Privacy Policy

Please read this Privacy Policy carefully, as it contains important information about how UniHawk Education Support Services L.L.C (“Company”, “we”, “us”, or “our”) collect, store, use and share any information relating to you (your personal data) in connection with your use of our HawkNest platform, including our website and mobile application, and related features and functionalities (together, the “Platform”). It also explains your rights in relation to your personal data and how to contact us or a relevant regulator in the event you have a complaint.

We collect, use, and are responsible for certain personal data about you. When we do so, we are subject to UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and any applicable implementing regulations, as well as other applicable UAE laws and regulations governing the processing of personal data from time to time (UAE Data Protection Law).

This version of our privacy policy is primarily written for users of our Platform, including students, parents and guardians of child users.

This privacy policy is divided into the following sections:

1. What this policy applies to
2. Personal data we collect about you
3. How your personal data is collected
4. How and why we use your personal data
5. Marketing
6. Who we share your personal data with
7. How long your personal data will be kept
8. Transferring your personal data out of the UAE
9. Cookies and other tracking technologies
10. Your rights
11. Keeping your personal data secure
12. Privacy of Minors and Users Aged 13+
13. Changes to this privacy policy
14. How to contact us

1. What this policy applies to

This privacy policy relates to your use of our Platform.

2. Personal data we collect about you

The personal data we collect about you depends on the particular activities carried out through our Platform. We will collect and use the following personal data about you:

• your name, parent/guardian name, address, school affiliation, passport copy and contact information, including email address and telephone number;
• information to check and verify your identity, e.g., date of birth;
• location data, if you choose to give this to us;
• details of any information, notes, feedback or other matters you give to us by phone, email, post or via social media;
• your activities on, and use of, our Platform;
• information about the services we provide to you;
• academic records (including transcripts, enrolment details, report cards and test scores);
• profile information such as grade, curriculum, academic interests, goals, intended study destinations and preferences;
• school and cohort identifiers (including Unique Student Code (UniCode) for use of our Platform, student ID, and school name);
• responses to assessments, questionnaires, or AI-driven guidance tools within the Platform;
• documents uploaded by you (e.g., transcripts, certificates);
• app usage data, analytics, logs, crash reports, and performance metrics;
• your internet protocol (IP) address, region, or general location where your computer or device is accessing the internet, browser type, operating system and device type;
• a record of third party websites accessed when you visit on our Website and clicks on a hyperlink; and
• your responses to surveys, competitions and promotions.

Sometimes you can choose if you want to give us your personal data and let us use it. Where that is the case we will tell you and give you the choice before you give the personal data to us. We will also inform you if declining to share that personal data will affect your ability to use our Platform or any services.

We collect and use this personal data for the purposes described in the section ‘How and why we use your personal data’ below.

3. How your personal data is collected

We collect personal data from you:

• directly, when you enter or send us information, such as when you register, use the Platform (including HawkNest features), contact us, send feedback, upload documents, complete assessments, or participate in surveys; and
• indirectly, such as your browsing activity or usage activity on our Platform; we will usually collect information indirectly using the technologies explained in the section on ‘Cookies and other tracking technologies’ below.

We also collect personal data about you from other sources. The categories of sources from which we collect information include:

• schools, educational institutions, counsellors, or partner organisations that onboard you onto the Platform (including student rosters and consent status);
• Social Networks and other locations that serve or assist in serving our advertisements;
• Documents submitted in support of university or academic program applications;
• Consent and authorization forms issued by us for the purpose of enabling the provision of our services to you.
• Online and offline registration forms;
• Marketing campaigns and digital promotions (website, social media, email).
• Joint Marketing that we engage for joint marketing activities; and
• Publicly-available sources, including information in the public domain.

