Legal

Privacy Policy

Last updated: 12 October 2026

In short

What we collect. We collect the details that you give us (such as your name, email address and Orders), data that is collected automatically when you use the Website, and limited data from payment and other service providers.
Why we use it. We use Personal Data to deliver Products and Services, take payment through the Payment Processor, provide support, protect the Website and our Intellectual Property Rights and, where you agree or the law allows, send you marketing.
We do not sell it for money. We do not sell Personal Data for money.
Who we share it with. We share Personal Data only with the categories of recipient listed in clause 10, such as the Payment Processor, hosting and email providers, and authorities where the law requires it.
How long we keep it. We keep Personal Data only for as long as we need it, as the table in clause 13 shows.
How to contact us. To exercise your rights or ask a question, write to [email protected].

1. Introduction, scope and controller

1.1 Who we are. Scribe Crest is the controller of the Personal Data described in this Privacy Policy, which means that we decide why and how it is Processed. In some countries the law uses a different term, such as “responsible party”, and this Privacy Policy applies to us in that role as well. Our contact for all privacy matters is [email protected].

1.2 Data protection contact and representatives. We have appointed a person responsible for data protection matters, who can be contacted at [email protected]. Where Applicable Data Protection Law requires us to appoint a representative in the European Economic Area or the United Kingdom, we will do so and publish the contact details here.

1.3 Who this Privacy Policy covers. This Privacy Policy applies to visitors to the Website, customers, learners, subscribers, clients and Affiliate Partners. It covers the Website at https://www.scribecrest.com, our Products and Services, and our online and offline dealings with you, including support and correspondence.

1.4 What it does not cover. This Privacy Policy does not cover the practices of Third-Party Platforms, which are responsible for their own handling of Personal Data. It also does not cover Personal Data that you Process about other people through a Product, which clause 23 explains.

1.5 Relationship to the Terms of Use. This Privacy Policy forms part of our Terms of Use at https://www.scribecrest.com/terms-of-use/. Words that start with a capital letter and are not defined here have the meaning that they have in the Terms of Use.

1.6 Regional supplements. Clause 27 introduces regional supplements for people in particular regions. For people whom a supplement covers, the supplement prevails over the main body of this Privacy Policy where the two differ.

1.7 Acknowledgement is not consent. By using the Website you acknowledge that you have read this Privacy Policy. This acknowledgement is not consent to any Processing, and where the law requires your consent for a purpose, we ask for it separately.

1.8 How to read this Privacy Policy. The summary at the top is a short guide and is not a complete statement of our practices. If the summary and the clauses differ, the clauses prevail.

1.9 People we hold data about. We Process Personal Data about people who visit the Website, buy or use a Product or Service, sign up to our emails, write to us, apply to join our affiliate programme or take part in an Event. We also Process limited Personal Data about people who are named in correspondence that we receive, but only to the extent needed to deal with it.

1.10 Our role in different situations. We act as a Controller when we decide why and how Personal Data is Processed, for example when we run our Accounts and send our emails. We act as a Processor only where a Product Processes data that you provide about other people on your behalf, as clause 23 explains.

1.11 Your choices. You do not have to give us Personal Data, but if you do not, we may be unable to provide a Product or Service. Where you have choices, such as marketing and non-essential Cookies, this Privacy Policy tells you how to exercise them.

2. Definitions and interpretation

2.1 Definitions. In this Privacy Policy, the following words have the meanings given below.

Applicable Data Protection Law means the data protection and privacy laws that apply to the Processing in question. They include the EU General Data Protection Regulation (GDPR); the UK GDPR and the Data Protection Act 2018; the Swiss Federal Act on Data Protection; United States state privacy laws, including the California Consumer Privacy Act as amended; the Nigeria Data Protection Act 2023; the Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial laws in Canada; the Privacy Act 1988 in Australia; the Lei Geral de Proteção de Dados (LGPD) in Brazil; the Protection of Personal Information Act (POPIA) in South Africa; and similar laws.

Controller means the person that decides why and how Personal Data is Processed.

Cookies means small text files and similar technologies, including pixels, web beacons, local storage, software development kits and device identifiers, that store or read information on your device.

Data Subject means an identified or identifiable person to whom Personal Data relates.

