Legal

Privacy policy

Last updated: 11 November 2026

This policy sets out what personal data ekpharm.com collects, why, how long it is kept, and your rights. It covers the website, the EKPharm Academy and the certificate verification page.

1. Who is responsible

The website and EKPharm Academy are run by Emad Kirolos, an individual based in Dubai, United Arab Emirates. I am responsible for the personal data described here. Contact: [email protected].

2. What data is collected

| Data | When it is collected | Why |

|---|---|---|

| Anonymous visit data: pages and sections viewed, clicks on course, certificate, resource and project links, country, device type, the site that referred you, and campaign tags (UTM) | Every visit, unless your browser sends a Global Privacy Control or Do Not Track signal, in which case nothing is counted | To see which content is useful and to improve the site |

| Introduction details: name, job title, organisation and an optional email address | Only if you fill in the introduction form and tick the consent box | To know who is interested in my work, and to reply if you ask me to |

| Certificate ID you enter | When you check a certificate | To return its status from the certificate registry |

| Messages you send by email or through the contact page | When you contact me | To reply and handle your enquiry |

What the site does not do. It does not store your IP address. To limit spam requests, the server keeps a one-way scrambled version of it for up to one hour, then deletes it automatically. Visit records are kept for 395 days and store only a daily anonymous code made from a scrambled version of your connection and browser. That code changes every day and is treated as personal data under the law, so it is deleted automatically after 395 days. Apart from the bot check described below, it does not set cookies for visitors and does not create user accounts. Visitors are counted per day using an anonymous code that changes every day and cannot be traced back to you. Location is recorded at country level only.

3. Legal basis and purpose

• Anonymous visit data: my legitimate interest in running and improving the site. It is not used to identify you.
• Introduction details: your consent, which you can withdraw at any time without affecting anything done before.
• Certificate checks and messages: to give you the service you asked for.

The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) applies to this processing.

4. Who receives your data

• Hosting and infrastructure: Cloudflare hosts the site, stores the anonymous counts and introduction records in its database, and provides the sign-in that protects the administration area. Cloudflare processes data under its own data processing terms, which can involve countries outside the UAE.
• Certificate registry: the certificate ID you enter is sent to the registry service that holds EKPharm certificate records, which returns the status, course, score and completion date.
• No one else. I do not sell personal data, and the site does not use advertising networks, third-party analytics or social media scripts.

5. Cookies and browser storage

This site sets no cookies for visitors, except the technical cookies Cloudflare may set for the bot check on pages with the introduction form.

The site stores nothing in your browser's local storage or cookies.

The only cookie involved is the sign-in cookie that Cloudflare sets for me when I sign in to the administration area.

6. How long data is kept

| Data | Kept for |

|---|---|

| Anonymous visit events | 395 days, then deleted automatically |

| Introduction details | 730 days, then deleted automatically, or earlier if you ask |

| Linked activity | Deleted together with the introduction it belongs to |

| Messages | Until the enquiry is closed, then no longer than 12 months, unless the law requires otherwise |

| Certificate records in the registry | For as long as the certificate is valid, so that it can be verified |

| Rate-limit counters | 10 minutes, then deleted automatically |

7. Your rights

You can ask me to:

• tell you what personal data I hold about you;
• correct it;
• delete it;
• restrict or object to its use;
• give it to you in a portable form;
• withdraw your consent.

Send your request to [email protected]. I will respond to your request. For introductions, I can also delete a person directly.

8. Security

The site uses HTTPS, avoids storing secrets in browser code, limits how often certificate checks can be made, applies strict server-side checks to all submissions, and protects the administration area with a sign-in that requires a second factor. The site loads no third-party scripts.

9. Children

The site is not directed at people under 18. I do not knowingly collect their personal data. If you believe a child has sent me personal data, contact me and I will delete it.

10. Changes to this policy

I may update this policy. The date at the top shows when it was last changed.