4. How and why we use your personal data

Under the data protection law, we can only use your personal data if we have a proper reason, eg:

• where you have given consent
• to comply with our legal and regulatory obligations
• for the performance of a contract with you or to take steps at your request before entering into a contract, or
• for our legitimate interests or those of a third party

We use your personal data, specifically for the following purposes:

• Providing services to you and perform our contract with you or to take steps at your request before entering into a contract;
• Conducting checks to identify you and verify your identity or to help prevent and detect fraud against you or us, to minimise fraud that could be damaging for you and/or us;
• Enforcing legal rights or defend or undertake legal proceedings and protect our business, interests and rights;
• Analytics and improvement of the Platform using aggregated and anonymised data;
• Generating personalised career guidance, recommendations, and academic pathways (including through AI tools);
• Customising our Platform, and its content to your particular preferences based on a record of your selected preferences or on your use of our Platform, where your consent is gathered or in cases where we are not required to obtain your consent and do not do so, for our legitimate interests, i.e., to be as efficient as we can so we can deliver the best service to you at the best price. If you have provided such a consent, you may withdraw it at any time by reaching out to our Data Protection Officer (this will not affect the lawfulness of our use of your personal data in reliance on that consent before it was withdrawn);
• For retaining and evaluating information on your recent visits to our Platform and how you move around different sections of our Platform for analytics purposes to understand how people use our Platform so that we can make it more intuitive or to check our Platform is working as intended in order to be as efficient as we can so we can deliver the best service to you at the best price. If you have provided such a consent you may withdraw it at any time by reaching out to our Data Protection Officer (this will not affect the lawfulness of our use of your personal data in reliance on that consent before it was withdrawn);
• Communications with you not related to marketing, including about changes to our terms or policies or changes to the services or other important notices, in order to be as efficient as we can so we can deliver the best service to you at a competitive price;
• Protecting the security of systems and data used to provide the services. We may also use your personal data to ensure the security of systems and data to a standard that goes beyond our legal obligations, and in those cases our reasons are for our legitimate interests, i.e. to protect systems and data and to prevent and detect criminal activity that could be damaging for you and/or us;
• Statistical analysis to help us understand our student base so as to be as efficient as we can so we can deliver the best service to you at competitive prices;
• Updating and enhancing student records, to perform our contract with you or to take steps at your request before entering into a contract and for our legitimate interests such as making sure that we can keep in touch with our students about new services;
• Disclosures and other activities necessary to comply with legal and regulatory obligations that apply to our business, e.g. to record and demonstrate evidence of your consents where relevant;
• Generally, internal and external audit purposes, including audits to support our finance department; and
• To share your personal data with members of our group and third parties that will or may take control or ownership of some or all of our business (and professional advisors acting on our or their behalf) in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency so as to protect, realise or grow the value in our business and assets

See ‘Who we share your personal data with’ for further information on the steps we will take to protect your personal data where we need to share it with others.

Artificial Intelligence (AI) Processing Clarification:

The Platform utilises artificial intelligence technologies to generate insights, guidance, and recommendations in relation to users’ academic pathways, learning progress, goal-setting, and higher education planning.

• AI prompts are processed on a real-time, stateless basis and are not retained by third-party AI service providers.
• No directly identifiable student personal data is included in AI prompts.
• pseudonymised identifiers are used where strictly necessary.
• Personal Data is not used for the training, retraining, or improvement of any third-party or external AI models.

For information on how AI technologies are used responsibly on the Platform, please see our Responsible AI Policy at /legal/responsible-ai.

5. Marketing

We will use your personal data to send you updates (by email, text message, telephone or post) about our services, including exclusive offers, promotions or new services.

We have a legitimate interest in using your personal data for marketing purposes (see above ‘How and why we use your personal data’). This means we do not need your consent to send you marketing information. If we change our marketing approach in the future so that consent is needed, we will ask for this separately and clearly.

We may use your name, achievements, and success stories in digital media, presentations, and marketing campaigns only after obtaining your express written consent. Where you are a minor, consent will be obtained from a parent or legal guardian. We do not use the personal data of minors for marketing, advertising, or any commercial purpose beyond providing the educational service.

You have the right to opt out of receiving marketing communications at any time by contacting us at support@hawknest.ai, using the ‘unsubscribe’ link in emails, or the ‘STOP’ number in texts.

We may ask you to confirm or update your marketing preferences if you ask us to provide further services in the future, or if there are changes in the law, regulation, or the structure of our business.

We will always treat your personal data with the utmost respect and never sell or share it with other organisations outside our group for marketing purposes.

For more information on your right to object at any time to your personal data being used for marketing purposes, see ‘Your rights’ below.

6. Who we share your personal data with

Where we share your data with third parties, we always ensure appropriate measures are taken to protect your data in compliance with the UAE Data Protection Law.

