Privacy Policy

Last updated October 2024

This policy explains:

• who we are
• why we collect personal data
• what kinds of personal data we collect 
• where we get it from
• how we use it;
• direct marketing;
• who we might share it with;
• how we store and secure it; 
• how long we keep it; 
• your rights; and
• how to complain about our use of personal data.

WHO WE ARE

ALX Holdings Limited (“ALX”, “we”, “us”) is a company registered in Mauritius.

Business registration number: C213364

Registered office address: 5th Floor, The CORE Building, No. 62, ICT Avenue, Cybercity, Ebene,

We act as a ‘controller’ of the personal data on our website (https://www.alx-global.com/), “ALX”, or “ALX Platform”.

WHY WE COLLECT PERSONAL DATA 

ALX is a community of passionate, courageous ‘doers’ where we help the world’s top talent to fulfil their potential. At ALX, young talent receive best-in-class training to prepare, launch and grow their career. Our Privacy Policy applies to any participant of ALX programmes or visitors to the website or applications operated by us. 

This privacy policy applies to all information collected through our website (such as https://www.alx-global.com/), and/or any related services, sales, marketing or events (we refer to them collectively in this Privacy Policy as the “Services”). We detail below the purposes of processing, type of personal data and legal basis for the processing. Our Privacy Policy applies to any learner of ALX or visitor to ALX Platform or applications operated by ALX.

We never sell personal data to anyone for any purpose. We do not give personal data to others for their own use.

We hope you take some time to read through this Privacy Policy carefully, as it is important. If there are any terms in this Privacy Policy that you do not agree with, please discontinue use of our platform and our Services.

HOW WE USE PERSONAL DATA ABOUT YOU

Under the law, we must process your data lawfully, fairly, and transparently. We rely on one of the legal bases below for processing personal data, depending on what the data is and what we use it for:

• our legitimate interests;
• to comply with the law;
• your consent; or
• to perform our contract with you (providing your user account)

Why we process it	Type of personal data	Our legal basis
Providing and managing access to ALX courses (https://www.alx-global.com/), including user support and related communication	Identification details of learners (e.g.  name, area code, country of residence, country of origin, ID/passport, age, date of birth, gender, preferred city hub) Contact details (e-mail, phone number, username) Education and employment data (CVs, diplomas, certifications, field of study, highest level of education, language spoken, employment status, current occupation, profession, technical specialty, ALX courses and progress and status years of paid work experience, soft skills, technical skills, LinkedIn profile) IP address and referral IP addresses and usage data Publicly available personal information (such as maiden name, nickname; current and former address; phone numbers; email addresses; business email; business phone number; information available on the LinkedIn profile (including data available after becoming a learner, such as data on new employment) and other similar data payment data (your payment instrument number (such as a credit card number), and the security code associated with your payment instrument) your other social media account information (e.g.  Meta / Facebook, Instagram, Whatsapp) if you log-in or contact us through these channels your voice and image for inbound inquires, support requests or onboarding video (when recorded)	to perform our contract with you (providing your user account and support)

Why we process it	Type of personal data	Our legal basis
ALX – Programme Recruitment & Selection (recruitment of learners, only top applicants get selected to follow courses) 1. candidates fill in an application assessment to get into ALX courses 2. the candidates are assessed: they are accepted, rejected, or waitlisted.	Identification details of candidates (e.g. name, e-mail, area code, phone number, country of residence, country of origin, ID/passport, age, date of birth, gender, preferred city hub) Education and employment data (CVs, diplomas, certifications, field of study, highest level of education, language spoken, employment status, current occupation, profession, technical specialty, ALX courses and status years of paid work experience, soft skills, technical skills, LinkedIn profile) Publicly available personal information (such as maiden name, nickname; current and former address; phone numbers; email addresses; business email; business phone number; information available on the LinkedIn profile (including data available after becoming a learner, such as data on new employment) and other similar data Application data (the jobs you applied for, hiring status, notifications, employment status, voice and image for online interviews/meetings, technical data (such as timestamp, IP, user usage data) for asynchronous video interview or for calls), Status of application (approved, rejected, on the waitlist)	your consent for entering the selection process and for being waitlisted  or to perform our contract with you for selected members

