This Privacy Notice explains how Zelus International FZCO ("Zelus", "we", "us", "our") and our affiliated brands (including Zelus Academy at learn.zelusinternational.com) collect, use, and protect personal information when you use our websites, services, and learning platforms.
This notice applies globally. The same protections, the same rights, the same standards, regardless of where you live or where our servers happen to be located. Where local law gives you stronger rights than what we describe here, those local rights also apply automatically.
Zelus Academy is designed primarily for adult learners and professionals. Minor learners may also use the Services, subject to verifiable parental or guardian consent obtained by attestation at signup. See Section 9 for the full framework.
Learning activity: courses you enrol in, your progress, certificates you earn, time spent on the platform
Technical data: IP address, browser type, device type, language preference, approximate location at city/country level
Payment information: only when you make a paid purchase, and only as needed to complete the transaction. We never see or store your full card number. That goes directly to the payment processor.
Communications: support tickets you raise, course feedback you submit, emails you send us
Acceptances and representations: your acceptance of our Terms of Service and Privacy Notice at signup, including the eligibility and parental consent representations described in Section 9 and in Terms of Service Appendix A.2
For minor learners (under 18), we collect the minimum needed to deliver educational content and do not enrich the data with information from third-party sources. See Section 9 for additional protections.
For students enrolled through a school program, the institution may provide account-creation information (name, year group, course assignment) on the student''s behalf under a School Service Provider Agreement.
We do not collect:
Special category data (race, religion, political views, health, sexual orientation, biometric data) unless you explicitly volunteer it for a specific purpose with your consent
Social media profiles unless you specifically connect them
Personal data from any individual below the minimum age threshold for data processing consent applicable to their jurisdiction (typically 13 years; see Section 9)
3. Why we collect it
Six purposes only:
To deliver the service: so you can sign up, log in, take courses, and receive certificates
To improve the service: aggregated usage patterns help us decide what content to add and how to improve the experience
To communicate with you: course updates, certificates, billing, support responses (for school-enrolled students, communications go to the school administrator; for minor accounts where parental consent has been revoked, communications route to the parent or guardian)
To protect the service: detecting fraud, abuse, automated bots (for example, the captcha on our signup form), and breaches of our Terms of Service including breaches of the eligibility and parental consent representations
To comply with law: tax records, regulatory reporting, lawful requests from authorities
To enforce our terms: investigating violations including false eligibility or parental consent representations made at signup
We will never sell your personal information. Not now, not later, not in aggregate, not for any reason. We also never sell, share for advertising purposes, or use for targeted advertising any data about a minor learner. If we ever change this commitment, we will notify you in advance and give you the opportunity to delete your data before the change takes effect.
4. Lawful basis for processing
We process your personal information only when we have a lawful basis to do so. The bases we rely on are:
Performance of a contract: to deliver the courses you enrol in, issue your certificates, and provide the account services you request.
Legitimate interests: to operate, secure, and improve the platform; to prevent fraud and abuse; to communicate with you about your enrolments and account.
Legal obligation: to retain tax invoices and financial records, respond to lawful requests from authorities, and meet other regulatory requirements applicable to Zelus International FZCO.
Consent: for optional communications such as marketing emails, and for any processing that requires it under applicable law. You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
This corresponds to Article 6 of the EU/UK GDPR and the equivalent grounds under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).
5. Who we share it with
We use a small set of carefully chosen service providers to operate our services. Each one is contractually bound to protect your data and process it only on our instructions, under Data Processing Agreements that meet GDPR, UAE PDPL, and equivalent international standards.
Named subprocessors:
Provider
Purpose
Data they see
Google reCAPTCHA
Bot detection on signup form
IP address, browser fingerprint, behavioral signals at the moment of signup
Google Analytics
Anonymous traffic analysis
Page views, referrer, IP address (anonymised; disabled for accounts flagged as minor learners)
Web hosting and CDN provider
Server infrastructure
All data we store, encrypted at rest
Email delivery provider
Transactional emails (verification, certificates, notifications); for school-enrolled students, only to school administrator; for minor accounts where parental consent has been revoked, only to parent or guardian
Recipient email address, message content
Payment processor
Card payments (only if you make a paid purchase)
Your name, billing address, card details (we never see the card number directly)
We do not share your personal information with anyone else, except when the law requires it (subpoenas, court orders, tax authorities) and only the minimum required to comply; when you explicitly direct us to share (for example, linking your account to a third-party tool); or in a business transfer (merger, acquisition, sale of assets) and only if the same protections continue to apply.
