Privacy Policy

This Privacy Policy explains how ITSGovernance collects, uses, shares and protects personal data when you visit itsgovernance.com or use the ITSGovernance assessment platform at assessment.itsgovernance.com (together, the "Service"). It forms part of our End User Agreement.

1. Who we are

ITSGovernance is an assessment platform operated under SMCE (Service Management Center of Excellence), based in Business Bay, Dubai, United Arab Emirates. SMCE is the controller of your personal data. In this policy, "we", "us" and "our" mean ITSGovernance and SMCE.

For any privacy question or request, email info@itsgovernance.com.

2. The data we collect

Information you give us

• Account details: your first and last name, email address, phone number and password (stored only as a one-way hash, never as readable text).
• Organization details: your sector, industry, organization type, country of operations and, for company accounts, the company name, address, phone number, email and tax registration number (TRN).
• Assessment data: your ratings and comments for each assessment question, your target levels, and the scores and reports the platform produces from them. The Service has no upload for documents or evidence: you answer questions, and your evidence stays with you.
• Team invitations: when you buy an assessment for a team, the email addresses of the people you invite, and the role each one answers for.
• Payment records: what you bought, when, and the payment status. If you pay by bank transfer, the proof of payment you upload.
• Messages: your name, email address and message when you use our contact form.
• Agreement records: the version and text of the End User Agreement you accepted or declined, and when.

Information collected automatically

• Security and login records: your IP address, browser and device information, and the time of each sign-in attempt. We use these to protect accounts and investigate misuse.
• Usage data: pages visited and how the Service is used, collected through Google Analytics (see section 6).

Information from others

• Google or Facebook sign-in: if you choose to sign in with Google or Facebook, we receive your name and email address from that provider. We do not receive your password for those accounts.
• Team buyers: if someone invites you to answer an assessment, we receive your email address from them.

We do not receive or store your full card number. Card payments are handled directly by our payment provider, Stripe.

3. How we use your data

Purpose	Legal basis
Creating and running your account, delivering assessments, scores and reports	Performing our agreement with you
Processing payments, issuing receipts and keeping financial records	Performing our agreement; legal obligations
Sending service emails: email verification, password resets, team invitations, purchase and account notices	Performing our agreement
Answering messages you send us	Our legitimate interest in responding to you
Keeping the Service secure, preventing fraud and spam (including reCAPTCHA on forms)	Our legitimate interest in protecting the Service and its users
Understanding how the Service is used so we can improve it	Your consent, which you give or refuse in the cookie banner
Building anonymized, aggregated benchmarks that do not identify you or your organization	Our legitimate interest in improving the Service

We do not sell your personal data, and we do not use it for third-party advertising.

4. Who can see your data

Within a team purchase

When an organization buys an assessment for a team, the buyer manages the invitations and can see each invitee's progress, their answers and the combined team results. If you are invited, the buyer may see what you submit for that assessment.

Service providers

We share data only with providers that help us run the Service, and only what each one needs:

• Stripe: card payment processing.
• Google: Google Analytics (usage statistics), reCAPTCHA (spam and bot protection on forms) and Google sign-in, if you use it.
• Meta (Facebook): Facebook sign-in, if you use it.
• Sucuri: website firewall and security, which processes visitors' IP addresses to block attacks.
• Amazon Web Services (AWS): hosting and storage.
• Our email provider: delivering service emails.
• Our AI provider: generating guidance and report text (see section 4A).

Legal reasons

We may disclose data if the law requires it, to respond to a valid request from a public authority, or to protect our rights, our users or the public.

4A. How we use AI

We use AI to generate guidance and report text from your ratings and comments. Your organization's name is not sent to the AI service. Our AI provider processes this content only to return results to us and does not use it to train its models. AI-generated text is a starting point for your own review, not professional, legal or audit advice.

5. International transfers

Some of our service providers process data outside the United Arab Emirates. When this happens we rely on the provider's contractual and security commitments to protect your data to the standard required by applicable law.

6. Cookies

We use a small number of cookies:

Cookie	Why
Session and security cookies	Keep you signed in, remember "Remember me" if you tick it, and protect forms against cross-site request forgery. These are essential and the Service cannot work without them.
Cookie choice	Remember whether you chose "Accept analytics" or "Essential only", for 12 months. This is essential.
Google Analytics	Count visits and show which pages are used, so we can improve the Service. Set only if you choose "Accept analytics" in the cookie banner.
Google reCAPTCHA	Tell people from automated bots when forms are submitted.
Stripe	Process card payments securely and prevent payment fraud, on the checkout page only.

You can change your choice at any time with the "Cookie settings" link at the bottom of every page. You can also block or delete cookies in your browser settings. If you block essential cookies, you will not be able to sign in.

7. How long we keep your data

• Account and assessment data: for as long as your account is active, unless you ask us to delete it sooner.
• After your account is closed: 90 days, so the data can be recovered if you ask. After that it is permanently deleted unless the law requires us to keep it.
• Deletion requests: completed within 30 days, subject to any legal duty to keep certain records.
• Payment and agreement records: as long as tax, accounting and other laws require.
• Anonymized, aggregated data: may be kept indefinitely, because it does not identify you or your organization.

8. How we protect your data

The Service is served only over encrypted HTTPS connections and sits behind a website firewall. Passwords are stored as one-way hashes, access to data is limited to people who need it to run the Service, and sign-ins are logged so unusual activity can be investigated. No system is completely secure, so please use a strong, unique password and tell us straight away if you suspect your account has been misused.

9. Your rights

Depending on where you live, including under the UAE Personal Data Protection Law and the EU General Data Protection Regulation, you may have the right to:

• get a copy of the personal data we hold about you;
• correct data that is wrong or incomplete (much of it you can change yourself in your profile);
• have your data deleted;
• receive your assessment data in a portable format;
• object to, or ask us to restrict, how we use your data;
• withdraw consent you have given, at any time;
• complain to your data protection authority.

To use any of these rights, email info@itsgovernance.com from the address on your account. We will reply within 30 days. If you answered an assessment as part of a team purchase, we may also involve the buyer who invited you.

10. Children

The Service is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy when the Service or the law changes. The effective date at the top shows when it last changed. If a change materially affects how we use your data, we will tell registered users by email or through the platform.

12. Contact

ITSGovernance (SMCE), Business Bay, Dubai, United Arab Emirates. Email info@itsgovernance.com or use our contact form.