Privacy Policy

1. Introduction & Who We Are

This Privacy Policy explains how Menataur FZ-LLC (“Menataur,” “we,” “us,” or “our”), the operator of the “Business Strategy as Code” consultancy and advisory programme and the website strategyascode.org (together, the “Service”), collects, uses, discloses, and protects personal data belonging to visitors, prospective participants, and participants (“you”).

Menataur FZ-LLC is the data controller responsible for the personal data described in this Policy. We are a Free Zone company registered with the Ras Al Khaimah Economic Zone (RAKEZ), with our registered address at RAKEZ Compass Coworking Centre, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates. You can reach us at any time using the contact details in Section 13 below.

Our participants and website visitors are located around the world, including the European Union, European Economic Area, and United Kingdom (where the General Data Protection Regulation, “GDPR,” applies) and the United Arab Emirates (where Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, the “UAE PDPL,” applies). This Policy is designed to meet the requirements of both frameworks, and of other applicable data protection laws.

2. Information We Collect

We collect the following categories of personal data:

• Information you submit through our “Request a Call” form: your name, phone number, email address, and any optional message you include. This information is transmitted to us through our website and delivered to us as a notification via Telegram, a messaging service operated by Telegram Messenger Inc. (“Telegram”), so that we can respond to your enquiry.
• Registration and payment information: when checkout is enabled and you join the programme, we collect the information necessary to process your registration (such as your name and email address) and, where card payment is used, payment is processed directly by our payment processor, Stripe. We do not store your full card details on our own systems — Stripe handles this in accordance with its own security standards and privacy policy.
• Scheduling information: where used, session or call scheduling is handled through Calendly, which may collect your name, email address, and time-zone information to arrange bookings.
• Technical and usage data: our hosting provider (Netlify) automatically processes technical data (such as IP address and request logs) necessary to serve web pages to you. Separately, every page loads Google Analytics 4 (“GA4”). If you click “Accept analytics” on our cookie banner, GA4 collects information such as browser type, device type, pages visited, and general usage patterns to help us understand how visitors use the Service. If you do not, GA4 sets no cookies and sends Google only a limited, cookieless signal for each page view. See Section 5 for details, including how to reject analytics.
• Correspondence: if you email us, message us, or otherwise communicate with us directly, we keep a record of that correspondence, including your contact details and the content of the communication.

Design-partner applications and the agent waitlist

Two further forms on the website collect personal data: the design-partner application form and the sign-up form for the agent waitlist. This part of the Policy applies to them in addition to the rest of the Policy.

Design-partner application.

• What we collect: the details you enter: your name, work email address, company, role, the size band of your company, a description of the strategy decision or problem you want to work on, and your confirmation that you understand the pilot is paid. If you choose to add them: your company’s website, country, telephone number, when you would want to start, and how you heard about us. When you submit the form it also records the page you applied from, your language setting, the last page or file you viewed on the site, a short reference code and, if you arrived through a tagged link, the campaign and source details of that link.
• Why we use it: to assess your application and reply to you; to arrange a call; if a pilot goes ahead, to agree its scope and run it; to prevent spam; and to understand which channels bring applications. Our legal bases (Section 4) are taking steps at your request before entering into a contract, and our legitimate interests in running and securing the Service.
• Where it goes: the application is delivered to us as a notification via Telegram (see Section 6), in the same way as the “Request a Call” form. It is not added to any email list and no automatic confirmation email is sent. We reply to you personally, by email or telephone.
• How long we keep it: an application that does not lead to a pilot is retained for a reasonable period to allow follow-up and is then deleted or anonymised. If a pilot goes ahead, records of the agreement and of payments are retained for as long as applicable tax and accounting law requires (Section 8).
• Your browser: to flag a repeat submission, your browser stores a marker made of a one-way hash of your email address and a time stamp. The hash stays on your device; only the fact that a submission is a repeat is sent to us.

Agent waitlist.

