Privacy Notice & Cookie Policy

WHO WE ARE AND HOW TO CONTACT US

This Privacy Notice is published by the Advanced Technology Research Council ("ATRC"), a council established under Law No. (14) of 2020 in Abu Dhabi with its principal office at Accelerator 2 Building, Plot M12, Masdar City, Abu Dhabi, the United Arab Emirates. ATRC is the data controller for the personal data described in this Notice – meaning we determine why and how your personal data is used.

The Website and portal are hosted on infrastructure provided by Microsoft Azure, with data hosted within the United Arab Emirates. Microsoft Azure and any other technical sub-processors we engage act as data processors on our instructions and do not use your personal data for their own purposes.

ATRC is the organising entity for the Path 2 A2RL STEM Competitions conducted through this portal, with Challenge Tracks delivered by ATRC's appointed Challenge Providers. ATRC's supplier agreements with the Challenge Providers are entered into by Technology Innovation Institute – Sole Proprietorship L.L.C. ("TII") on ATRC's behalf.

References to "we", "us" or "our" in this Notice mean ATRC.

Where we refer to "the Website", we mean the Path 2 A2RL registration portal at https://portal.a2rl.io/ and any successor URL. Terms used but not defined in this Notice have the meanings given to them in our Terms and Conditions ("T&Cs").

Contact us about privacy: Please contact us via email at Path2A2RL@atrc.gov.ae; or via mail at Advanced Technology Research Council (ATRC) Accelerator 2 Building, Plot M12, Masdar City, Abu Dhabi, UAE.

HOW THIS NOTICE WORKS

This Privacy Notice explains how we collect, use, store, share and transfer your personal data when you use the Website or participate in a Challenge Track. It should be read alongside our T&Cs and the Cookie Policy set out at the end of this Notice, which explains the cookies and other tracking technologies we use.

For these purposes, "personal data" means any information that identifies or could reasonably be used to identify a living individual, either on its own or together with other information.

Please read this Notice carefully. By registering a Team or using the Website, you confirm that you have read and understood how we use your personal data.

1. WHAT PERSONAL DATA WE COLLECT AND HOW

We collect personal data in three ways: directly from you, automatically when you use the Website, and from third-party sources.

Information you give us directly

• Registration. When a Team Representative registers a Team, we collect information about the Team (such as team name, institution name and country) and, in relation to each Team Member (including where entry is at team level), mandatory information such as full your name, gender, date of birth, email address, password, country of residence, nationality, contact details, school/institution details, and, where applicable, Emirates ID or national ID number, passport number and expiry date, and a passport-size photograph. We also collect emergency contact details, and, where relevant, known medical conditions or allergies (where necessary for participant safety, accessibility requirements or event logistics), accessibility requirements, and international team logistics information (such as visa status, travel and accommodation details). Where a Team Member is under 18, we also collect the information described in the "Minors and Guardian Consent" at section 1.4 below.
• Supporting documents and uploads. We collect personal data you provide, post or upload during registration, and when you upload Deliverables such as documents, presentations and audio/video files), or school institution enrolment proof, identification or passport copies, and any consent or authorisation documents.
• Verification and evidence materials. Where we request it, we may collect identification documents and other supporting materials for the purposes of verifying a Team's or Team Member's eligibility or identity in connection with a Challenge Track.
• Correspondence. We keep a record of any correspondence between you and us, such as information you send when you report a problem with the Website or our Services. Any other information you choose to provide to us.

Information we collect automatically

Technical and device data. When you visit the Website, we may collect certain technical information about the devices you use and the networks to which you are connected to access the Website. This includes your IP address, log-in information, time of visit, browser type and version, and operating system. We collect this information using different technologies including cookies (see our Cookie Policy below).

Minors and Guardian Consent

Where a Team Member is under 18, we additionally collect, from that Team Member's parent or legal guardian: the guardian's full name, relationship to the Team Member, email address and mobile number; a copy of the guardian's identification or passport; the signed parental/guardian consent form; separate media and photo release consent; the school authorisation letter; and, where applicable, the name and contact details of an accompanying chaperone.

This information is collected in order to obtain and evidence guardian consent before a minor Team Member is permitted to participate, in accordance with the age-verification and consent process described in our T&Cs. It is used only for that purpose and for safeguarding, communication and event-logistics purposes connected with the Team Member's participation.

2. HOW LONG WE KEEP YOUR PERSONAL DATA

We retain personal data collected through the Website for up to 12 months following the conclusion of the relevant Challenge Track (or, for Grand Finale participants, following the Grand Finale), after which it will be securely deleted, save to the extent a longer retention period is required or permitted by applicable law.

We may also retain your personal data for an additional period to the extent necessary to assert or defend against legal claims.

In addition, we may retain certain verification documents, tax records and award-related information for as long as required by applicable UAE law and our internal records retention policies, including any safeguarding-related retention requirements applicable to records concerning minors.

3. HOW WE USE YOUR PERSONAL DATA.

We use your personal data for the following purposes:

More specifically:

We use your personal data to enable Teams to register for and participate in the Path 2 A2RL STEM Competitions, and to send service-related information (such as confirmation of a Team's registration in a Challenge Track) by email or other means.

