Privacy Policy and Data Protection Notice

Welcome to TABcounsel www.tabcounsel.com (hereinafter "Website") operated by TABONE VENTURES PARTNERS FZCO (hereinafter "TABcounsel").

This Privacy Policy (hereinafter "Policy") applies to the use of the Website and the TABcounsel platform (hereinafter "Platform") and covers any information about users of our products and/or services (hereinafter "Services") that may include personal data as defined by applicable laws and regulations (hereinafter "Personal Data"), which TABcounsel may obtain when you use the Platform. The Policy is intended to inform you about how we collect and use information so you can make an informed decision about using the Services. Please read it carefully before using the Services or submitting any information to us. If you do not agree to any part of this Policy, then you should stop accessing the Website and the Platform.

The term “you” “your” (or a similar reference) and “User” refers to the user of the Website and the term “us” “our” “we” refers to the Data Protection Officer (hereinafter “Operator”).

This Policy does not apply to information collected in any other way, including offline.

The Platform is hosted on Amazon Web Services infrastructure located in the United Kingdom. Your Personal Data will therefore be transferred from the UAE to the UK for processing and storage. Further details on international data transfers are set out at Section 7 of this Policy.

TABcounsel is the data controller for the Personal Data processed through the Platform. For the purposes of the UK General Data Protection Regulation (hereinafter "UK GDPR") as retained under the Data Protection Act 2018, the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, hereinafter the "PDPL"), and, where applicable, the EU General Data Protection Regulation (Regulation (EU) 2016/679, hereinafter the "EU GDPR").

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, our contact details are as set out at the Contact section below.

The Policy may change as a result of changes to the Services and the content. Users are requested to refer to this Policy periodically or whenever you visit www.tabcounsel.com. By accessing and using the Website and availing the Services, the User consents to the collection, storage, and use of the personal data that the User provides (including any changes thereto as provided by you) for any of the Services and expressly authorizes the Operator to process such personal data.

TABcounsel connects Students with educational Counsellors. We process personal data about three groups of people. The first group is Students, including Students under 18; referred to in this policy as Minors, who must be linked to a Guardian. The second group is Guardians, meaning a parent or legal guardian representing a Minor Student. The third group is Counsellors, who are verified professionals who deliver counselling sessions.

We also hold limited details about people who are not yet Users. When an invitation is sent, we store the invitee’s name, contact details, and, for a Minor, date of birth, before that person has registered. If you have received an invitation and do not wish us to hold your details, please contact us and we will remove them.

Personal Information

We may collect and store Personal Information that you provide to us when accessing or using the Platform. “Personal Information” means information relating to a person who is or can be identified directly from that information. This includes your name, gender, date of birth, mobile number, email address, residential address, your login information such as your username and password, any information mentioned in inquiries, and any other details that are asked through the registration or process of placing an order. Where a Student is under 18, we hold the relationship connecting them to their Guardian. Personal Information does not include: (1) aggregated or anonymized information; (2) information about you that is provided by third parties; or (3) information that is posted to publicly accessible areas of the Services.

Such Personal Information may be stored when you (a) create or update your account, (b) communicate with us, (c) place an order on our Website, (d) contact us, (e) update your profile (“Profile”), or post information using your Profile, we may also collect verification information.

We may use certain information so that Counsellors, Guardians, and the Platform can understand who you are and match you appropriately. For Students this includes academic background and uploaded documents. For Counsellors this includes professional credentials and verification documents.

You should exercise caution when disclosing personal information in the creation of your account. Please do not submit any confidential, proprietary or sensitive personally identifiable information (e.g. identity card number, drivers license number, passport number (collectively, "Sensitive Information")). If you submit any Sensitive Information, you do so at your own risk and we will not be liable to you or responsible for consequences of your submission.

We may use certain information you provide for research and statistical purposes and in such cases, we will take steps with an aim of protecting your individual identity. We may also use the information you provide to offer you products and services that we believe may be of interest to you. You may choose not to receive such offers and communications from us when you register. You may also opt out or unsubscribe at any time by using the unsubscribe function in any electronic marketing material sent to you or by contacting info@tabcounsel.com.