• What we collect: your email address and, if you choose to add them, your name, role and company. The form also records the page you signed up from and, if you arrived through a tagged link, the campaign and source details of that link.
• Why we use it: to write to you about the BSaC_ agent, including when it opens. No date is promised. Our legal basis (Section 4) is your consent, which you give by signing up and can withdraw at any time. Every email carries an unsubscribe link, and you can also ask us to remove you.
• Where it goes: to Kit, our email service provider, where your address is added to our list with a tag that identifies the agent waitlist, and to us as a notification via Telegram (see Section 6). People on the agent waitlist are emailed only about the agent.
• How long we keep it: waitlist details are retained for as long as necessary to fulfil the purpose above and are then deleted or anonymised (Section 8).
• Your browser: after you sign up, your browser stores a flag on your device so that the form can show that you have already joined. The flag is not sent to us.

You have the rights described in Section 9 in respect of this data. To exercise them, contact us using the details in Section 13.

3. How We Use Your Information

We use the personal data described above for the following purposes:

• To respond to enquiries submitted through the “Request a Call” form and to follow up with prospective participants.
• To process your registration, manage payments and installment plans, and administer your participation in a cohort.
• To schedule calls or sessions, and to send confirmations, reminders, and related communications.
• To deliver the programme itself, including session materials, recordings (where applicable), and access to the CODE-REGISTRY and other programme resources.
• To communicate with you about your registration, respond to support requests, and provide customer service.
• To maintain, secure, and improve our website and the Service, including diagnosing technical issues.
• To understand, in aggregate, how visitors use our website, if and when analytics are enabled.
• To comply with our legal, tax, and accounting obligations.
• To detect, prevent, and address fraud, unauthorised access, or other misuse of the Service.

4. Legal Bases for Processing (GDPR)

Where the GDPR applies to our processing of your personal data, we rely on the following legal bases:

• Performance of a contract: to process your registration, take payment, and deliver the programme you have purchased or are in the process of purchasing.
• Consent: where we ask for your explicit agreement, for example before enabling optional analytics or marketing communications; you may withdraw consent at any time.
• Legitimate interests: to respond to enquiries, operate and secure our website, improve the Service, and communicate with prospective and existing participants, provided these interests are not overridden by your own rights and freedoms.
• Legal obligation: where we must retain or disclose information to comply with tax, accounting, or other applicable law.

5. Cookies & Tracking Technologies

By default, our website sets only the essential, strictly necessary cookies and storage it needs to function. Analytics cookies are set only after you actively consent to them.

When you visit the site, a cookie banner asks you to “Accept analytics” or “Reject analytics.” Every page loads Google Analytics 4 (“GA4”). If you click Accept analytics, GA4 helps us understand, in aggregate, how visitors use our website (for example, which pages are viewed and how). If you click Reject analytics, or take no action, no analytics cookies are set and no identifier is stored on your device. GA4 then sends Google only a cookieless signal for each page view (for example, the time, the page address and basic information about your browser). This choice is implemented using Google’s Consent Mode: analytics storage defaults to “denied” for every visitor and is only switched to “granted” after you click Accept analytics.

After you click Accept analytics, GA4 sets the following cookies on your device:

• _ga — distinguishes visitors; expires after up to 2 years.
• _ga_31QPF05X96 — persists GA4 session state for this property; expires after up to 2 years.

GA4 is provided by Google (for visitors in the UK or EEA, by Google Ireland Limited), which acts as our processor for this data under its own data processing terms. We do not enable Google’s advertising features (such as ad personalisation or remarketing) in GA4, and Google’s ad_storage, ad_user_data, and ad_personalization signals remain permanently denied for every visitor regardless of your analytics choice — we do not use GA4, or any other tool, for advertising. Consistent with our GA4 configuration, IP addresses are not logged or stored by GA4 in connection with your visit.

Because Google and its sub-processors operate globally, data collected by GA4 may be transferred to, and processed in, countries outside the UK and EEA, including the United States. Where this occurs, it is carried out under Google’s Standard Contractual Clauses or equivalent safeguards recognised under the GDPR and UK data protection law.

