Privacy Policy

1. Who We Are

Leadership Impact Institute (LII) is an independent international professional certification body. Clever Find Consultancy Limited, trading as LII, is the data controller for all personal data processed in connection with its certification, accreditation, verification, and associated services.

This Privacy Policy explains how LII collects, uses, retains, and protects personal data. It applies to all individuals who interact with LII, including candidates, employers, accredited institutions, delivery partners, and visitors to lii.institute.

Leadership Impact Institute is a trading name of Clever Find Consultancy Limited, a company incorporated in the Ras Al Khaimah International Corporate Centre (RAK ICC), United Arab Emirates (Registration No. ICC20160318). LII operates internationally from its UAE base.

2. Personal Data We Collect

LII collects personal data only to the extent necessary for the purposes described in this Policy. The categories of personal data collected depend on the nature of your interaction with LII.

Category	Examples	Collected from
Identity data	Full name, job title, professional designation	Certification applications, enquiry forms
Contact data	Email address, phone number, organisation name	Applications, accreditation, employer registration
Professional data	Employment history, leadership evidence, portfolio submissions, impact statements	Certification submissions, assessment process
Assessment data	Assessment grades, panel notes, assessor feedback, certification status	LII internal systems, assessor panels
Verification data	Certification reference number, level attained, date of award	Certification records (not publicly listed; see Section 5)
Technical data	Browser type, IP address, pages visited, session duration	Website analytics (aggregated only)
Employer data	Organisation name, HR contact details, credential confirmation requests	Employer enquiries and agreements
CYL candidate data	Date of birth or age; for candidates under 18, parent or guardian names, contact details and written consent; supporting-referee details; school or organisation information where supplied	CYL enquiries and applications, parents and guardians, referees
Safeguarding records	Records of safeguarding concerns and actions taken	LII's designated safeguarding process (held separately, restricted access)

3. Lawful Basis for Processing

LII processes personal data on the following lawful bases under UAE Federal Decree-Law No. 45 of 2021 (PDPL) and applicable data protection legislation:

• Contract performance — processing necessary to deliver certification, accreditation or related services you have requested
• Legitimate interests — maintaining certification records, responding to credential confirmation requests, improving assessment standards, and ensuring the integrity of the LII qualification
• Legal obligation — where processing is required to comply with applicable law or regulatory requirements
• Consent — for communications where consent is the appropriate basis; you may withdraw consent at any time without affecting processing already completed

4. How We Use Personal Data

LII uses personal data for the following purposes:

• Processing certification applications and managing the assessment process
• Issuing certificates
• Confirming a credential to a third party where the holder consents or the law permits
• Handling consent, communications and safeguarding for CYL candidates, including candidates under 18
• Managing employer and accreditation partner accounts
• Communicating with candidates, employers, and partners about their engagement with LII
• Maintaining the integrity of the LII qualifications register and certification records
• Responding to complaints, appeals, and enquiries
• Conducting quality improvement activities using aggregated or anonymised data where possible
• Complying with legal and regulatory obligations

5. Credential Verification and Public Listing

LII does not currently operate a public credential verification portal or a Digital Passport service. Certificate holders are not automatically listed publicly. Where an employer or other party asks LII to confirm a credential, LII confirms it only with the holder's consent or where otherwise permitted by law.

If LII introduces a public verification service in future, it will update this Policy before the service operates, explaining what is shown and how holders can object. No candidate under 18 will be named through any verification service unless that service has been separately authorised and this Policy updated.

5A. Certified Young Leader (CYL) Candidates, Including Candidates Under 18

CYL is open to people aged 15–24. For CYL, LII may process date of birth or age; for candidates under 18, parent or guardian details and written consent; supporting-referee details; school or organisation information where the candidate supplies it; assessment evidence; appeal and complaint records; and safeguarding records. LII collects only what is necessary for application, consent, assessment, safeguarding, certification, appeals and complaints, and record keeping.

