Privacy & Data Protection Policy

Effective Date: 4 September 2026

1. Controller

The Golden Path L.L.C-FZ is the controller of personal information where it determines why and how that information is processed.

2. Scope and Applicable Laws

This Policy applies to personal information processed through our website, booking and payment processes, client portal, communications, sessions, events, retreats, digital programs and related Services.

Depending on your location and the circumstances, applicable privacy laws may include UAE data-protection law, the EU General Data Protection Regulation (“EU GDPR”), the UK GDPR and Data Protection Act 2018, and applicable U.S. federal and state privacy laws, including consumer-health-data laws where applicable.

References to particular laws do not mean that every law applies to every processing activity or every Client.

3. Personal Information We May Collect

• Identity and contact information: name, email address, telephone number, country and similar contact details.
• Account and booking information: bookings, appointments, programs purchased, attendance and client-account information.
• Transaction information: payment status, invoices, transaction identifiers, billing information and limited payment-related information.
• Communications: emails, messages, support requests, feedback and other communications with us.
• Session and service information: information you choose to provide in connection with coaching, mentoring, wellbeing, personal-development or other Services, including session notes and integration information.
• Sensitive, special-category or health-related information: during a Service you may voluntarily disclose information concerning physical health, emotional wellbeing, psychological experiences, symptoms, relationships or other sensitive matters. We do not use this information to diagnose or provide medical treatment.
• Recordings and transcripts: if you separately consent, we may process audio, video, transcripts, summaries or similar material from a session.
• Technical information: IP address, browser type, device information, security logs and website interaction information.
• Marketing preferences: subscriptions, consent records and communication preferences.

4. Sources of Information

We primarily collect information directly from you. We may also receive limited information from booking and scheduling platforms, payment processors, website and client-platform providers, service providers acting on our behalf, or another person whom you have authorized.

We do not purchase sensitive personal information or consumer health data from data brokers.

5. Why We Process Personal Information

• to provide and administer Services you request;
• to manage bookings, accounts, payments and customer support;
• to communicate with you concerning your Services;
• to provide client materials and, where separately agreed, recordings or summaries;
• to maintain security and integrity of systems;
• to prevent fraud or misuse;
• to comply with tax, accounting, legal and regulatory obligations;
• to establish, exercise or defend legal claims;
• to improve Services using appropriately minimized or aggregated information; and
• to send optional marketing communications where legally permitted.

6. Legal Bases for EU/EEA and UK Individuals

Where EU GDPR or UK GDPR applies, we rely on an appropriate legal basis for each processing purpose. These may include contract, legal obligation, legitimate interests and consent.

Where we rely on consent, you may withdraw it at any time with future effect.

7. Sensitive and Health-Related Information

Information concerning health may constitute special-category personal data under EU or UK data-protection law and may constitute consumer health data under certain U.S. laws.

Where EU GDPR or UK GDPR applies and we intentionally process health or other special-category information supplied by you, we will identify both an appropriate Article 6 legal basis and an applicable Article 9 condition.

Where explicit consent is the relevant condition, it will be requested through a clear affirmative statement separate from unrelated consent requests.

You are not required to provide health information that is unnecessary for the Service. We do not diagnose medical or psychological conditions from your data.

8. Session Recording, Transcription and AI-Assisted Tools

Sessions are not automatically recorded merely because you accept our general Terms.

Where recording, transcription or an AI-assisted meeting tool is offered, we obtain separate affirmative consent where required.

Depending on the Service and your consent, such processing may involve transferring session content to a service provider for the limited purpose disclosed to you.

We do not use identifiable session recordings or transcripts for public marketing, testimonials or advertising without separate permission.

9. Service Providers and Recipients

Depending on the Service, we may use:

• Kajabi — website, client portal, digital products, forms, checkout and email infrastructure.
• Stripe and PayPal — payment processing.
• Zoom and/or Riverside — online communication and session delivery where used.
• Calendly or equivalent scheduling services — appointment scheduling where used.
• Google Workspace / Google Drive — business communications and business storage where used.
• Read.ai, Otter.ai or equivalent transcription or meeting-assistance services — only where such functionality is used and appropriate consent has been obtained.

We may also disclose limited information to professional advisers such as accountants, lawyers, insurers and compliance advisers where necessary, or to competent authorities where legally required.

10. Sale of Personal Information and Advertising

We do not intentionally sell personal information or consumer health data for monetary consideration. We do not sell session content, recordings or transcripts. We do not use sensitive or consumer health data for behavioural advertising.

11. Cookies and Similar Technologies

Our website and technology providers may use cookies or similar technologies for functions such as security, authentication, preferences, checkout, analytics and embedded content.

