Privacy Policy

1. Data Controller & Scope of Policy

This Privacy Policy applies to all services, training courses, assessments, interactive portals, and digital platforms operated by Belhasa Safety Training Academy (“BSTA”, “we”, “us”, or “our”), registered in the Emirate of Dubai, United Arab Emirates, under the umbrella of Saif Belhasa Holding.

For the purposes of the UAE Federal Decree-Law No. 45 of 2021 regarding Personal Data Protection (PDPL), BSTA acts as the Data Controller responsible for deciding the purposes and methods of processing your personal data.

2. Information We Collect

We collect personal information necessary to deliver professional health, safety, fire, medical, and industrial compliance training. This includes:

• Identification & Contact Data: Full legal name (English and Arabic where required for official regulatory registers), Emirates ID number, passport copy (for international candidates), date of birth, nationality, email address, phone number, and physical company address.
• Corporate & Employment Data: Employer name, job title, department, employee identification number, corporate purchase orders, and sponsor contact details.
• Course & Academic Data: Course registration details, attendance logs, exam scores, competency evaluations, video recordings of practical simulations (e.g. fire grounds and CPR scenarios for grading and accreditation auditing), and certificate issuance numbers.
• Financial & Invoicing Information: Corporate billing addresses, TRN (Tax Registration Numbers), transaction history, and bank transfer receipts. Note: We do not store full credit card credentials on our servers; card transactions are handled by certified, PCI-DSS-compliant UAE payment gateways.
• Technical & Digital Usage Data: IP address, device specifications, browser type, operating system, pages visited, and interaction timestamps captured via cookies and analytical scripts.

3. How We Use Your Information

We process personal data only when backed by legitimate lawful grounds under UAE law:

4. Accreditations & Regulatory Data Disclosures

To provide recognized qualifications, candidate details must be submitted to accredited government and international awarding bodies. We strictly disclose only required data to:

• Dubai Corporation for Ambulance Services (DCAS): For First Aid, CPR, and AED candidate registrations and certification validation.
• General Directorate of Civil Defence (Dubai Civil Defence): For fire safety, fire warden, and emergency response approvals.
• Highfield Qualifications (UK & Middle East): For international level qualifications, exam verification, and global registry recording.
• Institution of Occupational Safety and Health (IOSH): For IOSH Managing Safely and Working Safely candidate verification.
• Sponsoring Employers: If your training was funded or organized by your employer, attendance logs, scores, and completion certificates will be reported to the designated corporate safety coordinator.

We never sell, rent, or lease candidate personal data to marketing third parties.

5. Data Retention & Security Measures

We retain candidate qualification records for a minimum period of 7 years, or as required by DCAS, Civil Defence, and international awarding bodies to enable lifelong certificate verification, replacement issuance, and official employer compliance audits.

All digital records are stored in secure cloud facilities located within certified data centers. Technical defenses include end-to-end TLS 1.3 encryption, network firewalls, multi-factor authentication for academy administrators, and role-based access restrictions.

6. Cookies & Digital Analytics

Our website utilizes standard HTTP cookies and session tokens to enhance navigation, analyze aggregate traffic trends, and optimize user experience. You can control or block cookies at any time via your browser settings; however, certain functions (such as interactive forms and course filtering) may have diminished performance.

7. Your Rights under UAE Data Protection Law

Under UAE Federal Decree-Law No. 45 of 2021, candidates and clients have specific statutory rights:

• Right of Access: Request a copy of the personal data held in your academy candidate record.
• Right to Rectification: Request correction of inaccurate, incomplete, or out-of-date records.
• Right to Erasure (“Right to be Forgotten”): Request deletion of data where retention is no longer required by regulatory bodies or statutory accounting rules.
• Right to Restrict or Object to Processing: Request suspension of processing in specified circumstances.
• Right to Withdraw Consent: Withdraw previously given consent for non-statutory communications.

To exercise any of these rights, please contact us via email at info@bstamena.com, call us at +971 4 324 4896, or visit our academy. We will process and acknowledge your request within 30 days.

8. Policy Updates

We may periodically update this Privacy Policy to reflect enhancements in our training services, new accreditation partnerships, or changes in UAE legislation. Updates will be posted on this page with an amended “Last Updated” date.

9. Contact Information

If you have any questions, comments, or concerns about this policy or your personal data, please reach out to us via email, phone, or visit our academy in person: