NEUE ACADEMY — PRIVACY POLICY

Data Controller: Revelium Studios FZCO Version: 1.0 Last Updated: 26 July 2026

1. Who We Are and What This Policy Covers

Revelium Studios FZCO, a free zone company incorporated in the Dubai Silicon Oasis free zone, with registered address at Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates ("Revelium", "we", "us"), is the data controller for personal data processed through the Neue Academy web application, website, and related services (the "Service").

This Policy explains what personal data we collect, why, on what legal basis, who we share it with, how long we keep it, and the rights you have over it. It applies to all users of the Service worldwide, with additional region-specific information in Sections 10–12.

Cookies and similar tracking technologies are addressed in our standalone Cookie Policy, not in this document. Payment terms are addressed in our Payment Terms, and your contractual relationship with us is governed by our Terms and Conditions.

Privacy contact: legal@theneue.academy (see Section 15).

2. Personal Data We Collect

a. Account data — name, email address, password (stored hashed), country, language preference, and any optional profile information you choose to add.

b. Purchase and payment data — plan type (Lifetime Access or, when available, recurring subscription), transaction history, billing country, VAT/tax status, and payment confirmation records. We do not store full card numbers; card details are collected and processed directly by our payment processors (Section 5).

c. Usage and learning data — lessons viewed, course progress, completion status, quiz or exercise results, bookmarks, and in-app preferences. We use this to run the product (e.g., resuming where you left off, showing progress).

d. Communications data — messages you send to hello@, support@, or legal@theneue.academy, in-app support requests, and survey responses.

e. Technical data — IP address, device and browser type, operating system, access timestamps, and error logs, collected automatically when you use the Service for security, debugging, and performance purposes.

We collect data directly from you (a, b, d), automatically from your use of the Service (c, e), and from our payment processors (confirmation of payment status only).

We do not knowingly collect special-category/sensitive data (health, religion, biometrics, etc.) and ask that you do not submit it.

3. Purposes and Legal Bases

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights; you may object at any time (Section 10).

We do not use your personal data for automated decision-making that produces legal or similarly significant effects, and we do not sell your personal data or share it for cross-context behavioral advertising.

4. Cookies and Tracking

The Service uses cookies and similar technologies. The categories used, their purposes, durations, and your consent and opt-out choices are described in our standalone Cookie Policy, which should be read together with this Policy. Where required (including in the EU/EEA and UK), non-essential cookies are set only with your consent, managed through the cookie banner.

5. Who We Share Data With

We share personal data only with:

a. Service providers (processors) acting on our documented instructions under data-processing agreements, in these categories: payment processing; cloud hosting, storage, and content delivery; email delivery; customer-support tooling; and privacy-respecting analytics. The current list of our processors is available at any time by writing to legal@theneue.academy, and material changes to it are reflected in updates to this Policy.

b. Professional advisers and authorities — accountants, auditors, insurers, and legal advisers under confidentiality; and courts, regulators, or law-enforcement authorities where disclosure is required by applicable law or necessary to establish, exercise, or defend legal claims.

c. Corporate transactions — a successor entity in a merger, acquisition, restructuring, or asset sale, subject to this Policy continuing to apply to your data (consistent with Section 18.2 of the Terms and Conditions).

We do not share personal data with third parties for their own marketing.

6. International Data Transfers

We operate from the UAE and use cloud infrastructure that may store or process data in the European Union, the United Kingdom, and the United States.

From the UAE: cross-border transfers are made in accordance with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021 and its Executive Regulations) — to jurisdictions with adequate protection, or otherwise under appropriate contractual safeguards or with your consent where required.

From the EU/EEA and UK: where personal data of EU/EEA or UK users is transferred to countries without an adequacy decision (including the UAE), we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum/IDTA, as applicable) with supplementary technical measures such as encryption in transit and at rest. You may request a copy of the relevant safeguards via legal@theneue.academy.

7. Retention

Backups are retained on rolling cycles and purged on schedule; data in backups is not restored except for disaster recovery.