If you submit your information, know that:

It must be accurate, complete, and current. It may be distributed to third parties in multiple formats (including online), and you will not be compensated by in any way for its use.

By submitting the information on our Website, you consent to the review of such information by our team members and by those who assist us in the provision of Services to the Users of our Website. We may take steps to inform all such people that such information should be treated as being confidential and should not be shared with anyone (unless required for the provision of any requested service).

If you choose to provide us with Personal Information, you consent to the transfer and storage of that information on our servers. We take reasonable steps to ensure that your Personal Information is not kept for longer than necessary for the purpose it is collected for.

Financial Information

TABcounsel can or may collect and store financial Information if you register on the Platform. For Counsellors this includes payout details. For Students and Guardians this includes a limited payment reference. Third party provider handles payments and refunds, so no credit card information is stored on the TABcounsel Platform.

Technical Information

We store Session content, including recordings, transcripts, automated summaries, Counsellor notes, messages, and shared documents produced during your use of the Platform. Account activity and conduct, including sign-in activity, reports, disputes, and any restrictions applied to an account.

Communications, meaning a record of the notifications we have sent you.

Technical data, including your IP address, browser type and version, device information, operating system, time zone setting, and usage data collected through your interaction with the Platform. Specific fields within these categories may change over time as the Platform evolves.

You provide us with information when you sign up to TABcounsel. TABcounsel will also collect information from all of its Users about their use of the Platform. Any information on Users or their use of the Platform is subject to this Privacy Policy. By using TABcounsel, you consent to use of that information and warrant that all information provided by you is accurate.

Under the UK GDPR and the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the "PDPL"), we must have a lawful basis for each processing activity. The lawful bases we rely on are as follows:

• Contract performance (UK GDPR Article 6(1)(b); UAE PDPL Article 5): processing that is necessary to perform our contract with you, including creating and maintaining your account, delivering the Services, facilitating sessions, and processing payments.
• Legitimate interests (UK GDPR Article 6(1)(f)): processing that is necessary for our legitimate interests or the legitimate interests of a third party, provided those interests are not overridden by your rights and freedoms. This includes maintaining the security and integrity of the Platform, preventing fraud, improving our services, enforcing our Terms, and the automatic recording of sessions for safeguarding purposes.
• Legal obligation (UK GDPR Article 6(1)(c); UAE PDPL Article 5): processing that is necessary for compliance with a legal obligation to which we are subject, including tax and financial reporting requirements, responding to lawful requests from regulatory authorities, and complying with safeguarding obligations.
• Consent (UK GDPR Article 6(1)(a); UAE PDPL Article 5): where we rely on consent, we will obtain clear, specific, and informed consent. For Minor Students, consent is obtained from the linked Guardian. You may withdraw your consent at any time by contacting us, without affecting the lawfulness of processing carried out before withdrawal.

We may use your Personal Data to help us improve our products and services. TABcounsel will not sell, trade, or share Personal Data collected through the Platform with third parties for their own marketing purposes. Other reasons why we may use your Personal Data include:

• verifying your identity;
• processing payment or online transactions;
• matching Students with appropriate Counsellors;
• generating automated session summaries using artificial intelligence tools (these summaries are intended as a convenience and should be reviewed by the Counsellor for accuracy; we do not use automated processing to make decisions that produce legal effects or similarly significant effects on any User without human involvement);
• facilitating the recording of counselling sessions for safeguarding purposes;
• complying with laws and regulations applicable to us;
• assisting law enforcement and investigations conducted by any governmental and/or regulatory authority;
• responding to or taking part in legal proceedings, including seeking professional advice.

We use information other than Personal Data, including aggregated or anonymised information, to analyse trends, administer the Services, improve the Platform, diagnose problems with our servers, track user activity, and gather demographic information for aggregate use.

