Privacy Policy

This Privacy Policy explains how we collect, use, share, store and protect personal data when you: visit redthread.ae; contact us; purchase or use our services; create an account; join a learning programme; complete an assessment or survey; act as an assessment rater; receive coaching or facilitation; attend an event or webinar; or work with us as a client, supplier or partner.

1.Who we are

The data controller responsible for this Privacy Policy is:

In this Policy, "Red Thread", "we", "us" and "our" refer to RED THREAD FZE.

2.Scope of this Policy

This Policy applies to personal data processed through: our website; online forms; client communications; learning platforms; assessment platforms; survey tools; coaching services; virtual and physical programmes; client projects; marketing communications; and related Red Thread digital services.

A separate privacy notice may apply to a specific service. Where a specific notice provides more detail, it should be read with this Policy.

3.Our role when working with organisations

3.1 When Red Thread is the controller

Red Thread will normally act as the controller when we decide why and how personal data is processed, such as when you: visit our website; contact us directly; subscribe to our communications; buy a Red Thread service personally; create a direct customer account; apply to work with us; attend a Red Thread event; or participate in Red Thread research with us as the organiser.

3.2 When Red Thread processes data for a client

A corporate client may be the controller when it asks Red Thread to provide services for its employees, candidates, customers, leaders, learners, coaches, assessment participants, survey respondents, or 360-degree raters. In that situation: the client decides the purpose of the processing; Red Thread processes data under the client's instructions; the client is responsible for its own privacy notice and legal basis; and a data-processing agreement may govern this relationship.

4.Personal data we may collect

4.1 Identity and contact data

• Name
• Job title
• Employer
• Email address
• Telephone number
• Country and location
• Preferred language
• Professional profile information

4.2 Account and authentication data

This may include username, account identifier, encrypted password, access permissions, login history and account status. We do not have access to your plain-text password where passwords are managed through secure authentication systems.

4.3 Learning and programme data

• Course registrations
• Attendance and participation records
• Assignments and reflections
• Quiz results and facilitator feedback
• Coaching notes
• Certification status
• Learning-resource usage

4.4 Assessment and survey data

• Assessment responses and survey answers
• Scores and competency ratings
• Behavioural preferences and working-style information
• Development themes and generated reports
• Coaching or development recommendations
• Rater-category information and written comments

4.5 Technical and usage data

• IP address
• Browser type and device type
• Login time and pages visited
• Session duration and cookie identifiers
• Error logs and security events
• Approximate location derived from an IP address

5.How we collect personal data

We may collect data: directly from you (when you complete a form, create an account, make a purchase, or attend a programme); from a client or sponsoring organisation; from other participants in a multi-rater process; from service providers; or from public or professional sources for business-development purposes.

6.Why we use personal data

We may process personal data to provide contracted services; take steps requested before entering a contract; administer client relationships; operate and protect our services; improve our services; communicate with you; send marketing communications (with consent); and meet legal and regulatory requirements.

7.Legal grounds for processing

Depending on the circumstances, we process personal data because: you have given clear consent; processing is needed to perform a contract with you; processing is required by UAE law; processing is needed to establish, exercise or defend legal rights; or processing is otherwise permitted under applicable data-protection law.

Where processing relies on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that took place lawfully before withdrawal.

8.Assessments, profiling and automated processing

Some Red Thread services use automated methods to convert responses into scores, compare results with reference information, identify patterns and generate profile descriptions. Assessment outputs are designed to support development and qualified human judgement. Red Thread does not intend its standard assessment tools to make final legal, medical or employment decisions without appropriate human involvement.

9.AI-supported processing

Red Thread may use AI-supported tools to assist with drafting report narratives, summarising feedback, recommending learning resources, supporting coaching preparation and analysing de-identified service trends. Access is limited to an authorised purpose, personal data is minimised, and outputs may be reviewed by a person. We do not use confidential client information or identifiable participant assessment responses to train publicly available AI models unless clearly disclosed and lawfully authorised.

10.Assessment reports and access

Assessment data may be accessible to the participant, authorised Red Thread personnel, the sponsoring client, authorised client administrators, nominated managers, coaches or facilitators, and approved technical support personnel. Access depends on the assessment design, the client agreement, and applicable law.

11.Multi-rater confidentiality

For 360-degree and multi-rater assessments, rater responses may be combined into category results, rater names may be hidden where anonymity is promised, and small categories may be combined or suppressed. No system can guarantee anonymity if a rater identifies themselves through the content of a comment or if the group is too small. Clients must not attempt to identify raters where anonymous participation has been promised.

12.Who we share personal data with

We may share personal data with: clients and sponsoring organisations where they have arranged or purchased the service; authorised coaches and facilitators; technology providers (hosting, email, video conferencing, analytics, payment processing, AI services); professional advisers; government and regulatory authorities where required by law; and business successors in the event of a merger, acquisition or restructuring.

We do not sell or rent personal data to third parties.

13.International data transfers

Some Red Thread providers, clients or users may operate outside the UAE. Where personal data is transferred internationally, we use a lawful transfer mechanism where required. You may contact us for further information about safeguards relevant to your data.

14.Data retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected. Retention may depend on the duration of the client relationship, the service purchased, client instructions, legal and tax-record requirements, contractual limitation periods, and security and fraud-prevention needs.

15.Data security

We use technical and organisational measures designed to protect personal data. These may include: access controls; role-based permissions; multi-factor authentication; encryption in transit; secure cloud infrastructure; system monitoring; backups; vendor due diligence; and incident-response procedures. No online system can guarantee complete security.

16.Personal-data breaches

Where we become aware of a personal-data incident, we will investigate, take reasonable steps to contain it, assess the possible impact, notify relevant parties where legally required, and take corrective measures.

17.Your privacy rights

Subject to applicable law, you may have the right to: ask whether we process your personal data; receive information about the data and purpose; request access, correction, or deletion; request restriction of processing; object to processing for direct marketing; withdraw consent; request portable data; and object to certain automated decisions.

18.Exercising your rights

To make a privacy request, email: info@redthread.ae. Please include your full name, the email address connected to the service, the organisation that sponsored your service (where relevant), and a clear description of your request. We may ask for information to verify your identity.

19.Marketing communications

You may unsubscribe from marketing by using the unsubscribe link in any email or by contacting info@redthread.ae. Unsubscribing from marketing will not stop necessary service communications.

20.Cookies and similar technologies

We may use essential cookies (website operation, authentication, session management), analytics cookies (website traffic and performance), preference cookies (language, display settings), and marketing cookies where used. You may control cookies through your browser. Blocking some cookies may affect website functionality.

21.Third-party links

Our website may link to external sites. This Policy does not govern websites operated by other organisations. You should review their privacy information before providing personal data.

22.Children's privacy

Our general website and services are not directed at children under 18. We do not knowingly collect personal data from children through general website forms. If you believe a child has submitted personal data without proper authority, contact info@redthread.ae.

23.Research and benchmarking

Red Thread may use aggregated or de-identified data for assessment validation, benchmark development, reliability analysis, and research. We will take reasonable steps to prevent individuals and client organisations from being identified in published findings unless separate permission has been obtained.

24.Changes to this Privacy Policy

We may update this Policy to reflect changes in law, new technologies, or new services. The latest version will be published on redthread.ae. Where a change materially affects how we use personal data, we will provide suitable notice where reasonably practical.

25.Complaints

We encourage you to contact us first so that we can investigate and address your concern. You may also have the right to complain to the competent UAE data-protection authority or another regulator with jurisdiction over the processing.

26.Contact us