Legal
Privacy Policy
Effective date: 14 October 2026 · Last updated: 14 October 2026
1. Who we are
The Institute of Strategic People Operations (“The Institute,” “we,” “us,” or “our”) operates this website (the “Site”). We are a Qatar Financial Centre (QFC) entity based in Doha, Qatar. This policy explains what personal data we collect through the Site, why we collect it, and the choices you have.
Where you are located in the European Economic Area (EEA) or the United Kingdom, this policy is also intended to meet our obligations to you as a data controller under the GDPR (and, where applicable, the UK GDPR). We do not currently have an EEA/UK representative appointed under Article 27 GDPR / Article 27 UK GDPR, as we do not regularly offer programmes to, or monitor the behaviour of, individuals in those regions; we will appoint one if that changes.
We have not appointed a Data Protection Officer, as one is not currently required for our size and type of processing. Any privacy queries should be directed to the contact in Section 12 below.
2. What we collect
We collect personal data in the following ways:
- Enquiries by email. When you email our admissions team, we receive your email address, your name if it appears in your message, and anything else you choose to include.
- Register Your Interest form. When you use this form, we collect your full name, email address, phone number (including country code), country, LinkedIn profile link, current role or title, and organisation.
- Prospectus and programme overviews. Downloading or viewing the prospectus or a programme overview does not require you to give us any personal data.
- Automatically collected data. Like most websites, our hosting and any analytics tools we use may automatically log technical information such as your IP address, browser type, device type, and pages visited.
- Third-party fonts. This Site loads typefaces from Google Fonts, which involves your browser making a request to Google’s servers and sharing your IP address as part of that request.
We do not knowingly collect sensitive personal data (such as health, religious, or biometric information) through this Site, and we ask that you not include such information in the message field of any form.
3. Cookies and similar technologies
This Site uses a small amount of local storage rather than traditional tracking cookies:
- Cookie preference (strictly necessary). When you choose “Accept” or “Necessary only” on the cookie notice, we store that choice in your browser’s local storage so the notice does not reappear on your next visit. This does not identify you personally and is not shared with us or any third party. As this storage is strictly necessary to remember your preference, it does not require consent.
- Third-party fonts (requires your consent). This Site can load typefaces from Google Fonts, which involves your browser requesting them from Google’s servers and sharing your IP address as part of that request. We only load these fonts if you select “Accept” on the cookie notice; if you select “Necessary only,” the Site displays using standard system fonts instead. You can change your choice at any time using the “Cookie Preferences” link in the footer.
- Analytics (if enabled). If we add analytics tools in future to understand how the Site is used, they may set cookies to distinguish visitors and sessions, and we will only do so with your consent via an updated cookie notice. We will update this policy if and when that happens.
You can control or delete local storage and cookies through your browser settings at any time. Doing so may cause the cookie notice to reappear and may affect how some parts of the Site display.
4. How we use your data
We use the personal data we collect to:
- Respond to enquiries sent to our admissions email address;
- Follow up on your interest registration, including sending information about programmes, fees, intake dates and the admissions process;
- Maintain records of communications with prospective participants, Fellows, and partner organisations;
- Improve the Site and understand how it is used; and
- Meet legal, regulatory, or administrative obligations.
We do not sell personal data, and we do not use it for automated decision-making that produces legal or similarly significant effects on you.
5. Legal basis for processing
Where the GDPR or other applicable law requires a legal basis for processing, we rely on one or more of the following:
- Consent (Article 6(1)(a) GDPR): for example, when you tick the consent box on the Register Your Interest form or agree to receive marketing communications from us. You can withdraw consent at any time; see Section 9 below.
- Contract (Article 6(1)(b) GDPR): where processing is necessary to take steps you request before entering into a contract, or to perform a contract with you, such as processing a programme application or enrolment.
- Legitimate interests (Article 6(1)(f) GDPR): for example, responding to enquiries, keeping the Site secure, and understanding how it is used, provided these interests are not overridden by your own rights and freedoms.
