Privacy Policy
Who we are
The PCL platform is run by Connected Leadership Platform Management Development Training L.L.C ("PCL", "we", "us"), registration number 1491748, of Floor 1, Oud Metha Office Building B, Oud Metha, Healthcare City, Dubai.
- Privacy questions and requests: josh@pcllearning.com
We are responsible for your information as described in this policy, except where we process it for a client organisation, as the next section explains. We handle personal information under the UAE's Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL).
What this policy covers
This policy covers the PCL platform at pclleadership.com and its apps, including ASCENT and ARCC, and the service behind them at api.pclleadership.com.
Most people use the platform because their organisation enrolled them in a PCL leadership programme. In that case:
- Your organisation decides who takes part and what the programme involves. For that information your organisation is the controller and PCL is its processor, under our agreement with it.
- We decide how the platform itself works: sign-in, security, and keeping it running. For that information, PCL is the controller.
It does not cover other websites the platform links to.
Information we collect
| What | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email address, your organisation, your role (such as participant, facilitator or coach), a hashed password if you set one, email preferences | You, your organisation, or the PCL staff who set up your account |
| Google sign-in | Your Google account's identifier, email address and name | Google, when you choose to sign in with Google (see "Google user data") |
| Access requests | Name, email address and the organisation you ask to join | You, when you request access |
| Programme activity | Sessions and cohorts you are part of, attendance and check-ins, progress through courses, projects and their feedback, badges and certificates | Your use of the platform, and your facilitators |
| Assessments and reports | Your answers to questionnaires and assessments, the scores and reports generated from them | You, and the platform's scoring (including AI, see "AI processing") |
| Coaching and reflection | Your coaching assignment, availability for sessions, and journal entries | You and your coach. Journal entries are visible to you alone. |
| AI chat | The messages you send to the learning assistant, while it answers | You. We keep a usage record (time, size, cost), not the messages. |
| Technical data | IP address, browser details, the security cookies described below, and service logs | Your device, when you use the platform |
We do not ask for special categories of information, such as health or religious beliefs. Please do not put them in free-text answers unless your programme asks you to.
How we use it
| Purpose | Lawful basis under the PDPL |
|---|---|
| Run your programme: sessions, courses, assessments, coaching and reports | Your organisation's basis as controller, usually its employment obligations to you (Article 4(8)) or its contract with you (Article 4(9)). We act on its instructions. |
| Sign you in, keep accounts separate between organisations, and protect the platform from misuse | Protecting your interests, by keeping your account and information secure (Article 4(7)) |
| Send the emails the platform needs: invitations, sign-in links, password resets and confirmations | Your organisation's basis, as for your programme; for sign-in and security emails, protecting your interests (Article 4(7)) |
| Show your progress to the people your programme involves: your facilitators, your coach, and your organisation's programme contact | Your organisation's basis, as for your programme |
| Generate assessment reports and answer the learning assistant, using AI | Your organisation's basis, as for your programme. You can ask for a person to review any AI result (Article 18). |
| Keep records of who changed what, such as role changes | Our obligations under UAE law (Article 4(10)), and protecting your interests (Article 4(7)) |
We do not sell your information, show you advertising, or send marketing emails from the platform.
Google user data
If you choose "Sign in with Google", we ask Google for three things only: your account identifier, your email address and your name (the openid, email and profile permissions).
- How we use them: to confirm who you are and find your PCL account. We keep the account identifier so we recognise you next time. If you have no account yet, we keep your name and email as an access request for PCL to review.
- What we do not do: we do not read your Gmail, Drive, Calendar, contacts or any other Google data. We keep no Google access token, so we cannot act in your Google account.
- Sharing: we do not share information received from Google with anyone, and do not use it for advertising or to train AI models.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect PCL from your Google account at any time at myaccount.google.com/connections. You can still sign in with an emailed link.
AI processing
The platform uses an AI model from OpenAI for two things:
- Assessment reports. Where a programme's assessment includes written answers, the text of your answers is sent to the model to score them and write feedback. Your name and email address are not sent.
- The learning assistant. The messages you write in the chat are sent to the model to produce a reply. We do not store the conversation; we keep a usage record of each request (time, size and cost) to control spending.
