Privacy Notice

Last updated: 2 September 2026 Effective: 2 September 2026

HOW TO READ THIS NOTICE

Part A applies to everyone, everywhere. Parts B to F add rights and disclosures that apply depending on where you live. Where a regional part gives you more than Part A, the regional part wins.

If you want the short version: we collect what we need to run your programs and issue your credentials, we store it in India, we share it with a university or employer only when you have said yes to that specific organisation, we do not sell it, and you can get it back or have it deleted at any time by emailing support@4excelerate.org.

PART A — GENERAL PROVISIONS

1. WHO WE ARE

Excelerate is operated by V-Empower Global Strategy Services L.L.C-FZ, a limited liability company incorporated in the Meydan Free Zone, Dubai, United Arab Emirates (formation number 2200537, commercial licence number 2200537.01), with registered office at Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates ("Excelerate", "we", "us", "our").

We are the controller of the personal information described in this notice, except where we process personal information on behalf of a school, university or other institution, in which case that institution is the controller and we act as its processor. Section 11 explains the difference and why it matters to you.

Contact: support@4excelerate.org Grievance Officer (India): Ananya Kumar — ananya@4excelerate.org

2. SCOPE

This notice covers 4excelerate.org, experience.4excelerate.org, our mobile applications, and all programs and services delivered through them (together, the "Services").

It does not cover third-party websites we link to, or the independent processing carried out by a university, school or employer with whom you engage through the Services. Those organisations have their own privacy notices.

3. WHAT WE MEAN BY "PERSONAL INFORMATION"

Information that identifies you, relates to you, describes you, or could reasonably be linked to you, directly or indirectly. It does not include information that has been aggregated or de-identified so that it can no longer reasonably be linked back to you.

4. WHAT WE COLLECT

We do not collect government identification numbers, financial account numbers, precise geolocation, biometric identifiers, health information, or information about your race, religion, political opinions, trade union membership, sex life or sexual orientation. Please do not send us this information. If a program ever requires any of it, we will tell you separately and ask for your explicit consent first.

5. SPECIAL CARE: SENSITIVE AND SPECIAL-CATEGORY INFORMATION

Some of what we collect needs extra explanation.

Working rights and visa status. We collect this because programs and employers have eligibility requirements. It can reveal your nationality or immigration status. We use it only to determine eligibility and to match you to programs you can lawfully take part in. We do not use it for any other purpose and we do not share it except with an organisation you have consented to share with.

Photographs. Your profile photograph is used to identify you within the Services and on your credential. We do not apply facial recognition or any other biometric processing to it. It is not used in marketing without your separate written consent, and never for anyone under 18.

Gender. Collected on an optional basis, used for aggregate reporting to funders and for equity monitoring. You may leave it blank or ask us to delete it at any time without affecting your access to anything.

Where the GDPR treats any of this as special category data, we rely on your explicit consent under Article 9(2)(a), and you may withdraw it at any time. Where US state law treats any of it as sensitive personal information, you may direct us to limit its use — see Part C.

6. HOW WE COLLECT IT

• Directly from you — when you register, complete a profile, submit work, contact us or make a payment.
• Automatically — through server logs and strictly necessary cookies. We use only the cookies required to sign you in, keep your session active and keep the Services secure. We do not use analytics cookies, advertising cookies, tracking pixels or conversion-measurement technologies on our marketing website or on the Excelerate platform. If that ever changes, we will ask for your consent first and update this notice before doing so.
• From others — from a school or university that enrols you; from a single sign-on provider if you use one; from a partner organisation running a program with us.

We do not buy personal information from data brokers.

7. WHY WE USE IT, AND ON WHAT LEGAL BASIS

Where we rely on consent, you may withdraw it at any time and we will stop, though we may then be unable to provide the related service. Withdrawal does not affect processing that already happened.

A note for users in India. India's Digital Personal Data Protection Act does not recognise "legitimate interests" as a general basis. Where you are in India, we rely on your consent, or on one of the Act's specified legitimate uses, as set out in the right-hand column above. See Part D.