We never share minor learner data with advertising networks, data brokers, social media platforms for marketing, or any third party not strictly necessary to deliver the educational service.
6. Your rights
These rights apply to everyone, everywhere, regardless of your country of residence:
Access: get a copy of what we hold about you
Correction: fix anything that is wrong
Deletion: we will erase your data when you no longer need our services
Portability: download your data in a machine-readable format
Restriction: limit how we use your data while a complaint is being resolved
Objection: say no to specific uses, especially marketing - you can opt out at any time
Withdrawal of consent: where we rely on your consent, you can withdraw it at any time
No automated decision-making: we do not use algorithms to make decisions about you that produce legal or similarly significant effects without human review
Complaint: lodge a complaint with your local data protection authority
No retaliation: we will not deny service, raise prices, or reduce service quality because you exercised any of these rights
To exercise any of these rights: email support@zelusinternational.com with the subject line "Privacy request" and a brief description of what you need. We respond within 30 days. For sensitive requests we may verify your identity before fulfilling them. For minor learners and school-enrolled students, we respond within 14 days as a priority handling commitment. Parents and legal guardians can exercise these rights on behalf of an under-18 user (see Section 9).
7. How we protect your data
Technical and organisational measures:
Encryption in transit (HTTPS/TLS) for all connections
Encryption at rest for sensitive data in storage
Access controls: only authorised personnel can access user data, and only for stated purposes; minor learner data has additional access restrictions
Regular security reviews and updates
Incident response process with 72-hour breach notification to authorities and affected users where required by law
Contractual eligibility and parental consent representations at signup, with material-breach consequences for false representations (see Terms of Service Appendix A.2)
We honour the Global Privacy Control (GPC) signal. If your browser sends it, we treat that as an opt-out request from non-essential data sharing.
8. How long we keep it
Active account data
As long as your account is open, plus 6 months after closure
Minor learner account data
Deleted within 7 days of a verified deletion request from the learner or their parent/guardian; otherwise within 30 days of account closure
School-enrolled student data
Per the School Service Provider Agreement; typically deleted within 30 days of institutional account termination
Certificates and academic records
7 years (industry standard for educational credentials)
Payment records
7 years (tax law requirement in most jurisdictions)
Marketing data
Until you opt out, then deleted immediately. We never collect marketing data on minor learners.
Support tickets
3 years after resolution
Log files
90 days
9. International transfers
Our primary operations are based in Dubai, United Arab Emirates. Your data may be processed in other countries where our service providers operate (mainly the European Union, United Kingdom, and United States).
When data leaves the country where you provided it, we use Standard Contractual Clauses (SCCs) or equivalent legal mechanisms approved by your local data protection authority to ensure the same level of protection follows the data wherever it goes.
10. Minor learners, age, and parental consent
Service design and minimum age
Zelus Academy is designed primarily for adult learners and professionals. While the educational content may be of value to minor learners aged 13 and older, our default user is an adult.
We do not knowingly accept users below 13 years of age, anywhere in the world. In jurisdictions where local law requires a higher minimum age for consent to data processing without parental involvement (for example, 16 in some European Union member states under GDPR Article 8; 18 in the United Arab Emirates under the PDPL; 18 in India under the DPDP Act 2023), users below the local threshold may not create accounts without obtaining verifiable consent from their parent or legal guardian.
Parental consent attestation for users under 18
If you are under 18 years of age, you may use the Services only with the consent of your parent or legal guardian. You provide this consent through a contractual attestation made at signup by accepting our Terms of Service (see Terms of Service, Appendix A.2 for the full warranty text).
By creating an account, an under-18 user represents and warrants that:
The user has obtained the consent of their parent or legal guardian;
The user is using the Services under the ongoing supervision and guidance of that parent or guardian;
The parent or guardian is aware of these Terms and this Privacy Notice;
The parent or guardian remains responsible for monitoring the user''s use of the Services.
We rely on this attestation in good faith. We do not technically verify parental consent at signup. The attestation is a legally binding warranty made as part of the Terms of Service contract; a false attestation is a material breach with the consequences described in the Terms.
Reservation of right to verify. We reserve the right to request verification of age, parental consent, or identity at any time if we have reasonable basis to believe a representation may be inaccurate, and to suspend an account pending such verification.