The model provider receives this text through its business API. It does not use it to train its models: PCL has not opted in to sharing any data with OpenAI. It keeps the text for up to 30 days to monitor for abuse, then deletes it. The assistant screens messages before they are sent and refuses some topics. AI-generated scores and feedback can be wrong. You can ask for any result produced by AI to be reviewed by a person, your facilitator, and object to it.
Who we share information with
Inside the platform, people see only what their part in your programme needs:
- Your facilitators see the sessions they run, with attendance, progress and assessment results.
- Your coach sees the people they coach.
- Your organisation's programme contact sees its own people's progress, attendance and reports.
- PCL staff who run the platform can see what is needed to support it.
- Nobody but you sees your journal entries.
Service providers process information for us under contract, only to run the platform:
| Provider | What for |
|---|---|
| Google Cloud | Hosting the platform and its database |
| OpenAI | AI scoring and the learning assistant (see "AI processing") |
| Google Workspace | Sending the platform's emails |
| "Sign in with Google", when you choose it |
We also disclose information where the law requires it, and to a buyer if PCL's business is ever sold, under this policy's protections.
Where your information is stored
The platform and its database run in Google Cloud's Frankfurt region, in Germany. Text sent for AI processing goes to OpenAI in the United States, and email is sent through Google Workspace, on Google's servers.
Where information leaves the United Arab Emirates, it is protected by a data processing agreement with each provider, which binds the provider to protect it to the standard UAE law requires.
Cookies
The platform sets one cookie, and it is essential: it keeps you signed in.
| Cookie | Purpose | How long |
|---|---|---|
pcl_session | Keeps you signed in, and carries the security checks for your sign-in and requests | 8 hours for PCL staff; 30 days for programme participants |
It is sent only to api.pclleadership.com, only over encrypted connections, and cannot be read by page scripts. The apps also keep a little in your browser's local storage: display preferences such as light or dark mode, where you are in a course, and a coach's own working notes. It stays on that device, and most of it is cleared when you sign out.
We use no advertising, analytics or tracking cookies, so there is nothing to opt out of. Blocking the cookie stops you signing in.
How long we keep information
| Information | Kept for |
|---|---|
| Your account and programme records | While your organisation's agreement with PCL lasts, and 24 months after it ends, unless you ask us to delete them sooner |
| Walk-in participants of a session run without email sign-up | Deleted automatically 0 to 7 days after the session ends, as the facilitator sets |
| Access requests whose email link was never confirmed | Deleted automatically once the 24-hour link expires |
| Links asking you to confirm a move between organisations | Deleted automatically once the 7-day link expires |
| AI usage records | 24 months per PCL's internal retention policies |
| Service logs on our servers | Up to 30 days |
| Records of role and account changes | While your organisation's agreement with PCL lasts, and 24 months after it ends |
If you move to another organisation, the records of your earlier programme stay with the organisation that ran it.
How we protect information
- Separation between organisations is enforced by the database itself, not only by the application, so one organisation's records cannot be read in another's.
- Access by role: each person sees only what their role in a programme needs.
- Encryption of connections to the platform, and of the database's stored data by Google Cloud.
- Credentials: passwords are stored only as salted hashes, and sign-in links only as one-way digests. Sign-in attempts are rate-limited.
- Accountability: role and account changes are recorded with who made them.
No system is perfectly secure. If a breach puts your information at risk, we will tell you and the regulator as the law requires.
Your rights
Depending on the law that applies to you, you can ask us to:
- give you a copy of the information we hold about you;
- correct it if it is wrong;
- delete it;
- stop or limit how we use it, or object to a use;
- give it to you, or to someone else, in a common electronic format;
- review by a person any decision made about you by automated processing alone, such as an AI-generated score, and let you object to it.
Email josh@pcllearning.com to make a request. We will acknowledge your request within 48 hours, confirm who you are, and answer it in full within 30 days. Where we hold the information for your organisation, we will pass your request to it and help it respond.
You can also complain to the UAE Data Office, the regulator under the PDPL. We would welcome the chance to put things right first.
Children
The platform is for adults taking part in professional programmes. It is not meant for anyone under the age of 18, and we do not knowingly collect their information. If you think we have, contact us and we will delete it.
Changes to this policy
We will post any change here and update the date at the top. If a change materially affects how we use your information, we will tell you by email or in the platform before it takes effect.
Last updated: 12 October 2026.
Contact us
For any question about this policy or your information:
- Email: josh@pcllearning.com