Withdrawing consent: your choice is stored in your browser. To withdraw consent after clicking Accept analytics, use the “Cookie settings” link in the footer at any time to reopen the banner and click Reject analytics. Alternatively, you can clear this site’s data in your browser (in most browsers: site settings/permissions → Cookies and site data → remove strategyascode.org) and reload the page, which has the same effect. You can also control or delete cookies generally at any time through your browser settings.

For more information about how Google handles data, see Google’s Privacy Policy. You can also install the Google Analytics Opt-out Browser Add-on to prevent GA4 from collecting your data on any site that uses it.

6. Third Parties We Share Data With

We do not sell your personal data. We share personal data only with service providers (“processors”) who process it on our behalf and under our instructions, strictly to operate the Service:

• Telegram: receives and relays to us, as a notification, the information you submit through our “Request a Call” form, our design-partner application form and our agent waitlist form, so that we can contact you.
• Kit: our email service provider. When you join a waitlist, it receives your email address and, if you provide them, your name, role and company, so that we can email you about that waitlist and so that you can unsubscribe.
• Stripe: processes payment and billing information when checkout is enabled; Stripe acts as an independent controller for certain payment-related data under its own privacy policy.
• Calendly: processes scheduling information when used to book calls or sessions.
• Netlify: hosts our website and processes technical data necessary to serve web pages to you.
• Google (Google Analytics 4): Google processes website usage data on our behalf as described in Section 5: full usage data if you click Accept analytics on our cookie banner, and otherwise only the cookieless page-view signal described there.

We may also disclose personal data where required to comply with applicable law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Menataur, our participants, or others.

7. International Data Transfers

Menataur FZ-LLC is based in the United Arab Emirates, and the service providers listed in Section 6 may process personal data in the UAE, the United States, the European Union, and other countries in which they or their sub-processors operate. This means your personal data may be transferred to, stored, and processed in countries outside your own, including outside the European Economic Area and the United Kingdom.

Where we transfer personal data originating in the EEA or UK to a country that has not been recognised as providing an adequate level of data protection, we rely on appropriate safeguards, such as Standard Contractual Clauses or equivalent mechanisms offered by our service providers, to ensure your data continues to be protected in accordance with this Policy and applicable law.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, including to deliver the programme you joined, respond to your enquiries, satisfy our legal, tax, and accounting obligations, and resolve any disputes. Enquiry and lead information from the “Request a Call” form that does not lead to registration is retained for a reasonable period to allow follow-up and is then deleted or anonymized. Registration and payment records are retained for as long as required by applicable tax and accounting law. When personal data is no longer needed, we delete or anonymize it.

9. Your Rights

If the GDPR applies to you, you have the right to:

• Access the personal data we hold about you;
• Request rectification of inaccurate or incomplete data;
• Request erasure of your personal data, subject to certain exceptions;
• Request restriction of processing in certain circumstances;
• Receive your data in a structured, commonly used, machine-readable format and have it transmitted to another controller (data portability);
• Object to processing carried out on the basis of legitimate interests;
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal; and
• Lodge a complaint with your local data protection supervisory authority.

If the UAE PDPL applies to you, you have broadly equivalent rights, including the right to be informed of and object to the processing of your personal data, the right to obtain and access your personal data, the right to correct or erase inaccurate data, and the right to restrict or stop processing in certain circumstances.

To exercise any of these rights, please contact us using the details in Section 13. We will respond to verified requests within the timeframe required by applicable law.

10. Security

We take reasonable technical and organisational measures designed to protect your personal data against unauthorised access, loss, misuse, or alteration, including relying on reputable service providers (such as Stripe, Netlify, Calendly, and Meta) that maintain their own industry-standard security practices. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

11. Children

The Service is intended for business professionals and is not directed to, nor knowingly used by, anyone under the age of 18. We do not knowingly collect personal data from individuals under 18. If you believe a child has provided us with personal data, please contact us so that we can delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. We will post the updated Policy on this page with a revised “Last updated” date. We encourage you to review this Policy periodically.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: