سياسة الخصوصية
Effective Date: 27 April 2026
www.GhassanChallenges.com · Jurisdiction: United Arab Emirates
Your privacy matters to us. This Privacy Policy explains how Ghassan Challenges, trading as GhassanChallenges ("we," "us," "the Platform"), collects, uses, stores, and protects your personal data when you use our platform. By accessing or using GhassanChallenges, you consent to the practices described in this policy.
Contents
01 Data Controller
02 Data We Collect
03 How We Collect Your Data
04 Legal Basis for Processing
05 How We Use Your Data
06 Third-Party Service Providers
07 Data Sharing & Disclosure
08 International Data Transfers
09 Data Retention
10 Your Rights
11 Cookies & Tracking Technologies
12 Children's Privacy
13 Security Measures
14 Data Breach Notification
15 Changes to This Policy
Contact Information
01 - Data Controller
The data controller responsible for your personal data is:
Legal Entity
Ghassan Challenges
Trading As
GhassanChallenges
Registered In
United Arab Emirates
Business Address
Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates
Privacy Contact
support@ghassanchallenges.com
If you have any questions about how we handle your personal data, you may contact us at the email address above.
02 - Data We Collect
We collect the following categories of personal data:
Account Information
- Username
- Email address
- Contact information
- Profile photo
Health & Fitness Data
- Macro calculator inputs (height, weight, age, activity level, dietary goals)
- Activity and performance metrics submitted as challenge entries (e.g. step counts, distances, repetitions, durations, or other tracked values)
- Workout completion records
User-Generated Content
- Journal entries and written responses submitted as challenge entries
- Photos and videos uploaded as part of challenges
- Numerical data entries (measurements, step counts)
Usage & Technical Data
- Login dates and times
- Features accessed and interactions within the platform
- Device type, operating system, and browser type
- IP address
- Push notification subscription status
Payment Data
- Billing name and address
- Transaction history (dates, amounts, subscription status)
- Note: Full payment card details are processed and stored exclusively by our payment provider, Stripe. We do not have access to or store your full card number, CVV, or expiration date.
Identity Verification Data
- Government-issued photo identification (collected only for prize winner verification as described in our Terms & Conditions, Section 05)
- Any additional documentation requested for the purpose of confirming prize eligibility
Prize Winner Data
- Bank account details (IBAN, account holder name, bank name) collected solely for the purpose of prize payouts
- Social media handles (e.g. Instagram) collected for winner verification and promotional coordination
- Note: Bank details are used only to process the payout and are deleted immediately after the transfer is completed. We do not retain bank details beyond what is necessary to complete the transaction.
03 - How We Collect Your Data
Directly From You
When you create an account, complete the onboarding process, subscribe, submit challenge entries, upload content, contact support, or provide identification for prize verification.
Automatically
When you use the platform, we automatically collect certain technical and usage data, including your IP address, device information, browser type, and interaction data. As a Progressive Web App (PWA), GhassanChallenges does not use traditional app store tracking mechanisms.
From Third Parties
We may receive transaction confirmation data from Stripe (our payment processor) to confirm subscription status and billing events. We do not purchase or acquire personal data from data brokers or other third-party sources.
04 - Legal Basis for Processing
We process your personal data on the following legal grounds, in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL):
Providing and Operating the Platform
Legal basis: Performance of a contract (your subscription agreement)
Processing Payments
Legal basis: Performance of a contract
Sending Transactional Communications
Legal basis: Performance of a contract
Sending Push Notifications and Marketing
Legal basis: Your consent
Displaying Challenge Rankings
Legal basis: Legitimate interest in operating the platform
Prize Winner Verification
Legal basis: Legitimate interest; your consent at the time of verification
Zoom Call Recording (Internal/Operational)
Legal basis: Condition of attendance; consent granted by joining the call (see T&C, Section 09)
Use of Zoom Recordings for Marketing
Legal basis: Separate revocable consent (see T&C, Section 09). You may opt out without affecting membership or prize eligibility.