Personal Data means information that relates to a Data Subject. It includes “personal information” and equivalent terms in Applicable Data Protection Law.

Processing means any operation on Personal Data, such as collecting, recording, storing, using, sharing or deleting it, and “Process” has a matching meaning.

Processor means a person that Processes Personal Data on behalf of a Controller. It includes a “service provider” or “contractor” as those terms are used in some laws.

Regulator means a public authority responsible for enforcing Applicable Data Protection Law.

Sensitive Data means categories of Personal Data that the law treats as needing extra care, such as government identifiers, precise geolocation, biometric data, health data and data about children.

Third-Party Platform means a website, service, application or system that is operated by someone other than us and that the Website or a Product uses or links to.

2.2 Terms of Use definitions. The words Account, Coaching Services, Course, Ebook, Software, Subscription, Payment Processor and Affiliate Partner have the meanings given in the Terms of Use.

2.3 Interpretation. In this Privacy Policy, “including” means “including without limitation”, headings are for convenience only, a reference to a law includes that law as amended, and the singular includes the plural. A period expressed in days means calendar days.

3. Personal Data we collect

3.1 Overview. We collect Personal Data in three ways: from you directly, automatically when you use the Website, and from other sources. The lists below describe the main categories, and not every category applies to every person.

3.2 Data that you give us. You may give us the following:

(a) identity and contact details, such as your name, email address, country and the details that you give when you contact us;

(b) Account credentials, which we store in hashed form and not as plain text;

(c) order and billing information, noting that the Payment Processor holds your full card details and that we see only limited data, such as the card brand, the last four digits, your billing country and the order value;

(d) learning inputs, such as assignments, quiz answers and the proof of effort that you submit with a refund claim;

(e) support messages and correspondence;

(f) survey responses and feedback;

(g) reviews, comments and testimonials that you choose to submit;

(h) event registration details;

(i) intake information that you give us for Coaching Services;

(j) affiliate application and payout details; and

(k) a photograph or likeness, only if you choose to send one to us.

3.3 Data that is collected automatically. When you use the Website or a Product, we and our providers collect:

(a) device and browser data, such as the type of device, the operating system and the browser version;

(b) your IP address and approximate location derived from it;

(d) Cookies and similar technologies, as clause 9 and Schedule 1 explain;

(e) licence, activation and download data;

(f) video playback data; and

(g) email interaction data, such as whether you open an email and which links you click.

3.4 Data from other sources. We also receive Personal Data from:

(a) the Payment Processor, which tells us about your Order, the status of your payment and any refund or dispute;

(b) Third-Party Platforms that we use to deliver Products;

(d) public sources and service providers that we use for fraud checks; and

(e) social platforms, if you choose to connect an account from one of them.

3.5 Sensitive Data. We do not intend to collect Sensitive Data, and you should not send it to us. If you volunteer Sensitive Data in a coaching session or a support message, we use it only to respond to you.

3.6 Why we collect it. We collect Personal Data because we need it to deliver Products and Services, because the law requires us to keep certain records, or because it helps us to protect the Website and improve what we offer. Clause 4 sets out each purpose and its legal basis.

3.7 Information that you must give us. Some Personal Data, such as your name, your email address and your billing country, is needed to complete an Order. If you do not give it to us, we cannot process the Order or give you access to the Product.

3.8 Accuracy. We rely on you to give us accurate details and to keep them up to date. You may ask us to correct details that are wrong, as clause 15 explains.

3.9 Information about other people. If you give us Personal Data about another person, for example in an affiliate application or a support message, you must have the right to do so. You must tell the person that you have shared their details with us where the law requires it.

3.10 Inferences. We may draw simple conclusions from the data that we hold, such as the topics that interest you, from the Products you have bought and the pages you have viewed. We use these conclusions for the purposes in clause 4 and clause 17, and we do not use them to make decisions that significantly affect you.

3.11 Data from your device. The data that we collect automatically depends on your settings and on the choices that you make about Cookies. You can limit it by changing your browser settings and your Cookie preferences, as Schedule 1 explains.

3.12 Aggregated data. We may combine Personal Data from many people into aggregated or anonymised statistics that no longer identify you. We may use and keep those statistics without time limit.

4. How we use Personal Data and our legal bases

4.1 Purposes and legal bases. The table below sets out why we Process Personal Data and the legal basis on which we rely under Applicable Data Protection Law. Where a law does not use legal bases, the table describes the reason for the Processing.