8. WHO WE SHARE IT WITH

8.1 Universities, schools and employers. We share your registration information and work product with a partner organisation only where you, or your parent or guardian, have given specific consent naming that organisation. We tell you who the organisation is before the sharing happens.

We do not share your personal information with undisclosed partners. Any earlier statement to the contrary — including in our previous Terms of Use — is withdrawn and of no effect.

8.2 Direct contact from partners. A partner organisation will contact you directly only where you have separately opted in. Telephone and SMS contact requires its own express opt-in and is never bundled into acceptance of our terms. You can withdraw at any time.

8.3 Service providers. We use third parties to run the Services. Each is bound by a written agreement to process data only on our instructions, with appropriate security, and not for their own purposes.

A current list is available at any time from support@4excelerate.org. We will publish material changes to this list before they take effect.

8.4 Legal and safety. We may disclose personal information where we are required to by law, or where we reasonably believe it is necessary to protect the safety of any person, to investigate fraud or a breach of our terms, or to establish or defend a legal claim. Where a Participant may be at risk of harm, we will disclose to the relevant authority without delay.

8.5 Business transfers. If we are involved in a merger, acquisition or sale of assets, personal information may transfer to the acquirer, who will remain bound by this notice or give you notice of any change.

8.6 With your consent. Otherwise, only with your consent.

9. WE DO NOT SELL YOUR PERSONAL INFORMATION

We do not sell personal information for money, and we do not disclose it in exchange for other valuable consideration.

We do not use advertising, retargeting or conversion-measurement technologies on our marketing website or on the Excelerate platform, and we therefore do not "share" personal information for cross-context behavioural advertising as that term is defined under California law.

We never use personal information relating to anyone under 18 for targeted or behavioural advertising, in any jurisdiction, regardless of consent.

Universal opt-out signals. We honour the Global Privacy Control (GPC) and equivalent browser-level opt-out signals as a valid request to opt out of sale and sharing, and where technically feasible we apply it to your account and not only to that browser.

10. HOW LONG WE KEEP IT

About backups, stated plainly. When you delete your account, your data is removed from our live systems within about 10 days. It may persist in encrypted backups for up to 6 months before those backups are erased on their normal cycle. During that period the data is not accessible for ordinary use and is not restored to live systems except in a disaster-recovery event. This replaces our previous wording, which implied deleted data left backups immediately.

11. WHERE YOUR INFORMATION IS STORED, AND CROSS-BORDER TRANSFERS

11.1 Location. Personal information is hosted on Amazon Web Services infrastructure in the Asia Pacific (Mumbai) region (ap-south-1), in India. We do not currently operate infrastructure in the European Economic Area, the United Kingdom or the United States.

11.2 What this means if you are in Europe. Your personal information is transferred to and stored in India. India has not received an adequacy decision from the European Commission or the UK government. We therefore rely on:

• the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), Module One and Module Two as applicable, for transfers from the EEA;
• the UK International Data Transfer Addendum to those Clauses for transfers from the United Kingdom;
• a Transfer Impact Assessment covering Indian law and government access powers, available to institutional partners on request;
• supplementary measures including encryption in transit and at rest, access controls, and a commitment to challenge unlawful government access requests and to notify you where we are legally permitted to do so.

11.3 Other transfers. Some service providers listed in Section 8.3 process data outside India. Those transfers are covered by the same safeguards.

11.4 Institutional partners. Where a university or school requires data residency in a particular region, that must be agreed in writing before enrolment begins. We will tell you honestly if we cannot meet a residency requirement rather than agree to one we cannot deliver.

12. HOW WE PROTECT IT

Infrastructure. We host on Amazon Web Services, which maintains SOC 2 and ISO 27001 certification. These certifications cover the AWS infrastructure layer, not Excelerate's own application. We state this plainly because some vendors imply otherwise.

Our own measures.