Improving the Platform and Content
Legal basis: Legitimate interest
Compliance with UAE Legal Obligations
Legal basis: Legal obligation
05 - How We Use Your Data
We use your personal data for the following purposes:
- Platform operation: To create and manage your account, deliver daily workout programs and meal plans, calculate macros, track challenge completions, and display rankings.
- Payment processing: To process subscription payments, manage billing cycles, handle refund requests, and maintain transaction records.
- Communications: To send daily challenge reminders, workout alerts, winner announcements, Zoom call invitations, platform updates, and support responses.
- Prize administration: To determine eligibility, select winners based on performance metrics, verify identity, arrange prize fulfilment, and administer fallback winner procedures.
- Content moderation: To review user-generated content for compliance with our content standards and challenge integrity requirements.
- Platform improvement: To understand how members use the platform, identify technical issues, and improve programs, content, and user experience.
- Legal compliance: To comply with applicable UAE laws, respond to lawful requests from authorities, and enforce our Terms & Conditions.
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
06 - Third-Party Service Providers
We share personal data with the following categories of third-party service providers, strictly to the extent necessary to operate the platform. All providers are contractually bound to process your data securely and only for the purposes we specify.
Stripe
Purpose: Payment processing
Data shared: Billing name, email, payment card details, transaction data
Google Cloud Platform (GCP)
Purpose: Application hosting and data storage
Data shared: All platform data is hosted on GCP infrastructure
Zoom
Purpose: Group video calls
Data shared: Name, email (for invitations); audio/video recordings if recorded
Klaviyo
Purpose: CRM and email marketing
Data shared: Name, email address, subscription status, engagement data
Google Workspace
Purpose: Internal business operations and communications
Data shared: Name, email address, support correspondence
If we introduce analytics services (such as Google Analytics) in the future, this policy will be updated accordingly and you will be notified as described in Section 14.
Each third-party provider operates under its own privacy policy. We encourage you to review the privacy policies of Stripe, Google Cloud, and Zoom for details on how they handle your data.
07 - Data Sharing & Disclosure
We do not sell, rent, or trade your personal data.
Beyond the service providers listed in Section 06, we may disclose your personal data only in the following limited circumstances:
- Legal requirements: Where required by UAE law, regulation, or court order, or in response to a lawful request by a government authority.
- Protection of rights: Where necessary to protect the rights, safety, or property of GhassanChallenges, our members, or the public.
- Business transfer: In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer.
- With your consent: Where you have given explicit consent, such as for promotional use of your content or Zoom call recordings.
08 - International Data Transfers
GhassanChallenges is operated from the United Arab Emirates. Our hosting infrastructure (Google Cloud Platform) and payment processor (Stripe) may process and store data in locations outside the UAE, including the United States and the European Economic Area.
Where your personal data is transferred outside the UAE, we ensure that appropriate safeguards are in place in accordance with the PDPL, including:
- Transfers to jurisdictions that provide an adequate level of data protection as determined by the UAE Data Office.
- Contractual clauses with service providers that require them to protect your data to a standard consistent with UAE law.
By using the platform, you consent to the transfer, processing, and storage of your data as described in this section.
09 - Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by law.
Account Information
Retention period: Duration of active membership, plus 12 months after account deletion or cancellation
Health & Fitness Data
Retention period: Duration of active membership; deleted upon account deletion
User-Generated Content
Retention period: Until you request deletion, or upon account deletion. Point records may be retained for historical integrity.
Usage & Technical Data
Retention period: 12 months from collection
Payment & Transaction Data
Retention period: As required by applicable UAE financial record-keeping laws (typically 5 years)
Identity Verification Data
Retention period: 30 days from verification completion or prize forfeiture, whichever is earlier
Bank Details (Prize Payouts)
Retention period: Deleted immediately after the payout transfer is completed
Social Media Handles (Prize Winners)
Retention period: 30 days from verification completion or prize forfeiture, whichever is earlier
Zoom Call Recordings
Retention period: Recording is a mandatory condition of attendance. Retained for internal purposes for 24 months. Recordings used for marketing retained for as long as in active use. You may opt out of marketing use at any time.