Purpose	Main categories of Personal Data	Legal basis
To create and manage your Account and to identify you	Identity and contact; account; technical	Performance of a contract; legitimate interests (account security)
To process Orders, take payment, issue receipts and deliver Products	Identity and contact; order and billing; access and download	Performance of a contract; legal obligation (tax and accounting records)
To provide course delivery, track progress and issue certificates	Account; learning and progress; video playback	Performance of a contract; legitimate interests (delivering and improving the learning experience)
To manage licences, prevent piracy and unauthorised sharing and enforce our Terms of Use	Licence and security; access and download; IP address; watermark identifiers	Legitimate interests (protecting our intellectual property and revenue); performance of a contract
To provide customer support and respond to enquiries	Identity and contact; support and correspondence; order	Performance of a contract; legitimate interests (providing support and keeping records)
To assess and process refund, cancellation and chargeback claims	Order and billing; refund and dispute data; learning and progress; proof of effort	Performance of a contract; legitimate interests (verifying eligibility and preventing abuse); establishment, exercise or defence of legal claims
To send service messages (receipts, access, security, policy and renewal notices)	Identity and contact; order; account	Performance of a contract; legal obligation; legitimate interests
To send marketing communications about our Products and Services	Identity and contact; marketing; email interaction	Consent, or legitimate interests or another basis permitted by Applicable Data Protection Law in respect of existing customers, with a right to opt out at any time
To run analytics, measure performance and improve the Website, Products and Services	Technical; usage and log; Cookie data	Consent where required for non-essential Cookies; otherwise legitimate interests
To personalise content and offers and to measure and optimise advertising	Technical; usage; marketing; Cookie data	Consent where required; otherwise legitimate interests
To publish reviews, comments and testimonials	Identity; content you submit; photograph or likeness where you provide one	Consent; legitimate interests (moderation)
To run live sessions, coaching and events	Identity and contact; content; session data; recordings	Performance of a contract; consent (recordings); legitimate interests
To administer the affiliate programme and pay commissions	Affiliate data; referral attribution; payout and tax data	Performance of a contract; legal obligation
To detect, prevent and investigate fraud, abuse, security incidents and unlawful activity, and to screen against sanctions lists	Identity; order; technical; licence and security	Legitimate interests; legal obligation
To comply with legal obligations, respond to lawful requests and protect our rights	All categories as necessary	Legal obligation; legitimate interests; establishment, exercise or defence of legal claims
To conduct research, produce aggregated or anonymised statistics and develop new Products	Usage; learning and progress; feedback (aggregated or de-identified where practicable)	Legitimate interests; consent where required
For corporate transactions such as a merger, acquisition or sale of assets	As necessary	Legitimate interests

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of Processing before withdrawal. Where we rely on legitimate interests, you may object as described in clause 15.

4.2 No incompatible purposes. We do not use Personal Data for a purpose that is incompatible with those in the table. If we want to use it for a new purpose, we will tell you first and, where the law requires it, ask for your consent.

4.3 Consent where the law requires it. Where a law requires your consent for a purpose, such as non-essential Cookies or some marketing, we obtain it before we start that Processing. You may refuse consent without losing access to the Products that you have bought.

4.4 Automated decisions. We do not make decisions that have legal or similarly significant effects on you solely by automated means, as clause 17 explains.

4.5 Changes of purpose. If we need to use Personal Data for a purpose that is not described in the table, we will first check that the new purpose is compatible with the original one. Where it is not, we will ask for your consent or rely on another legal basis that the law allows, and we will tell you.

4.6 Your control. You may ask us how a particular purpose relates to a particular legal basis by writing to [email protected]. We will explain it in plain words, subject to the limits in clause 15.

5. Payments, Orders and merchant of record

5.1 The Payment Processor. The Payment Processor acts as merchant of record for your Order. For payment, tax and fraud Processing, it acts as an independent Controller, and its own privacy policy governs the payment data that it holds.

5.2 What we receive. We receive limited order data from the Payment Processor, such as your name, email address, billing country, the Product you bought, the order value and the status of the payment. We do not store full card numbers.

5.3 International handling. The Payment Processor may transfer Personal Data internationally under its own arrangements. Clause 12 describes how this fits with our other transfers.

