PRIVACY NOTICE & COOKIE POLICY

Effective Date: 5 May 2026 

Last Reviewed: 1 June 2026

 

WHO WE ARE AND HOW TO CONTACT US

• This Privacy Notice is published by the Advanced Technology Research Council (“ATRC”), a council established under Law No. (14) of 2020 in Abu Dhabi with its principal office at Accelerator 2 Building, Plot M12, Masdar City, Abu Dhabi, the United Arab Emirates. ATRC is the data controller for the personal data described in this Notice – meaning we determine why and how your personal data is used. 

• The Website and platform are hosted and maintained by Agorize SAS (“Agorize”), a simplified joint-stock company with capital of €107,217.90, registered with the Paris Trade and Companies Registry under no. 530 774 439, with its registered office at 15 rue Béranger, 75003 Paris, France. Agorize acts as a data processor on behalf of ATRC — meaning it processes personal data only on our instructions and does not use it for its own purposes, except where it acts as an independent controller under its own privacy policy.

• ATRC is the organising entity for the programmes and activities conducted through this platform, whether operated directly by ATRC or, where applicable, through its affiliates including ASPIRE UAE - SOLE PROPRIETORSHIP L.L.C. ("ASPIRE").  

References to "we", "us" or "our" in this Notice mean ATRC.

Where we refer to "the Website", we mean the ATRC / ASPIRE open innovation platform at challengeon.atrc.ae and any successor URL. Terms used but not defined in this Notice have the meanings given to them in our Platform Terms and Conditions ("T&Cs").

Contact us about privacy: Advanced Technology Research Council (ATRC) Accelerator 2 Building, Plot M12, Masdar City, Abu Dhabi, UAE Email: challengeon@aspire.ae for professional challenges and talents@atrc.ae for student challenges.

 

HOW THIS NOTICE WORKS

This Privacy Notice explains how we collect, use, store, share and transfer your personal data when you use the Website or participate in a Challenge. It should be read alongside our T&Cs and the Cookie Policy set out at the end of this Notice, which explains the cookies and other tracking technologies we use. 

For these purposes, "personal data" means any information that identifies or could reasonably be used to identify a living individual, either on its own or together with other information. 

Please read this Notice carefully. By registering for an Account or using the Website, you confirm that you have read and understood how we use your personal data.

1. WHAT PERSONAL DATA WE COLLECT AND HOW

We collect personal data in three ways: directly from you, automatically when you use the Website, and from third-party sources.

1.1 Information you give us directly 

• Registration. When you create an Account, we collect the mandatory information required to register including your name, telephone number, email address, password, date of birth, name and country of incorporation of your company (if applicable), area of expertise, country of residence, nationality, gender, name of school/institution, level of education, school enrolment status and grade, field of study, academic major, skills  and field of study (if applicable).

• Messages, postings and uploads. We collect personal data you provide, post or upload when you register for activities on the platform, upload Deliverables (such as documents, presentations and audio/video files), chat or message with other Members of the Community, post announcements, or use public message boards.

• Verification and evidence materials. Where we request it, we may collect identification documents, tax registration information, banking details, compliance certifications and other supporting materials for the purposes of verifying your eligibility, identity or entitlement to any award or benefit in connection with a Challenge.

• Correspondence. We keep a record of any correspondence between you and us, such as information you send when you report a problem with the Website or our Services. Any other information you choose to provide to us.

1.2 Information we collect automatically

Technical and device data. When you visit the Website, we collect information about the devices you use and the networks to which you are connected. This includes your IP address, log-in information, bandwidth used, time of visit, browser type and version, browser plug in types and versions, operating system, information about your visit including the URL clickstream, download/upload errors, pages visited and page interactions. We collect this information using different technologies including cookies (see our Cookie Policy below).

1.3 Information from third-party sources

Social media authentication. If you register on the Website using social media authentication (such as Facebook, LinkedIn, or similar platforms), we will receive certain personal data (such as your name and email address) from your social media profile, in accordance with the terms and conditions of those platforms. You should review those platforms' privacy policies before using this feature.

 

2. HOW LONG WE KEEP YOUR PERSONAL DATA

We retain your personal data so long as you hold an account with us. If you close your account, your personal data will be anonymized, where required under applicable law, or deleted      promptly, unless a longer retention period is required or permitted by applicable law.

