Privacy & Data Protection Policy

Data Protection, Privacy & Information Security Policy

Public policy · Approved for website publication

1. Purpose and Scope

SpacePoint is committed to protecting personal information and maintaining appropriate information security throughout its educational programs, events, products, websites, learning platforms, research collaborations, and business operations. This policy applies to SpacePoint personnel and, where relevant, its service providers and contractors. It is intended to serve as a public privacy notice and an organizational statement of minimum security commitments.

2. Information We Collect

Depending on the service, SpacePoint may collect names, contact details, organization or school affiliation, age or age range, parent/guardian and emergency contact details where necessary, enrollment and attendance records, project submissions, assessments and learning progress, photographs or recordings where authorized, payment and invoice records, professional correspondence, and technical records such as IP addresses, account identifiers, platform logs and device information. We seek to collect only information reasonably necessary for stated purposes.

3. How We Use Information

We use information to register participants; deliver workshops, competitions and courses; manage the SpacePoint learning platform; communicate schedules and progress; issue certifications; provide support; safeguard participants; manage transactions and contractual relationships; improve program quality using appropriate analysis; comply with legal obligations; and, where permitted, publish event stories or send marketing communications. We will not use information for materially incompatible purposes without an appropriate legal basis and notice.

4. Lawful Processing and Choice

We process personal data using an appropriate basis permitted by applicable law, which may include consent, the performance of a contract, compliance with legal duties, or other legally available grounds. Where consent is required, it should be specific and recorded, and individuals may withdraw it where applicable. Optional marketing communications and promotional image use are subject to appropriate choices.

5. Children and Student Safeguarding

For participants under 18, SpacePoint takes particular care to obtain appropriate authorization from a parent, guardian, school or other authorized institution as required by the activity and applicable law. Before using identifiable student photographs, testimonials, videos or work for promotional purposes, SpacePoint seeks appropriate permission. Student access is limited according to educational and operational needs. We do not intentionally collect more information about children than is necessary.

6. Sharing and International Transfers

Information may be shared on a need-to-know basis with authorized instructors, host institutions, event organizers, payment and technology providers, certificate issuers, professional advisers, and competent authorities when legally required. We require service providers handling personal information to apply appropriate confidentiality and security protections. Where data is transferred outside the UAE, SpacePoint will assess the applicable transfer requirements and use appropriate safeguards.

7. Retention and Deletion

We retain information only as long as reasonably necessary for the purposes described, agreed contractual needs, dispute resolution, and applicable legal or accounting obligations. Retention periods vary by record type and will be set in an internal retention schedule. On expiry, information will be securely deleted, anonymized or archived where legally justified.

8. Individual Privacy Rights

Subject to applicable law and exceptions, individuals may request information about their data, access, correction, deletion, restriction or cessation of certain processing, transfer where applicable, and withdrawal of consent. Requests may be sent through the designated privacy contact listed below. SpacePoint will verify identity where necessary and respond within applicable legal requirements.

9. Information Security Controls

SpacePoint adopts risk-appropriate administrative, technical and physical safeguards, including least-privilege account access, strong authentication, role-based permissions, secure configuration and patching, appropriate encryption in transit and at rest, controlled sharing, backups, vendor assessment, staff confidentiality commitments, and secure disposal. Personnel are expected to report suspected security incidents promptly. Controls are reviewed as systems and risks evolve; no system can be guaranteed completely secure.

10. Security Incidents

Suspected personal-data breaches or unauthorized access must be escalated immediately to the designated information-security lead. SpacePoint will contain and investigate incidents, preserve relevant evidence, assess potential harm, and make notifications to affected individuals or competent authorities where legally required.

11. Cookies and Third-Party Services

SpacePoint websites and learning portals may use essential cookies and, where enabled, analytics or other optional technologies. Any non-essential technologies will be described through an appropriate cookie notice or consent mechanism where required. Linked third-party services have their own policies.

12. Contact and Updates

Privacy and security requests: [email protected]. Company: SpacePoint (UAE-based organization; registered entity name and address to be confirmed on the website before publication), United Arab Emirates. Website: https://spacepoint.ae. SpacePoint may update this policy as operational, legal or technical requirements evolve, identifying the effective date of the current approved version.

Policy accountability and approval

Policy owner: SpacePoint management (designated policy owner to be assigned internally). Approved by: Abdullah AlSalmani, Co-Founder & CEO. Review cycle: At least annually or sooner if legal or operational requirements change.

Publication, Contacts and Approval

Approved by: Abdullah AlSalmani, Co-Founder & CEO, SpacePoint.

Publication date: 25 October 2026. Review: At least annually and when relevant legal or operational changes occur.

Primary contact: [email protected]. Secondary contact / escalation: [email protected].

For access, correction, withdrawal of consent or other privacy-related requests, email [email protected] with sufficient detail to help locate the relevant records. Please avoid sending passwords or unnecessary sensitive information by email.