Learner Privacy Notice

This notice tells you what happens to your personal information when your employer enrols you on a course on Shog Corporate Training. It is written for you, the learner, and your employer is welcome to hand it to you as it stands.

Who is responsible for your information

Your employer decides that you should take a course, chooses which one, and decides how long to keep the result. In data protection language, your employer is the controller of your information.

Shog Consulting (FZC) runs the training platform for your employer. We are the processor. That means we handle your information on your employer's instructions, and we do not use it for our own purposes.

Shog Consulting (FZC), licence SC242038101, STRIP Block C VL07-017, Sharjah, United Arab Emirates. Contact: training@shogconsulting.com.

How you get in

You do not have a password here.

Your employer enrols you, and you receive an email with a private link. When you open it, you enter a one-time code to confirm it is you. That link is yours alone. Do not forward it to anyone, and do not let anyone else use it, because everything done with it is recorded against your name.

What we collect

From your employer, when they enrol you: your name, your work email address, and, if they choose to add them, your phone number and job details such as your role, department or site.

From you, as you train: which modules you have opened and finished, how far through the course you are, the language you chose, your answers in assessments and your score, and the dates on which you did these things.

At the end, to confirm it was you: either a photograph taken through your browser, or an identity declaration that you sign. See the next section.

Technical information needed to run the service: sign-in and activity events recorded in your employer's audit log, and the small number of cookies described in our Cookie Notice. There is no advertising cookie and no third-party tracking on the training pages.

We do not ask for your Emirates ID number, your passport number, your salary or your health information, and please do not enter them into a free-text box. If a course asks you a question, answer the question; there is no need to add personal details it did not ask for.

The identity photograph, specifically

When you finish a course and pass the assessment, your employer needs evidence that the person who did the training is the person named on the certificate. The platform gets that evidence in one of two ways: it takes a photograph of your face through your browser camera, or it asks you to sign a declaration that you are the person named.

This matters, so here is the detail.

• A photograph of your face is sensitive information. It is biometric in nature, because a face can identify you. We treat it accordingly.
• The photograph is taken at the moment you complete the course. It is a single still image. There is no video, no continuous monitoring, and nothing runs while you are working through the modules.
• The photograph is not used to recognise you anywhere else. We do not run face recognition on it, we do not match it against any other image, we do not build a face template from it, and we do not use it to train any model.
• It is attached to your completion record so that your employer, or an auditor your employer allows to look, can confirm who did the training.
• It never appears on the public certificate verification page.
• The photograph is written straight into your employer's own Microsoft SharePoint, OneDrive or Google Drive and is not kept on our systems at all. We keep only the record that identity evidence exists, alongside your certificate. Your employer has to connect its own storage before it can enrol anyone, so there is no version of this where we hold your photograph.
• Where a photograph is not appropriate for you, ask your employer about signing an identity declaration instead. Your employer decides which option applies, not us.

Why your information is used

Your information is used to enrol you, to let you take the course, to mark your assessment, to issue a certificate if you pass, to confirm that the certificate belongs to you, to remind you when something is due, and to give your employer the training records it is required to keep.

Your employer is likely to have legal duties behind that. UAE employers must keep records of occupational safety and health training under Cabinet Resolution No. 1 of 2022 (Article 23(3)) and MoHRE Administrative Decision No. 19 of 2023, and firms in scope of the UAE anti-money-laundering regime must be able to evidence staff training. Your employer can tell you which duty applies to your course.

Who sees it

• Your employer's administrators. They can see your enrolment, your progress, your score and your certificate.
• An auditor or inspector your employer chooses. Your employer can grant time-limited preview access to a named auditor so that training evidence can be checked. Your employer decides who and for how long.
• Us, in a limited way. Our people access your employer's workspace only when they need to in order to run or support the service, and they are bound by confidentiality.
• Service providers we use to run the platform. Hosting and storage sit with Oracle Cloud Infrastructure in the Middle East region, and emails to you are sent through Microsoft 365. The full list is on our Sub-processors page.
• Anyone who checks a certificate number. See "What is public" below. Your name is not part of that.

We do not sell your information. We do not send you marketing. We do not use your training data to train models.

How it is protected

Your employer's learner records sit in a database of their own, separate from every other organisation on the platform. Your name, email address and phone number are encrypted where they are stored, using AES-256-GCM with a key belonging to your employer's organisation. Traffic to the platform is encrypted in transit. Our Security Policy has the detail.

What is public, and what is not

A certificate can be checked by anyone who has its number, at the verification page, without an account. That is deliberate: it lets a client, a regulator or a prospective employer confirm that a certificate is genuine.

The public page shows the certificate number, the course title, the name of the organisation, the issue date, the expiry date and whether the certificate is valid, expired or revoked.

The public page does not show your name. It does not show your email address, your phone number, your score, your assessment answers, your photograph or your signature. Someone who holds your certificate number cannot learn who you are from that page.

How long it is kept

Your employer decides. Training evidence is the point of the product, so certificates and completion records are kept for as long as your employer's account is open, unless your employer removes them sooner. Many employers are required to keep them for years: as examples, six years applies to certain records in Abu Dhabi Global Market and five years applies under Abu Dhabi occupational safety practice.

When your employer closes its account, it has 30 days to export its data, and after that we securely delete the organisation's data from our systems. If your employer connected its own storage, the files already written there belong to your employer and stay with your employer.

Our Data Retention and Deletion policy sets this out record by record.

Your rights, and how to use them

Depending on where your employer is established, you may have the right to ask for a copy of your information, to have it corrected, to have it deleted, to object to certain uses of it, or to complain to a supervisory authority.

Onshore in the UAE, those rights come from Federal Decree-Law No. 45 of 2021. That law's Executive Regulations have not yet been issued, so some of the procedure for exercising these rights is not yet settled in law. If your employer is in the Dubai International Financial Centre or in Abu Dhabi Global Market, a different data protection law applies, with its own commissioner, and it may give you more.

Ask your employer first. Your employer is the controller and holds the decision. Contact your HR, training or compliance team.

If your employer cannot help, or if you want to raise something about the platform itself, write to training@shogconsulting.com. If you ask us directly to change or delete your training records, we will not act on it ourselves. We will pass the request to your employer and tell you that we have done so, because that decision is theirs.