- Legal obligation (Article 6(1)(c) GDPR): where we need to process data to comply with a legal or regulatory requirement.
We do not process any special category data (as defined in Article 9 GDPR) through this Site; see Section 2 above.
6. Who we share data with
We may share personal data with service providers who help us run the Site and our operations, such as our CRM provider (Zoho), email and hosting providers, and IT support. These providers are only permitted to use your data to provide services to us. We may also disclose personal data if required to do so by law, or to protect the rights, property, or safety of the Institute, our students, or others.
We do not otherwise share, rent, or sell personal data to third parties for their own marketing purposes.
7. Data retention
In line with the storage limitation principle under Article 5(1)(e) GDPR, we keep personal data only for as long as it is needed for the purpose we collected it for. When that period ends, we delete or anonymise the data. We use the following periods:
- Enquiries and interest registrations that do not lead to enrolment: up to 12 months from our last contact with you.
- Admissions and enrolment records for people who join a programme: for 6 years after the programme ends, so that we can manage our relationship with participants and deal with any claims or complaints.
- Credential records: if you earn a credential from the Institute, we keep the minimum record needed to verify it (your name, the award and its date) for as long as the credential is recognised.
- Marketing communications: until you withdraw your consent or ask us to stop.
- Legal, tax or regulatory records: for as long as the applicable law requires.
- Technical logs: held by our hosting and technology providers for the short periods set in their own systems.
You can ask us to delete your data sooner by contacting us using the details in Section 12, subject to the rights and exceptions described in Section 9.
8. International transfers
Some of the service providers we use may store or process data outside Qatar, including, for visitors in the EEA or UK, outside those regions. Where this happens, we take reasonable steps to ensure your data continues to receive an appropriate level of protection, consistent with Qatar’s Personal Data Privacy Protection Law. Where we transfer personal data protected by the GDPR or UK GDPR to a country that has not been recognised as providing an adequate level of protection, we put appropriate safeguards in place, such as the European Commission’s Standard Contractual Clauses (or the UK International Data Transfer Addendum), before the transfer takes place. You can request more information about these safeguards by contacting us using the details in Section 12.
9. Your rights
Depending on where you are located, you may have the right to:
- Access: ask us to confirm what personal data we hold about you and provide a copy of it;
- Rectification: ask us to correct inaccurate or incomplete data;
- Erasure: ask us to delete your personal data, where one of the grounds under Article 17 GDPR applies;
- Restriction: ask us to restrict how we use your data in certain circumstances;
- Object: object to processing based on our legitimate interests, or to any direct marketing, at any time;
- Data portability: where processing is based on consent or contract and carried out by automated means, ask us to provide your data in a structured, commonly used, machine-readable format, or to transmit it to another controller;
- Withdraw consent: withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal; and
- Lodge a complaint: with the relevant data protection authority. If you are in the EEA or UK, this is the supervisory authority in your place of residence, place of work, or the place of the alleged infringement, for example the UK Information Commissioner’s Office (ico.org.uk).
We do not use your personal data for any automated decision-making, including profiling, that produces legal or similarly significant effects on you.
To exercise any of these rights, contact us using the details in Section 12 below. We aim to respond within one month, as required by Article 12 GDPR, and will not charge a fee unless your request is manifestly unfounded, excessive, or repetitive.
10. Data security
We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. Children’s privacy
This Site and our programmes are intended for working professionals and are not directed at children. We do not knowingly collect personal data from anyone under the age of 18.
12. Contact us
If you have questions about this policy or wish to exercise your rights, contact us at admissions@theispo.com.
13. Changes to this policy
We may update this policy from time to time to reflect changes in our practices or for legal or operational reasons. We will update the “Last updated” date at the top of this page when we do.
14. Governing law
This policy is governed by the laws of the State of Qatar, including the Personal Data Privacy Protection Law (Law No. 13 of 2016), without prejudice to any additional rights you may have under the law of your own country of residence. Nothing in this policy limits any rights you have as a matter of mandatory law, including your rights under the GDPR or UK GDPR if you are located in the EEA or UK.