Why we process it	Type of personal data	Our legal basis
Delivering ALX courses to you and admin & support activities, communication for program activity (e.g. delivering foundations program, software engineering and Intro to SWE program, AWS Program, Salesforce Program, ExploreAI Data Science (DS) & Data Analytics (DA) Programs, activities like assigning pending peer grading, post learner grades, and identifying learner-specific issues) Communication on milestone submission, test submission, peer grading reminder, self-placement survey reminder, drop-offs, and grace period. Tracking learners’ progress Handling inbound inquiries and support request from learners	Identification details of learners (e.g. name, e-mail, area code, phone number, country of residence, country of origin, ID/passport, age, date of birth, gender, preferred city hub) Contact details (e-mail, phone number, username) Learner performance data (such as: course completion, course scores, exam scores, date the exam was taken, milestones, tests, peer grading completion, modules completed, modules started, scores on quizzes, peer review process), track and report daily/weekly learning progress Image and voice on calls, metadata captured for calls	to perform our contract with you
Commercial communication with you (marketing) (e.g. sending commercial communications to learners, extending invitations to masterclasses and workshops, promoting events, newsletters or other commercial information, awarding, presenting initiatives and career opportunities)	Identification details of learners (e.g.  name, address, country of origin, country of residence, age, gender, languages) Contact data (e.g. email, phone number, SMS) Technical skills, employment and education (e.g. work experience, years of experience, CV,  background, career goals, skills, educational history, employment status) LinkedIn account information (work experience), ALX programme, graduation scores and status events attended Data on outreach and deliverability of communications: – advert engagement data (e.g. views, clicks, keywords used, posts engaged with, sentiment reports, impression count)  – Website Conversion Actions (e.g. form fills, link clicks) and user traffic source.  – browsing patterns (e.g. , device type, operation system, number of sessions, pages viewed, time spent on website, link engagement, bounce rate)	Our legitimate interest for  direct marketing of our services or other products to existing learners Consent for direct marketing to other individuals

Why we process it	Type of personal data	Our legal basis
Use of co-working spaces (hubs)	Identification details of learners (e.g.  name, address, country of origin, country of residence, age, gender) Contact data (e.g. email, phone number)  Education and employment data (CVs, language spoken, employment status, profession, technical specialty, years of paid work experience, LinkedIn profile) Data collected when attending the hub (e.g. image, audio, booking and attendance data)	to perform our contract with you and for our legitimate interests
Organising marketing events and webinars	Identification details of participants (e.g.  name, address, country of origin, country of residence, age, gender)   Contact data (e.g. email, phone number, ALX Platform) and communication via social media (e.g. Telegram, WhatsApp, Instagram, or Facebook/Meta, Tiktok, LinkedIn)   Education and employment data (CVs, language spoken, employment status, profession, technical specialty, years of paid work experience, LinkedIn profile) Image (for marketing of events; photos/videos) IP (for webinars), user logs (e.g. for email communications, for webinars, marketing insights)	our legitimate interest for  growing ALX community (for existing learners) and your consent for new participants/leads

