LEGACY ONLINE SCHOOL PRIVACY POLICY

1. Introduction

Legacy Online School respects your privacy and is committed to protecting it through compliance with this policy. This policy describes the types of information we may collect from you or that you may provide when you visit the website legacyonlineschool.com (our ‘Website’) and our practices for collecting, using, maintaining, protecting, and disclosing that information.

This Privacy Policy has been updated in 2026 to reflect Legacy Online School’s international expansion and to comply with: UAE PDPL (Federal Decree-Law No. 45/2021); Qatar PDPPL (Law No. 13/2016); EU GDPR (Regulation 2016/679); Dutch Uitvoeringswet AVG; German BDSG; Spanish LOPDGDD (Organic Law 3/2018); Portuguese Lei 58/2019.

2. Personal Information We Collect

When you visit the Site, we automatically collect certain information about your device, including information about your web browser, IP address, time zone, and cookies. Additionally, as you browse the Site, we collect information about individual web pages or products you view and how you interact with the Site.

When you enroll or attempt to enroll in a course, we collect: name, billing address, payment information (including credit card numbers), email address, and phone number (‘Enrollment Information’).

For students under the age of 18, we also collect: student’s name, date of birth, year of study, and academic records. This data is processed on behalf of the parent or guardian who executes the enrolment agreement.

We do not collect data from or about courier services. References to FedEx and UPS in previous versions of this policy have been removed as they are not relevant to our educational services.

3. How We Use Your Personal Information

We use Enrollment Information to enroll you in courses, process payments, provide invoices and enrollment confirmations, communicate with you, and screen for fraud.

We use Device Information to improve the Site, generate analytics, and assess marketing campaigns.

We do not use children’s personal data for targeted advertising, behavioural profiling, or commercial purposes not directly related to educational service delivery. This applies specifically to students under 13 in all markets and more broadly to all students under 18.

4. Age of Digital Consent by Country

The age at which a child may consent to online data processing varies by country. The following thresholds apply to Legacy Online School’s markets:

For clients below the applicable age threshold, explicit parental or guardian consent is required before Legacy Online School processes personal data.

5. Legal Basis for Processing

We have a legal obligation to process your data related to payments and orders. We have a contractual basis for processing your data when you place an enrolment. We have a legitimate interest in processing your data where our commercial interests are concerned and we are not doing anything you wouldn’t reasonably expect.

For EU and UK clients, the specific legal bases under GDPR Article 6 are: (a) Art. 6(1)(b) — performance of contract: for data necessary to deliver educational services; (b) Art. 6(1)(a) — consent: for marketing communications and non-essential processing. For special categories of data (including children’s data under national law), the basis is Art. 9(2)(a) explicit consent.

6. International Data Transfers (SCC / PDPL) — NEW

Personal data of clients in the EU, Qatar, and UAE is transferred to and processed on servers in the United States of America by Legacy Online School and its authorised service providers.

For EU clients: such transfers are conducted pursuant to Standard Contractual Clauses (SCCs) approved by the European Commission under GDPR Article 46(2)(c). Legacy Online School has entered into SCCs with each of its US-based data processors.

For UAE clients: transfers are conducted under contractual arrangements ensuring the receiving party is bound by obligations equivalent to UAE PDPL requirements, in accordance with UAE Federal Decree-Law No. 45/2021.

For Qatar clients: transfers are conducted in accordance with Qatar PDPPL Art. 15.

7. Sharing Your Personal Information

We may share your Personal Information with third parties to help us use your information as described above. The following categories may have access:

Authorised service providers: Zoom Video Communications, Inc. (live lessons); Stripe, Inc. (payments); Bitrix24 (CRM); Buzz Learning Management System (course delivery); Google LLC (Analytics, Workspace); Mailchimp (email communications); HotJar (website analytics).

We may also share Personal Information to comply with applicable laws, respond to lawful requests, or protect our rights.

8. Cookies and Consent — Updated

We collect Device Information using cookies, log files, web beacons, tags, and pixels.

For EU clients (Netherlands, Germany, Spain, Portugal) and Qatar, non-essential cookies (advertising, analytics, performance) are placed only with explicit prior consent (opt-in). A cookie consent banner is displayed on first visit. Strictly necessary cookies are placed without consent. Clients may withdraw cookie consent at any time via the cookie settings link in the website footer.

For UAE clients, consent is obtained for non-essential cookies in accordance with applicable UAE law.

9. Behavioural Advertising

We use Personal Information to provide targeted advertisements we believe may be of interest to you via Google Ads, Facebook, Instagram, and Twitter. You can opt out of targeted advertising via the links below:

Facebook: https://www.facebook.com/settings/?tab=ads

Google: https://www.google.com/settings/ads/anonymous

Important: We do not use personal data of students under 18 for behavioural advertising or targeted marketing. We do not engage in targeted advertising directed at children.

10. Your Rights

Your rights include: (1) To have your personal data corrected, restricted or erased; (2) To port your personal data; (3) To withdraw consent; (4) To access your personal data; (5) To object to processing; (6) To lodge a complaint with a supervisory authority.

EU clients additionally have: the right to data portability (GDPR Art. 20); the right not to be subject to solely automated decision-making with legal effects (GDPR Art. 22). EU

11. Data Retention

Personal Information shall be processed and stored for as long as required by the purpose for which it was collected. Personal Information collected for the performance of a contract shall be retained until such contract is fully performed. After the retention period expires, Personal Data shall be deleted.

Lesson recordings are retained for a maximum of 12 months from the date of recording. Academic records (transcripts, enrolment confirmations) are retained for a minimum of 5 years for the purposes of academic verification.

12. GDPR Provisions (Updated)

If you are within the European Union, you are entitled to certain information and have certain rights under the General Data Protection Regulation (GDPR). Those rights include: Right of Access (Art. 15); Right of Rectification (Art. 16); Right to Erasure (Art. 17); Right to Restrict Processing (Art. 18); Right to Data Portability (Art. 20); Right to Object (Art. 21); Right to Lodge a Complaint; Right to Withdraw Consent.

13. UAE PDPL and Qatar PDPPL Provisions — NEW

UAE clients: personal data is processed in accordance with UAE Federal Decree-Law No. 45/2021 (PDPL). Legacy Online School implements technical and organisational measures as required by PDPL. Complaints: UAE Data Office (uaedataoffice.gov.ae). For students under 13: CDS Law (Federal Decree-Law No. 26/2025) applies — see clause B.1.3.

Qatar clients: personal data of students under 18 is classified as ‘Personal Data of Special Nature’ under Qatar PDPPL (Law No. 13/2016). Guardian has the right to request a description of all data processing for the child. Complaints: NDPO / NCSA (ncsa.gov.qa). Breach notification to NDPO within 72 hours of awareness.

14. Changes to This Policy

We may update this privacy policy from time to time to reflect changes to our practices or for operational, legal or regulatory reasons. We will notify you of material changes by email or by posting a notice on our website.

For EU clients, material changes to this Privacy Policy will be communicated with 30 days’ notice where required by applicable law.

15. Contact Us

If you have questions, or if you would like to make a complaint, please contact us by email at [email protected] :

LEGACY SCHOOL LIMITED, Unit 2A, 17/F, Glenealy Tower, No.1 Glenealy, Central, Hong Kong S.A.R

Contact numbers: +852 444 63946, +1 844 949 3862

Privacy Officer, Billing / Refunds, Academic queries: [email protected]