Information you have shared with others - such as through messages, chats or on message boards will remain visible after you close your account but will be anonymized. Your profile may continue to appear in third-party search engine results until those services refresh their cache.

We may also retain your personal data for an additional period to the extent necessary to assert or defend against legal claims.

In addition, we may retain certain verification documents, tax records and award-related information for as long as required by applicable UAE law and our internal records retention policies.

 

3. HOW WE USE YOUR PERSONAL DATA.

We use your personal data for the following purposes: 

 

More specifically: 

We use your personal data to allow you to take part in innovation activities on the Website, to enable you to personalise your profile, and to send you service-related information (such as confirmation of your registration in a Challenge) by email or other means.

We use your data to enable you to communicate and interact with other Community members, such as team members, Mentors, jury members and Joint Organisers, and to publish announcements and related content sharing that you are a finalist or winner of a Challenge.

We also use your data to give you access to our support services, to keep the Website secure and safe, to notify you about changes to our Services, to administer the Website (including for troubleshooting, data analysis, testing, research and survey purposes); to improve the Website and ensure content is presented effectively and to comply with our legal obligations, including court orders and other regulatory requirements.

In accordance with applicable laws and where required with your consent, we may send you marketing materials and suggestions relating to our Services and upcoming activities that may interest you. You may withdraw your consent at any time – see section 9 below. 

 

4. WHO WE SHARE YOUR PERSONAL DATA 

4.1 Within the ATRC group

We may share your personal data with ATRC’s Affiliates, including ASPIRE where applicable, for the purposes set out in this Notice.

4.2 Visibility of your profile and content on the platform

When you use the Services, your profile is visible to all Members of our Community, such as Challenge participants, Mentors, jury members, and the entity that sponsors a Challenge. Certain profile information – such as your name, photo and Community affiliation - may also be visible to others on or off the Website, including visitors to the Website and users of third-party search engines.

When you post on a message board or wall, it can be viewed by all Members of the Community. You can send messages to team members, individual participants, Challenge administrators or Mentors. Deliverables relating to a Challenge, can be viewed by other members of your team (if applicable), Challenge administrators, jury members and Mentors.

Certain Challenges are public, which may allow the public to vote on winning Deliverables. The public can view wall posts related to the Challenge, individual and team profiles and Deliverables. Before participating in a public Challenge, you will be asked to consent to this information being made public. Please do not participate in a public Challenge, if you do not want your information to be publicly accessible.

4.3 Third-party recipients

We work with third parties who may receive your personal data, including Agorize SAS (which hosts and maintains the platform) and our sub-contractors, such as cloud computing platforms, data and content management systems, search engine providers and analytics providers.

We also share your data with the entity that has sponsored a Challenge, together with their administrators, Mentors and jury members, or other persons granted access for the sole purpose of administering the relevant activity. We have entered into appropriate data sharing arrangements to ensure compliance with data protection laws;

We may also share data with social media platforms that provide you with connecting services to use the Website.

4.4 Other circumstances for sharing

We only share your personal data with third parties in the following circumstances:

• where you have explicitly requested it (such as when registering through social media authentication);

• where we are required to do so by law, or in good faith where disclosure is reasonably necessary to respond to claims, comply with legal or regulatory proceedings, or protect the rights, property or safety of ATRC, its Affiliates, or Members; or

• where we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer and if all or part of our assets are acquired by a third party, your personal data may be included as transferred assets.

 

5. THE LEGAL BASIS FOR DATA PROCESSING

We are required by applicable data protection law — including UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL") and, where relevant, the EU General Data Protection Regulation ("GDPR") — to identify a lawful basis for each purpose for which we use your personal data.

We collect, use and share your personal data:

• Contract performance: where processing is necessary to provide the Services on the Website and fulfil the T&Cs – for example, creating your account, enabling Challenge participation and administering awards. 

• Consent: where you have given consent – for example, for direct marketing emails or targeted advertising. You may withdraw your consent at any time through your profile page or by contacting us;

• Legal obligation: where processing is necessary to comply with our legal obligations – for example, tax reporting, responding to regulatory requests, or complying with court orders.

• Legitimate interests: where processing is necessary for our legitimate interests - including our interests in providing an effective and innovative platform for our users and partners - provided those interests are not overridden by your interests or fundamental rights.

