Privacy Policy

This Privacy Policy describes how THE BOARD (“we”, “us”, “our”, or the “Firm”) collects, uses, stores, and discloses personal information when you visit theboard.consulting (the “Site”), interact with our forms, or engage with our advisory services.

By using the Site or contacting us, you acknowledge that you have read and understood this Policy. If you do not agree with any part of it, please do not use the Site or submit any information to us.

THE BOARD is the data controller responsible for the personal information collected through this Site. Our principal place of operation is Dubai, United Arab Emirates.

For any privacy-related queries, contact us at advisory@theboard.consulting.

We collect the following categories of personal information, depending on how you interact with the Site:

From contact and enquiry forms

• Full name
• Email address
• Phone number (with country code)
• Company name and role
• Enquiry type and message content

From the Strategic Audit qualification form

• Contact details (as above)
• Business revenue range and team size
• Primary strategic goal and a free-text description of your principal business challenge
• Investment commitment confirmation

From the Strategic Audit intake brief

• Business overview details (industry, years operating, revenue, employee count)
• Description of your strategic challenge, desired outcomes, and operational context
• Optional financial documents or KPI summaries you choose to upload

From the Boardroom Q&A subscription

• Name, email, phone, optional company and role

Automatically collected

• Approximate geographic location (derived from your IP address) used only to set the default country code in our phone fields
• Standard technical information from your browser and device during page loads — including browser type and version, operating system, screen size, referring page, and time zone
• Pages you visit, links you click, time spent on each page, scroll depth, and similar engagement signals captured by our analytics tools (see “Cookies, analytics, and tracking technologies” below for details and how to opt out)
• Anonymised session insights captured by Microsoft Clarity, including mouse movement and click patterns. Clarity is configured to mask form fields and personal identifiers in its recordings.

We process personal information for the following purposes:

• Responding to enquiries. Routing your contact request to the appropriate founding partner and replying.
• Assessing engagement fit. Reviewing Strategic Audit applications against our published qualification criteria.
• Delivering paid services. Reading intake briefs, preparing for sessions, and producing the deliverables described in our engagement terms.
• Sending session invites and updates for the Boardroom Q&A, if you subscribed.
• Operating the Site securely and improving its usability.
• Complying with legal obligations applicable to the Firm.

Where applicable data protection law (including the EU and UK GDPR for visitors from those regions) requires a legal basis, we rely on:

• Your consent — when you submit a form, subscribe to Q&A invites, or upload documents to us.
• Contract performance — when we are preparing to enter, or are performing, an advisory engagement with you.
• Legitimate interests — for routing enquiries, operating the Site, and maintaining the security and integrity of our services.
• Legal obligation — when we must retain or disclose information to comply with the law.

We do not sell your personal information. We share it only with:

• Founding partners and authorised personnel of the Firm who require access to deliver services or respond to your enquiry.
• Service providers we use to operate the Firm:
  • Google LLC — Google Workspace, Apps Script, Drive, and Gmail are used for forms, storage, and email delivery. May also be used for Google Analytics (GA4) when enabled.
  • Microsoft Corporation — Microsoft Clarity receives anonymised session insights (page views, click patterns, scroll behaviour) to help us improve the Site.
  • Meta Platforms, Inc. — Meta Pixel may receive page view and conversion events when enabled, to support advertising-performance measurement.
  • OneHash Inc. (cal.id) — cal.id powers the Strategic Audit scheduling page. When you book a session, your name, email, and any answers you provide to scheduling-form questions are shared with cal.id to create the calendar event.
  • Other infrastructure providers for hosting, security, and email deliverability as needed from time to time.
  These providers process information on our behalf under contractual safeguards.
• Payment processors (where applicable) to handle secured payment for paid engagements.
• Professional advisers such as legal counsel or auditors, on a confidential basis.
• Regulators, courts, or law enforcement when required by applicable law.

We do not transfer your information to any third party for their independent marketing purposes.

Because we use cloud services and third-party tools (notably Google Workspace, Microsoft Clarity, Meta, and cal.id), your information may be processed on servers located outside the United Arab Emirates, including in the European Union, the United States, India, and other jurisdictions where our providers operate. We take reasonable steps to ensure such transfers are subject to appropriate contractual and technical safeguards.

