Privacy Policy

This Privacy Policy is issued primarily in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, which govern the collection, processing, storage, and transfer of personal data by UK-registered organisations. We also respect the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) in connection with data relating to participants based in the UAE. We process personal data lawfully, fairly, and transparently, and only for the specific purposes described in this Privacy Policy.

We collect the following categories of personal data across our programmes and touchpoints: General interest and enquiry • Full name, email address, and WhatsApp number (optional) • Role, organisation, and areas of interest • Free-text messages submitted via enquiry forms Masterclass bookings • Name, email address, and organisation • Audience size, preferred month, and topic of interest GEMS Family First (Family Innovation Challenge) • Parent or guardian name, email address, and phone number • Child's name, year group or age, and GEMS school • City or emirate of residence • Areas of interest and kickoff webinar availability • Consent confirmation (recorded with timestamp) • Submitted programme materials, including documents, presentations, images, and video files - which may contain the child's name, likeness, voice, and ideas Unity Showcase • Registration type (school or parent/guardian) • Participant name, email address, and phone number • School name and city or emirate • Student count (for school registrations), message, and consent confirmation Challengers, Juniors, and Skills programmes • Participant name, age, school or institution, and contact details • Parent or guardian name and contact details (for participants under 18) • Submitted project work, including videos, presentations, and photographs ProofScaling (Institutional and Individual) • Institutional contact name, organisation, email, and phone number • Individual participant names and contact details • Platform usage data and submitted validation work Second Chance / Overlooked Residency • Applicant name, email address, phone number, and business background • Application materials including business descriptions and supporting documents Website visitors • Startopia uses Google Analytics 4 (GA4), a web analytics service provided by Google LLC. GA4 collects data including pages visited, events triggered, approximate geographic location (country or city level), device type, browser type, and session duration. This data is collected in pseudonymous form and is used to understand how visitors interact with the website so that we can improve it. GA4 does not load unless you click "Accept" on the cookie consent notice displayed when you first visit the site. If you click "Decline", no analytics data is collected. Your choice is stored in your browser's localStorage and honoured on subsequent visits. You can opt out of Google Analytics tracking at any time by installing Google's opt-out browser add-on at tools.google.com/dlpage/gaoptout. Google's privacy policy is available at policies.google.com/privacy. Technical and security data • IP addresses are logged when admin authentication requests are made to the platform. This data is processed for security and fraud prevention purposes and is retained for no longer than 90 days.

Under the UK GDPR, we rely on the following lawful bases for processing personal data: Consent - We rely on consent for sending marketing and programme update communications, and for processing the personal data of participants under the age of 18 (obtained from the parent or legal guardian at the point of registration). Consent for use of a child's likeness, voice, or submitted creative work in promotional materials is obtained separately at the point of submission. You may withdraw consent at any time by contacting help@startopia-edu.com. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Contractual necessity - We process data that is necessary to deliver the programme or service you have registered for, including issuing onboarding materials, managing submissions, scheduling events, and communicating programme outcomes. Legitimate interests - We process limited data for our legitimate interests in improving our programmes, understanding participant outcomes, and communicating Startopia's educational mission. We have assessed that these interests are not overridden by the rights and interests of the individuals concerned, given the limited nature of the data processed for this purpose and the reasonable expectations of participants in an educational context. Legal obligation - We may process or retain data where required to comply with applicable law, including UK tax and company law.

We use personal data for the following purposes: • Registering participants and managing programme enrolment • Delivering programme materials, onboarding packs, and communications • Facilitating kickoff webinars, workshops, and events • Evaluating and judging programme submissions • Awarding scholarship places and communicating programme outcomes • Providing programme support and responding to enquiries • Sharing programme updates, next-step information, and news about related Startopia opportunities (subject to applicable consent) • Promoting Startopia programmes using participant-submitted content - photographs, videos, and project work - on our website, social media, and in press materials, subject to the explicit consent obtained at the point of submission • Complying with our legal and contractual obligations • Analysing programme participation in aggregate to improve our services • Security monitoring and fraud prevention in connection with platform access

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are: • Registration and contact data: up to 3 years after the end of the relevant programme cohort, unless you request earlier deletion • Submitted programme materials (documents, presentations, videos, and other files): up to 3 years, used for programme evaluation and promotional purposes during this period • Financial and transaction records (where applicable): 6 years, in line with UK HMRC requirements • Security and technical logs (including IP addresses): up to 90 days • Website analytics data (Google Analytics 4): retained for up to 12 months in pseudonymous form, only where consent has been given When data is no longer required, we securely delete or anonymise it.