Note on the PDPL: UAE Federal Decree-Law No. 45 of 2021 (PDPL) governs the processing of personal data of individuals in the UAE. Where the PDPL applies, we process your personal data in accordance with its requirements, including in relation to consent, data subject rights and cross-border transfers. Where GDPR applies additionally (for example, to data subjects in the European Economic Area), we comply with those requirements in parallel.

 

6. DIRECT MARKETING AND TARGETED ADVERTISING

In accordance with applicable laws and where required with your consent, we may use the information you give us on the Website for direct marketing communications – for example, newsletters, invitations to upcoming activities or events, and other communications that we think may interest you.

You can withdraw your consent at any time by unticking the relevant box in your Member account, clicking on the unsubscribe link in any marketing email or contacting us at the details provided above.

Withdrawing consent does not affect the lawfulness of any processing carried out before you withdrew it.

 

7. TRANSFERRING YOUR PERSONAL DATA INTERNATIONALLY

We store your personal data on servers located in the European Economic Area (EEA). Specifically, the platform is hosted by Amazon Web Services on servers in the eu-west-3 region (Paris, France). 

If you use the Website, your personal data may be shared among ATRC Affiliates, including ASPIRE where applicable, both inside and outside the EEA. Transfers of data between ATRC (in Abu Dhabi) and Agorize (in France) involve a cross-border transfer from a UAE controller to an EEA processor. We ensure that such transfers are made subject to appropriate contractual safeguards — including data processing agreements that reflect the requirements of the PDPL and, where applicable, the GDPR — so that your data receives a consistent and adequate level of protection wherever it is processed.

Our global policy requires all affiliated entities to ensure a level of data protection at least as protective as that mandated within the EEA.

Where your personal data is transferred outside the UAE to a country that has not been designated as providing adequate protection under the PDPL, we will ensure that appropriate safeguards are in place, such as standard contractual clauses, or equivalent mechanisms approved by the UAE Data Office.

 

8. HOW WE KEEP YOUR PERSONAL DATA SECURE

We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage in accordance with our internal security procedures covering storage, access and destruction.

These measures include, but are not limited to, encryption of data in transit and at rest, access controls and authentication mechanisms, regular security testing and vulnerability assessments, and contractual security obligations on Agorize and other data processors.

No security system is impenetrable. If you become aware of any security issue or suspect that your Account has been compromised, please contact us immediately.

 

9. YOUR RIGHTS IN RELATION TO YOUR PERSONAL DATA

In addition to your rights under applicable data protection legislation and where we are permitted or required by applicable law, we will provide you, - upon request - with a copy of your personal data and we will correct any errors you identify. 

Under the PDPL and, where applicable, the GDPR, you may have the following rights in relation to your personal data:

• Right of access: The right to obtain confirmation of whether we process your personal data and to receive a copy of it.

• Right to rectification: The right to have inaccurate or incomplete personal data corrected.

• Right to erasure: The right to request deletion of your personal data in certain circumstances — for example, where it is no longer necessary for the purposes for which it was collected.

• Right to restrict processing: The right to ask us to restrict how we use your personal data in certain circumstances.

• Right to data portability: The right to receive a subset of your personal data in a structured, commonly used format and/or to have it transferred to another data controller, where technically feasible. 

• Right to object: The right to object to our processing of your personal data where we rely on legitimate interests as our legal basis.

• Right to withdraw consent: Where we rely on your consent, the right to withdraw it at any time without affecting the lawfulness of prior processing.

• Right to complain: You have the right to lodge a complaint with the relevant supervisory authority regarding our processing of your personal data.  In the UAE, the relevant authority is the UAE Data Office (established under Federal Decree-Law No. 45 of 2021). If you are based in the EEA, you may also complain to your local data protection authority.

To exercise any of these rights, or if you have any questions about this Notice or how we handle your personal data, please contact us at challengeon@aspire.ae for professional challenges and talents@atrc.ae for student challenges.

We will respond to your request within the timeframe required by applicable law (generally within 30 days, or such other period as specified under the PDPL or GDPR as applicable). We may need to verify your identity before responding.

 

10. LINKS TO OTHER WEBSITES

Our Website may contain links to other websites, including those of partner companies. Those websites have their own privacy practices, for which we do not accept responsibility or liability. Please review those policies before submitting any personal data to those sites.

 

11. UPDATES TO THIS NOTICE

We reserve the right to amend this Privacy Notice from time to time to reflect changing legal requirements or our processing practices. Any changes will be posted on the Website and will be effective upon posting. Where changes are material, we will notify you before they take effect — for example, by email or by displaying a prominent notice on the Website.