Your name and contact details may be passed on to a Counsellor or to an educational institution where this is necessary to deliver the Services you have requested. When you book a session through TABcounsel, your Personal Data may also be used for marketing and/or promotional purposes. However, you can choose not to receive marketing or promotional information from TABcounsel at any time by simply utilising the unsubscribe function in the electronic marketing material sent to you, or by contacting info@tabcounsel.com. It is our policy not to provide Personal Data to third parties for their own marketing purposes without your consent.

All Personal Data collected by TABcounsel will only be used internally and exclusively within our corporate group. TABcounsel does not share Personal Data with third parties unless: (a) you have indicated to us that you wish to receive information from such parties; (b) you have expressly requested that your information be shared with a specific educational institution in connection with an application; (c) you otherwise give us your consent to do so; or (d) we are required by law to do so.

TABcounsel uses cookies and your browser’s local storage only for purposes that are strictly necessary to deliver the service, such as keeping you signed in and preserving work in progress so it is not lost. This includes:

• Technical information your computer, tablet or phone tells us, like the type of device you are using, the type and version of your web browser and operating system, the unique identifier used by your device to connect to the internet called the Internet Protocol (IP) address, and your location; and
• Information about your visit to our website, like which pages you visited, where you click, any searches you made on the site and other sites that you go to from our site. Some of this information is provided by cookies (little bits of computer software) that operate on our site.
• Any information that you share as part of completing an inquiry, live chat, subscriber or event form on our website;
• Any personal data that you provide to us as part of a survey on our website.

We may in future utilize third-party analytics tools, such as Google Analytics, on our Website to help us understand how visitors use the site. If and when such tools are enabled, they may use first-party cookies to collect anonymised usage data. We will update this Policy to reflect any such changes before they take effect. We use only strictly necessary cookies, including authentication cookies for secure access. We do not use advertising, analytics, or tracking cookies on the Platform application, and we do not embed third-party trackers in the Platform. The User is free to decline the Platform’s cookies by going to the browser’s security settings and blocking all cookies; however, certain features on the Platform may consequently become unavailable for use.

TABcounsel endeavours to secure your Personal Data from unauthorised access, use, or disclosure by putting into place reasonable and practical physical, electronic, and organisational measures to safeguard the information we collect. These measures include:

• Passwords are stored using one-way hashing. We cannot read your password.
• Sensitive financial and personal information is protected using strong industry-standard encryption.
• All traffic between your browser and TABcounsel is encrypted in transit using TLS 1.2 or higher.
• Access to workspaces, documents, session records, and other Personal Data is restricted to those who are authorised to see it. Holding an account type alone does not grant access to another person’s data.
• Administrative access to sensitive information is restricted, logged, and subject to periodic review.
• We apply industry-standard sign-in protections (including multi-factor authentication where available) and monitor for unusual activity.

No security measures are perfect or impenetrable. To protect the confidentiality of your Personal Data, you must keep your password confidential and not disclose it to any other person. You are responsible for all use of the Platform by any person using your credentials. Please contact us immediately by emailing us if you believe your information has been misused. You should also note that email is not secure, and you should not send any confidential or sensitive information to us via an unsecured email.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will: (a) notify the relevant supervisory authority (the UK Information Commissioner’s Office and/or the UAE Data Office, as applicable) without undue delay and, where feasible, within 72 hours of becoming aware of the breach; and (b) where the breach is likely to result in a high risk to your rights and freedoms, notify you directly without undue delay.

To operate the Platform we rely on carefully selected third-party service providers. These fall into the following categories:

• Infrastructure and hosting providers (including Amazon Web Services, with servers located in the United Kingdom), who store Platform data on our behalf.
• Communication providers, who help us deliver emails, messages, and video sessions.
• Payment providers (including Stripe), who process transactions on our behalf.
• Security and operational providers, who help us keep the Platform running, secure, and compliant.

We share only the personal data each provider needs to perform its function, and each is bound by a data processing agreement to process it solely on our instructions. We may also share personal data with:

• Educational institutions, where a Student or Guardian has expressly requested that their information be shared with a specific university or college in connection with an application.
• Regulatory authorities, law enforcement agencies, or courts, where we are required to do so by law or where necessary for the establishment, exercise, or defence of legal claims.
• Professional advisers, including lawyers, auditors, and insurers, where necessary for the provision of their services.