• Consent — before LII accepts an application from a candidate under 18, a parent or guardian must give written consent covering participation, processing of the candidate's personal data, contact through approved LII channels, assessment, handling of submitted evidence and necessary safeguarding communications. The candidate also makes their own declaration.
• Parent or guardian data — used only where necessary, for CYL administration, consent, safeguarding and communication.
• Communication — through approved LII channels only, recorded where required, and never through private personal messaging accounts. Formal communications may be copied to the parent or guardian.
• Outcomes — the candidate receives the outcome; a parent or guardian may receive the formal outcome notification. Assessor working notes, internal moderation material and confidential assessor deliberations are not provided to parents or guardians.
• Other young people in evidence — candidates must minimise, redact, blur or anonymise information about other minors where reasonably possible. LII minimises such data, and assessors do not keep unnecessary copies.
• Safeguarding records — handled separately through LII's designated safeguarding process, with restricted access.
• Withdrawal of consent — if a parent or guardian withdraws consent while the candidate is under 18, the application or assessment is paused. Data already lawfully held remains subject to LII's retention, safeguarding and legal obligations.

6. Sharing Personal Data

LII does not sell personal data. Personal data is shared only in the following circumstances:

• Assessors and Internal Verifiers — candidate data necessary for fair assessment, subject to confidentiality obligations
• Credential confirmation requests — confirmation of a holder's credential only with the holder's consent or where otherwise permitted by law (see Section 5)
• Parents and guardians — for candidates under 18, formal communications and the formal outcome notification only (see Section 5A)
• Safeguarding — through LII's designated safeguarding process, only where necessary to protect a young person or where required by law
• Accredited institutions — where an institution has submitted a candidate or requested verification of a candidate's certification
• Service providers — third-party technology and infrastructure providers operating under data processing agreements with LII
• Legal requirements — where disclosure is required by law, court order, or regulatory authority

7. Data Retention

LII retains personal data for as long as necessary for the purposes set out in this Policy and to meet legal obligations. The following retention periods apply as a general guide:

• Certification and assessment records — retained for the lifetime of the certification plus seven (7) years following lapse or withdrawal
• Application data (unsuccessful) — retained for two (2) years following the final decision
• Employer and partner records — retained for five (5) years following the end of the commercial relationship
• Complaints and appeals records — retained for six (6) years from closure
• Safeguarding records — held separately with restricted access and retained in line with LII's safeguarding and legal obligations
• Information about other minors in evidence — not kept beyond what assessment requires
• Website analytics — aggregated data retained for up to three (3) years; no individually identifiable records are retained

8. Your Rights

Under UAE PDPL and applicable data protection law, you have the following rights in relation to personal data LII holds about you:

To exercise any of these rights, submit a written request to enquiries@lii.institute. LII will respond within 30 calendar days. Requests may be refused where fulfilment would conflict with LII's legal obligations or the legitimate interests of third parties.

A candidate under 18 has the same rights. A parent or guardian may assist the candidate, or act for them where the law allows, but does not replace the candidate's own rights.

9. Data Security

LII applies appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, loss, or destruction. These measures include access controls, encryption of data in transit, restricted assessor access, and regular security reviews. No transmission of data over the internet is completely secure; LII applies measures proportionate to the risk and sensitivity of data held.

10. Cookies and Website Analytics

The LII website uses minimal, privacy-preserving analytics to understand aggregate usage patterns. No advertising or tracking cookies are set. No individual user profiles are built from website activity. Where third-party analytics tools are used, data is processed in aggregate form and configured to anonymise IP addresses.

11. Changes to This Policy

LII may update this Privacy Policy from time to time. Material changes will be published on this page with the effective date updated. Continued use of LII services following publication of an updated Policy constitutes acceptance of the changes. If changes materially affect how LII processes your data, LII will provide direct notification where practicable.

12. Contact and Complaints

For all data protection enquiries, contact LII at enquiries@lii.institute. If you believe LII has not handled your personal data in accordance with this Policy or applicable law, you have the right to submit a complaint to the relevant data protection authority in your jurisdiction. Internal complaints and appeals procedures are set out in the Complaints and Appeals Policy.