We use your data to enable communication between Teams, Mentors, Challenge Providers and us in connection with the Challenge, and to publish results and related content about Challenge Track participation and outcomes.

We also use your data to give you access to our support services, to keep the Website secure and safe, to notify you about changes to our Services, to administer the Website (including for troubleshooting, data analysis, testing, research and survey purposes); to improve the Website and ensure content is presented effectively and to comply with our legal obligations, including court orders and other regulatory requirements.

In accordance with applicable laws and where required with your consent, we may send Team Representatives and marketing materials, institutions communications about future competitions, STEM programmes and related activities that may be of interest. You may withdraw your consent at any time – see section 9 below.

4. WHO WE SHARE YOUR PERSONAL DATA

Within the ATRC group

We may share your personal data with ATRC's Affiliates, where applicable, for the purposes set out in this Notice.

Visibility of your profile and content on the platform

Information contained in your Team registration profile, Team profile and any content submitted through the platform is not publicly visible and is not accessible to other Teams. Access to such information is restricted to your Team Representative, ATRC personnel with a need to access the information for administration of the Challenge, and the relevant Challenge Provider(s) responsible for administering the applicable Challenge Track or event.

Third-party recipients

We work with third parties who may receive your personal data, including Microsoft Azure (which hosts the platform) and other sub-contractors, such as cloud computing platforms, data and content management systems, and analytics providers.

We also share relevant Team registration data with the Challenge Provider(s) delivering the Challenge Track(s) the Team has entered, together with their administrators, Mentors and judges, and with the event management contractor engaged for the Finals, solely for the purpose of administering that Challenge Track or event. We have entered into appropriate data sharing arrangements with each Challenge Provider to ensure compliance with data protection laws. Access to registration data within ATRC is otherwise restricted to the designated portal administration team.

Other circumstances for sharing

We only share your personal data with third parties in the following circumstances:

• where you have explicitly requested it; or
• where we are required to do so by law, or in good faith where disclosure is reasonably necessary to respond to claims, comply with legal or regulatory proceedings, or protect the rights, property or safety of ATRC, its Affiliates, or Teams.

5. THE LEGAL BASIS FOR DATA PROCESSING

We are required by applicable data protection law — including UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL") and, where relevant, the EU General Data Protection Regulation ("GDPR") — to identify a lawful basis for each purpose for which we use your personal data.

We collect, use and share your personal data:

• Contract performance: where processing is necessary to provide the Services on the Website and fulfil the T&Cs – for example, creating your account, enabling Challenge participation and administering awards.
• Consent: where you have given consent – for example, for media and photo release consent, guardian consent on behalf of a minor Team Member, direct marketing communications, or targeted advertising on social media platforms. Consent may be withdrawn at any time through the contact details provided above;
• Legal obligation: where processing is necessary to comply with our legal obligations – for example, tax reporting, responding to regulatory requests, or complying with court orders.
• Legitimate interests: where processing is necessary for our legitimate interests - including our interests in providing an effective and innovative platform for our users and partners - provided those interests are not overridden by your interests or fundamental rights.

Note on the PDPL: UAE Federal Decree-Law No. 45 of 2021 (PDPL) governs the processing of personal data of individuals in the UAE. Where the PDPL applies, we process your personal data in accordance with its requirements, including in relation to consent, data subject rights and cross-border transfers. Where GDPR applies additionally (for example, to data subjects in the European Economic Area), we comply with those requirements in parallel.

6. DIRECT MARKETING AND TARGETED ADVERTISING

In accordance with applicable laws and where required with your consent, we may use the contact details provided by Team Representatives and institutions on the Website for direct marketing communications directed to those adult contacts – for example, newsletters, invitations to upcoming competitions, STEM programmes or events, and other communications that we think may interest them. Such communications will not be directed to individual minor Team Members.

You can withdraw your consent at any time by clicking on the unsubscribe link in any marketing email or contacting us at the details provided above.

Withdrawing consent does not affect the lawfulness of any processing carried out before you withdrew it.

7. TRANSFERRING YOUR PERSONAL DATA INTERNATIONALLY

We store your personal data on servers located within the United Arab Emirates, using Microsoft Azure.

Because certain Challenge Providers are headquartered or parented outside the UAE (including entities headquartered in the United States), and because Teams may use third-party platforms for training and mentorship in connection with a Challenge Track, your personal data may in some cases be transferred outside the UAE. Where this occurs, we ensure that such transfers are made subject to appropriate contractual safeguards, consistent with the requirements of the PDPL, so that your data receives an adequate level of protection wherever it is processed.

Our policy requires all Challenge Providers and other third parties who receive personal data on our behalf to maintain a level of data protection consistent with the requirements of the PDPL.

Where your personal data is transferred outside the UAE to a country that has not been designated as providing adequate protection under the PDPL, we will ensure that appropriate safeguards are in place, such as standard contractual clauses, or equivalent mechanisms approved by the UAE Data Office.

8. HOW WE KEEP YOUR PERSONAL DATA SECURE

We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage in accordance with our internal security procedures covering storage, access and destruction.

