Privacy Policy

Section 01

Introduction & Scope

Arslan Larik & Company (AL&CO) operates from Karachi, Pakistan, with activities in Dubai, UAE. This Privacy Policy applies to all personal data collected through our website, registration processes, online platform, and the delivery of our services.

This Policy is established in compliance with the Prevention of Electronic Crimes Act (PECA), 2016, the Electronic Transactions Ordinance 2002, and is aligned with internationally recognized data protection standards including the General Data Protection Regulation (GDPR) where applicable.

By using our website or registering for any AL&CO service, you consent to the data practices described in this policy.

Section 02

Information We Collect

We collect only the personal information necessary for the purposes outlined in this policy:

We do not collect sensitive categories of data — such as national identity numbers, health information, or financial account credentials — unless explicitly required and separately consented to.

Section 03

How We Use Your Information

We process personal data only for specified, lawful purposes. These include:

• —Creating and managing participant accounts and program access
• —Processing enrollments, payments, and issuing certificates
• —Communicating program updates, schedules, and account-related notices
• —Sending promotional or informational communications, where you have provided consent
• —Improving the quality of our services and website through analytics
• —Complying with legal, regulatory, and accreditation obligations
• —Preventing unauthorized access, fraud, or misuse of our services

Section 04

Legal Basis for Processing

• —Contractual Necessity: To fulfill our obligations under the enrollment agreement
• —Legal Compliance: To comply with applicable laws and regulatory requirements
• —Legitimate Interests: To operate, improve, and protect our services
• —Consent: For marketing communications and optional data uses, where freely given and withdrawable at any time

Section 05

Sharing of Personal Data

AL&CO does not sell personal data. We share data only in the following limited circumstances:

• —Accreditation Bodies: ABNLP, ICF, American Board of Hypnotherapy, and similar — for certificate verification and issuance
• —Payment Processors: Licensed gateways for secure transaction processing
• —Technology Service Providers: Platform and communication tool providers acting as data processors under written agreements
• —Legal Obligations: Where disclosure is required by law, court order, or competent government authority

All third-party service providers are contractually bound to handle data securely and use it only for specified, agreed purposes.

Section 06

Cookies & Tracking Technologies

Our website uses cookies and similar tracking technologies to improve user experience and gather usage data:

• —Essential Cookies: Required for the website to function (e.g., session management, security). These cannot be disabled
• —Analytics Cookies: Used to understand how visitors interact with our website (e.g., Google Analytics). Data is aggregated and anonymized
• —Marketing Cookies: Used to deliver relevant advertising, only activated with your explicit consent

You may manage or disable non-essential cookies through your browser settings or our cookie consent tool at any time.

Section 07

Data Retention

• —Active participant records: retained for the duration of participation plus 2 years
• —Enrollment and certificate records: retained for 7 years in accordance with recordkeeping obligations
• —Payment records: retained for 5 years as required by financial regulations
• —Marketing data: retained until consent is withdrawn or the participant opts out
• —Inactive accounts (no activity for 3+ years): data is anonymized or securely deleted

Section 08

Your Data Rights

You have the following rights regarding your personal data held by AL&CO, exercisable by submitting a written request to connect@arslanlarik.com:

We will respond to all requests within 30 days. Requests that are manifestly unfounded or excessive may be subject to a reasonable administrative fee.

Section 09

Data Security

AL&CO implements appropriate technical and organizational measures to protect personal data:

• —SSL/TLS encryption for all data transmitted via our website and digital platform
• —Passwords stored using industry-standard secure hashing; never stored in plain text
• —Access to personal data restricted to authorized personnel on a need-to-know basis
• —Regular security assessments and platform updates
• —Staff trained on data protection responsibilities

In the event of a data breach that poses a risk to individuals, AL&CO will notify affected parties and relevant authorities in accordance with applicable legal requirements.

Section 10

International Data Transfers

Where personal data is transferred outside of Pakistan (e.g., to service providers or accreditation bodies in other jurisdictions), AL&CO ensures appropriate safeguards are in place, including contractual data protection clauses consistent with recognized international standards.

Section 11

Policy Updates

AL&CO may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material updates will be communicated via email or a prominent notice on our website, along with a revised effective date. Continued use of our services following notification of changes constitutes acceptance of the updated policy.

Section 12

ALCO CRM & QuickBooks Online Integration

AL&CO operates an internal business system, ALCO CRM, used only by AL&CO staff. It is not available to the public, to students, or to any third party.

ALCO CRM connects to AL&CO's own QuickBooks Online company file to read financial and customer information, so that AL&CO staff can manage enrolments, invoicing, instalment plans, and receivables in one place.

What information is accessed from QuickBooks Online

• —Customer records: name, email address, telephone number, billing address
• —Sales records: invoices, invoice line items, programme or product purchased, amounts, dates, and discounts applied
• —Payment records: payments received, dates, amounts, and the account they were received into
• —Balances: amounts outstanding, ageing, and instalment position
• —Supplier records and purchase records, where relevant to cost reporting
• —Chart of accounts and product or service definitions, as reference data

ALCO CRM does not access, and does not require, bank login credentials, card numbers, or any payment instrument details.

Whether the information is stored

Yes. ALCO CRM keeps its own copy of the information listed above. A copy is stored so that reporting is fast, so that historical positions can be compared, and so that the system continues to function if the QuickBooks Online connection is temporarily unavailable.

Where it is held and who can see it

The system is hosted on infrastructure operated by Quantris Technologies, AL&CO's software house, under the direction of AL&CO. Access is restricted to named AL&CO staff who need it to perform their role. Access is granted individually, is recorded, and is removed when a person's role changes or they leave.

How it is protected

• —Access requires an individual login. Accounts are not shared.
• —Data is transmitted over encrypted (TLS/SSL) connections.
• —Access is limited to the minimum necessary for each role.
• —Access is reviewed when roles change.

How long it is kept

Information from ALCO CRM is retained for as long as needed for accounting and business record-keeping purposes — 6 years, in line with standard record-keeping practice in Pakistan.

If the QuickBooks Online connection is ended

If AL&CO disconnects ALCO CRM from QuickBooks Online, the connection is revoked immediately and no further data is read. Data already stored is deleted within 30 days, except where AL&CO is legally required to retain business records.

Sharing

In addition to the parties listed in Section 05, ALCO CRM data is shared only with Intuit, as the operator of QuickBooks Online and the source of the data, and with Quantris Technologies, as the hosting and technical provider acting on AL&CO's instructions.

Requests to access, correct, or delete information held in ALCO CRM follow the same process as Section 08 of this policy — write to connect@arslanlarik.com, and AL&CO will respond within 30 days.