We do not sell personal data and we do not share it with advertisers.

A current list of our service providers and sub-processors is available on request from info@tabcounsel.com.

TABcounsel is based in the United Arab Emirates (UAE) and governed by UAE law. The Platform is hosted on Amazon Web Services infrastructure located in the United Kingdom. If you are accessing our site from outside UAE, please be aware that your personal data will therefore be transferred from the UAE to the UK for processing and storage. Personal information collected through the site will be processed in UAE. Data protection laws in UAE are likely different from those of your country of residence. By submitting your Personal Information through our site, you acknowledge that your personal information will be processed in accordance with this Policy.

For transfers from the UAE to the UK, we rely on the transfer mechanisms permitted under Articles 22 and 23 of the UAE PDPL and its implementing regulations, including adequacy assessments and standard contractual clauses as applicable.

For transfers of personal data of UK or EEA data subjects to countries outside the UK or EEA, we ensure that: (a) the transfer is to a country that has been recognised as providing an adequate level of protection by the UK Secretary of State or the European Commission; (b) appropriate safeguards are in place, such as the UK International Data Transfer Agreement or EU Standard Contractual Clauses; or (c) a permitted derogation under Article 49 of the UK GDPR applies.

You agree, acknowledge and consent that your Personal Information (and such other personal information which you provide to us) may be stored or processed in any country where we have operations or where we engage service providers. We may transfer personal information outside UAE to countries which may have different data protection laws. However, we shall take measures to ensure that any Personal Information remains protected to the standards described in this Privacy Policy. In certain circumstances, courts, law enforcement agencies, regulatory agencies or security authorities in those other countries may be entitled to access the Personal Information.

Information about our Users, including Personal Data, may be disclosed as part of any merger, acquisition, debt financing, sale of company assets, as well as in the event of an insolvency, bankruptcy, or receivership in which Personal Data could be transferred to third parties as one of our business assets. In such an event, TABcounsel will attempt to notify you before your Personal Data is transferred, and you shall have the right to opt out of any such transfer.

The Platform uses automated processing to generate session summaries from recorded sessions. These summaries are produced by artificial intelligence tools and are intended as a convenience to help Students and Counsellors review session content. Automated summaries are not a substitute for professional counselling advice and should be reviewed by the Counsellor for accuracy.

We do not use automated processing to make decisions that produce legal effects or similarly significant effects on any User without human involvement.

The data protection aspects of sessions and Workspaces are governed by this section, which should be read together with Section 9 of the Terms and Conditions.

Sessions are recorded automatically as a safeguarding measure. The lawful basis for this recording is our legitimate interest in safeguarding Users, particularly Minor Students, and maintaining the integrity of the Platform. We have conducted a balancing test and concluded that the safeguarding interest outweighs the privacy impact, given that: (a) participants are clearly informed before each session; (b) recordings are retained for a limited period only; (c) access is restricted; and (d) the involvement of Minors heightens the safeguarding justification.

Different categories of personal data are retained for different periods:

• Session recordings and transcripts are retained for 90 days.
• Written session summaries generated from meeting notes are retained for the duration of the Student’s engagement and are not currently subject to automatic deletion. An automated deletion schedule will be implemented in a future update.
• Chat messages are held and processed through Sendbird. They are retained for six (6) months from the date of the message, in accordance with Sendbird’s default retention settings. Further details on Sendbird’s data handling practices are available at sendbird.com.
• Account records are kept while your account is open. See Section 11 for how to request deletion.
• Sign-in credentials and one-time passcodes are short-lived by design and are automatically purged.
• Change and activity history is kept for security, dispute resolution, and audit purposes for a period of 6 years from the date of the relevant activity, under UK HMRC requirements.
• Financial and transaction records are retained for 6 years as required by UAE tax law and UK HMRC requirements.

Your Personal Data shall be deleted in accordance with the timeframes set out above. However, other anonymous data in reference to your access and use of the Services collected with your permission may be retained indefinitely for the purposes of improving the Platform and for aggregate statistical analysis. Such anonymous data cannot be used to identify you individually.

