Your Privacy Matters

Privacy Policy

How Talem collects, uses, and protects your personal data.

Last updated: 27 July 2026

Introduction

This Privacy Policy explains how Talem EdHub Portal (“Talem”, “we”, “our”, or “us”), a business registered with the Department of Economic Development (DED) in Dubai, United Arab Emirates, collects, uses, stores, and protects personal information when you use our website at talem.ae.

Talem is a UAE-based platform that helps families discover, compare, and enquire about schools, universities, nurseries, and kindergartens. By creating an account or using the platform, you agree to the practices described in this policy.

We comply with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) for all users, the EU General Data Protection Regulation (GDPR) for users in the European Economic Area, the UK Data Protection Act 2018 and UK GDPR for users in the United Kingdom, and the California Consumer Privacy Act (CCPA/CPRA) for residents of California.

Information We Collect

Information you provide

When you create an account or use Talem, we collect information you give us directly. This includes:

Account credentials: email address, password (stored only as a salted hash), and your selected account type (parent, student, or institution representative).

Profile details: first and last name, date of birth, gender, nationality, phone number, emirate of residence, and preferred language.

For parents: information about your child, including their name, date of birth, gender, current school, and intended entering year.

For students: your current education level, expected graduation year, and current school.

For institution representatives: your job title, the institution you represent, and any access-request notes.

Education preferences: preferred curriculum, preferred emirates, fee range, gender preference, and required facilities.

Uploaded documents you choose to add: passport copy, Emirates ID, passport photo, transcripts and report cards, vaccination records, birth certificate, and any other documents you label and upload.

Interactions: enquiries, applications, reviews, questions you ask about a school, messages you send through our contact form, saved institutions and saved searches, and other content you submit through forms.

Sensitive data and children’s data: some of what an application involves is a special category of personal data, and we want to be explicit about it. Vaccination and immunisation records are health data; passport copies, Emirates ID copies and birth certificates are official identity documents; and most of this relates to a child rather than to the adult filling in the form. We collect these only when a school you are applying to asks for them, and only because you choose to upload them so your application can be processed. We rely on your explicit consent, and on the fact that supplying them is necessary for the application you asked us to submit. You never need to upload a document to browse, compare, save or enquire about a school — only to complete a formal application, and you can always apply to the school directly instead. You can withdraw consent at any time by deleting the document or the application; note that once a document has been shared with an institution, that institution holds its own copy as an independent controller and you would need to contact them to have it removed.

Information collected automatically

When you use Talem we automatically collect technical and usage information, including:

Device and browser information (user agent, operating system, screen size).

IP address and approximate location derived from it (city / country only).

Usage data: pages visited, searches performed, institutions viewed, time spent, referring URL.

Cookies, local storage, and similar technologies used to keep you signed in, remember preferences, and measure how the platform is used.

Diagnostic and error logs captured when something goes wrong, so we can fix it.

Information from third parties

If you choose to sign in with Google, we receive your name, email, and profile photo from Google. If you submit a form protected by hCaptcha, hCaptcha receives technical signals (IP, device characteristics) to verify you are not a bot.

How We Use Your Information

We process your personal data for the following purposes:

To create and operate your account and provide the platform features.

To match your education preferences with relevant institutions and surface useful recommendations.

To process enquiries and applications you submit and forward them to the relevant institution (see "How We Share Your Information" below).

To send transactional emails (verification codes, password resets, application status updates). These are necessary to operate your account and cannot be turned off while the account is active.

To send newsletters and product updates, only if you have opted in. You can opt out at any time from Account → Email Preferences or via the unsubscribe link in any marketing email.

To send service notifications for features you switch on, for example a periodic alert (you choose the frequency, or turn it off) when new schools match a search you saved, and reminders about an application you have started.

To analyse aggregated and de-identified usage data so we can improve the platform.

To detect, investigate, and prevent fraud, abuse, and security incidents.

To comply with applicable laws, court orders, and regulatory obligations in the UAE and any other jurisdiction whose laws apply to you.

Legal Basis for Processing (EU/UK Users)

If you are in the European Economic Area or the United Kingdom, the GDPR requires us to identify a legal basis for each type of processing. Our bases are:

Performance of a contract: to provide the platform features you signed up for, including processing your applications and enquiries.

Consent: for marketing emails, optional profile fields, and any processing where we ask for your explicit permission. You can withdraw consent at any time.

Legitimate interests: for analytics, product improvement, security monitoring, and fraud prevention, always balanced against your rights.

Legal obligation: where we are required by law to retain or disclose information.

How We Share Your Information

With educational institutions

When you submit an enquiry or an application through Talem, we share the relevant information with the educational institution you selected. For enquiries this typically includes your contact details and the message you wrote. For applications this includes your full application details and any documents you uploaded as part of the application. We share this information so the institution can respond to you and process your application; once shared, the institution becomes an independent controller of that data and its own privacy notice applies.

