make final admissions decisions solely through automated Processing. Final admissions decisions are made through the Educational Partner's process.

We may create anonymised or aggregated information that is not reasonably capable of identifying an individual and use it for analysis, forecasting, benchmarking, reporting, service improvement and other lawful business purposes.

23. Your Privacy Rights

Subject to applicable law, identity verification and lawful exceptions, you may have rights to:

• obtain information about Processing and recipients;
• access or receive a copy of your Personal Data;
• correct inaccurate or incomplete Personal Data;
• request deletion, restriction or suspension of Processing;
• object to direct marketing and related profiling;
• withdraw consent;
• request transfer of Personal Data where applicable;
• object to certain automated decisions or request human review;
• submit a complaint; and
• exercise other rights provided by applicable law.

These rights are not absolute. A request may be limited or refused where permitted by law, including where Processing or retention is required for legal compliance, safeguarding, security, fraud prevention, evidence, another person's rights, suppression records or legal claims.

24. How to Exercise Your Rights

Contact Enrolia using Section 25 and describe your request, your contact details, the relevant Prospective Student or Educational Partner, the approximate date of the interaction and information that will help us locate the records.

We may request information reasonably necessary to verify identity or authority, locate records, prevent unauthorised disclosure and clarify the request. A representative may be required to provide evidence of authority.

We will respond within the period required by applicable law. We may forward or refer a request to the relevant Educational Partner where it controls the records concerned.

25. Contact Details

Privacy questions, requests, complaints, corrections, consent withdrawals and marketing opt-outs may be directed to:

Enrolia L.L.C-FZ
6th Floor, Meydan Grandstand
Nad Al Sheba, Dubai, UAE
Email: info@enrolia.ae

Please use "Privacy Request" in the subject line where appropriate.

Do not send passport copies, identity documents, medical records, payment-card information or other highly sensitive documents by ordinary email unless specifically requested through an approved channel.

You may also contact the relevant Educational Partner using the details shown on its website, Partner Page, application system or privacy notice.

26. Complaints

We encourage you to contact Enrolia or the relevant Educational Partner first so the concern can be investigated. You may also have the right to complain to a competent data-protection, education, telecommunications, consumer-protection or other authority, or seek another remedy available under applicable law.

27. External Services, Messaging and Social Media

Websites and Partner Pages may link to Educational Partner websites, application systems, maps, payment services, social networks, video platforms and other external services. We do not control their availability, content, security, cookies, data collection, terms or privacy practices.

If you communicate through WhatsApp, Facebook, Instagram or another third-party service, that platform may independently process account, device, content and metadata information under its own terms, potentially outside the UAE. Deleting a message from your device may not delete copies lawfully retained by Enrolia, an Educational Partner or the platform.

Do not send highly sensitive student documents through social media, general messaging or ordinary email unless an authorised representative directs you to an approved secure method.

28. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our Services, Educational Partner arrangements, technologies, providers, practices or legal requirements. The updated version will be published with a revised "Last Updated" date.

Where a material change requires additional notice or consent, we will take reasonable steps to provide it or obtain consent.

29. Language

This Privacy Policy is provided in English and may be translated. Where Arabic or another language is legally required to prevail, that legally controlling text will prevail. Otherwise, the English version published by Enrolia will govern to the extent permitted by law if there is a material inconsistency.

30. General Provisions

If any provision is invalid, unlawful or unenforceable, the remaining provisions continue to apply. Headings are for convenience and do not affect interpretation. Delay in exercising a right is not a waiver. This Privacy Policy must be interpreted consistently with mandatory applicable law, which prevails in the event of a conflict.