Strictly necessary technologies may operate without consent where permitted by law. Where EU, EEA or UK law requires consent for non-essential cookies or similar technologies, those technologies should not be activated until appropriate consent has been obtained.

You can manage available choices through the cookie-consent mechanism provided on the website.

12. Marketing Communications

Where required by law, marketing emails or similar electronic communications are sent only with appropriate consent. You may unsubscribe at any time using the unsubscribe function or by contacting us.

Transactional or service-related communications may still be sent where necessary to provide a Service you requested.

13. International Data Transfers

The Golden Path is established in the United Arab Emirates and uses technology providers that may operate internationally.

Your information may therefore be processed in the UAE, United States, European Economic Area, United Kingdom or other countries in which our authorized providers operate.

Where EU GDPR applies to a restricted international transfer and no adequacy decision applies, we use an appropriate transfer mechanism where required, such as the European Commission Standard Contractual Clauses, together with supplementary safeguards where appropriate.

Where UK GDPR applies, appropriate safeguards may include the UK International Data Transfer Agreement, the UK Addendum to approved EU Standard Contractual Clauses, applicable UK adequacy regulations or another lawful mechanism.

Transfers are also handled in accordance with applicable UAE data-transfer requirements.

14. Retention

• Client, booking and core contractual records: generally for the duration of the relationship and up to six years afterwards where reasonably necessary.
• Financial and tax records: for the period required under applicable tax and accounting laws.
• Session notes and integration information: no longer than reasonably necessary for the client relationship and related legal obligations.
• Recordings and transcripts: generally up to 12 months after the relevant Service unless a different period is agreed, earlier deletion is requested and legally possible, or longer retention is reasonably required.
• Technical and security logs: generally up to 12 months unless longer retention is reasonably necessary.

15. Security

We use reasonable administrative, organizational and technical safeguards appropriate to the nature of the information processed. Measures may include access controls, multifactor authentication, encryption where appropriate, confidentiality requirements, data minimization and vendor review.

No internet-based system can be guaranteed to be completely secure.

16. Data Breaches

We maintain procedures for identifying and responding to suspected personal-data breaches. Where applicable law requires notification to an individual, regulator or authority, we will provide that notification in accordance with the applicable legal requirements.

17. Your Privacy Rights

Depending on applicable law, you may have rights to access, correct, delete, restrict or object to certain processing, receive portable data, withdraw consent, opt out of certain uses, request information about recipients, or complain to an applicable authority.

EU/EEA individuals may lodge a complaint with the competent supervisory authority in their country. UK individuals may complain to the UK Information Commissioner’s Office. UAE and U.S. individuals may exercise rights available under applicable local law.

Requests may be sent to [email protected]. We may take reasonable steps to verify your identity before acting on a request.

18. U.S. Consumer Health Data

Residents of jurisdictions with specific consumer-health-data laws may have additional rights concerning health-related information.

Where applicable, our separate U.S. Consumer Health Data Privacy Notice forms part of our privacy disclosures and should be linked prominently from our website.

19. California and Other U.S. State Privacy Rights

Where a U.S. state privacy law applies to us, residents of that state may exercise the rights provided by that law.

We do not represent that a particular U.S. state privacy statute applies to every transaction merely because an individual lives in that state. Where a statutory threshold or exemption determines applicability, we apply the law as required.

We will not unlawfully discriminate against you for exercising an applicable privacy right.

20. Children

Our Services are intended for adults aged 18 or older. We do not knowingly provide Services to children or intentionally collect personal information from children through our client Services.

21. Automated Decision-Making

We do not use solely automated decision-making that produces legal or similarly significant effects concerning Clients based on session content or sensitive personal information.

22. EU/EEA and UK Privacy Contact

The Golden Path L.L.C-FZ is established in Dubai, United Arab Emirates.

For all privacy, data-protection and consumer-rights inquiries, including requests from individuals in the European Union, European Economic Area and United Kingdom, contact us directly at [email protected].

Where applicable law requires The Golden Path L.L.C-FZ to appoint a representative in the European Union, European Economic Area or United Kingdom, the representative’s details will be published in this Privacy Policy once formally appointed.

23. Policy Changes

We may update this Policy to reflect changes in law, technology, vendors or our Services. The current Policy will be published on our website with its effective date.

Where legally required, material changes will be communicated directly or additional consent will be obtained before new processing begins.

24. Contact

The Golden Path L.L.C-FZ
License No. 2538330.01
Meydan Grandstand, 6th Floor
Meydan Road, Nad Al Sheba
Dubai, United Arab Emirates
Privacy Contact: [email protected]