With service providers (processors)

We rely on the following third-party services to operate Talem. Each is bound by contractual data-processing terms and only processes your data on our instructions:

Supabase (Australia — Sydney region): our database, authentication, and file storage provider. This is where your account data, enquiries, applications, and any documents you upload are stored.

Resend (Ireland, European Union): our transactional and marketing email delivery provider.

Vercel (global edge network): our application hosting provider; also provides optional, consent-gated performance and usage analytics.

PostHog (United States): optional, consent-gated product analytics to understand how the platform is used.

Sentry / BetterStack (European Union / United States): error monitoring and diagnostics.

Slack (United States): internal team notifications. When you submit a lead, enquiry, contact-form message, review, or institution claim, a notification that may include your name, email, phone number, and message is sent to our private internal Slack workspace so our team can act on it.

hCaptcha (global): bot protection on signup, sign-in, and other sensitive forms; it receives your IP address and device signals.

MapTiler (European Union) and CARTO (United States): map providers that render the interactive search map; they receive your IP address and the map area you view in order to serve map tiles.

Google (global): used if you choose to sign in with your Google account, and to show an embedded Google map of a school's location on institution pages. Loading that map sends your IP address to Google and may set Google cookies, whether or not you sign in with Google.

For legal reasons

We may disclose your information if required to do so by law, court order, or government request; to enforce our terms of service; or to protect the rights, property, or safety of Talem, our users, or others.

Business transfers

If Talem is involved in a merger, acquisition, restructuring, or sale of assets, your information may be transferred as part of that transaction. We will notify you (typically by email and on the platform) before your data becomes subject to a different privacy policy.

We do not sell your personal data

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. This applies to all users, including those covered by the California CCPA/CPRA “do not sell or share” right.

International Data Transfers

Talem is based in the UAE, but our systems and service providers operate from outside it. In particular, our primary database and document storage (Supabase) are hosted in Australia, in the Sydney region — so your account data, enquiries, applications, and any documents you upload are stored there, not in the UAE. Other providers are located in or operate from the European Union, the United Kingdom, the United States, or on global edge networks. This means your personal data is transferred to, stored in, and processed in those countries.

For transfers from the European Economic Area or the United Kingdom to countries that do not have an adequacy decision, we rely on Standard Contractual Clauses (SCCs) and supplementary measures (encryption in transit and at rest, access controls, contractual confidentiality) to ensure your data receives an equivalent standard of protection. For transfers from the UAE, we comply with the cross-border transfer requirements of the UAE PDPL.

Data Retention

We keep your personal data only for as long as we need it. Typical retention periods:

Account profile data: retained for as long as your account is active. If you delete your account, we remove your profile and uploaded documents within 30 days.

Enquiries and applications: retained for up to 2 years after submission so we and the receiving institution can respond to follow-up questions across an admission cycle.

Uploaded documents: deleted when you delete the document, when the related application is deleted, or when you delete your account.

Marketing-email contact list: retained until you unsubscribe or delete your account, whichever happens first.

Server, application, and security logs: retained for up to 90 days.

Email delivery logs (via Resend): retained according to Resend’s own retention period (currently up to 1 year).

Database backups: retained on a 30-day rolling basis, after which deleted records age out of backups automatically.

Anonymous usage analytics (aggregate counts not linked to your account): kept to understand platform trends; because these records are not tied to your identity, they are not removed by an account-deletion request.

We may retain data longer than these periods if we are legally required to (for example, to comply with tax, accounting, or anti-fraud obligations), or if we need to defend against legal claims.

Cookies and Tracking Technologies

Talem uses cookies, local storage, and similar technologies for the following purposes:

Strictly necessary: keeping you signed in (our authentication session cookie), remembering your in-progress searches and form inputs, and recording your cookie-consent choice. These cannot be turned off.

Analytics: we record how the platform is used (pages visited, features used, performance metrics) so we can improve it. From your first visit we count this anonymously, without storing anything on your device. Only after you click Accept do we set a longer-lived visitor cookie named "talem_anon_id" (about 12 months) to recognise return visits, and load our analytics partners PostHog and Vercel Analytics. Choose "Reject non-essential" and we keep only the anonymous counts.

Security: hCaptcha sets short-lived cookies on signup and sign-in pages to detect automated abuse.

Maps: when you open the interactive search map or view a school's location, the map provider (MapTiler, CARTO, or Google Maps) may set its own cookies and receives your IP address to serve the map.

