Privacy Policy

1. Who We Are

schoolofinsights.global is operated by Undiscovered Insights FZCO, a company registered in the United Arab Emirates under licence number 43075, with registered address at 43075-001, IFZA Business Park, DDP, Dubai Silicon Oasis, Dubai, UAE ("School of Insights", "we", "us", "our").

We are the data controller of all personal data described in this policy. For all privacy matters, contact us at team@schoolofinsights.global.

2. Governing Law

This policy is governed by the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its implementing regulations. We comply with the PDPL's principles of lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, and security.

Visitors who are residents of the European Union, European Economic Area, or United Kingdom may have additional rights under the GDPR or UK GDPR respectively. Those rights are addressed in Section 15.

3. Scope

This policy applies when you:

1. Visit the Site;
2. Take the self-reflection assessment at /assessment (the "Assessment");
3. Submit the contact form;
4. Apply for the Private Track or any programme;
5. Book or attend a discovery call;
6. Receive emails from us, including the newsletter;
7. Otherwise contact us.

Purchases of the book are made on Amazon under Amazon's own terms; we receive no personal data from those transactions. Data relating to paid programme enrolments is additionally governed by the programme agreement provided at enrolment.

4. What Data We Collect

4.1 Data you give us directly

4.2 Data collected automatically

4.3 Data we derive

On completion, an automated engine calculates your primary archetype, secondary archetype, and severity band from your answers. These derived results are personal data and receive the same protections as your answers. See Section 5.

4.4 Call recordings

Discovery calls may be recorded and transcribed (currently via Read.ai). Recording is disclosed in your booking confirmation and at the start of the call. You may decline recording and the call proceeds normally. Recordings are used internally for quality and training only and are never shared externally without your explicit consent.

4.5 What we do not collect

You do not need an account to use the Site. We do not store payment card details; those are processed directly by our payment provider. We do not purchase data about you from third parties. We do not knowingly collect data from anyone below the minimum age in Section 14.

5. Automated Processing and Profiling

Your Assessment result is generated automatically. Each answer carries weighted points toward one or more archetypes; the totals are ranked to produce your primary archetype, secondary archetype, and severity band. This determines the content of your result page and emails.

This processing has no legal effect on you and is not used to make any significant decision about you without human involvement. Every application for a session or programme is reviewed and decided by a human being. You may request a human review of your result at any time by writing to team@schoolofinsights.global.

The Assessment is an educational self-reflection tool, not a clinical instrument, and your result is not a diagnosis.

6. Purposes and Legal Bases

Under the UAE PDPL, we process personal data on the following bases:

We do not sell your personal data. We do not share your contact details with third parties for their own marketing. This is the "no list sharing" commitment made on the Site and it is binding on us.

7. Email Communications

Service emails (your result, booking confirmations) are sent because you requested the underlying service.

Marketing emails are sent only with your separate opt-in and are strictly limited to:

• Reminders at approximately 1 hour, 24 hours, and 7 days after starting an unfinished Assessment. No further reminders are ever sent after the 7-day email;
• Up to three follow-up emails about the discovery call (approximately days 1, 4, and 10 after completion), only if you have not booked. No further follow-ups are ever sent after the day-10 email;
• The newsletter, based on your choice of joining the assessment process.

Automatic stop conditions applied without exception:

• Unsubscribing stops all emails immediately;
• Completing the Assessment stops all reminder emails;
• Booking a call stops all discovery-call follow-ups;
• Replying "later" to a reminder stops reminders.

Every marketing email contains a one-click unsubscribe link requiring no login. Unsubscribes are honoured immediately. We retain your email on a suppression list solely to ensure we never contact you again.

8. Cookies and Local Storage

Strictly necessary (no consent required):

Your Assessment progress is saved in your browser's local storage — not transmitted to us — until you submit. You can clear it via "Start over" or by clearing site data for schoolofinsights.global. Essential session and security cookies are also set automatically.

Non-essential (consent required via the cookie banner before they activate):

• Analytics tracking: session ID, page views, events, UTM parameters;
• The Calendly booking widget, a third-party embed that sets its own cookies (see Calendly's policy at https://calendly.com/privacy). This widget does not load until you consent on our banner.

The cookie banner offers Accept and Reject with equal prominence. You can change your choice at any time via "Cookie settings" in the footer. Declining non-essential cookies never prevents you from taking the Assessment.

