Privacy Policy.

This policy covers this website and the enquiries people send us through it. Work delivered under a signed engagement is governed by the data protection and confidentiality terms of that agreement, which sit alongside this policy.

The site links to other organisations from time to time. Those sites have their own policies, and we are not responsible for them.

What you send through the contact form. Your full name, your work email address, your company name if you give one, the programme you are interested in, the message you write, and a record that you agreed to this policy when you submitted the form.

What you send by email. If you write to us directly, we hold whatever you choose to include, including your address and signature block.

Technical information. Our hosting provider keeps standard server logs, such as IP address, browser type and the time of each request, to keep the site secure and available. We do not use those logs to identify individual visitors.

Please do not send sensitive information through the form. That includes health information: our wellbeing work is educational, and we never need clinical details in order to answer an enquiry.

• No analytics. This version of the site runs no analytics product, no advertising pixels and no third-party tracking scripts.
• No profiling and no automated decision-making. A person reads every enquiry and decides how to answer it.
• No purchased or scraped contact lists, and no marketing list built out of your enquiry unless you ask us to keep in touch.
• No payment details. Nothing is bought through this website.

• To answer your enquiry and prepare a recommendation. Our basis is the steps taken at your request before entering a contract, together with the consent you give when you submit the form.
• To keep a record of enquiries and what we proposed. Our basis is our legitimate interest in running the business and being able to evidence what was discussed.
• To keep the website secure and available. Our basis is our legitimate interest in protecting the service and its users.
• To meet legal obligations. Where accounting, tax or regulatory rules require us to keep records, our basis is compliance with a legal obligation.

Where the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) applies, we rely on your consent and on the permitted purposes that law sets out. Where the EU or UK GDPR applies, we rely on Articles 6(1)(a), 6(1)(b), 6(1)(c) and 6(1)(f).

• Enquiries that do not lead to an engagement: 24 months
• Records connected to a signed engagement: for as long as the engagement runs, and then for the period required by the commercial, accounting and tax rules that apply to us.
• Server logs: the short retention period set by our hosting provider.

Once data is no longer needed for the purpose it was collected for, we delete it or strip out everything that identifies you.

We do not sell personal data, and we never share it for advertising. We share it only with:

• the provider that hosts and delivers this website;
• the email and business software we use to receive your message and reply to it;
• our professional advisers, where they need it to advise us; and
• public authorities, where the law requires us to disclose something.

Each provider acts on our instructions under a written agreement, and may use the data only to deliver the service we bought from them.

We are based in the UAE and work with clients worldwide, so your data may be handled in a country other than your own. Where a transfer is made out of the UAE, the EU or the UK, we use the safeguards those laws require, such as a finding that the destination offers adequate protection, or approved contractual clauses between us and the recipient.

The site is served over an encrypted connection. Access to enquiries is limited to the people who need it, on accounts protected by strong authentication, and that access is reviewed. No transmission over the internet is ever completely secure, which is why we ask you not to send confidential material through the form, and to agree a secure route with us first.

Depending on where you are, you have the right to:

• ask what personal data we hold about you, and get a copy;
• have inaccurate data corrected;
• ask us to delete data we no longer have a reason to keep;
• ask us to restrict how we use it while a question is resolved;
• object to use that relies on our legitimate interests, including any use for direct marketing;
• receive the data you gave us in a portable format, or ask us to send it to someone else; and
• withdraw consent at any time. Withdrawing consent does not undo anything we did lawfully before you withdrew it.

You may also complain to a regulator. Where UAE law applies, that is the UAE Data Office. Where the EU or UK GDPR applies, it is the supervisory authority for your country. We would rather hear from you first, so that we can put things right.

Write to hello@cenhconsultancy.com or use the contact form. We answer within 30 days. If a request is complex, we will tell you before that deadline and explain how long we need.

We may ask you to confirm your identity before we act, so that we do not disclose your data to someone else. There is no charge, unless a request is clearly excessive or repetitive.

This website and our services are aimed at organisations and working professionals. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, contact us and we will delete it.

We update this page when our practice changes. The date at the top shows when the current version took effect. If a change is significant, for example if we start using analytics, we will say so plainly on this page before or when it takes effect.

For anything in this policy, including a request about your own data, write to hello@cenhconsultancy.com or use the contact form.

Postal address: Dubai, UAE