Data Protection Policy

1. Introduction and Scope

LoopSkills (“we”, “us”, or “our”) is committed to protecting the privacy and personal data of all users (“you” or “User”) who access loopskills.com and the LoopSkills AI Skill Test (collectively, the “Platform”).

This Data Protection Policy (“Policy”) describes how we collect, use, store, share, and protect your personal data. It is designed to comply with applicable data protection regulations globally, including:

• General Data Protection Regulation (GDPR) — European Union & UK
• California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) — United States
• Personal Data Protection Act (PDPA) — Singapore, Thailand, and similar frameworks
• Digital Personal Data Protection Act (DPDPA) — India
• Protection of Personal Information Act (POPIA) — South Africa
• Federal Law No. 45 of 2021 on Personal Data Protection — UAE
• Lei Geral de Proteção de Dados (LGPD) — Brazil

This Policy should be read alongside our Terms and Conditions. By using the Platform, you consent to the practices described in this Policy.

2. Data Controller

LoopSkills acts as the Data Controller for personal data collected through the Platform. This means we determine the purposes and means of processing your personal data.

For data protection enquiries, please contact:

Data Protection Officer (DPO)

Email: privacy@loopskills.com

Website: loopskills.com

EU/UK Representative: [To be designated upon EU/UK entity registration]

3. Personal Data We Collect

3.1 Data You Provide Directly

When you register, purchase, or interact with the Platform, we may collect:

• Identity data: Full name, username, profile photo
• Contact data: Email address, phone number (if provided)
• Account credentials: Hashed passwords (never stored in plain text)
• Professional data: Job title, industry, years of experience, LinkedIn profile (if connected)
• Payment data: Billing name, address, and payment confirmation (card details handled by third-party processors; we do not store full card numbers)
• Assessment data: Responses to AI Skill Test questions, scores, performance metrics, and completion timestamps
• Communications: Support tickets, feedback, survey responses

3.2 Data Collected Automatically

When you use the Platform, we automatically collect:

• Technical data: IP address, browser type and version, device type, operating system
• Usage data: Pages visited, features accessed, time spent, click patterns, error logs
• Assessment behavioural data: Time per question, navigation patterns within the AI Skill Test (used solely for assessment integrity and quality improvement)
• Cookie and tracking data: As described in Section 7 below

3.3 Data from Third Parties

We may receive personal data from:

• Social login providers (e.g., Google, LinkedIn) if you choose to sign in via these services
• Employer or institutional partners who enrol employees/students on the Platform
• Analytics and marketing partners (aggregated and pseudonymised where possible)

4. Lawful Basis for Processing

We process your personal data on the following legal bases:

• Contractual necessity: To provide services you have signed up for, process payments, and deliver assessments
• Legitimate interests: To improve the Platform, prevent fraud, ensure security, and send relevant service communications — balanced against your rights
• Consent: For marketing communications, optional cookies, and analytics — which you may withdraw at any time
• Legal obligation: To comply with applicable laws, regulations, and court orders

For users in the EU/UK, India (DPDPA), Brazil (LGPD), and similar jurisdictions, all processing has a clearly identified lawful basis. We do not rely on consent for processing where another lawful basis applies.

5. How We Use Your Personal Data

We use your personal data to:

• Create and manage your account and provide access to purchased services
• Administer and score the LoopSkills AI Skill Test and generate personalised proficiency reports
• Process payments and maintain financial records
• Communicate service updates, assessment results, and course recommendations
• Personalise your learning experience and suggest relevant content
• Ensure platform security, prevent fraud, and maintain assessment integrity
• Analyse aggregated usage trends to improve content and product features
• Send marketing communications (only with your consent; opt-out available at any time)
• Comply with applicable legal and regulatory obligations

We do not use your personal data for automated decision-making that produces legal or similarly significant effects without human oversight, except where you have explicitly consented.

6. AI-Powered Processing and Skill Assessments

The LoopSkills AI Skill Test uses automated systems to evaluate your responses and generate proficiency scores. This constitutes automated processing under applicable data protection law.

You have the right to:

• Request human review of automated assessment outcomes that significantly affect you
• Object to solely automated processing for decisions with legal or significant effects
• Obtain an explanation of the criteria used to generate your score

Assessment data is used to improve our AI models in an aggregated and pseudonymised form. Your identifiable assessment responses are not shared with third parties for model training without your explicit consent.

Where AI models are trained using your data, we apply privacy-by-design principles including data minimisation and pseudonymisation.

7. Cookies and Tracking Technologies

We use cookies and similar technologies (web beacons, pixel tags) to operate and improve the Platform. Categories of cookies used:

• Strictly necessary cookies: Essential for Platform functionality (e.g., login sessions, security). Cannot be disabled.
• Performance/analytics cookies: Help us understand how the Platform is used (e.g., Google Analytics with IP anonymisation). Require your consent.
• Functional cookies: Remember your preferences and settings. Require your consent.
• Marketing cookies: Used to deliver relevant advertising. Require your consent. We do not engage in cross-site tracking without consent.

You can manage cookie preferences via the Cookie Preferences panel available on the Platform. Withdrawing consent for non-essential cookies will not affect your access to core services.

8. Data Sharing and Third-Party Disclosure

8.1 Service Providers

We share personal data with carefully selected third-party processors who act on our instructions and are bound by data processing agreements. These include:

• Cloud hosting and infrastructure providers
• Payment processors (e.g., Stripe, Razorpay — subject to their own privacy and security standards)
• Email communication platforms
• Analytics providers (with pseudonymisation where feasible)
• Customer support tools

8.2 Business or Institutional Partners

If your access to the Platform is sponsored or arranged by an employer or educational institution, we may share your assessment results and progress data with that organisation. You will be notified of this arrangement at the point of registration.