We share your data internally purely on a need-to-know basis. We share your data with our Affiliates, with persons representing you or arranging services on your behalf, universities, institutions, as well as with other persons to help us provide you with our services or from whom we need information to process your claims or entitlements. We also share your information where required to by law or to protect our legal rights.

In certain instances, we share your data with the following persons for the purposes set out in this Policy:

• Other companies within our group, where necessary for internal administrative and operational purposes;
• Cloud and technology service providers, including Amazon Web Services (AWS) for data hosting and Microsoft Azure OpenAI for AI processing (both hosted in the United Arab Emirates);
• Third-party service providers who support the operation, maintenance, and security of the Platform;
• Schools or educational institutions that provide you access to the Platform, for administrative, reporting, and service delivery purposes, in accordance with applicable arrangements;
• Professional advisers, including legal, financial, and tax consultants, where required;
• Competent regulatory authorities, governmental bodies, or law enforcement agencies, where required by applicable law or regulation; and
• Any other person where disclosure is required or permitted by applicable law.

We may process your data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

We only allow those organisations to handle your personal data if we are satisfied they take appropriate measures to protect your personal data. We also impose contractual obligations on them to ensure they can only use your personal data to provide services to us and to you.

We occasionally also share personal data with our external auditors, eg in relation to the audit of our accounts, in which case the recipient of the information will be bound by confidentiality obligations;

• our and their professional advisors (such as lawyers and other advisors), in which case the recipient of the information will be bound by confidentiality obligations; and
• other parties that have or may acquire control or ownership of our business (and our or their professional advisers) in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency—usually, information will be anonymised but this may not always be possible. The recipient of any of your personal data will be bound by confidentiality obligations.

If you would like more information about who we share our data with and why, please contact us (see ‘How to contact us’ below).

7. How long your personal data will be kept

We will not keep your personal data for longer than we need it for the purpose for which it is used. We will retain and use your personal data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies. The length of time over which data may be retained is dependent upon the circumstances including why the personal information was obtained in the first place. Different retention periods apply for different types of personal data. Following the end of the of the relevant retention period, we will delete or anonymise your personal data, unless we are legally obligated to retain this data for longer time periods. Where consent is withdrawn (including by a parent/guardian), accounts will be deactivated and data will be deleted in accordance with our data retention and deletion policies, unless retention is required by law. For further details on how long we retain and delete personal data, please see our Data Retention & Deletion Policy at /legal/data-retention.

8. Transferring your personal data out of the UAE

As part of a multinational group, we deal with entities in different jurisdictions with global presence themselves. However, as a matter of practice, all personal data collected through the Platform is stored and processed within the United Arab Emirates, and we do not transfer personal data outside the UAE in the ordinary course of our operations. As a result, we do not ordinarily transfer or process data outside the UAE. It is sometimes necessary for us to transfer your personal data to countries outside the UAE. In those cases we will comply with the UAE Data Protection Law designed to ensure the privacy of your personal data.

We will only transfer your data to a jurisdiction classified as adequate as per the UAE Data Protection Law or otherwise where we have put in place adequate safeguards to protect your data. In particular, if none of the above apply and we wish to transfer your data to a jurisdiction that does not have an adequate level of data protection as per the UAE Data Protection Law, we will undertake all reasonable measures to ensure this protection is set out in a written agreement between us and the receiving entity or that otherwise, the legally required measures are undertaken. For more information on the safeguards and measures undertaken by us to protect your data, please contact us using the details set out under ‘How to contact us’ section below.

In the event we cannot or choose not to continue to rely on mechanisms at any time we will not transfer your personal data outside the UAE unless we can do so on the basis of an alternative mechanism or exception provided by the UAE Data Protection Law and reflected in an update to this policy.

If you would like further information about data transferred outside the UAE, please contact us or our Data Protection Officer (see ‘How to contact us’ below).

9. Cookies and other tracking technologies

A cookie is a small text file which is placed onto your device (eg computer, smartphone or other electronic device) when you use our Platform (“Cookies”). We use Cookies and similar technologies on our Platform to track the activity on and store certain information. These help us recognise you and your device and store some information about your preferences or past actions.