On your first visit we show a cookie consent banner. Before you choose, we set only strictly necessary cookies and run our own privacy-preserving analytics that count usage anonymously without storing anything on your device. Clicking "Accept" additionally enables the talem_anon_id analytics cookie and our analytics partners (PostHog and Vercel Analytics); clicking "Reject non-essential" keeps analytics anonymous and storage-free. You can change your choice at any time using the "Cookie preferences" link in the footer, and we honour the Do Not Track signal sent by your browser. We do not use advertising cookies and do not track you across other websites.

Children's and Minors' Data

Talem allows three types of accounts: parents, students, and institution representatives. We recognise that students and the children parents register on the platform are often minors, and we treat their data with extra care.

Children under 13 years old should not create their own account. Only a parent or legal guardian may create an account that contains data about a child under 13.

Students aged 13 to 17 may create their own account but should have permission from a parent or guardian before doing so. We may ask for verifiable parental consent for accounts identified as belonging to minors in jurisdictions that require it (for example, the US under COPPA, or the EU under Article 8 of GDPR for users under the relevant member-state age).

Parents and guardians who register a child’s information are responsible for keeping it accurate, and for monitoring how the platform is used.

We do not knowingly collect data directly from a child under 13 without verifiable parental consent. If you believe a child has provided us with personal data without proper consent, contact us at legal@talem.ae and we will delete it.

A parent or guardian can at any time request access to, correction of, or deletion of a child’s data by emailing legal@talem.ae.

Your Rights

Depending on where you live, you have some or all of the following rights regarding the personal data we hold about you:

Access: request a copy of the personal data we hold about you.

Correction (rectification): ask us to fix data that is inaccurate or incomplete.

Deletion (erasure): ask us to delete your personal data. You can also delete your account yourself from Account → Profile → Danger Zone.

Restriction: ask us to limit how we use your data while a complaint or correction is being investigated.

Objection: object to processing we carry out based on legitimate interests (such as analytics) or for direct marketing.

Portability: receive a copy of your data in a structured, machine-readable format so you can transfer it elsewhere.

Withdraw consent: where processing is based on consent (for example marketing emails), withdraw your consent at any time.

Non-discrimination: we will not deny service, charge different prices, or provide a different level of service because you exercised any of these rights.

Lodge a complaint with a regulator: EU users can complain to their national data protection authority; UK users to the Information Commissioner’s Office (ICO); UAE users to the UAE Data Office; California residents to the California Attorney General or the California Privacy Protection Agency.

To exercise any of these rights, email legal@talem.ae. We will respond within 30 days. We may need to verify your identity before processing the request to make sure we don’t disclose data to the wrong person.

Data Security

We take reasonable technical and organisational measures to protect your personal data. These include:

Encryption of data in transit (TLS 1.2 or higher) for all connections to talem.ae.

Encryption of data at rest in our database and document storage.

Passwords stored only as salted hashes via our authentication provider; we never see or store your password in plain text.

Row-level access controls in our database, so users can only read and write their own data.

hCaptcha-protected signup and other sensitive forms to reduce automated abuse.

Optional two-factor authentication (via an authenticator app) on your account; we never collect a phone number for SMS codes.

Sentry / BetterStack error monitoring so we detect problems quickly, with personally identifying fields automatically masked where possible.

Regular review of access permissions for the small number of Talem team members with administrative access.

No system is perfectly secure. If we ever become aware of a personal-data breach that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours where required, and notify you without undue delay if the risk is high.

Marketing Communications

Marketing emails (newsletters, product updates, school highlights) are sent only to users who have explicitly opted in. You can opt in or out at any time from Account → Profile → Email Preferences, or by clicking the unsubscribe link at the bottom of any marketing email. Opting out takes effect immediately.

Transactional emails, such as email verification codes, password reset codes, application status updates, and security notifications, are necessary to operate your account and cannot be turned off while your account is active.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the services we use, or applicable law. The “Last Updated” date at the top of this page indicates when the policy was last revised.

For material changes (for example, a new category of data we collect, or a new third-party processor that significantly changes how your data is handled), we will notify you in advance by email (to the address on your account) and via a prominent notice on the platform. Continued use of Talem after a change takes effect means you accept the updated policy.

How to Contact Us

If you have any questions about this Privacy Policy, want to exercise your rights, or want to raise a concern about how we handle your data, please contact us at:

Email: legal@talem.ae

Postal address: Talem EdHub Portal, Dubai, United Arab Emirates

Registration: Dubai Department of Economic Development (DED)

Instagram: instagram.com/talem.ae (general updates only; please do not send personal data or privacy requests through social media, as those channels are not secure and are not monitored for rights requests)

We will respond within 30 days of receiving your request. If you are not satisfied with our response, you have the right to escalate to the data protection authority in your jurisdiction (see "Your Rights" above).

Have questions about your data?

We're committed to transparency. Reach out if you need any clarification.