Privacy Notice

1. Introduction

DEEP KNOWLEDGE INTERNATIONAL - FZCO, a free zone company incorporated in the Emirate of Dubai, United Arab Emirates, under company/licence number 60293, with its registered address at IFZA Business Park, DDP, Premises Number 001 - 60293, Makani Number A1 - 3641379065, Dubai, United Arab Emirates (hereinafter “our Company”, “we”, “us” or “our”), operates the Global Health Challenges platform.

This Privacy Notice explains how we collect, use, share, protect and retain your personal data when you access our website https://health-challenge.org/ with all its subdomains, pages, forms and gated materials (collectively, the “Platform”), or whenever we otherwise interact with you in connection with the Platform (for example, by email or at events).

We act as the “controller” of your personal data for the processing described in this Privacy Notice. Other members of the Global Health Challenges Consortium (the “GHC Consortium”) are separate organisations; where they process your personal data for their own purposes, their own privacy notices apply.

We process personal data in accordance with the data protection laws of the Gulf region that apply to our activities, including:

• UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “UAE PDPL”);
• the Saudi Personal Data Protection Law issued by Royal Decree No. M/19 of 1443H, as amended, and its implementing regulations (the “KSA PDPL”);
• Qatar Law No. 13 of 2016 on Personal Data Privacy Protection;
• Bahrain Law No. 30 of 2018 on Personal Data Protection;
• Oman Royal Decree No. 6/2022 promulgating the Personal Data Protection Law;
• the Kuwait CITRA Data Privacy Protection Regulation;

(together, the “Gulf Data Protection Laws”), and, where applicable to you, Regulation (EU) 2016/679 (the “GDPR”) and the UK GDPR.

Regardless of where you are located, we apply to all users of the Platform a standard of protection that is no lower than the standard required by the GDPR. Where a Gulf Data Protection Law sets a stricter requirement for you, we apply that stricter requirement.

Please read this Privacy Notice carefully. If you do not agree with it, please do not use the Platform or submit your personal data to us.

2. What Personal Data We Collect and How

We collect only the personal data we need for the purposes described in Section 3.

2.1. Information you provide to us

2.2. Information we collect automatically

• Technical and usage data: IP address, device type, operating system, browser type and version, language settings, referring website, pages viewed, time and duration of visits, clicks and navigation paths.
• Approximate location: country or city derived from your IP address. We do not collect your precise geolocation.
• Cookies and similar technologies: strictly necessary cookies are always active; all other cookies are placed only with your consent. See our Cookie Notice for details.

2.3. Information we obtain from other sources

• GHC Ecosystem Leaders database and analytical reports: the Platform includes analytical materials that refer to individuals who play a significant role in the global health challenges ecosystem (for example, executives, researchers, investors, policymakers and philanthropists). For these individuals we process professional information obtained from publicly available sources, such as company websites, official registers, publications, press releases and professional networking profiles: name, job title, organisation, professional achievements, public statements, publicly available professional photograph and links to public profiles. We do not collect private contact details or sensitive data for this purpose. If you are featured in our materials, you have all the rights described in Section 9, including the right to object and to request correction or removal.
• GHC Consortium members and partners: contact details of individuals who have expressed interest in partnering, sponsoring or accessing GHC reports through a GHC Consortium member, where that member is permitted to share them with us.
• Service providers: confirmation of payments from our payment service providers and delivery statistics from our email service provider (for example, whether an email was opened).

Where a field in a form is mandatory, it is marked as such. If you do not provide mandatory information, we may be unable to respond to your request, process your application or donation, or grant access to gated materials.

3. Why We Use Your Personal Data and Our Legal Bases

We use your personal data only for the purposes below and only where we have a valid legal basis.

Consent under Gulf Data Protection Laws. Some Gulf Data Protection Laws, including the UAE PDPL, treat consent as the primary basis for processing and allow processing without consent only in listed cases (for example, performance of a contract, compliance with a legal obligation, or establishing and defending legal claims). Where such a law applies to you and none of its exemptions covers a particular processing activity, we will ask for your consent before carrying out that activity.

Your consent must be specific, informed, unambiguous and given by a clear affirmative action. We do not use pre-ticked boxes. You may withdraw consent at any time, as easily as you gave it, without affecting the lawfulness of processing carried out before withdrawal (see Section 10.2).