We use Cookies and similar tracking technologies to track activity on our Platform and store certain information. Tracking technologies used are beacons, tags, and scripts to collect and track information and to improve and analyse our Platform. The technologies we use may include:

• Cookies or Browser Cookies. A cookie is a small file placed on your device. You can instruct your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if you do not accept Cookies, you may not be able to use some parts of our website. Unless you have adjusted your browser settings so that it will refuse Cookies, Platform may use Cookies.
• Web Beacons. Certain sections of our Platform and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit us, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of a certain section and verifying system and server integrity)

Cookies can be "Persistent" or "Session" Cookies. Persistent Cookies remain on your personal computer or mobile device when you go offline, while Session Cookies are deleted as soon as you close your web browser.

Please see our cookie policy at /legal/cookie-policy.

10. Your rights

With respect to your data, you have the following rights, among others:

• Right to access personal data: You have the right to ask us to provide you with information relating to any data of yours processed by us. We are permitted to restrict such access where legal grounds set out in applicable data protection laws apply, such as, among others, to protect the rights of others or avoid obstructing legal inquiries, investigations and procedures. Where we restrict your access to data, we will inform you of the basis for such restriction.
• Right to correction/rectification: You have the right to request correction of any personal data collected by us, which is inaccurate or incomplete as per the applicable laws.
• Right to erasure: You have the right to request deletion of your data where (a) it is no longer necessary for the purposes it was collected; (b) you withdrew your consent and no other lawful processing basis applies; (c) our storage is unlawful or deletion is required for us to comply with applicable law; or (d) you object to our processing of your data and we do not have any overriding legitimate grounds to continue with such processing. We are not obliged to delete any data unless at least 1 (one) of the above circumstances apply and we do not require your data to comply with legal requirements or to establish or defend ourselves with respect to any legal claims.
• Right to restriction on processing: You have the right to request that we restrict processing of your data if (a) you contest the accuracy of your data, for as long as it takes us to verify such accuracy; (b) our processing is unlawful; (c) the processing was carried out in violation of the UAE Data Protection Law. We may however continue to process such data requested for restriction if we require them to establish, exercise or defend yourself against legal claims; or (d) where you have objected to our processing of your data and we are establishing if we have overriding legitimate grounds to continue such processing.
• Right to transfer data: You shall have the right to obtain personal data which has been provided to us in a structured and machine readable manner only if processing of their information is (a) based on consent or is necessary to fulfil a contractual obligation, and (b) is made by automated means; and may also request the transfer of their personal data to another controller when feasible.
• Right to withdrawal: For the data you have consented to, you shall have the right to withdraw his or her consent at any time which shall not, however, affect the lawfulness of processing based on consent before its withdrawal.
• Right to object to use: You have the right to object to the processing of their personal data by us when it is based on legitimate interests, for direct marketing (including profiling), and processing for scientific and/or historical research and statistics purposes or in violation of the laws. Where such an objection is received based on our legitimate interests, we must cease such processing immediately unless we can demonstrate that our legitimate grounds for such processing override the data subject’s interests, rights and freedoms, or that the processing is necessary for the conduct of legal claims. Where such an objection is received based on our use of the data for direct marketing purposes, we must cease such processing promptly.
• Right to not to be subject to decisions without human involvement: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Where automated tools (including AI) are used to provide recommendations, such outputs do not produce legally binding decisions and you may request human review.

For further information on each of those rights, including the circumstances in which they do and do not apply, please contact us (see ‘How to contact us’ below).

If you would like to exercise any of those rights, please email, call or write to us, details of which are available on ‘How to contact us’. When contacting us please:

• provide enough information to identify yourself, including details such as your full name, address and any additional identity information we may reasonably request from you, and
• let us know which right(s) you want to exercise and the information to which your request relates

11. Privacy of Minors and Users Aged 13+

The Platform is intended for individuals aged thirteen (13) years and above. We do not knowingly permit individuals under the age of 13 to create accounts or use the Platform, except where access is explicitly enabled through a school and subject to verified parental or guardian consent and applicable legal requirements.

Where a user indicates that they are under the age of 13, account creation shall be restricted unless valid parental or guardian consent has been obtained and verified. If such consent is not provided or verified, the attempted registration shall not be completed.

If we becomes aware that personal data of a child under the age of 13 has been collected without appropriate parental or guardian consent, access to the relevant account shall be suspended, and the personal data shall be deleted or anonymised without undue delay, subject to any applicable legal obligations.