We retain personal information only as long as necessary:

• Active client and engagement records are kept for the duration of our relationship and for a reasonable period after, to satisfy legal, accounting, or reporting requirements.
• General enquiry records are retained for up to twenty-four (24) months from the date of last contact, unless a longer period is required by law.
• Boardroom Q&A subscriber lists are retained until you unsubscribe. You can unsubscribe at any time by replying to any session invite or writing to advisory@theboard.consulting.

Subject to applicable law, you have the right to ask us to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Delete information we no longer need
• Restrict certain processing
• Receive a portable copy of information you provided to us
• Object to processing based on our legitimate interests
• Withdraw any consent you previously gave, without affecting the lawfulness of processing before withdrawal

To exercise any of these rights, contact advisory@theboard.consulting. We will respond within a reasonable period and may need to verify your identity before acting on the request.

We use reasonable administrative, technical, and physical safeguards to protect personal information against loss, misuse, unauthorised access, disclosure, alteration, and destruction. No method of transmission over the internet is fully secure; we cannot guarantee absolute security but commit to acting promptly on any incident we become aware of.

The Site uses cookies and similar technologies to function, to help us understand how visitors use it, and — where you allow — to support marketing measurement. Cookies are small data files stored in your browser by the sites you visit; pixels are tiny image requests that record a page view; session-recording tools capture mouse movement and click patterns. This section describes what we set, why, and how you can change your preferences.

Categories of cookies we use

• Strictly necessary — required for the Site to function (for example, storing your cookie preferences themselves). These cannot be turned off and do not require consent.
• Analytics — help us understand how the Site is used so we can improve it. Currently active: Microsoft Clarity. Google Analytics (GA4) may be enabled in the future; this Policy will describe its identifiers when it is.
• Marketing — support ad-performance measurement and audience targeting on third-party platforms. Meta Pixel may be enabled in the future. No marketing cookies are active until an applicable identifier is configured on the Site.

Specific cookies and identifiers

When the Analytics category is active, the following cookies are set by Microsoft Clarity:

• _clck — Clarity visitor identifier (approximately one year)
• _clsk — Clarity session identifier (approximately one day)
• MUID / MR — Microsoft cross-property identifier (approximately one to two years; may be set in certain Microsoft contexts)

When Google Analytics is enabled, the following are set:

• _ga — Google Analytics persistent visitor identifier (approximately two years)
• _ga_<container-id> — Google Analytics 4 session state (approximately two years)

When Meta Pixel is enabled, the following is set:

• _fbp — Meta first-party Pixel identifier (approximately ninety days)

The scheduling page (/strategic-audit-schedule/) embeds a third-party scheduling widget (cal.id). When the widget loads, cal.id may set its own cookies on the cal.id domain. Those cookies are governed by cal.id’s privacy policy, not this one.

Your choices

On your first visit, a cookie notice appears at the bottom of the Site. From there you can:

• Click “Accept all” to allow every category described above.
• Click “Customize” to open the cookie preferences panel, where you can enable or disable Analytics and Marketing categories individually.
• Click “Reject all” inside the preferences panel to disable everything except strictly necessary cookies.

Your choice is stored locally in your browser and is honoured on every page you visit on this Site. You can change your choice at any time via the “Cookie preferences” link in the Site footer.

If you have not yet expressed a choice (for example, on your first page view before clicking either banner button), Analytics and Marketing scripts are loaded by default. This reflects the notice and implied-consent model commonly applied in the United Arab Emirates and other jurisdictions where affirmative opt-in is not required. Visitors in the European Economic Area, the United Kingdom, or other jurisdictions with strict opt-in requirements should open the Customize panel and adjust their preferences before continuing to browse, if they do not want analytics or marketing cookies to be set.

Country auto-detection

Country auto-detection on our forms uses a third-party IP geolocation service to set the default phone country code. This is a request-time lookup; no identifying information is stored on your device or in our systems.

The Site and our services are not directed to individuals under the age of 18. We do not knowingly collect information from children. If you believe we have inadvertently collected information from a minor, please contact us so we can delete it.

We may update this Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. Material changes will be communicated through the Site or via direct notice to active clients where practicable.

Questions about this Privacy Policy or how we handle your information should be sent to advisory@theboard.consulting.