• Encryption of data in transit using HTTPS/TLS, and encryption at rest for stored data and backups
• Identity and access management through AWS Cognito, with least-privilege access
• Multi-factor authentication required for administrative access to production systems
• Access to personal information limited to personnel who need it, with access rights formally reviewed every six months
• Logging and monitoring of access to production systems
• Written agreements with all service providers imposing equivalent obligations
• Staff confidentiality obligations and privacy training
• A documented incident response procedure

Honestly stated limits. No system is impenetrable and we cannot guarantee absolute security. You also play a part: use a strong, unique password and tell us immediately at support@4excelerate.org if you think your account has been compromised.

13. IF THERE IS A BREACH

If a breach affects your personal information we will investigate, contain it, and notify you and the relevant authorities as required by law. Specifically:

• Europe: the lead supervisory authority without undue delay and, where feasible, within 72 hours; affected individuals where there is a high risk to their rights
• India: the Data Protection Board and affected Data Principals, in the manner and time prescribed
• United States: affected individuals and state authorities as required by applicable state breach notification law; where a school is the controller, we notify the school without unreasonable delay so it can meet its own obligations, including under New York Education Law §2-d and equivalent statutes
• UAE: the UAE Data Office as required under Federal Decree-Law 45 of 2021

14. AUTOMATED DECISION-MAKING

We do not make decisions producing legal or similarly significant effects about you by solely automated means. Where automated tools assist us — for example in flagging suspected fraud or plagiarism — a person reviews the matter before any adverse decision, and you can appeal to a different person.

15. CHILDREN AND YOUNG PEOPLE

17.1 Minimum age. You must be at least 13 to hold an account. We do not knowingly collect personal information from anyone under 13. If we learn we have, we delete it promptly. If you believe we hold information about a child under 13, contact support@4excelerate.org.

17.2 Parental and guardian consent. Where a young person is below the age of consent that applies where they live, we obtain verifiable consent from a parent or guardian before the account is activated, and we record how and when it was given. The applicable ages are set out in our Terms of Use, and range from 13 to 18 depending on country. In India the threshold is 18.

17.3 What a parent or guardian can do. At any time: see what we hold about the young person; have it corrected or deleted; withdraw consent to any sharing with a university or employer; and require that work product is not shared beyond Excelerate. Contact support@4excelerate.org.

17.4 Protections that apply automatically to everyone under 18, without anyone having to ask:

• highest privacy settings by default
• no targeted or behavioural advertising, and no advertising profiling
• no tracking or behavioural monitoring for commercial purposes
• no use of image, voice or likeness in marketing, under any circumstances
• no engagement techniques designed to extend time on the platform
• no profiling producing legal or similarly significant effects

These commitments are made in line with the UK Age Appropriate Design Code and India's Digital Personal Data Protection Act, and we apply them globally rather than only where they are legally required.

17.5 Where a school enrols students. The school is the controller and we act as its processor under a written data processing agreement. We use student data only as the school instructs, do not use it for advertising or to build profiles for non-educational purposes, do not sell it, and delete or return it when the school tells us to.

16. YOUR RIGHTS

Wherever you live, you may ask us to:

• tell you what personal information we hold about you and why
• give you a copy, in a portable, machine-readable format
• correct anything inaccurate or incomplete
• delete your personal information
• stop using it for marketing
• withdraw consent you have given
• explain any decision that affects you

Additional rights apply depending on where you live — see Parts B to F.

How to ask. Email support@4excelerate.org. A subject line beginning PRIVACY helps us route it, but we act on any request that raises a right, however it is worded.

Verification. We will verify your identity before acting, normally by asking you to make the request from your registered email address or to sign in. We use anything you send for verification only to handle the request.

Timing. Within one month where the GDPR or UK GDPR applies, extendable by two further months for complex requests, in which case we tell you within the first month. Within 45 days where US state law applies, extendable once by 45 days. Otherwise within 30 days.

Cost. Free, unless a request is manifestly unfounded or excessive, in which case we will tell you before doing anything.