9. Security

We take the security of your data seriously. The following technical and organisational measures are in place:

In transit:

• All traffic is served over HTTPS with TLS encryption and HTTP Strict Transport Security (HSTS), so data cannot be intercepted between your browser and our servers.

At rest:

• All stored personal data is encrypted at rest. Database records are held with Row-Level Security enforced on every table, meaning each record is accessible only to the specific role authorised to read it, not to the database as a whole.

Access controls:

• Only named team members hold administrative access, granted on a strict least-privilege basis with unique credentials;
• Administrator login uses one-time passcodes (no long-lived passwords or shared credentials), with leaked-password screening applied;
• Multi-factor authentication is enforced on all administrative systems.

Operational controls:

• All third-party processors are bound by data processing agreements and confidentiality obligations before receiving any personal data;
• Application logs are scrubbed to ensure they do not contain email addresses, assessment answers, or other personal data;
• Cryptographic secrets are rotated on a documented schedule;
• Access rights are reviewed quarterly;
• Encrypted backups are taken regularly with point-in-time recovery enabled.

Breach response:

• We maintain an internal breach register;
• In the event of a breach affecting your data, we will notify you and the relevant authority without undue delay in accordance with applicable law, and we maintain a pre-drafted notification process and a nominated incident lead to ensure a rapid response.

No system can guarantee absolute security. We commit to the measures above and to acting promptly and transparently if an incident occurs. If you believe your data may have been compromised, contact team@schoolofinsights.global immediately.

10. Who We Share Data With

We share personal data only with the following service providers, each bound by a data processing agreement, and only to the extent required to operate the Services:

Amazon receives no data from us; the book link takes you to Amazon's site where their own terms apply.

We may also disclose data where required by UAE law or a lawful authority order, to professional advisers under confidentiality, or to a successor entity if our business is sold or reorganised under this same policy.

11. International Data Transfers

Some providers above are based in the United States and process data there. We ensure appropriate safeguards are in place for these transfers, including contractual protections with each provider and, where available, reliance on recognised transfer mechanisms such as the EU–US Data Privacy Framework certifications held by those providers. A record of the safeguards in place for each transfer is available on request from team@schoolofinsights.global.

12. Retention

Data is retained only for as long as necessary, enforced by a scheduled automated deletion process:

Earlier deletion applies on a valid erasure request or consent withdrawal. Expired data is deleted or irreversibly anonymised; anonymised aggregate statistics may be kept to improve the Assessment.

13. Your Rights

Under the UAE PDPL you have the right to:

1. Know what personal data we hold about you and how it is used;
2. Access a copy of your personal data;
3. Correct inaccurate or incomplete data;
4. Delete your data, subject to legal retention requirements;
5. Restrict processing in certain circumstances;
6. Object to processing based on legitimate interest;
7. Withdraw consent at any time, without affecting processing already carried out;
8. Request human review of your automatically generated Assessment result.

To exercise any right, write to team@schoolofinsights.global. We will respond within 30 days. We may ask you to verify your identity, typically by confirming from the email address on record, before acting on a request.

14. Children

The Site and Assessment are intended for adults. We do not knowingly collect personal data from anyone under 18. The Assessment includes an age confirmation before it begins. If you believe a person under 18 has provided us data, contact team@schoolofinsights.global and we will delete it promptly.

15. International Visitors — Additional Rights

EU and EEA residents have rights under the General Data Protection Regulation (GDPR), including the right to data portability (receive your data in a machine-readable format), the right not to be subject to solely automated decisions with significant legal effects, and the right to complain to the supervisory authority in your country of residence (list at https://edpb.europa.eu). The protections in this policy are structured to meet GDPR standards in practice, including the legal bases in Section 6, the security measures in Section 9, and the transfer safeguards in Section 11.

UK residents have equivalent rights under the UK GDPR and may complain to the ICO at https://ico.org.uk.

California residents have rights under the CCPA/CPRA. We do not sell or share personal information for cross-context behavioural advertising. California residents may exercise access, deletion, and correction rights by writing to team@schoolofinsights.global without discrimination.

Canadian residents are protected by PIPEDA. Every marketing email identifies us and provides a working unsubscribe in compliance with CASL.

16. Changes to This Policy

We may update this policy. The version number and effective date will change, and we will give reasonable notice of material changes on the Site. Where a change requires fresh consent, we will ask for it before it takes effect.

17. Contact

For all privacy queries, data subject requests, or security concerns: team@schoolofinsights.global

We aim to acknowledge all privacy enquiries within 5 business days and resolve them within 30 days.