5.4 Tax data and invoices. The Payment Processor collects the data needed to calculate and report tax, and it issues invoices and receipts. We keep the order records that we need for our own accounting, for the period shown in clause 13.

5.5 Refunds and chargebacks. The Payment Processor shares dispute data with us when you ask for a refund or raise a chargeback. We may share proof of effort and Account data with the Payment Processor to answer a dispute, and we use the data only for that purpose.

5.6 Fraud screening. The Payment Processor and we may screen Orders to detect fraud and to meet sanctions obligations. A person always reviews a decision to refuse an Order for fraud reasons, as clause 17 explains.

5.7 Questions about payments. If you have a question about a payment, you should contact us first at [email protected]. We will explain what data we hold about the payment and, where the Payment Processor holds it, tell you how to contact the Payment Processor.

5.8 Payment Processor policies. The Payment Processor’s privacy policy is shown at checkout, and you should read it. We do not control how the Payment Processor uses the data that it collects as an independent Controller.

6. Accounts, product delivery and learning data

6.1 Accounts and sign-in. When you create an Account, we collect the details that you provide and the data created when you sign in. We use them to identify you, to protect your Account and to give you access to your Products.

6.2 Delivery of Products. We deliver Products by download link, platform access or licence key. To do so, we record the access and download data that is needed to deliver the Product and to answer questions about it.

6.3 Course progress. When you take a Course, we record your progress, quiz results, completion status and any certificate issued to you. A certificate may include your name and the date of completion.

6.4 Video playback. Where a Course includes video, the video host records playback data, such as which videos you watch and how far you get. We use this data to track progress and to improve the Course.

6.5 Refund verification. We may use progress records to assess whether you meet the conditions for a Course refund under our Terms of Use. We use the records only for that assessment and for answering any dispute about it.

6.6 No wider decisions. We do not use learning data to make decisions about you beyond providing the service and assessing refunds. We do not use it to profile you for any other purpose.

6.7 Learning platforms. The learning platforms that we use act as Processors on our instructions, or as independent Controllers of the data in their own accounts. Schedule 2 lists the categories of those providers.

6.8 Certificates. Where we issue a certificate, it may include your name and the date. We keep a record of the certificate so that we can confirm it is genuine if someone asks, and clause 13 explains how long we keep it.

6.9 Support with access. If you ask us for help with access to a Product, we may check your Account, your Order and your access logs to solve the problem. We use that information only for that purpose.

6.10 Downloads. When you download a file, we may record the time of the download and the file name. We use that record to deliver the Product, to answer questions about it and to detect unauthorised sharing, as clause 7 explains.

7. Licence, anti-piracy and security data

7.1 Purposes. We Process licence and security data to enforce licences, detect unauthorised sharing, protect our Products and the Website, and prevent fraud. We use it for no other purpose without telling you.

7.2 Data involved. This data includes IP addresses, device identifiers, activation and download logs, login patterns and, where we use them, watermark identifiers embedded in files. We collect only what is needed to achieve these purposes.

7.3 Legal basis. Our legal basis is our legitimate interest in protecting our Intellectual Property Rights and revenue, together with performance of our contract with you. We have weighed that interest against your rights, and we believe the Processing is proportionate because it is limited to what is needed.

7.4 Retention. We keep licence and security data for the periods in clause 13, and for longer where it relates to a confirmed infringement.

7.5 Consequences of infringement. If we confirm unauthorised sharing, we may suspend your access and take legal action. We may also share evidence with our advisers and with the authorities, as clause 10 explains.

7.6 Limits on the data we use. We do not use licence and security data to track what you do outside the Website and the Products. We do not use it to build advertising profiles, and we do not use it for any purpose other than those in this clause.

7.7 Security of the data. We store licence and security data with the same care as other Personal Data, and we limit access to the people who need it. Clause 14 describes our security measures.

7.8 Your rights. You may object to this Processing, as clause 15 explains. If you object, we will consider whether our reasons for the Processing outweigh your rights, and we will tell you our decision.

7.9 Fairness of enforcement. Before we take action based on licence and security data, a person reviews the evidence. We do not suspend an Account solely because of an automated alert.

8. Marketing and email communications

8.1 What we send. We may send newsletters, offers and product news by email. We send marketing only where the law allows it.