Why we process it	Type of personal data	Our legal basis
Loyalty and rewards programme for members  (awarding legacy points for increase activity in the ALX community (e.g. events, comments), providing/updating information for the ALX Platform profile, completion of courses provided by us)	Identification details of participants (e.g.  name, address, country of origin, country of residence, age, gender) Data on activity in The ALX Platform’s community (e.g. attending/hosting online/offline events, comments on the platform) Data on ALX Platform profile (e.g. education and employment data (CVs, language spoken, employment status, profession, technical specialty, years of paid work experience, LinkedIn profile)), image and sound (for videos posted) Technical data evidencing the above (such as IP address, location, the browser and platform/device being used, usage metrics for the activity on the platform)	our legitimate interest for growing ALX community
Feedback and Surveys Programme surveys (onboarding and selection, mid-point, end of program) and feedback (e.g. weekly feedback), application & testing feedback, organising focus groups	Identification details of learners (e.g.  name, address, country of origin, country of residence, age, gender, photo) Contact data (email, phone number, google account) Education and employment data (e.g. CVs, language spoken, employment status, profession, job title, technical specialty, years of paid work experience, courses and status, grades, logs of interactions in ALX Platform, LinkedIn profile) Image, voice (for recorded online meetings, including focus groups), metadata for calls Technical data evidencing the above (such as IP address, location, the browser and platform/device being used, usage metrics for the activity on the platform) learners preferences and satisfaction (e.g. needs and pain points throughout the journey)	your consent

Why we process it	Type of personal data	Our legal basis
Data analysis, statistics and reporting (including data analysis for different courses, milestone submission, test submission, peer grading reminder, self-placement survey reminder, drop-offs, and grace period, student behaviour on the ALX platform; also, analysis to identify usage trends, determining the effectiveness of our promotional campaigns and to evaluate and improve our services, products, marketing and your experience, business intelligence, market research)	Identification details of learners (name location, age, date of birth, gender country of origin, municipality  city and country of residence  age, IP Address and referral IP addresses, referral URLs, user activity logs, device type, operating system Contact details (e-mail, area code, phone number, username) Data for analysis of programmes:  courses (pending and finalised), learner performance data (such as: course completion, course scores and grades, exam scores, date the exam was taken, milestones, tests, peer grading completion, modules completed, modules started, scores on quizzes, peer review process), preferred ALX City Hub Education and employment data: CV, highest level of education, field of study, current, employment status, employer name and position in the organisation, number of years of work experience, internships and related data, LinkedIn profile, soft skills, tech skills, students/alumni employment outcomes, financial household earnings ALX Student Portal & Community Platform: community platform engagement data including first login date, most recent login date, time spent on a page, number of posts/comments made, etc. Data on outreach and deliverability of communications: – advert engagement data (e.g. views, clicks, keywords used, posts engaged with, sentiment reports)  – Website Conversion Actions (e.g. form fills, link clicks) and user traffic source.  – browsing patterns (e.g. , device type, operation system, number of sessions, pages viewed, time spent on website, link engagement, bounce rate) – user behaviour (e.g., browsing history, preferences) Data is aggregated for this purpose.	our legitimate interest

Why we process it	Type of personal data	Our legal basis
For our IT operations management, security purposes and to diagnose technical issues	all the personal data we collect for ALX courses	To comply with the law  (securing personal data  from unauthorised access) and for our legitimate interest
Compliance with legal requests from public authorities, with our legal obligations (such as preparation of annual accounts, tax filings and other legal – accounting financial obligations), or for the establishment, exercise, or defence of legal claims	all the personal data we collect for ALX courses	To comply with the law and for our legitimate interest
For reorganisation of our business (such as transfers, mergers, spin-off)	all the personal data we collect for ALX courses	Our legitimate interest
For our internal collaboration and communication	all the personal data we collect for ALX courses	Performance of a contract and our legitimate interest to improve our product and your experience

We do not collect any “special categories” of personal data as defined in the Data Protection Act 2017 (Mauritius) or the GDPR (European Union).

Some of your legal rights will depend on which legal basis we are relying on for processing. Please see the Your Rights section below.

DO WE COLLECT INFORMATION FROM MINORS?

We do not knowingly solicit data from or market to children under 18 years of age. By using the ALX Platform or our services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent’s use of the ALX Platform or of our services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we have collected from children under age 18, please contact us at [email protected].

WHERE WE GET YOUR PERSONAL DATA FROM

We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when applying for ALX courses and Services, expressing an interest in obtaining information about us or our products and services, when participating in activities initiated by us (such as posting messages in our online forums or entering competitions, contests or giveaways) or otherwise contacting us.