Enhanced protections for minor learners (under 18)
For users identified as minor learners (under 18), the following protections apply automatically:
No targeted advertising or behavioural profiling: we never use minor learner data for targeted ads or profile-building, and we never share such data with advertising networks or data brokers
No public visibility of user-generated content: assignments, course feedback, and project work are visible only to instructors, school administrators (for school-enrolled students), and Zelus support; never publicly
Stricter data minimisation: we collect only what is needed to deliver educational content; no data enrichment from third-party sources
Stronger right to deletion: we delete the account and associated data within 7 days of a verified deletion request
No automated decision-making: we do not use algorithms to make decisions about minor learners that produce legal or similarly significant effects
Marketing communications opt-in only: marketing emails are off by default; minor learners cannot be enrolled in marketing without affirmative parental opt-in
Priority response on data requests: 14-day response window for access, correction, portability requests (vs 30 days general)
Analytics disabled or anonymised: Google Analytics and similar measurement tools are disabled or fully anonymised for accounts identified as minor learners
Revocation of parental consent
If a parent or legal guardian becomes aware that their under-18 child has signed up to the Services and wishes to revoke their consent, the parent or guardian may contact support@zelusinternational.com with the subject "Parental consent revocation". The request should include enough information to identify the account (the child''s email address or username; if unknown, a description of the circumstances and we will work with you to identify the account). We may ask for verification of your identity and your relationship to the under-18 user.
On verified revocation:
We suspend the account within 24 hours
We delete all associated personal data within 7 days (or retain only what we are legally required to keep, with no further use)
We route any pending communications to the parent or guardian
The minor user may not re-create an account on the Services without renewed parental consent, evidenced by a fresh attestation at signup
Parents and legal guardians may also exercise any of the rights in Section 5 on behalf of an under-18 user without first revoking consent. Use subject line "Minor learner request" for routine data requests; we respond within 14 days.
School Use program (institutional enrolments)
Schools, universities, accredited learning programs, and similar educational institutions can enrol students aged 13 and above through our School Use program. Under this program:
The institution warrants that all students it enrols are at least 13 years old
The institution warrants that it has appropriate authority and any required parental consent under applicable law (including COPPA, FERPA, GDPR, UAE PDPL, India DPDP, and similar)
The institution is the data controller for student personal data
Zelus Academy acts as the data processor under a School Service Provider Agreement (SSPA) with the institution
A separate SSPA governs the institutional relationship and includes a GDPR Article 28-compliant Data Processing Agreement annex
All communications about enrolled students go to the school administrator, not directly to the student
The institution can request bulk deletion of all student data at any time
Schools interested in the School Use program may contact support@zelusinternational.com with subject "School Use enquiry".
Compliance frameworks recognised
We design our age policy and minor learner protections to meet or exceed the following frameworks:
United States: COPPA (under-13 prohibited), FERPA (when acting as a school service provider), CCPA/CPRA minor provisions, Texas SCOPE Act, and similar state laws
European Union: GDPR Article 8 (age of consent for data processing), Article 28 (data processor obligations)
United Kingdom: UK GDPR; Age Appropriate Design Code (Children''s Code) from the ICO
United Arab Emirates: PDPL child data protections; Federal Law on the Rights of the Child (Wadeema''s Law)
India: DPDP Act 2023 (under-18 parental consent)
China: PIPL (under-14 guardian consent)
South Korea: PIPA (under-14 legal representative consent)
If you believe a person below the applicable minimum age has created or accessed a Zelus Academy account, please contact support@zelusinternational.com with the subject "Underage account report". We investigate promptly and, where appropriate, suspend the account within 24 hours and delete the associated personal data within 7 days of a verified report.
11. Updates to this notice
When we change this notice in any material way, we will:
Update the "Version" and "Effective" date at the top
Email registered users at the address tied to their account (for school-enrolled students, this notice goes to the school administrator; for under-18 accounts where parental consent has been revoked, to the parent or guardian)
Display a notice on our websites for at least 30 days
For material changes that reduce your rights (or reduce minor learner protections), give you a meaningful opportunity to delete data before the new terms take effect
Subject line: "Privacy request" general; "Minor learner request" for 13-17 user matters; "Parental consent revocation" to revoke an under-18 attestation; "School Use enquiry" for institutional; "Underage account report" for reports of users below the minimum age
Response time: 30 days general; 14 days for minor learner and school matters; 24 hours for underage account reports and parental consent revocations
If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.