Privacy Policy

1. Who we are

The Works LMS is a service operated by The Works Holdings, a privately held company based in Dubai, United Arab Emirates ("we", "us", "our"). For everything covered by this policy in relation to our own platforms, The Works Holdings is the data controller. You can reach us at support@theworkslms.com.

2. Scope

This policy governs personal data we process as controller: data about people who visit our sites, create an individual account, or set up and administer a company account.

3. The personal data we collect

We collect only what we need to run the service:

• Account and sign-up data. Your name, email address and, for company accounts, your company name, work email domain and the number of seats you request.
• Authentication data. Login credentials and session records, handled through our authentication provider, including single-device session enforcement on licensed accounts so a seat is used by one person.
• Usage statistics. How the site is used (pages, clicks, scrolling and time on a page), counted by our own counter without cookies and without your account details. See Visitor statistics below. We do not store your network address.
• Feedback and support data. Anything you choose to send us through the voluntary feedback widget or by email.
• Learning records. For learners, course progress, test and exam results and the certificates issued to you.
• Exam sitting record. While you sit an exam we record when the exam tab is switched away from or the window loses focus, with the time, and whether the attempt was submitted late. This is kept with that attempt as part of your learning record, for as long as your learning records are kept. Staff with admin access can review flagged attempts; it is not used for automated decisions.
• Public certificate check. Anyone who holds a certificate reference, or its link or QR code, can open the public check page without an account. It shows your first name and the initial of your last name, the course, the issue date and whether the certificate is valid or has been revoked. We show this so that anyone can check that a certificate is genuine, and the basis is the agreement you enter when you take the course. If your account has no name on it we show “Learner”, never your email address. You can ask us to correct or restrict this at the address below.
• Enquiries. If you use the contact form we collect the name, email, phone number, company and message you enter, only to reply to you. The enquiry is passed to our group enquiry intake (the lead desk of our CRM) and is not stored in the learning database. We answer by email through Microsoft 365.

4. How we use your data and our lawful basis

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), we process your data on one of the following lawful bases:

• Performance of a contract. To create and run your account, deliver courses, issue certificates, assign company seats and provide support.
• Legitimate interests. To keep the service secure, prevent misuse, understand aggregate usage through privacy-preserving analytics, and improve what we offer, in a way that does not override your rights.
• Consent. For any non-essential processing. Where we rely on consent you may withdraw it at any time without affecting processing already carried out.
• Legal obligation. Where we must process data to comply with applicable law.

We practise data minimisation: we collect the least data needed for each purpose and do not use your data for automated decisions that produce legal or similarly significant effects.

5. Cookies and analytics

We use only essential cookies required to sign you in and keep your session secure. Our visitor counter is first-party, sets no cookies and does not follow you across other sites. How it works is set out in Visitor statistics below. Where any non-essential processing is introduced, we will ask for your consent first.

Visitor statistics. We count how this site is used with a counter that we run ourselves, on our own server in the European Union (Finland). No analytics company receives anything. When you open a page it records the page; the site or search engine that sent you (the page address without anything after a question mark) and any campaign tag in the link; your country and approximate city, worked out on our server from your network address, which we do not store; the type of browser and device; how long the page stayed open and how far down you scrolled; and where on the page you clicked (a position and the kind of element, such as a link or a button). This applies to the pages you see after you sign in as well. The counter is not connected to your account: it does not receive your name, your email address, your sign-in or session details, your answers, your results or anything you type, and it ignores everything inside a form. It sets no cookies. It keeps a random number in your browser tab while the tab is open; it is gone when you close the tab. To tell one visit from another within a single day it uses a code made from your network address and a secret that we change every day and then destroy, so we cannot recognise you from one day to the next or turn the code back into an address. We use the figures to see which pages and lessons help learners and to fix the ones that do not. We do not sell them and do not share them. If your browser sends a Do Not Track signal, the counter does not run. The individual records are deleted after 90 days; only totals are kept. Because we cannot link the figures to you, we may not be able to find your records if you ask; you can still write to support@theworkslms.com about this notice.

6. Your rights

Subject to the conditions in the PDPL, you have the right to:

• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• request deletion of your data;
• object to, or ask us to restrict, certain processing;
• object to and stop any processing of your data for direct marketing, including any profiling carried out for that purpose (PDPL Article 17) — you can unsubscribe from marketing email at any time using the link in that email, or by emailing us;
• receive your data in a portable, machine-readable format and, where feasible, have it transmitted to another controller;
• withdraw consent where processing is based on consent.

To exercise any of these rights, email support@theworkslms.com. We aim to respond to every request within 14 days. If we need longer for a complex request, we will tell you why and keep you informed.

7. International visitors (EU and UK)

If you are in the European Union or the United Kingdom, we extend to you rights equivalent to those under the GDPR and UK GDPR, including access, rectification, erasure, restriction, objection and portability, and the right to lodge a complaint with your local supervisory authority. We continue to apply data minimisation and rely on consent for any non-essential processing.

8. Sharing and sub-processors

We do not sell your personal data. We share it only with service providers who process it on our behalf, under contract and only as needed to run the service. Our current categories of sub-processor are:

• Hosting and delivery: a server we own and control ourselves, a Hetzner server in Falkenstein, Germany, with Cloudflare at the edge.
• Database and authentication: a self-hosted, open-source database instance on the same server; not a third-party hosted database service.
• Email: Microsoft 365.

We may also share data where required by law or to protect our rights. If we engage further sub-processors, we will hold them to equivalent data-protection obligations.

9. International data transfers

Some of our providers process data outside the UAE. We transfer personal data across borders only where an adequate level of protection exists or where appropriate safeguards are in place, such as contractual protections that meet the requirements of the PDPL, so your data stays protected wherever it is processed.

10. Security and breach notification

We use appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit and least-privilege access to systems. No system is ever completely secure. In the event of a personal data breach that poses a risk to your rights, we are committed to notifying the competent UAE authority and affected individuals without undue delay, in line with the PDPL.

11. Data Protection Officer

The PDPL requires us to appoint a Data Protection Officer once our processing meets a stated risk or volume threshold (PDPL Article 10 — high-risk processing from new technology or data volume, systematic assessment of sensitive personal data, or large-scale processing of sensitive personal data). We keep this under review as The Works LMS's enrolment grows and will name our Data Protection Officer and their contact details here the moment that threshold is met; today, direct any data-protection question to support@theworkslms.com.

12. Data retention

We keep your personal data for as long as your account is active, plus a defined wind-down period after closure during which the data may be recovered or exported before secure deletion or anonymisation, unless a longer period is required by law.

13. Children

The service is intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date below and, where appropriate, notify you through the service.

15. Contact and complaints

For any privacy question or to exercise your rights, contact support@theworkslms.com. If you are not satisfied with our response, you may lodge a complaint with the competent UAE data protection authority or, for EU and UK visitors, your local supervisory authority.

16. Governing law

This policy is governed by the laws of the United Arab Emirates as applied in the Emirate of Dubai. Any dispute is subject to the exclusive jurisdiction of the courts of Dubai (the DIFC courts excluded).