These measures include, but are not limited to, encryption of data in transit and at rest, access controls and authentication mechanisms, regular security testing and vulnerability assessments, and contractual security obligations on our hosting provider and other data processors.

No security system is impenetrable. If you become aware of any security issue or suspect that your Account has been compromised, please contact us immediately.

9. YOUR RIGHTS IN RELATION TO YOUR PERSONAL DATA

In addition to your rights under applicable data protection legislation and where we are permitted or required by applicable law, we will provide you, - upon request - with a copy of your personal data and we will correct any errors you identify.

Under the PDPL and, where applicable, the GDPR, you may have the following rights in relation to your personal data:

• Right of access: The right to obtain confirmation of whether we process your personal data and to receive a copy of it.
• Right to rectification: The right to have inaccurate or incomplete personal data corrected.
• Right to erasure: The right to request deletion of your personal data in certain circumstances — for example, where it is no longer necessary for the purposes for which it was collected.
• Right to restrict processing: The right to ask us to restrict how we use your personal data in certain circumstances.
• Right to data portability: The right to receive a subset of your personal data in a structured, commonly used format and/or to have it transferred to another data controller, where technically feasible.
• Right to object: The right to object to our processing of your personal data where we rely on legitimate interests as our legal basis.
• Right to withdraw consent: Where we rely on your consent, the right to withdraw it at any time without affecting the lawfulness of prior processing.
• Right to complain: You have the right to lodge a complaint with the relevant supervisory authority regarding our processing of your personal data. In the UAE, the relevant authority is the UAE Data Office (established under Federal Decree-Law No. 45 of 2021). If you are based in the EEA, you may also complain to your local data protection authority.

To exercise any of these rights, or if you have any questions about this Notice or how we handle your personal data, please contact us at Path2A2RL@atrc.gov.ae. Where a Team Member is under 18, requests should ordinarily be made by that Team Member's parent or legal guardian.

We will respond to your request within the timeframe required by applicable law (generally within 30 days, or such other period as specified under the PDPL or GDPR as applicable). We may need to verify your identity before responding.

10. LINKS TO OTHER WEBSITES

Our Website may contain links to other websites, including those of partner companies. Those websites have their own privacy practices, for which we do not accept responsibility or liability. Please review those policies before submitting any personal data to those sites.

11. UPDATES TO THIS NOTICE

We reserve the right to amend this Privacy Notice from time to time to reflect changing legal requirements or our processing practices. Any changes will be posted on the Website and will be effective upon posting. Where changes are material, we will notify you before they take effect — for example, by email or by displaying a prominent notice on the Website.

12. GOVERNING LAW AND JURISDICTION

This Privacy Notice including the Cookie Policy shall be governed by and construed in accordance with the governing law provisions set out in the T&Cs. Any dispute arising out of or in connection with this Privacy Notice (including the Cookie Policy) shall be resolved in accordance with the dispute resolution provisions specified in the T&Cs, which are incorporated herein by reference. By using the Website you agree that such governing law and dispute resolution provisions shall apply to this Privacy Policy.

COOKIE POLICY

What is a Cookie?

A cookie is a small file placed on your device that records information relating to your navigation on the Website (such as the date and time pages were loaded, the browser used and language, pages viewed, frequency and duration of visits, number of visits, sources of the visit, and approximate location) and that can facilitate your future visits to the Website.

We also use similar technologies such as web beacons, pixels and local storage, which operate in a similar way. References to "cookies" in this policy include these technologies unless otherwise stated.

Your Consent to Cookies

The Website uses strictly necessary cookies and similar technologies that are required for the operation, security and functionality of the platform.

Types of Cookies We Use

Strictly Necessary Cookies (no consent required)

When you access the Website, a session cookie and a "token" cookie with a unique encrypted session ID are passed to your device. The session cookie controls your access to the Website for that session and is deleted once you close your browser or log out. These cookies also allow us to identify your device and preferences when you return, including language and regional settings. These cookies are essential for the Website to function and cannot be switched off. The information gathered is used only to ensure the Website operates correctly.

Cookies Installed by the Platform

The following cookies are classified as strictly necessary and do not require your consent:

How to Manage or Delete Cookies

You have several options for managing cookies:

1. Via the Website's cookie banner or footer tool: Click on the "Cookies" button in the footer of the Website at any time to update your preferences or withdraw consent.
2. Via your browser settings: All web browsers allow you to configure your cookie preferences before you navigate the internet. You can set your browser to refuse cookies or to notify you when a cookie is being installed. Instructions for the most popular browsers are available at:
   • Google Chrome: chrome://settings/cookies
   • Mozilla Firefox: support.mozilla.org
   • Safari: support.apple.com
   • Microsoft Edge: support.microsoft.com
   • Opera: help.opera.com
3. Clearing existing cookies: You can clear cookies already stored on your device by clearing your browser's cache.

Please note that if you delete or refuse cookies, some features of the Website may not function as intended.

Contact for Cookie Queries

If you have questions about our Cookie Policy, please contact us at Path2A2RL@atrc.gov.ae.