When data reaches the end of its retention period, it is securely deleted or anonymised so that it can no longer be linked to you.
10 - Your Rights
Under the UAE PDPL, you have the following rights in relation to your personal data:
- Right of access: You may request a copy of the personal data we hold about you.
- Right to rectification: You may request correction of any inaccurate or incomplete personal data.
- Right to erasure: You may request deletion of your personal data, subject to any legal obligations that require us to retain it. Note that deleting your account results in permanent loss of your challenge history, accumulated points, and rankings.
- Right to restrict processing: You may request that we limit how we use your data in certain circumstances.
- Right to data portability: You may request a copy of your data in a structured, commonly used, machine-readable format.
- Right to withdraw consent: Where processing is based on consent (e.g. push notifications, promotional use of content, marketing use of Zoom recordings), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Note: Zoom call recording itself is a condition of attendance and cannot be opted out of (see T&C, Section 09), but you may opt out of marketing use of your recordings at any time by contacting us.
- Right to object: You may object to processing based on legitimate interest. We will cease processing unless we have compelling legitimate grounds that override your interests.
How to Exercise Your Rights
Submit your request by email to support@ghassanchallenges.com. Please include your username and a clear description of your request. We will verify your identity before processing any request and will respond within 30 days.
If you are unsatisfied with our response, you have the right to lodge a complaint with the UAE Data Office.
11 - Cookies & Tracking Technologies
GhassanChallenges is delivered as a Progressive Web App (PWA). Our use of cookies and similar technologies is limited to:
- Essential cookies: Required for the platform to function, including session management and authentication. These cannot be disabled.
- Service worker data: Used to enable offline functionality and push notifications as part of the PWA. Service worker data is stored locally on your device.
We do not currently use third-party advertising cookies or cross-site tracking technologies. If we introduce analytics tools in the future, we will update this policy and, where required, seek your consent before deploying non-essential cookies.
12 - Children's Privacy
GhassanChallenges is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a minor, we will take immediate steps to delete that data and terminate the associated account.
If you believe a child under 18 has created an account or provided personal data to us, please contact us immediately at support@ghassanchallenges.com.
13 - Security Measures
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it, including:
- Data encryption in transit (TLS/SSL) and at rest
- Secure hosting on Google Cloud Platform with access controls and monitoring
- Payment data handled exclusively by Stripe, a PCI DSS Level 1 certified payment processor
- Access to personal data restricted to authorised personnel on a need-to-know basis
- Regular review of security practices and incident response procedures
While we take all reasonable precautions, no method of electronic storage or transmission is 100% secure. If you become aware of any security vulnerability or suspect unauthorised access to your account, please contact us immediately.
14 - Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:
- Notify the UAE Data Office without undue delay, and in any event within 72 hours of becoming aware of the breach, providing details of the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures taken or proposed to address the breach.
- Notify affected users without undue delay where the breach is likely to result in a high risk to your rights and freedoms. Notification will be made by email and, where possible, via in-app message. The notification will describe the nature of the breach, the data involved, the potential consequences, and the steps we are taking in response.
We maintain an internal breach register documenting all personal data breaches, including their effects and the remedial actions taken, regardless of whether notification to the UAE Data Office or affected users is required.
This commitment is made in accordance with the breach notification requirements under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and any implementing regulations issued by the UAE Data Office.
15 - Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons.
Where changes are material, we will notify you by email or in-app message at least 14 days before the changes take effect. The "Effective Date" at the top of this policy will be updated accordingly.
Continued use of the platform after the effective date of a revised policy constitutes your acceptance of the changes. If you do not agree with the revised policy, you should discontinue use of the platform and contact us to request deletion of your data.
Contact Information
For any questions, concerns, or requests related to your personal data or this Privacy Policy, please contact us:
support@ghassanchallenges.com
Website
www.GhassanChallenges.com
Business Address
Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates
Data Controller
Ghassan Challenges