8.3 Legal Requirements

We may disclose personal data when required by law, court order, or regulatory authority, or to protect the rights, property, or safety of LoopSkills, our users, or the public.

8.4 No Sale of Data

We do not sell, rent, or trade your personal data to third parties for their independent marketing or commercial purposes. For California residents: we do not “sell” or “share” personal information as defined under CCPA/CPRA, and we do not use personal data for cross-context behavioural advertising without consent.

9. International Data Transfers

LoopSkills operates globally. Your personal data may be transferred to and processed in countries other than your country of residence, including countries that may have different data protection standards.

Where we transfer data outside the European Economic Area (EEA), UK, or other regions with data transfer restrictions, we rely on appropriate safeguards including:

• European Commission Standard Contractual Clauses (SCCs)
• UK International Data Transfer Agreements (IDTAs)
• Adequacy decisions where applicable
• Binding Corporate Rules or equivalent mechanisms

A list of countries to which we transfer data and the applicable safeguards is available upon request at privacy@loopskills.com.

10. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our general retention periods are:

• Account data: Retained for the duration of your account plus 2 years after account closure, unless a longer period is required by law
• Assessment results: Retained for 3 years to support certification verification and learner history
• Payment records: Retained for 7 years in accordance with financial record-keeping obligations
• Marketing consent records: Retained for 3 years from the date of consent or last interaction
• Security and access logs: Retained for 12 months

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

11. Your Data Protection Rights

Subject to applicable law, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you (GDPR Art. 15 / CCPA / DPDPA)
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure (“right to be forgotten”): Request deletion of your personal data, subject to legal retention obligations
• Right to restriction: Request that we limit processing of your data in certain circumstances
• Right to data portability: Receive your data in a structured, machine-readable format (EU/UK/Brazil)
• Right to object: Object to processing based on legitimate interests or direct marketing
• Right to withdraw consent: Withdraw any consent you have given at any time, without affecting the lawfulness of prior processing
• Right not to be subject to automated decisions: As described in Section 6
• Right to lodge a complaint: File a complaint with your local data protection authority

To exercise any of these rights, please contact us at privacy@loopskills.com. We will respond within the timeframes required by applicable law (e.g., 30 days under GDPR, 45 days under CCPA). We may request verification of your identity before processing your request.

12. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• Encryption of data in transit (TLS 1.2 or higher) and at rest
• Hashed storage of passwords using industry-standard algorithms
• Role-based access controls limiting staff access to personal data
• Regular security assessments and penetration testing
• Data breach detection and response procedures with regulatory notification timelines (72 hours under GDPR)

While we take data security seriously, no system is entirely immune to breach. In the event of a data breach affecting your rights and freedoms, we will notify you in accordance with applicable law.

13. Children's Privacy

The Platform is not directed to children under the age of 13. We do not knowingly collect personal data from children under 13 without verifiable parental consent. For users aged 13–17, we require parental or guardian consent as described in our Terms and Conditions.

If you believe we have collected data from a child without appropriate consent, please contact us at privacy@loopskills.com and we will promptly delete such data.

14. Regional and Jurisdiction-Specific Provisions

14.1 European Union / United Kingdom (GDPR / UK GDPR)

EU and UK residents have the full suite of rights under GDPR/UK GDPR. You may lodge complaints with your national supervisory authority (e.g., ICO in the UK, CNIL in France).

14.2 California, USA (CCPA / CPRA)

California residents have additional rights including the right to know about personal information collected, the right to opt out of sale/sharing, and the right to non-discrimination. We do not discriminate against users who exercise their privacy rights. Submit California-specific requests at privacy@loopskills.com with “California Privacy Request” in the subject line.

14.3 India (DPDPA 2023)

Indian residents have rights to data correction, erasure, and grievance redressal. We designate a grievance officer reachable at privacy@loopskills.com for Indian user requests.

14.4 UAE, Saudi Arabia, and Middle East

We comply with applicable national data protection regulations in the UAE (Federal Law No. 45/2021) and other applicable frameworks in the Middle East and North Africa region.

14.5 Southeast Asia (PDPA — Singapore, Thailand, Philippines, Malaysia)

We comply with applicable PDPA frameworks in Singapore, Thailand, the Philippines (Data Privacy Act), and Malaysia (PDPA 2010). Users in these jurisdictions may exercise access and correction rights by contacting privacy@loopskills.com.

14.6 Africa (POPIA — South Africa and similar frameworks)

South African users have rights under POPIA, including the right to access and correct data. We designate an Information Officer for POPIA compliance. Other African markets are served subject to applicable national legislation.

15. Changes to This Policy

We may update this Policy periodically to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you via email or a prominent notice on the Platform before the changes take effect.

Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the changes. We recommend reviewing this Policy periodically.

16. Contact and Complaints

For any questions, concerns, or requests related to this Data Protection Policy, please contact:

LoopSkills — Privacy Team

Email: privacy@loopskills.com

General support: support@loopskills.com

Website: loopskills.com

If you are not satisfied with our response, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.

By proceeding to use the Platform or the LoopSkills AI Skill Test, you confirm that you have read, understood, and consent to the collection and use of your personal data as described in this Data Protection Policy.