Under the UK GDPR, you (and parents or guardians acting on behalf of participants under 18) have the following rights in relation to your personal data: Right of Access - You may request a copy of the personal data we hold about you or your child. Right to Rectification - You may request that we correct any inaccurate or incomplete personal data. Right to Erasure - You may request that we delete your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and there is no other lawful basis for continued processing. Right to Restrict Processing - You may request that we limit how we use your data in certain circumstances. Right to Data Portability - You may request that we provide your personal data in a structured, commonly used, machine-readable format where this is technically feasible. Right to Object - You may object to processing based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. Right to Withdraw Consent - Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. Rights related to automated decision-making - We do not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects. To exercise any of these rights, please contact us at help@startopia-edu.com. We will respond within one calendar month. We may need to verify your identity before processing your request. There is no charge for making a request.

We do not sell personal data to third parties. We may share personal data with the following categories of recipients: Programme partners - Where a programme is co-delivered with an institutional partner (such as GEMS Education for the Family Innovation Challenge), limited participant data - such as name and registration status - may be shared with that partner for programme coordination purposes. Partners are required to handle data in accordance with applicable data protection law. Technology and service providers - We use the following third-party service providers who process personal data on our behalf as data processors: • Neon (Neon Inc.) - Database hosting (PostgreSQL) - United States • Replit Inc. - Platform hosting and file storage - United States • Resend Inc. - Transactional email delivery - United States • Google LLC (Workspace) - Document collaboration and data logging via Google Sheets - United States • Google LLC (Google Analytics 4) - Web analytics - United States • Stripe Inc. - Payment processing (where fees apply) - United States / European Union Each of these providers is engaged under contractual terms that require them to process personal data only on our instruction and to implement appropriate security measures. Legal and regulatory bodies - We may disclose personal data where required by UK law or a valid order of a UK court or regulator, or where required by UAE law in connection with UAE-based participants.

Some of our third-party service providers operate servers outside the United Kingdom. Where personal data is transferred internationally, we take steps to ensure that adequate protections are in place. Transfers to the United States and other countries without a UK adequacy decision are made on the basis of the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as applicable, or under the terms of the UK-US Data Bridge where eligible. By participating in Startopia programmes and submitting personal data, you acknowledge that your data may be processed in jurisdictions outside the United Kingdom and the UAE as described in this section.

LAR Consultants Ltd implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration, or disclosure. These measures include: • Access controls limiting who can view personal data within the Startopia platform • Use of encrypted connections (HTTPS) for all data transmitted through the Startopia website • Authenticated access to the family submission portal via secure, time-limited magic links • Server-side validation of all file uploads, including file type verification • Rate limiting on all data submission endpoints to prevent automated abuse • Regular review of third-party processor security arrangements No method of electronic transmission or storage is completely secure. While we implement commercially reasonable security measures, we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO in accordance with our obligations under the UK GDPR, within 72 hours of becoming aware of the breach where feasible.

Startopia programmes are designed for young people, including children under the age of 18. We are committed to handling children's personal data with the highest level of care. Where programme participants are under 18, we require a parent or legal guardian to: • Register on the child's behalf • Provide explicit consent for the child's participation • Accept our Terms & Conditions and this Privacy Policy We do not knowingly collect personal data directly from any participant under 18 without verified parental or guardian consent obtained at the point of registration. Where a programme involves the submission of materials that may contain a child's name, likeness, voice, or creative work, a separate consent confirmation is obtained at the point of submission before those materials are used for promotional purposes. Parents and guardians may, at any time, exercise the data subject rights described in Section 7 on behalf of their child by contacting help@startopia-edu.com. Safeguarding Louis Ravenscroft is the Designated Safeguarding Lead for all Startopia programmes. Any safeguarding concern about a child on a Startopia programme should be raised immediately at help@startopia-edu.com, marked for the attention of the Designated Safeguarding Lead. Concerns are reviewed on receipt. Where a child is believed to be at risk of harm, the matter is referred to the relevant local authority or child protection agency in the participant's jurisdiction. Children do not register themselves for any Startopia programme. There is no child-to-child contact within any programme, and a parent or guardian is present for all live sessions involving a participant under 18.

The Startopia website uses the following cookies and similar technologies: Strictly necessary - Session cookies required for authenticated access to the family portal are strictly necessary for the functioning of that service and do not require consent. Analytics (consent-based) - We use Google Analytics 4 (GA4), which sets cookies to collect pseudonymous data about how visitors use the site. These cookies are only set if you click "Accept" on the cookie consent notice. If you click "Decline", no analytics cookies are placed. You can opt out of Google Analytics at any time by installing Google's opt-out browser add-on (tools.google.com/dlpage/gaoptout). No other non-essential cookies or third-party tracking technologies are used on this website.

If you have any concerns about how we handle your personal data, please contact us in the first instance at: LAR Consultants Ltd (operating as Startopia) 11 Turners Green, Britwell Salome, Watlington, England, OX49 5LF Company No. 15772276 Email: help@startopia-edu.com We will investigate your concern and respond within one calendar month. If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO): Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Website: ico.org.uk Telephone: 0303 123 1113 Participants based in the UAE may also have the right to contact the relevant UAE data protection authority in connection with the processing of their personal data.