8.2 Legal basis. We rely on your consent or, where the law permits, on the existing-customer rules (sometimes called a soft opt-in) for marketing to people who have bought from us. You can withdraw your consent at any time.

8.3 Unsubscribing. Every marketing email contains an unsubscribe link, and you may also write to [email protected] to opt out. We act on your request promptly.

8.4 Service messages. Unsubscribing from marketing does not stop service messages, such as receipts, access details, security alerts and notices of changes. We need to send these while you have an Account.

8.5 Email tracking. Our emails may include pixels that record whether you open an email and which links you click. You can block these by disabling the loading of images in your email program.

8.6 Segmentation. We may divide our email list into groups, for example by the Products you have bought and the topics that interest you, so that the emails we send are relevant to you.

8.7 Email service provider. We share your name, email address and preferences with our email service provider, which acts as a Processor on our instructions. We do not sell or rent our email lists.

8.8 Other channels. Where we offer text message or push notifications, we send them only if you opt in, and you may opt out at any time.

8.9 Suppression record. If you opt out, we keep a minimal suppression record so that we do not contact you again. Clause 13 explains how long we keep it.

8.10 Marketing laws. We follow the marketing laws that apply to us, such as the CAN-SPAM Act in the United States, Canada’s anti-spam legislation, and the electronic privacy rules in the European Economic Area and the United Kingdom.

8.11 Preferences. Where we offer a preference centre or Account settings, you can choose which topics you want to hear about. We respect your choice, and we do not treat it as a withdrawal of your consent to service messages.

8.12 Inactive subscribers. If you do not open or click our emails for a long time, we may remove you from our list. Clause 13 states the period.

9. Cookies and similar technologies

9.1 What Cookies are. Cookies are small text files that a website stores on your device, and similar technologies do the same job. We use four categories: strictly necessary Cookies, which the Website needs in order to work; functional Cookies, which remember your choices; analytics Cookies, which help us to understand how the Website is used; and marketing Cookies, which are used for advertising and measurement.

9.2 Consent. Strictly necessary Cookies do not need your consent. For all other Cookies we ask for your consent through our cookie banner, where Applicable Data Protection Law requires it.

9.3 No early setting. Where the law requires consent, we do not set non-essential Cookies before you have given it. If you do not consent, the Website still works, although some features may be limited.

9.4 Cookie settings. You can change your choice at any time through the cookie settings link in the footer of the Website. A change takes effect for future visits and does not delete Cookies that are already on your device.

9.5 Browser controls. You can also block or delete Cookies through your browser settings. The steps differ between browsers, so you should check the help pages of the browser that you use.

9.6 Global Privacy Control. We treat the Global Privacy Control signal as an opt-out of sale, sharing and targeted advertising where Applicable Data Protection Law requires it. You can turn it on through a browser or extension that supports it.

9.7 Full list. Schedule 1 lists the types of Cookies that we use, who provides them, what they do and how long they last. It forms part of this Privacy Policy.

9.8 Changes. The Cookies that we use change from time to time as the tools on the Website change. When they do, we update Schedule 1 and, where the law requires it, ask for your consent again.

9.9 Analytics and advertising. Clause 24 explains how analytics and advertising Cookies are used and how you can opt out of them.

10. Disclosure and sharing of Personal Data

10.1 Sharing only as needed. We share Personal Data only as needed for the purposes in this Privacy Policy. Our Processors act on our instructions and under a contract that requires them to protect the Personal Data and to use it only for the services that they provide to us.

10.2 Recipients. We share Personal Data with the following categories of recipients, only to the extent necessary for the purposes described in this Privacy Policy. We do not sell Personal Data for money. Clause 24 explains how advertising and measurement providers may receive data.