Legitimate interests. Where we rely on legitimate interests, we carry out a balancing test to ensure our interests are not overridden by your interests, rights and freedoms. You may request information about this test and you have the right to object (Section 9).

New purposes. We will not use your personal data for a purpose that is incompatible with the purpose for which it was collected. If we intend to use it for a new purpose, we will inform you in advance and, where required, ask for your consent.

4. Sensitive Personal Data

The Platform addresses health topics, but we do not ask for and do not intend to collect information about your health or other sensitive personal data (such as racial or ethnic origin, religious or philosophical beliefs, political opinions, genetic or biometric data, or criminal records).

Please do not include such information in forms or messages. If you nevertheless provide it voluntarily, for example when describing your interest in a health challenge, we will process it only on the basis of your explicit consent and only to handle your request, or we will delete it if it is not needed.

5. How We Share Your Personal Data

We do not sell your personal data and we do not share it with third parties for their own direct marketing.

We share personal data only with the following categories of recipients, and only to the extent necessary:

• Service providers (processors): website hosting and building (Wix.com Ltd. and its affiliates), cloud storage, email and newsletter delivery, form management, analytics (only with your consent), payment processing and IT support. They act only on our documented instructions, under written agreements that require confidentiality, appropriate security and deletion or return of the data at the end of the service.
• Payment service providers: when you donate, the payment provider processes your payment details as an independent controller under its own privacy notice.
• GHC Consortium members: where your request, application or donation relates to a programme run jointly with or by a GHC Consortium member (for example, a partnership, ambassador role or a specific report), we share the data needed for that purpose with that member. We will tell you which member is involved where practicable.
• Our group companies: affiliates within the Deep Knowledge Group that support the operation of the Platform and its analytics, under the same standards of protection as set out in this Privacy Notice.
• Professional advisers: lawyers, auditors, accountants and insurers, who are bound by confidentiality.
• Public authorities: courts, regulators, law enforcement and other competent authorities, where we are required by law or where disclosure is necessary to establish, exercise or defend legal claims. We assess each request and disclose only what is legally required.
• Business transfers: a buyer, successor or other party in a merger, acquisition, restructuring or sale of assets, subject to confidentiality and to this Privacy Notice.
• Others with your consent or at your instruction.

You may request a list of our current service providers by contacting us (Section 10.7).

6. International Data Transfers

Our Company is located in the UAE, and some of our service providers and GHC Consortium members are located in other countries, including countries in the European Union, the United Kingdom, the United States and Israel. Your personal data may therefore be transferred to, and processed in, countries other than the one in which you are located.

We transfer personal data across borders only where at least one of the following safeguards applies:

• the recipient country is recognised as providing an adequate level of data protection by the authority competent under the law that applies to the transfer (including adequacy decisions of the European Commission or the UK Government);
• we have concluded a written agreement with the recipient that requires it to protect the data to a standard equivalent to applicable law, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or standard contractual clauses issued by the competent Gulf authority (including those issued by the Saudi Data & AI Authority);
• the recipient is bound by binding corporate rules or an equivalent approved mechanism;
• another condition permitted by the applicable law is met, such as your explicit consent after being informed of the possible risks, or the transfer being necessary for the performance of a contract with you or for legal claims.

Where required, we assess the laws of the recipient country and apply supplementary measures (such as encryption and access controls). You may request a copy of the safeguards we use by contacting us (Section 10.7).

7. How Long We Keep Your Personal Data

We keep personal data only for as long as necessary for the purpose for which it was collected, and then delete or anonymise it.

We may keep personal data for longer where required by law, or where necessary to establish, exercise or defend legal claims, in which case we keep only the data needed and for no longer than needed.

8. How We Protect Your Personal Data

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and disclosure, taking into account the nature of the data and the risks involved. These measures include encrypted connections (HTTPS/TLS), role-based access limited to personnel who need the data, confidentiality obligations for staff and service providers, secure hosting, regular review of access rights and data minimisation.

The Platform is hosted on the Wix.com platform, which stores data on secure servers protected by firewalls and industry-standard security controls.

Data breaches. If a personal data breach occurs that is likely to affect your rights, we will notify the competent supervisory authority within the time required by applicable law (for example, within 72 hours of becoming aware of it, where the GDPR or the KSA PDPL applies) and will inform you without undue delay where the breach is likely to result in a high risk to you.

No method of transmission over the internet or of electronic storage is completely secure. Please do not send us personal data by email or other channels unless we request it.