Where the Services are deployed through a school or other educational institution, the school may act as a Data Controller or authorised intermediary for the purposes of onboarding students. The school is responsible for ensuring that students meet the applicable age requirements and that any required parental or guardian notices and consents are obtained in accordance with applicable law. We may rely on the representations and confirmations provided by the school in this regard, subject to any applicable contractual arrangements between the school and us.

How we handle minor data (13–17)

We apply additional safeguards for users aged 13–17:

• Data minimization: We collect only what is necessary for educational guidance features.
• No targeted advertising: We do not serve ads or use minor data for marketing purposes.
• No commercial use of data: Student data is used solely for providing and improving the educational Services.
• Access controls: Minors’ data is accessible only by authorized personnel on a need-to-know basis.
• Parental visibility: Where enabled, parents/guardians may view progress and profile information.
• Content controls: Age-appropriate AI safety guardrails are applied.

Where required by applicable law or school policy:

• Schools may obtain parental consent on behalf of students during onboarding using our Parental/Guardian Consent Form.
• Parents may withdraw consent at any time by contacting support@hawknest.ai which may result in account deactivation.
• Consent withdrawal is logged and processed within 72 hours. Upon withdrawal, the student’s account is deactivated and personal data is queued for deletion in accordance with our Data Retention & Deletion Policy.
• Upon withdrawal of consent, the minor’s account may be suspended or terminated, and any associated personal data shall be deleted or anonymised in accordance with applicable data retention obligations. We shall maintain records of consent where required by law.

UAE Child Digital Safety Law (CDS)

The UAE Child Digital Safety Law (Federal Decree-Law No. 3 of 2024) applies to all users under the age of 18, not only those under 13. In compliance with the CDS Law, we implement appropriate safeguards and controls.

User age is verified through one or more of the following mechanisms: collection of date of birth during onboarding, school-verified grade or year-level gating, or school attestation confirming that all onboarded users meet the minimum age requirement.

All accounts for users under 18 are configured by default with the highest available privacy settings. Profile visibility, data sharing, and optional features are set to the most restrictive configuration unless adjusted in accordance with applicable permissions.

Where enabled by the school or parent/guardian, parents have a shadow view of the student’s profile, milestone progress, and upcoming activities. Parents may request restriction or deletion of their child’s personal data at any time.

We use AI safety guardrails are applied to all outputs for users under 18, including content filters to block violent, sexual, or otherwise harmful material. Users, including minors and their parents, can report harmful content or safety concerns through in-app reporting tools or by contacting us at support@hawknest.ai.

Where a risk to a child’s safety or welfare is identified, such incidents are handled in accordance with applicable UAE child protection laws and may be reported to relevant authorities within legally required timeframes. Safeguarding incidents are treated separately from personal data breaches.

Children’s personal data is not used for tracking, profiling, or advertising beyond the authorised educational purpose. Student data and AI prompts are not used to train foundation AI models. Internal access to children’s data is restricted to authorised personnel only.

Parents, guardians, and eligible minors have rights under applicable data protection laws, including the right mentioned above in this Privacy Policy.

For further information on how UniHawk processes personal data, including the rights of access, correction, and deletion, please contact us (see ‘How to contact us’ below).

12. Keeping your personal data secure

We have undertaken all reasonable and legally required security measures to ensure your data is secure and prevent it from being accidentally lost, or used, accessed, altered or disclosed in an unauthorized way. We also regularly review and update such measures to meet new perceived threats that may arise from technological advances. We limit access to your personal data to those who have a genuine need to access it.

We also have procedures in place to deal with any suspected data security breach. Where legally required to do so, We will notify you and any applicable regulator of a suspected data security breach.

13. Changes to this privacy policy

We may modify or update this Privacy Policy from time to time. Changes will be posted on this page and cannot be retroactive. Where appropriate, we will notify you of any material changes made to the Privacy Policy. What constitutes a “material change” will be determined at our sole discretion, in good faith and using reasonable judgment and common sense.

Therefore, you are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

14. How to contact us

Please contact us if you have any queries or concerns about our use of your personal data. We hope we will be able to resolve any issues you may have.

You can contact us and/or our Data Protection Officer by post, email or telephone if you have any questions about this privacy policy or the information we hold about you, to exercise a right under data protection law or to make a complaint.

Our contact details are shown below: