Privacy notice

1. Who is responsible

Loriam Holding Ltd, Cyprus, is the controller of your personal data for SkilledPass. Contact: [email protected]. This notice covers the EU General Data Protection Regulation (GDPR) and India's Digital Personal Data Protection Act, 2023 (DPDP Act).

2. What we collect

Account: email address, and WhatsApp number if you add it.

Profile: name, photo, date of birth, country and state, languages, work experience, whether you have a passport and its expiry date, preferred countries, availability.

Learning and tests: lesson progress, quiz and test answers, scores, attempt times.

Test integrity: a selfie, random camera snapshots during the test, face-match results, and focus or tab-switch events.

Video intro: your 60-second video, its transcript, and the English level estimated from it.

Payments: amounts, currency and Stripe references. Card details are handled by Stripe, not by us.

Technical: IP address, device and browser type, and security logs.

3. Why we use it, and on what basis

To run your account, courses, tests and certificates (contract).

To keep certificates trustworthy: the selfie, snapshots and face match confirm that the person who passed is the person on the certificate. Face matching uses biometric data, so we only do it with your explicit consent, which you give before the test.

To share your certified profile with licensed HR partner agencies, only with your explicit consent, which you can withdraw at any time. Every share is logged.

To send sign-in codes, receipts and certificate or renewal reminders by email or WhatsApp (contract and legitimate interest; you can turn reminders off).

To issue invoices and meet tax and accounting rules (legal obligation).

4. Who receives it

Service providers that process data for us under contract: Hetzner (hosting, Germany), Cloudflare (network and file storage), Stripe (payments), Resend (email), Meta (WhatsApp messages), and Anthropic (an AI model that estimates your English level from the text transcript of your video; your video itself is transcribed on our own server).

HR partner agencies, only with your consent. The first is Starball Z Recruitment Services Limited, Cyprus.

Anyone who has your certificate serial number or QR code can see its public verification page (photo, name, track, score band, English level, dates and status).

Some providers are outside the EU or India. Where data leaves the EU, we rely on the European Commission's standard contractual clauses or an adequacy decision.

5. How we protect it

Selfies, snapshots, ID photos and videos are stored privately and encrypted (AES-256-GCM) before they leave our server. Only authorised staff can view them, and every view by staff is logged. All traffic uses HTTPS.

6. How long we keep it

Test selfies and snapshots: 12 months after the attempt, then deleted. Video intros: while your certificate is valid and 12 months after. Account and certificate records: until you delete your account. Invoices and payment records: as long as tax law requires (currently up to 7 years). You can ask us to delete photos and videos sooner.

7. Your rights

You can access, correct, download or delete your data, withdraw any consent, and object to processing. Use the app or write to us. Under the DPDP Act you may also nominate someone to exercise your rights. You can complain to the Cyprus Commissioner for Personal Data Protection or to India's Data Protection Board.

8. Age

SkilledPass is for adults aged 18 or over.