All personal information that you provide to us must be true, complete and accurate, and you must notify us of any changes to such personal information.

The personal information that we collect depends on the context of your interactions with us, the choices you make and the products and features you use, as detailed above. 

Other personal data resulted from your use of the ALX Platform or attending our events and other activities, as described above.

DIRECT MARKETING

If you are an existing or previous member of part of ALX ecosystem, we may send you promotional emails about initiatives or services that are similar to what you have done with us before. You have the right to opt out of receiving these emails at any time by:

• contacting us by email at [email protected]; or
• using the ‘unsubscribe’ link at the bottom of the email. 

However, we will still need to send you service-related emails that are necessary for the administration and use of your account.

In all other circumstances, we will only send marketing emails to your individual email if you have explicitly opted in to our marketing list in advance.

We never sell personal data to anyone for any purpose. Also, we will not give your data to others for their own use without your permission.

WHO WE SHARE PERSONAL DATA WITH

We may need to process your data or share your personal information in the following situations:

I. We may share your data with third-party vendors, service providers, consultants, contractors or agents who perform services for us or on our behalf and require access to such information to do that work, such as: 

1. IT maintenance and service providers, providers of software applications through which our IT systems and document management activities are carried out (including Google workspace, especially for e-mail end document storage), as well as the hosting of these software applications,  
2. data analysis, data statistics, surveys/feedback, customer service. We may allow selected third parties to use tracking technology on The ALX Platform or on the Services, which will enable them to collect data about how you interact with the platform over time. This information may be used to, among other things, analyse and track data, determine the popularity of certain content and better understand online activity.
3. service providers which we use for managing and allowing access to ALX Platform, or to service providers for managing and allowing access to the software engineer and intro to SWE courses, payment processing, for lead generation and for marketing communications, call center services, third-party advertisers to serve ads when you visit ALX Platform, of workflow (CRM), productivity software solutions, e-mail delivery and e-mail outreach service providers, email validation service providers, providers of self-service ticketing platform for live experiences, providers of video-conference solution or of the asynchronous video interview solution. 
4. service providers for our administrative / secretarial services, internal organisational flows, such as our digital productivity, collaboration, and organisational app, video-conferencing solutions and calendar application services.  

Such third-party service providers are also not allowed to reuse your personal data for their own purposes. 

II. We sometimes share personal data with third parties as part of providing our services or to comply with our legal duties. These third parties can include:

• public authorities. We may share your information with law enforcement agencies, public authorities or other organizations, if legally required to do so. This includes tax authorities, auditors, various categories of consultants or institutions with powers to carry out inspections and controls our activity and assets, who request us to provide information, by virtue of our legal obligations, courts, public notaries, bailiffs, official company registry;
• group and affiliated companies. We may share your information within entities affiliated to us by common control, management or ownership; 
• business partners. We may share your information to offer you certain products, services or promotions. We do this when we work together with our partners on a common purpose; or
• to third party acquirers/potential acquirers and to their auditors and consultants. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company. 

HOW WE STORE AND SECURE PERSONAL DATA

The ALX Platform central database is held in AWS cloud and hosted in Ireland. However, for our software engineering programs we store your data in the USA. Generally, we only store data with a provider if we are satisfied they protect it with robust policies and cybersecurity measures. 

We have implemented appropriate technical and organisational security measures designed to protect the security of any personal information we process. However, please also remember that we cannot guarantee that the internet itself is 100% secure. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the services within a secure environment.

All external processors have contracts with us. They are required not to reuse your personal data for their own purposes unless they observe the applicable privacy requirements.

TRANSFERRING YOUR PERSONAL DATA TO OTHER COUNTRIES

ALX data is transferred to Ireland for the central database and to the United State of America (by using several service providers which host data in the United State of America, such as AWS, HubSpot, SuperSet, SalesForce, Google suite, Holberton). Also, sometimes we need to send personal data to other countries, such as when we send data to another office / local hub in our corporate group (Egypt, Kenya, South Africa, Malawi, Nigeria, Ghana, Ethiopia, Morocco, Romania).