Please note we keep an internal record of changes made to data, which includes the previous values. This record currently has no automatic deletion schedule, so some personal data persists in it after an account is deleted. We are working to implement automated deletion for this record.

You have the right to request deletion of your account and associated personal data.

To make a deletion request, please contact info@tabcounsel.com. We will verify your identity, acknowledge your request within 5 working days under UAE PDPL and 1 month under UK GDPR, whichever is shorter, and action it within the applicable statutory timeframe.

Some information may be retained after deletion where we are required or permitted to do so. Examples include transaction records for financial and tax purposes, records needed to resolve disputes, and information held by our service providers under their own retention policies. Where personal data must be retained for these purposes, we limit access to it and delete it once the purpose no longer applies.

Guardians with a linked Minor cannot have their account fully deleted until the Minor is reassigned to another Guardian or unlinked. This is to protect the Minor’s continued access to counselling.

TABcounsel is intended to be used by Students under 18 with Guardian involvement:

• A Minor Student is linked to a Guardian, who approves bookings and is the payer.
• Guardians can see their child’s Workspace, sessions, and progress, but not private counselling notes.
• Guardians receive notifications about the Minor’s session activity.
• Sessions involving Minors are recorded under the same safeguarding policy as all sessions.

Under the UK GDPR, where consent is the lawful basis for processing, consent for a child under the age of 13 must be given by the holder of parental responsibility. Under the UAE PDPL, the processing of a Minor’s personal data requires the consent of the Minor’s guardian. TABcounsel obtains Guardian consent at the point of Minor Student registration.

TABcounsel has implemented practical safeguards for Minor Students, including requiring Guardian-linked accounts for minors, restricting payment functions to Guardians, and applying age-appropriate default privacy settings.

Subject to the applicable data protection laws of the United Arab Emirates (under the PDPL) and the United Kingdom (under the UK GDPR), you may have the following rights in relation to your personal data:

• The right to be informed about how your personal data is used (this Privacy Policy).
• The right of access to the personal data we hold about you.
• The right to rectification of inaccurate or incomplete personal data.
• The right to erasure (the "right to be forgotten") in certain circumstances.
• The right to restrict processing in certain circumstances.
• The right to data portability, to receive your personal data in a structured, commonly used, and machine-readable format.
• The right to object to processing based on legitimate interests or for direct marketing purposes.
• Rights in relation to automated decision-making and profiling.

To exercise any of these rights, please contact info@tabcounsel.com. We will respond to a valid request within one month or within the timeframe prescribed by the UAE PDPL, as applicable. There is normally no charge for exercising your rights, although we may charge a reasonable fee or decline to act if a request is manifestly unfounded or excessive.

TABcounsel reserves the right to suspend or deactivate your account at any time in accordance with the Terms and Conditions. Similarly, you reserve the right to request deactivation of your account.

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the relevant supervisory authority:

• In the United Kingdom: the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom. Website: ico.org.uk.
• In the United Arab Emirates: the UAE Data Office, or such other body as may be designated under the PDPL and its implementing regulations.

We would appreciate the opportunity to resolve your concerns before you approach a supervisory authority and would ask that you contact us first.

When you register, you accept our Terms of Service and this Privacy Policy, and we record that you accepted, the version you accepted, and the date and time of acceptance.

We will post changes to this Privacy Policy on the Platform and update the date at the top. By continuing to use and access the Website, you agree to be bound by such changes. It is your responsibility to view this Policy from time to time to stay updated with any changes made by us.

Continued use of the Platform after the effective date of any changes constitutes acceptance of the updated Privacy Policy.

If you have any additional concerns related to this Policy and/or our practices, you may contact our Data Protection Officer:

Data Protection Officer
Email address: support@tabcounsel.com

Name: TABONE VENTURES PARTNERS FZCO
Address: Building A1, Dubai Digital Park, Dubai Silicon Oasis
Email: info@tabcounsel.com
Telephone: +971-50-490-1969