Authorised agents. You may use an authorised agent. We will ask for evidence of authority and may ask you to confirm directly.

If we say no. We will explain why and tell you how to challenge it, including how to complain to your regulator.

17. CHANGES TO THIS NOTICE

We may update this notice. Where a change is material, we will give you at least 30 days' notice by email and in the Services before it takes effect, along with a summary of what changed. Non-material changes take effect on posting. We keep previous versions and will provide them on request.

18. CONTACT AND COMPLAINTS

Excelerate — V-Empower Global Strategy Services L.L.C-FZ Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates Formation no. 2200537 | Commercial licence no. 2200537.01

All privacy enquiries: support@4excelerate.org Grievance Officer (India): Ananya Kumar — ananya@4excelerate.org

Please contact us first — we would rather fix a problem than have you take it elsewhere. But you always have the right to complain directly to your data protection authority, and nothing here requires you to come to us first.

PART B — EUROPE (EEA, UK AND SWITZERLAND)

This Part applies if you are in the European Economic Area, the United Kingdom or Switzerland. It supplements Part A and prevails over it where they differ.

Controller. V-Empower Global Strategy Services L.L.C-FZ, as identified in Section 1.

Legal bases. As set out in Section 7. Where we rely on legitimate interests, we have carried out a balancing assessment and will provide a summary on request.

Transfers. Your personal information is transferred to India. See Section 11.2 for the safeguards we rely on. You may request a copy of the Standard Contractual Clauses, with commercial terms redacted, from support@4excelerate.org.

Your rights. In addition to Section 16, you have the rights to: access; rectification; erasure; restriction of processing; data portability; object to processing based on legitimate interests, on grounds relating to your particular situation; and object to direct marketing at any time, absolutely and without needing a reason.

Automated decisions. You have the right not to be subject to a decision based solely on automated processing producing legal or similarly significant effects. We do not make such decisions — see Section 14.

Complaints. You may complain to the supervisory authority in your country of residence, work, or where the issue arose. In the UK this is the Information Commissioner's Office (ico.org.uk).

Data protection officer. We have assessed whether we are required to appoint a DPO under Article 37 and concluded that we are not, as our core activities do not consist of large-scale regular and systematic monitoring or large-scale processing of special category data. Privacy responsibility sits with our Grievance Officer, contactable above. We will keep this assessment under review as we grow.

Representative. We have assessed our obligation to appoint a representative under Article 27 and concluded that the derogation in Article 27(2)(a) applies: our processing of personal information relating to individuals in Europe is occasional, is unlikely to result in a risk to their rights and freedoms, and does not involve large-scale processing of special category data or data relating to criminal convictions. We keep this assessment under review and will appoint a representative if our European activity changes.

PART C — UNITED STATES

C.1 All US states with comprehensive privacy laws

This includes California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island, as those laws come into force.

Your rights: to confirm whether we process your personal information and access it; to obtain a portable copy; to correct inaccuracies; to delete; to opt out of sale, targeted advertising and profiling with legal or similarly significant effects; to limit use of sensitive personal information; and not to be discriminated against for exercising any of these.

Appeal. If we decline a request, you may appeal by replying to our decision. We will respond within 45 days with a written explanation. If we deny the appeal, we will tell you how to complain to your state Attorney General.

Universal opt-out. We honour Global Privacy Control — see Section 9.

C.2 California — additional disclosures (CCPA/CPRA)

Categories collected in the past 12 months, and to whom disclosed for a business purpose:

Retention: as set out in Section 10.

Sensitive personal information. The only information we hold that may fall within this definition is working rights or immigration status, and optional gender. We use it solely to determine program eligibility and for aggregate reporting — never to infer characteristics about you and never for advertising. Because our use is already limited to purposes permitted under §1798.121(a), the right to limit adds nothing, but you may still exercise it and we will confirm our handling in writing.

Sale and sharing. We do not sell personal information. We do not share it for cross-context behavioural advertising. See Section 9.