 

12.  GOVERNING LAW AND JURISDICTION

This Privacy Notice including the Cookie Policy shall be governed by and construed in accordance with the governing law provisions set out in the T&Cs. Any dispute arising out of or in connection with this Privacy Notice (including the Cookie Policy) shall be resolved in accordance with the dispute resolution provisions specified in the T&Cs, which are incorporated herein by reference. By using the Website you agree that such governing law and dispute resolution provisions shall apply to this Privacy Policy.   

 

COOKIE POLICY

What is a Cookie?

A cookie is a small file placed on your device that records information relating to your navigation on the Website (such as the date and time pages were loaded, the browser used and language, pages viewed, frequency and duration of visits, number of visits, sources of the visit, and approximate location) and that can facilitate your future visits to the Website.

We also use similar technologies such as web beacons, pixels and local storage, which operate in a similar way. References to "cookies" in this policy include these technologies unless otherwise stated.

 

Your Consent to Cookies 

On your first visit to the Website, a consent banner will appear asking for your cookie preferences across the following categories:

• Audience monitoring (e.g. Matomo);

• Social media (e.g. Facebook, Linkedin); and

• Marketing.

All three categories are disabled by default. You may choose to accept all, refuse all, or select specific categories of cookies.

Until you make a choice, the consent banner will be displayed on every page you visit and no cookies will be installed, except strictly necessary technical cookies required to operate the platform.

Once you make a choice, the cookies in your selected categories will be installed on the next page you visit or upon page refresh.

You can change your cookie preferences at any time by clicking the "Cookies" button in the footer of the Website. 

 

Types of Cookies We Use

1. Strictly Necessary Cookies (no consent required)

When you access the Website, a session cookie and a “token” cookie with a unique encrypted session ID are passed to your device. The session cookie controls your access to the Website for that session and is deleted once you close your browser or log out. These cookies also allow us to identify your device and preferences when you return, including language and regional settings. These cookies are essential for the Website to function and cannot be switched off. The information gathered is used only to ensure the Website operates correctly.

Several tools dedicated to functional capabilities of the platform may also pass their relevant token cookies to your device. Tokens cookies may persist for different periods, depending on the third party provider (e.g: Filestack, Algolia)

2. Audience Monitoring Cookies (consent required)

We may use tools such as Matomo, Google Tag Manager, Hotjar or similar services to monitor traffic on the Website. When you visit the Website, these services set cookies that collect statistical information about your visits, including the number of visits, pages viewed, visitor activity and frequency of return. This helps us improve the Website and its functionality. These cookies do not store personal information that could be used to identify you.

3. Marketing Cookies (consent required)

Where marketing tools are configured on the platform, these cookies will be used to send you targeted communications. These are deactivated by default.

4. Social Media Cookies (consent required)

Where the platform allows you to register or log in using social media Single Sign-On (SSO) connectivity, we use the information stored in these cookies to authenticate you.

 

Cookies Installed by the Platform

The following cookies are classified as strictly necessary and do not require your consent:

 

A full and up-to-date list of all cookies — including third-party audience monitoring, marketing and social media cookies — is available in the cookie management tool accessible via the "Cookies" button in the Website footer. That tool is updated automatically as cookies change.

 

How to Manage or Delete Cookies

You have several options for managing cookies:

1. Via the Website's cookie banner or footer tool: Click on the “Cookies” button in the footer of the Website at any time to update your preferences or withdraw consent.  

2. Via your browser settings: All web browsers allow you to configure your cookie preferences before you navigate the internet. You can set your browser to refuse cookies or to notify you when a cookie is being installed. Instructions for the most popular browsers are available at:

• • Google Chrome:      chrome://settings/cookies     

  • Mozilla Firefox:      https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer     

  • Safari:      https://support.apple.com/guide/safari/     

  • Microsoft Edge:      https://support.microsoft.com/en-us/microsoft-edge     

  • Opera:      https://help.opera.com/en/latest/web-preferences/     

3. Clearing existing cookies: You can clear cookies already stored on your device by clearing your browser's cache. 

Please note that if you delete or refuse cookies, some features of the Website may not function as intended.

 

Contact for Cookie Queries

If you have questions about our Cookie Policy, please contact us at contact@agorize.com.