Data Protection & Privacy

1. Purpose

This policy sets out how Upstart Bar collects, uses, stores, shares, retains and protects personal information connected with its training, advisory and related professional-services activities. It is intended to protect learner and client privacy while allowing Upstart Bar to maintain the records needed for safe, effective and accountable delivery.

Upstart Bar is based in the United Arab Emirates. The organization applies the applicable UAE personal-data framework and, where an engagement falls within the scope of the EU/UK GDPR or a client requires equivalent controls, applies the relevant additional requirements.

2. Scope

This policy applies to employees, partners, contractors, freelance trainers, subject-matter experts and suppliers who handle personal information on behalf of Upstart Bar. It covers information relating to learners, client contacts, prospective participants, trainers and other individuals involved in an engagement.

Typical training records may include names, business contact details, employer and role information, attendance, registration details, pre-course survey responses, assessment or quiz results, feedback, certificate information, accessibility or support requests and engagement communications.

3. Data protection principles

• Process personal information fairly, transparently and for a clear business, contractual or learning purpose.
• Collect only the information reasonably required for the activity and avoid unnecessary sensitive information.
• Keep records accurate and allow corrections where appropriate.
• Restrict access to people who have a legitimate need to use the information.
• Retain information only for as long as it is reasonably needed and securely dispose of records that are no longer required.
• Protect information through proportionate technical, organizational and contractual safeguards.
• Do not sell learner or client personal information.

4. Collection and use of personal information

Training administration

Personal information may be used to manage registration, attendance, joining instructions, learner support, assessment, feedback, certification, client reporting, follow-up and quality assurance. Where the client organization manages registration, Upstart Bar normally receives only the information needed to deliver the agreed service.

Consent and optional uses

Consent is used where appropriate, particularly for optional communications, testimonials, recordings, newsletters or other uses that are not necessary to deliver the contracted training. A learner is not required to opt into marketing in order to participate in training.

Accessibility and support information

Information about accessibility, dietary or learner-support needs is treated as confidential and shared only with people who need it to arrange the relevant adjustment or support. Learners are not expected to disclose more information than is necessary to arrange the requested support.

5. Approved systems, storage and access

Approved working systems may include Google Workspace and Google Drive, Google Forms, OneDrive, Upstart Bar in-house systems and the proprietary training platform, depending on the engagement. Access is limited according to role and business need. Client-specific requirements may impose additional controls or restrict the systems that can be used.

• Individual accounts and appropriate password controls are used for systems holding training or client data.
• Access to folders, forms and platform records is limited to personnel with an operational need.
• Confidential client materials are not placed in public folders or shared externally without authorization.
• Company and delivery devices are expected to use appropriate screen locking, operating-system security and software updates.
• Backups and continuity arrangements are maintained using approved cloud or in-house storage as appropriate.

6. Sharing, suppliers and confidentiality

Personal information may be shared with the commissioning client, approved trainers, authorized delivery partners or technology providers where this is necessary for the agreed service. Upstart Bar uses confidentiality, non-disclosure, contractual and data-protection controls proportionate to the relationship and the sensitivity of the information.

Personal information and client confidential information must not be entered into unapproved public AI tools. Where an approved AI-supported training workflow processes learner or client information, the additional controls in our Responsible AI policies apply, including appropriate disclosure, approved data flows, vendor and tool review, minimization, retention and human oversight.

7. Retention and secure disposal

Operational training records such as registration files, raw survey exports and temporary delivery records are targeted for deletion or anonymization within 90 days after engagement close-out unless a legal, contractual, accreditation, client or quality requirement justifies a longer minimum period.

A limited record of attendance, completion, certificates, contractual evidence or quality actions may be retained for longer where needed for verification, accreditation, client reporting or legitimate business records. Separately consented contact details may be retained for newsletters or ambassador activity until consent is withdrawn or the information is no longer required.

Secure disposal may include permanent deletion from active systems and controlled deletion from normal retention locations, subject to the practical operation of provider backups.

8. Individual requests

Individuals may contact Upstart Bar to ask about the personal information held about them, request correction, raise a privacy concern, withdraw an optional consent, or request deletion or restriction where applicable. Requests should be sent to info@upstartbar.com. Upstart Bar will verify the request and respond in accordance with the applicable legal and contractual requirements.

9. Data incidents and breaches

1. Anyone who becomes aware of a suspected loss, unauthorized disclosure, access issue or other privacy incident must report it immediately to the Managing Partner or designated privacy lead.
2. Upstart Bar will take reasonable steps to contain the incident, preserve relevant evidence, assess the information affected and identify corrective action.
3. The affected client, individual, regulator or other authority will be notified where required by applicable law or contract.

10. Roles and responsibilities

• Managing Partner: overall accountability for this policy and significant privacy decisions.
• Partners and designated operational leads: ensure projects apply appropriate privacy controls and client requirements.
• Employees, trainers and contractors: collect and use only necessary information, protect confidentiality and report incidents promptly.
• Suppliers and delivery partners: comply with applicable contractual, confidentiality and privacy requirements when handling information on Upstart Bar's behalf.

11. AI-supported processing

This general privacy policy applies to all Upstart Bar processing. Where artificial intelligence is used to process learner, client or participant-authored information, the AI governance framework applies as an additional control layer rather than as a replacement for this policy.

Each material AI workflow involving learner or client data is documented and reviewed, including purpose, necessity, data categories, access, storage and retention, external provider, security, cross-border considerations and human oversight. Optional AI-supported features that rely on consent use clear, informed and affirmative learner action before the relevant processing occurs, and AI use is disclosed.

External AI providers are reviewed for privacy and security terms, retention, model-training use, sub-processors and regions, and relevant contractual requirements before learner data is sent to them. Client technology, data-classification and approved-tool requirements take precedence where they impose stricter controls. AI-supported processing does not remove the learner's right to human support, correction, complaint or escalation.

12. Review and policy compliance

This policy is reviewed annually, or earlier if there is a material legal, operational, contractual or delivery change. Material non-compliance may result in access being removed, corrective action, retraining, contractual action or other proportionate measures. Questions or concerns may be raised through info@upstartbar.com.