9. Your Rights

Wherever you are located, you have the following rights in relation to your personal data, subject to the conditions and exceptions of applicable law:

• Right to be informed about how we process your personal data, which this Privacy Notice provides.
• Right of access: to obtain confirmation of whether we process your personal data and a copy of it, together with information about the purposes, recipients, retention and source.
• Right to rectification: to have inaccurate data corrected and incomplete data completed.
• Right to erasure: to have your data deleted where it is no longer needed, you withdraw consent, you successfully object, the data was processed unlawfully, or deletion is required by law.
• Right to restriction: to have the processing of your data restricted, for example while its accuracy or our grounds for processing are being verified.
• Right to object: to processing based on legitimate interests, including the GHC Ecosystem Leaders database, on grounds relating to your particular situation, and at any time and without giving reasons to direct marketing.
• Right to data portability: to receive data you provided to us, processed on the basis of consent or contract by automated means, in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
• Rights relating to automated decision-making: not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. We do not make such decisions (Section 10.3).
• Right to withdraw consent at any time (Section 10.2).
• Right to lodge a complaint with a supervisory authority (below).

How to exercise your rights. Send your request to legal@dkv.global. We may ask you to verify your identity before acting on the request. We will respond within 30 days of receipt. Where a request is complex or we receive a large number of requests, we may extend this period to the extent permitted by applicable law, in which case we will inform you of the extension and the reasons within the initial 30 days.

Exercising your rights is free of charge. We may charge a reasonable fee or refuse to act only where a request is manifestly unfounded or excessive, and we will explain why. If we refuse a request, we will tell you the reasons and how you may challenge our decision.

Complaints. We encourage you to contact us first so that we can try to resolve your concern. You also have the right to lodge a complaint with the competent data protection authority, in particular in the country of your residence, place of work or place of the alleged infringement, including: the competent UAE federal data protection authority; the Saudi Data & AI Authority (SDAIA) in Saudi Arabia; the National Data Privacy Office in Qatar; the Personal Data Protection Authority in Bahrain; the Ministry of Transport, Communications and Information Technology in Oman; the Communication and Information Technology Regulatory Authority (CITRA) in Kuwait; the supervisory authority of your EU Member State; or the Information Commissioner’s Office in the United Kingdom.

10. Other Important Information

10.1. Direct marketing

We send newsletters and promotional communications only with your prior consent. Every message contains an unsubscribe link, and you may also unsubscribe by contacting us. Unsubscribing does not affect service messages relating to a request you made.

10.2. How to withdraw your consent

You may withdraw any consent you have given, in full or in part, at any time by using the unsubscribe link in our emails, changing your choices in the “Cookie Settings” on the Platform, or contacting us at legal@dkv.global. Once we receive your withdrawal, we will stop the processing based on that consent, unless another legal basis applies (for example, a legal obligation or legal claims), in which case we will inform you.

10.3. Automated decision-making and profiling

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. We may group subscribers by stated interests to send relevant content, which does not have such effects.

10.4. Children

The Platform is not intended for persons under 18 years of age, and we do not knowingly collect their personal data. If you believe that a child has provided us with personal data, please contact us at legal@dkv.global and we will delete it promptly.

10.5. Cookies

We use cookies and similar technologies. Strictly necessary cookies are always active; analytics, functionality and marketing cookies are used only with your consent, which you can give, refuse or withdraw through “Cookie Settings” at any time. For full details, please see our Cookie Notice.

10.6. Third-party websites and content

The Platform may contain links to, or embedded content from, third-party websites and services (for example, video players, social media pages, GHC Consortium members’ websites and payment pages). Those third parties process personal data under their own privacy notices, and we are not responsible for their practices. Please review their privacy notices before providing your personal data.

10.7. Contact us

For any questions about this Privacy Notice, to exercise your rights, to make a complaint or to report a possible security incident, please contact us:

• Email: legal@dkv.global
• Post: DEEP KNOWLEDGE INTERNATIONAL - FZCO, IFZA Business Park, DDP, Premises Number 001 - 60293, Dubai, United Arab Emirates

10.8. Changes to this Privacy Notice

This Privacy Notice is effective as of the “Last Update” date above. We may update it to reflect changes in our processing or in the law. We will publish the updated version on the Platform and, where the changes are material, we will notify you by email (if we have your email address) or by a prominent notice on the Platform before the changes take effect. Where a change requires your consent, we will ask for it.