Privacy Policy

1. Who We Are

GulfBridge Academy ("we", "us", "our") is a sole trader business based in the United Kingdom. We operate the website gulfbridgeacademy.com and provide online Arabic language courses and GCC (Gulf Cooperation Council) career advisory services.

Data Controller: GulfBridge Academy
Email: info@gulfbridgeacademy.com
ICO Registration: C1917158 — Verify at ico.org.uk

As a UK-based business, we are subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered with the Information Commissioner's Office (ICO) under registration number C1917158. You can verify this at ico.org.uk.

2. What Data We Collect

2.1 Data you provide directly

• Contact information: First name, last name, email address, phone number (optional)
• Account and purchase information: Name, email, billing country, course or service purchased
• Payment information: Processed by Stripe — we never see or store your full card number, expiry date or CVV (see Section 5)
• Enquiry content: Messages sent via our contact form, including the type of enquiry and any personal information you choose to include
• Application data (careers): Name, email, CV, university, course of study, availability and motivation statements submitted via our internship application form
• Lead magnet sign-ups: Email address provided when requesting our free GCC Career Starter Kit

2.2 Data collected automatically

• Technical data: IP address, browser type and version, device type, operating system
• Usage data: Pages visited, time spent, links clicked, referring URL
• Cookie data: See our Cookie Policy

2.3 Data we do not collect

We do not collect special category data (health, race, religion, political opinions, sexual orientation, biometric data) unless you voluntarily disclose it in a message to us.

3. How We Use Your Data and Our Legal Basis

Under UK GDPR, we must have a lawful basis for processing your personal data. The table below explains what we do and why.

Contract performance (Article 6(1)(b))

• Processing your course or service purchase
• Sending you course access details after payment
• Providing GCC career advisory services you have purchased
• Issuing receipts, invoices and VAT records
• Processing refund requests within our 14-day guarantee period

Legitimate interests (Article 6(1)(f))

• Responding to enquiries submitted via our contact form
• Improving our website and services based on usage data
• Fraud prevention and security monitoring
• Keeping records of transactions for business purposes
• Assessing internship applications submitted to careers@gulfbridgeacademy.com

Consent (Article 6(1)(a))

• Sending you marketing emails about new courses, promotions and GCC career resources (only where you have opted in)
• Setting non-essential cookies on your device (see Cookie Policy)

Legal obligation (Article 6(1)(c))

• Maintaining financial records for HMRC — we are required to keep VAT and transaction records for 6 years

4. Marketing and Email Communications (PECR)

We comply with the Privacy and Electronic Communications Regulations 2003 (PECR) as well as UK GDPR for all electronic marketing.

What this means in practice:

• We will only send you marketing emails if you have explicitly opted in — for example, by signing up for our free GCC Career Starter Kit or ticking a marketing consent box at checkout
• Every marketing email contains a clear, working one-click unsubscribe link
• If you are an existing customer, we may send you emails about similar courses and services under the "soft opt-in" rule — you can opt out at any time
• We never send unsolicited commercial emails (spam)
• We do not share your email address with third parties for their marketing purposes

To unsubscribe from marketing emails at any time, click the unsubscribe link in any email we send, or email info@gulfbridgeacademy.com. We will action your request within 5 working days.

5. Payment Processing

All payments on our website are processed by Stripe, Inc., a PCI DSS Level 1 certified payment processor. When you enter your card details:

• Your card data is transmitted directly to Stripe's secure servers — it never passes through or is stored on our systems
• We receive only a payment confirmation, the last four digits of your card, and the payment amount
• Stripe may store your payment method details if you consent to their terms
• All transactions are encrypted using TLS 1.2 or higher

Stripe's privacy policy is available at stripe.com/gb/privacy.

VAT: We charge UK VAT at 20% on all sales. We retain VAT records as required by HMRC for a minimum of 6 years.

14-day refund guarantee: To process a refund, we will ask for your name, email address and order reference. Refund data is retained for 6 years for accounting purposes.

6. Who We Share Your Data With

We do not sell, rent or trade your personal data. We share data only with the following trusted third-party processors, and only to the extent necessary to deliver our services:

• Stripe — payment processing (UK/US). Data processing agreement in place.
• Web3Forms — contact and enquiry form submission routing to our email inbox. No data is stored permanently by Web3Forms beyond transmission.
• Email service provider — transactional emails (course access, receipts). We use a GDPR-compliant provider with a data processing agreement.
• Hosting provider — our website host processes technical logs. We use a provider operating under UK/EU adequacy decisions.

We may disclose your data to law enforcement or regulatory authorities if required to do so by law, or to protect the rights, property or safety of GulfBridge Academy or others.

7. International Data Transfers

Some of our third-party processors (including Stripe and Web3Forms) are based in the United States. When your data is transferred outside the UK, we ensure it is protected by one of the following safeguards:

• An adequacy decision by the UK Government (e.g., the UK–US Data Bridge)
• Standard Contractual Clauses (SCCs) approved by the ICO
• The processor's certification under an approved framework

You may request details of the safeguards in place for any specific transfer by emailing us at info@gulfbridgeacademy.com.

8. How Long We Keep Your Data

• Purchase and transaction records: 7 years (required by HMRC)
• Contact enquiries: Up to 2 years from the date of enquiry
• Marketing email subscribers: Until you unsubscribe or withdraw consent
• Internship applications (unsuccessful): 6 months from the date of application
• Internship applications (successful): Duration of the placement plus 6 months
• Website usage/analytics data: 26 months from collection
• Cookie data: See Cookie Policy for specific retention periods

After the applicable retention period, we securely delete or anonymise your data.

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data. To exercise any of these rights, email info@gulfbridgeacademy.com. We will respond within one calendar month.

We will never charge a fee for exercising your rights unless requests are manifestly unfounded or excessive.

10. Cookies

We use cookies and similar tracking technologies on our website. For full details of the cookies we use, their purpose and how to manage them, please see our Cookie Policy.

11. Children's Privacy

Our website and services are intended for adults aged 18 and over. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with their personal data, please contact us immediately at info@gulfbridgeacademy.com and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify active customers and subscribers by email where the changes significantly affect them

We encourage you to review this policy periodically. Continued use of our website after changes are posted constitutes your acceptance of the updated policy.

13. Contact Us and Complaints