8. Security

We apply technical and organizational measures appropriate to the risk, including encryption in transit (TLS) and at rest, hashed passwords, access controls on a need-to-know basis, environment separation, and vendor due diligence. No system is perfectly secure; please use a strong, unique password and contact us immediately at support@theneue.academy if you suspect unauthorized access to your account.

9. Data Breach Notification

If a personal data breach occurs that is likely to result in a risk to your privacy or the security of your data, we will: (a) notify the UAE Data Office and, where EU/EEA or UK users are affected, the competent supervisory authority, without undue delay and within the timelines required by applicable law (including the 72-hour benchmark under GDPR Art. 33 and the periods specified under the UAE PDPL Executive Regulations); and (b) notify affected users without undue delay where the breach is likely to result in a high risk to them, with a description of the breach, its likely consequences, and the measures taken.

10. Your Rights (All Users)

Subject to applicable law, you have the right to: access the personal data we hold about you and receive a copy; correct inaccurate or incomplete data; delete your data; restrict or object to certain processing (including any processing based on legitimate interests, and marketing at any time); portability — receive data you provided in a structured, commonly used, machine-readable format; and withdraw consent at any time where processing is based on consent, without affecting prior processing.

To exercise any right, email legal@theneue.academy from your registered address or include information sufficient for us to verify your identity. We respond within 30 days (extendable where permitted for complex requests, with notice). Exercising your rights is free of charge except where requests are manifestly unfounded or excessive.

11. Additional Information for EU/EEA and UK Users

Your rights in Section 10 are as set out in GDPR Articles 15–22 (and the UK GDPR equivalents). In addition: our legal bases for each purpose are listed in Section 3; transfer safeguards are described in Section 6; and you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement (in the UK, the Information Commissioner's Office). We would appreciate the chance to address your concern first at legal@theneue.academy, but you may contact the authority directly at any time.

12. Additional Information for California Residents (CCPA/CPRA)

In the preceding 12 months we have collected these categories of personal information: identifiers (name, email, IP address); commercial information (purchase records); internet or network activity (usage and technical data); inferences limited to learning progress within the Service. Sources, purposes, and recipients are as described in Sections 2, 3, and 5.

We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information other than as permitted for providing the Service. We do not knowingly collect personal information of consumers under 16.

You have the rights to know/access, delete, correct, and limit use of sensitive personal information (not applicable, as above), and the right to non-discrimination for exercising your rights. Because we do not sell or share personal information, no opt-out link is required; if that ever changes, we will add the required "Do Not Sell or Share My Personal Information" mechanism before doing so.

Submit requests to legal@theneue.academy. You may use an authorized agent with written permission; we will verify requests using your account email and recent account activity.

13. Additional Information for UAE Users

Your rights in Section 10 correspond to those under the UAE PDPL (Federal Decree-Law No. 45 of 2021 and its Executive Regulations), including access, rectification, erasure, restriction, objection, portability, and the right not to be subject to solely automated decisions with legal effect. Complaints may be made to the UAE Data Office if you believe our processing infringes the PDPL; we ask for the opportunity to resolve your concern first via legal@theneue.academy.

14. Children

The Service is intended for users aged 18 and over, and we do not knowingly collect personal data from anyone under 18. In particular, the Service is not directed at children under 13, and we do not knowingly collect their data (consistent with the US COPPA). If you believe a minor has provided us personal data, contact legal@theneue.academy and we will delete it promptly.

15. Contact and Privacy Governance

We have appointed an internal privacy contact responsible for data protection matters (a formal Data Protection Officer is not currently required for our processing profile; we will appoint one if our processing changes such that it becomes required).

Privacy contact: legal@theneue.academy Postal: Revelium Studios FZCO, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates General: hello@theneue.academy · Support: support@theneue.academy

16. Changes to This Policy

We may update this Policy to reflect changes in our processing, the law, or our providers. For material changes we will give at least 30 days' notice by email or in-app notice before the change takes effect; the "Last Updated" date above always reflects the current version. Continued use of the Service after the effective date constitutes acknowledgment of the updated Policy (and, where any processing requires consent, we will ask for it separately).