Legal

Privacy policy

Last updated 14 August 2026.

This policy explains what Diversity on Board collects, what it does not collect and what may be requested from us. It is short because the service itself is simple: this is a set of static pages and browser-based tools, and almost everything a reader does here is held on the reader's own device rather than transmitted to us.

Who is responsible for your information

Diversity on Board is an initiative of 3BL Associates Consultancy Co. W.L.L., which is the controller of the personal data described in this policy.

3BL Associates Consultancy Co. W.L.L.
Flat 71, Building 20, Road 385
Al-Muthanna Avenue, Manama Centre, Block 305
PO Box 2922, Kingdom of Bahrain

Questions about this policy, and requests concerning your data, should be sent to privacy@diversityonboard.org.

What we collect

We ask for personal details at one point only: before the Pathway to the Boardroom opens, a form asks for a name, an organisation, a title, a country and an email address. Those five answers are recorded once, and they are the whole of what we hold that identifies a reader of this site. Separately, and without asking anything of you, we count page views in the way described under how we measure use of this site.

We collect that information so that we understand who the programme is reaching, which informs how it is developed and what is reported to the partners who fund it. The legal basis is consent, given by submitting the form, and consent may be withdrawn at any time by writing to the address above.

Where a reader contacts us directly, by email or through a form on another of our services, we hold what is sent to us for as long as is necessary to respond and to keep a record of the correspondence.

How we measure use of this site

We use Cloudflare Web Analytics to see which pages are read and how quickly the site loads. It is the one script on this site that is not served from our own domain: Cloudflare places it on the page and serves it from static.cloudflareinsights.com, and the site's content security policy names that single exception and refuses every other outside source.

It sets no cookie, and it writes nothing to the browser's storage. Those two statements are not a summary of what we were told: we read the script, and it contains no reference to cookies, to local or session storage, or to any other store on the device. Nothing is therefore left behind to recognise a device on a later visit.

For each page view it sends Cloudflare the address of the page, the address of the page that referred you where there was one, the description the browser gives of itself, and measurements of how quickly the page loaded. As with any request made over the internet, that message also carries the network address it came from, which Cloudflare handles as our processor. What is reported back to us is counts: pages, referrers and loading times in aggregate, never a record of an individual reader or a path taken through the site.

Nothing on this site depends on that script, so any browser setting, extension or network filter that blocks it costs you nothing at all.

What we do not collect

This site sets no cookies, and it runs no advertising technology, no tracking pixels and no third-party script other than the one described above. Every font, stylesheet and image, and every other script, is served from our own domain. There are no user accounts and no passwords to manage, we take no payments, and we neither collect location data nor build profiles nor carry out automated decision-making of any kind.

None of the work a reader does in the tools is transmitted to us. The modules opened, the answers given to the Compass, the results of the self-checks, the biography drafted in the builder and the opportunities saved are written to the browser's own local storage on that device, and they never reach our servers. Clearing the site's data in the browser erases all of it, and we have no copy.

What is stored in your browser

These entries are created by the tools on this site. They are readable only by this site, in this browser, on this device.

Two further entries exist only in passing. A short-lived probe confirms that this browser permits local storage at all, and a queue holds a weekly alert signup that could not be sent at the moment it was made. Neither outlives the task it serves.

Who your information is shared with

The five answers given at the access form are recorded in a Google Workspace spreadsheet held by 3BL Associates, and Google acts as a processor on our behalf in storing that record. Beyond that, we share personal data with nobody. We do not sell it, we do not trade it and we do not pass it to partners, sponsors or recruiters.

This site is hosted on Cloudflare Pages, and the measurement described above is Cloudflare's own. In serving a page and in counting it, Cloudflare processes the network information any web request necessarily carries, including the requesting address, and does so as our processor.

We may disclose personal data where we are required to do so by law, and we will limit any such disclosure to what the law requires.

Where your information is held, and for how long

Records are held on Google and Cloudflare infrastructure, which may place them on servers outside the Kingdom of Bahrain. We keep the access-form record for as long as the Pathway to the Boardroom is offered, and we review the record periodically so that entries no longer serving the purpose set out above are deleted.

Sensitive personal data

We do not ask for sensitive personal data, which under Article 5 of Bahrain's Personal Data Protection Law No. 30 of 2018 includes information revealing racial or ethnic origin, political or philosophical opinions, religious belief, trade union affiliation, criminal record, health or sexual life. Readers are asked not to enter such information into the tools on this site. Where sensitive personal data reaches us in correspondence, it is processed only with the sender's consent or where the law requires it.

Your rights

The rights below depend on where a reader is located. In every case the route to exercising them is the same: write to privacy@diversityonboard.org, and we will respond within one month.

In the Kingdom of Bahrain

Under the Personal Data Protection Law No. 30 of 2018 you have the right to request access to the personal data we hold about you, to have inaccurate data corrected and incomplete data completed, to request erasure in defined circumstances, to object to processing, to request that processing be restricted, to withdraw consent where we rely on it, to lodge a complaint with the supervisory authority and not to be subject to automated individual decision-making, including profiling.

In the European Union and the United Kingdom

Under the General Data Protection Regulation, and under the Data Protection Act 2018 for readers in the United Kingdom, you have the right of access to a copy of your personal data, the right to rectification, the right to erasure in defined circumstances, the right to restrict processing, the right to object to processing and the right to data portability. A reader in the European Economic Area who believes we are processing personal data unlawfully may also complain to the local supervisory authority.

In Canada

Under the Personal Information Protection and Electronic Documents Act we are accountable for the personal data under our control, we identify the purposes of collection before or at the time of collecting, we collect, use and disclose personal data with your knowledge and consent, we limit collection to the purposes set out in this policy and retain it only as long as those purposes require, we keep personal data accurate and up to date, we protect it with safeguards appropriate to its sensitivity, we publish this policy openly, we give access on request and we accept challenges to our compliance with these principles.

In California

California Civil Code Section 1798.83, known as the Shine the Light law, entitles residents of California to request once a year, free of charge, information about the categories of personal information disclosed to third parties for those parties' direct marketing purposes. We disclose no personal information for direct marketing purposes, and a request may nonetheless be made in writing to the address above.

Children

This site is intended for senior professionals and serving directors rather than for children, and we do not knowingly collect personal data from anyone under the age of eighteen.

Security

Pages are served over an encrypted connection, and the access-form record is held in a Google Workspace account restricted to the members of our team who need it. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, so we limit what we collect in the first place.

Links to other sites

The board openings, the resource library and the country guides link to organisations we do not control, including exchanges, regulators, recruiters and publishers. Those organisations set their own privacy practices, and a link from this site is neither an endorsement of them nor a statement about how they handle personal data.

Changes to this policy

Where this policy changes, the revised version is published on this page and the date at the top is updated. Material changes to what we collect or to how it is used will be described here rather than made quietly.

Return to the pathway →