Privacy policy

Skills Global is operated by SKILLS GLOBAL LIMITED (“we”, “us”). We are the data controller for the personal data described in this policy.

This policy covers the Skills Global website and the Skills Global learning platform, including courses, assessments, credentials, and the public credential verifier. Questions about it go to [email protected].

Information you give us

• Account details — your name, email address, and password, or the profile information returned by a sign-in provider if you sign in with Google.
• Profile information — anything you choose to add to your profile.
• Support correspondence — messages you send us and our replies.

Information created as you use the platform

• Learning activity — enrolments, lessons completed, and progress.
• Assessment records — attempts, answers, scores, and outcomes.
• Credential records — credentials issued to you, their identifiers, issue and expiry dates, and current status.
• Order records — what you bought, when, the amount, and the payment status.

Information collected automatically

• Technical data — IP address, browser and device type, and pages requested, recorded in server logs for security and reliability.
• Cookies — see Cookies.

We do not ask for special category data (such as health or biometric data), and we do not store your card details. Card data is entered directly into our payment provider and never reaches our servers.

We use personal data to:

• create and secure your account and sign you in;
• deliver courses and record your progress;
• run assessments, mark them, and record the outcome;
• issue, display, expire, and revoke credentials;
• answer a verification request about a credential (see below);
• take payment and provide receipts;
• send service messages about your account, purchases, and credentials;
• investigate suspected cheating, fraud, or misuse; and
• keep the platform working, and meet our legal and accounting obligations.

Where the law requires a lawful basis, we rely on performance of a contract (running your account, courses, assessments, credentials, and orders), legitimate interests (security, fraud prevention, and improving the platform), legal obligation (tax and accounting records), and consent where we ask for it — for example, optional marketing email, which you can withdraw at any time.

A credential is only useful if someone else can check it. When a credential is issued, it gets a public record that anyone holding the credential identifier can look up.

That record shows:

• the name of the holder, as it appears on the credential;
• the credential title and what it certifies;
• the issue date and, where one applies, the expiry date; and
• the current status — active, expired, or revoked.

The public record never shows:

• your email address or contact details;
• your assessment score, your answers, or how many attempts you took;
• other credentials you hold; or
• any other course or account activity.

You control who can verify a credential by controlling who you give the identifier to. Anyone who has it can check the record without an account and without contacting us.

We do not sell personal data. We share it only with:

• Payment processing — our payment provider, to take payment and handle refunds and chargebacks. They receive the transaction details and your card data directly; we receive the result.
• Authentication — our sign-in provider, if you choose to sign in with a third-party account.
• Hosting and infrastructure — the providers that host the platform and its database, under contract and on our instructions.
• Email delivery — the provider that sends account and service email.
• Professional advisers and authorities — where we are legally required to disclose, or need to establish or defend legal claims.

If we are ever involved in a merger, acquisition, or sale of assets, personal data may transfer as part of that transaction. We will tell you before it happens and before this policy stops applying.

Some of our providers operate outside the country you are in. Where personal data is transferred internationally, we rely on an adequacy decision covering the destination or on standard contractual clauses with the provider, together with technical measures such as encryption in transit. You can ask us which safeguard applies to a specific provider.

• Account and profile data — while your account is open, then deleted or anonymised within 12 months of closure.
• Learning and assessment records — while your account is open, and for as long as an associated credential remains verifiable.
• Credential records — kept for as long as the credential must stay verifiable, which may be after your account closes. A credential you have shared cannot silently disappear from the verifier.
• Order and payment records — kept for the period required by tax and accounting law, typically six years.
• Server logs — kept for a short period for security and diagnostics, typically no more than 90 days.

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy;
• have inaccurate data corrected;
• have data erased, where we do not need to keep it;
• restrict or object to how we use it;
• receive your data in a portable format; and
• withdraw consent where we relied on it, without affecting past processing.

To exercise any of these, email [email protected]. We respond within one month. If you are not satisfied with our response, you can complain to your local data protection authority.

Erasing an account does not automatically erase an issued credential’s public record, because other people may be relying on it. Tell us if you want a credential withdrawn from the verifier and we will explain what that means for anyone who holds it.

Traffic is encrypted in transit. Passwords are stored hashed, never in plain text. Access to production data is limited to the people who need it to run the service, and assessment and credential records are written so that changes are traceable. No system is perfect: if a breach affects your personal data and is likely to put you at risk, we will tell you and the relevant authority without undue delay.

We keep cookie use to what the platform needs to work:

• Essential — keeping you signed in, holding your session, and protecting forms against cross-site request forgery. These cannot be turned off without breaking sign-in.
• Preference — remembering choices you have made in the interface.

Our payment provider sets its own cookies on the checkout page for fraud prevention. You can block or delete cookies in your browser; if you block essential cookies, you will not be able to sign in.

Skills Global is for adults and is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, email [email protected] and we will delete it.

We update this policy when the platform or the law changes. The date at the top of the page always shows the current version. If a change materially affects your rights, we will tell you by email or in the platform before it takes effect.

Privacy questions, rights requests, and everything else: [email protected]

Controller: SKILLS GLOBAL LIMITED