Minors. We do not sell or share the personal information of consumers under 16.

How to exercise. Email support@4excelerate.org with the subject line CALIFORNIA RIGHTS REQUEST.

Shine the Light. California residents may request information about disclosures to third parties for their direct marketing purposes. We make no such disclosures.

C.3 Students at US educational institutions

Where an institution designates Excelerate as a school official with a legitimate educational interest under FERPA (20 U.S.C. §1232g), we act under its direct control with respect to education records, use them only for the authorised purpose, and do not redisclose them without authorisation.

Where we operate as an operator of a K-12 service, we comply with California SOPIPA, New York Education Law §2-d, Illinois SOPPA and equivalent statutes: no targeted advertising to students, no profiles for non-educational purposes, no sale of student data, and deletion at the school's direction.

PART D — INDIA

This Part applies if you are in India, and reflects the Digital Personal Data Protection Act, 2023.

Our role. We are a Data Fiduciary. You are a Data Principal.

Where your data is. In India, in the AWS Mumbai region.

Legal basis. We rely on your consent, or on a specified legitimate use under Section 7 of the Act — principally for security, fraud prevention and compliance with law. We do not rely on "legitimate interests," which the Act does not recognise.

Notice and consent. Before or at the time we ask for consent, we tell you what we will collect, why, how to withdraw, how to complain to us, and how to complain to the Data Protection Board. Consent requests are available in English and, on request, in any language listed in the Eighth Schedule to the Constitution.

Withdrawal. You may withdraw consent at any time, as easily as you gave it. We will stop processing and delete the information unless we must retain it by law.

Children — under 18. Anyone under 18 in India is a child under the Act. We obtain verifiable parental consent before processing. We do not undertake tracking or behavioural monitoring of children, and we do not direct advertising at children. We do not process a child's data in a way likely to cause any detrimental effect on their wellbeing.

Your rights. To access a summary of your personal data and our processing; to correction, completion, updating and erasure; to grievance redressal; and to nominate another individual to exercise your rights in the event of your death or incapacity. To nominate, email ananya@4excelerate.org.

Grievance redressal. Contact our Grievance Officer, Ananya Kumar, at ananya@4excelerate.org. We will respond within the period prescribed under the Act. If you remain dissatisfied you may complain to the Data Protection Board of India. You are required to approach us before the Board.

Your duties under the Act. The Act requires you not to impersonate another person, not to suppress material information, and not to file false or frivolous grievances.

PART E — UNITED ARAB EMIRATES

This Part reflects Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

As a UAE-established controller, we process personal data lawfully, fairly and transparently, collect it for specified purposes, keep it accurate, and retain it no longer than necessary.

Your rights: to information about processing; to access and to receive a portable copy; to rectification and erasure; to restrict or stop processing; to object to processing for direct marketing or automated decision-making; and to complain to the UAE Data Office.

To exercise any of these, email support@4excelerate.org. We will respond within the period prescribed by the Decree-Law.

Cross-border transfers are made in accordance with Articles 22 and 23, on the basis of appropriate contractual safeguards.

PART F — OTHER REGIONS

Canada. We handle personal information consistently with PIPEDA's fair information principles. Commercial electronic messages are sent only with consent meeting CASL, and include sender identification and a working unsubscribe mechanism in every message. Quebec residents have rights under Law 25 including access, rectification, de-indexing and portability, and may complain to the Commission d'accès à l'information. On request we will provide this notice in French.

Australia. We handle personal information consistently with the Australian Privacy Principles. You may complain to the Office of the Australian Information Commissioner.

Brazil. Where the LGPD applies, you have rights of confirmation, access, correction, anonymisation or deletion, portability, information about sharing, and to withdraw consent. Contact support@4excelerate.org.

Anywhere else. The rights in Section 16 apply to you regardless of where you live. We would rather extend the same protections everywhere than defend a lower standard because a local law permits it.

This notice covers privacy only. Payment, refund and safeguarding terms are set out in our Terms of Use.