Category of recipient	Why we share Personal Data	Role of the recipient
Payment Processors, merchants of record and marketplaces	To take payment, deliver Orders, issue invoices, calculate tax, and handle refunds and disputes	Independent Controller (and, for some functions, Processor)
Hosting, database, storage and file-delivery providers	To host the Website and Products and deliver files securely	Processor
Course, learning-management and video-hosting platforms	To deliver Courses and video content and track progress	Processor, or independent Controller of its own account data
Email, messaging, customer-relationship and help-desk providers	To send communications, manage contacts and provide support	Processor
Analytics, advertising and measurement providers	To measure performance and, where permitted, to measure and optimise advertising	Processor or independent Controller, depending on the service
Scheduling, video-conferencing and recording providers	To run coaching sessions, webinars and live events	Processor
Affiliate platforms and payout providers	To track referrals and pay commissions	Processor or independent Controller
Code-hosting and software-delivery providers	To grant access to repositories, releases and updates	Independent Controller of its own account data
Artificial-intelligence service providers	To provide AI-assisted features, transcription, translation or support	Processor
Fraud-prevention, security and identity-verification providers	To detect fraud, abuse and sanctions risks	Processor or independent Controller
Professional advisers (lawyers, accountants, auditors, insurers)	To obtain advice, comply with law and manage risk	Independent Controller or Processor
Regulators, courts, law-enforcement and other authorities	To comply with law or lawful requests, or protect rights and safety	Independent Controller
A successor or counterparty in a corporate transaction	In connection with a merger, acquisition, financing or sale of assets	Independent Controller after the transaction

10.3 Legal disclosures. We may disclose Personal Data where a court order, a law-enforcement request or another legal obligation requires it, or where it is needed to establish, exercise or defend legal claims or to protect the rights, property or safety of any person. Where the law permits, we will tell you about such a request.

10.4 Corporate transactions. If we are involved in a merger, acquisition, financing or sale of assets, Personal Data may be transferred as part of it. We will tell you about a change of control, and the new owner will have to protect your Personal Data in line with this Privacy Policy.

10.5 With your consent. We may share Personal Data in other ways where you ask us to or where you have given consent. You may withdraw your consent as clause 15 explains.

10.6 Aggregated data. We may share aggregated or de-identified information that does not identify you, for example statistics about how many people use the Website.

10.7 Register of providers. Schedule 2 lists the categories of providers that we use, with examples. On request to [email protected], we will give you the names of the providers that we use at the time.

11. Third-party platforms and embedded content

11.1 Embedded content. The Website and Products may include embedded content, such as video players, social media posts, maps, forms and payment buttons. This content may set Cookies and send data to its provider when it loads, and the provider’s policy governs how it uses that data.

11.2 Links to other sites. The Website may link to websites and services that we do not operate. This Privacy Policy does not cover them, and you should read the privacy policy of any site that you visit.

11.3 Signing in with another account. If you choose to sign in or connect with a third-party account, that platform shares with us the data that you authorise it to share. You can usually change what is shared in the settings of that platform.

11.4 Fonts. Our Website loads fonts from Google Fonts, a service of Google. When you view a page, your browser requests the fonts from Google’s servers, which receive your IP address and device information. Google’s privacy policy explains how it handles this information.

11.5 Our choice of platforms. We choose the Third-Party Platforms that we use with reasonable care. We do not control them, and clause 10 and Schedule 2 describe how we share data with those that act on our behalf.

11.6 Controlling embedded content. You can limit the Cookies that embedded content sets through the cookie settings link in the footer and through your browser settings. Blocking embedded content may stop some pages from working as intended.

11.7 Video and social content. Where we embed a video player or a social media post, the provider may record that you viewed it and may combine that with the information it already holds about you. We ask for your consent to load such content where the law requires it.

11.8 Third-party sign-in data. We use data received through a third-party sign-in only to run your Account and to give you access to your Products. We do not use it to collect more data from the platform than you authorised.

11.9 Changes of provider. We may change the Third-Party Platforms that we use. When we do, we remain responsible for the data that we share, and we update Schedule 2 to describe the categories of providers.

12. International transfers

12.1 Where we operate. We and our providers operate in several countries, including countries outside the one where you live. Your Personal Data may therefore be Processed in a country whose data protection laws differ from those of your own country.

12.2 Lawful mechanisms. Where Applicable Data Protection Law restricts the transfer of Personal Data, we use a lawful mechanism. These include adequacy decisions, standard contractual clauses, the United Kingdom International Data Transfer Agreement or Addendum, the Swiss addendum, binding corporate rules, your explicit consent, and transfers that are necessary for a contract.

12.3 Privacy frameworks. Where a provider is certified under a framework for transfers between the European Union and the United States, the United Kingdom and the United States, or Switzerland and the United States, we may rely on that certification. We also require such a provider to protect Personal Data to the standard that Applicable Data Protection Law requires.