We take note here of the adequacy decision of the European Commission for the EU-U.S. Data Privacy Framework, which concludes that the United States ensures an adequate level of protection – comparable to that of the European Union – for personal data transferred from to US companies under the new framework. AWS, HubSpot, SalesForce, Google are already part of the EU-U.S. Data Privacy Framework.

When we send data to a country that does not have “adequate” data protection laws according to the European Commission, we will only send the data after agreeing to the standard data protection contract clauses approved by the EC. You can see a copy of these standard clauses on the EC website here: Standard Contractual Clauses (SCC) (europa.eu). We will also take supplementary measures, if necessary, to compensate for any lack of protection afforded by the laws of the recipient country.

If you would like further information about data transfers to other countries please contact us.

HOW LONG WE KEEP PERSONAL DATA 

We keep your information for as long as necessary to fulfil the purposes outlined in this privacy policy unless otherwise required by law (such as tax, accounting or other legal requirements).

No purpose in this policy will require us keeping your personal information for longer than 90 days past the termination of the user’s account. 

If you ask us to delete your user account, we will delete your account data promptly, as we will have 

no further use for it once you stop using the platform.

Generally, when we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

If you have any questions in this regard, or any concerns about how long we keep your information for, please contact us using the details below.

YOUR RIGHTS

You can ask us to:

• provide you with a copy of your personal data;
• correct mistakes in data we hold about you;
• delete your personal data from our records (subject to some exceptions in the Data Protection Act 2017 or another applicable privacy law);
• restrict the processing of your personal data in some circumstances, such as where you contest the accuracy of the data; and
• in certain situations, provide you with a copy of the personal data you provided to us in an easily portable format.

You can object: 

• at any time to your personal data being processed for direct marketing;
• in certain other situations, to our continued processing of your personal data, such as where we carry out processing based on our legitimate interests.

If we are relying on your consent (permission) to use your personal data, you can withdraw your consent any time. However, in some cases if you withdraw consent:

• we may still process your personal data without your consent as required or permitted by law, for example to defend our legal rights or to obey a legal requirement to keep the data; or
• we may no longer be able to provide you with goods or services (we’ll let you know when this would be the case)

DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

Yes, if you are a resident of California, you are granted specific rights regarding access to your personal information.

California Civil Code Section 1798.83, also known as the “Shine The Light” law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact information provided below.

If you are under 18 years of age, reside in California, and have a registered account with the ALX Platform or Services, you have the right to request removal of unwanted data that you publicly post on the ALX Platform. To request removal of such data, please contact us using the contact information provided below, and include the email address associated with your account and a statement that you reside in California. We will make sure the data is not publicly displayed on the Services, but please be aware that the data may not be completely or comprehensively removed from our systems.

COMPLAINTS

If you wish to complain about our use of personal data, we would appreciate the chance to deal with your concerns first. If you still wish to complain, please consult the Mauritius Data Protection Office  website at https://dataprotection.govmu.org/

If you are resident in the EEA (which includes the EU), the GDPR also gives you right to lodge a complaint with your local data protection regulator. 

CHANGES TO THIS PRIVACY POLICY

This privacy policy was published on October 2024. We periodically review this policy and we will publish any changes on this website which will be effective as soon as it is accessible. If we make material changes to this privacy policy, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy policy frequently to be informed of how we are protecting your information.

HOW TO CONTACT US

Please contact us by post, email, or telephone if you have any questions about either this policy or the information that we hold about you:

Privacy Team 

ALX Holdings Limited

5th Floor, The CORE Building,

No. 62, ICT Avenue, Cybercity,

Ebene, Mauritius

[email protected]

or our 

Data Protection Officer

dpo@alxafrica.com

or our

EU Representative

Kinstellar SPARL

8 – 10 Nicolae Iorga, Sector 1, 

010434 Bucharest, Romania

[email protected]