12.4 Copies of safeguards. You may ask for a copy of the safeguards that apply to a transfer by writing to [email protected]. We may remove commercially sensitive details before we provide it.

12.5 Payment Processor. The Payment Processor transfers Personal Data under its own arrangements, as clause 5 explains.

12.6 Other countries. The transfer rules of Brazil, Nigeria and South Africa are covered in the regional supplement in Schedule 5.

12.7 Our assessment. Before we rely on a mechanism, we consider whether the laws of the receiving country would stop the recipient from meeting its obligations. If they would, we apply further protections or choose a different provider.

12.8 Transfers inside a group. If we share Personal Data with a business that is under common ownership with us, we apply the same protections to the transfer as we apply to other transfers. We tell you about any such sharing in this Privacy Policy.

12.9 Your rights on transfers. You may ask us which countries your Personal Data is transferred to and which mechanism we rely on, by writing to [email protected]. We will answer in plain words, subject to the limits in clause 15.

12.10 Changes. If we change the countries to which we transfer Personal Data, or the mechanisms that we rely on, we will update this Privacy Policy. Where the law requires us to tell you or to ask for your consent first, we will do so.

13. Data retention

13.1 How long we keep Personal Data. We keep Personal Data only for as long as necessary for the purposes for which we collected it, including to satisfy legal, accounting or reporting requirements, to resolve disputes and to enforce our agreements. The table sets out our standard retention periods. We may keep Personal Data for longer where the law requires or permits it, for example where there is an ongoing dispute, claim or investigation.

Category of Personal Data	Standard retention period	Reason
Account data	For the life of the Account and twelve (12) months after closure	Contract; security; handling of late queries
Order, transaction and invoice records	Six (6) years from the end of the financial year to which they relate, or any longer period that tax or accounting law applying to us requires	Legal obligation (tax and accounting)
Refund, cancellation and chargeback records, including proof of effort	Three (3) years from the date of the request, or longer where needed for a claim or a dispute with the Payment Processor	Legal claims; fraud and abuse prevention
Learning and progress data, certificates	For the life of the Account and twenty-four (24) months after closure; certificate verification records for as long as the certificate is valid	Contract; certification; refund verification
Licence, activation and download logs; watermark records	Two (2) years after the licence ends, or longer for confirmed infringements	Protection of intellectual property; legal claims
Support and correspondence about an Order, Account, refund or Product	Three (3) years from the last communication	Customer service; legal claims
Marketing list and preferences	Until you unsubscribe, plus a suppression record that is kept so that we do not contact you again; inactive subscribers are removed after twenty-four (24) months	Consent; legitimate interests
Consent records	For the life of the consent and six (6) years afterwards	Accountability
Reviews, comments and testimonials	While the content is published, subject to the clause on comments, reviews and testimonials	Consent; legitimate interests
Coaching notes and recordings	Twelve (12) months after the engagement ends, or as agreed with you in writing	Contract; quality; legal claims
Affiliate records and tax documents	Six (6) years after the end of the relationship	Legal obligation
Website logs and security logs	Thirteen (13) months	Security; legitimate interests
Analytics and cookie data	As stated in Schedule 1, and in any case no longer than twenty-five (25) months	Consent; legitimate interests
Backups	Up to ninety (90) days after deletion from live systems	Business continuity
General enquiries sent through the Website contact form	Twelve (12) months after the enquiry is closed; if the message concerns an Order, an Account or a refund, the periods for Order and refund records and for support correspondence apply instead	Customer service; handling of follow-up questions; legal claims

13.2 How we decide. To decide how long to keep Personal Data, we consider its amount, nature and sensitivity, the risk of harm from keeping it, the purposes for which we Process it, whether we can reach those purposes in another way, and the legal requirements that apply. Where several periods could apply, we apply the longest one that the law requires.

13.3 Deletion requests and legal retention. If you ask us to delete your Personal Data or to close your Account, we will delete or anonymise it within thirty (30) days. We will keep only the data that we are required or permitted to keep, such as transaction, tax and accounting records, records needed for legal claims, records to prevent fraud and enforce licences, and a minimal suppression record for marketing opt-outs.

13.4 Restricted use of retained data. We restrict retained data to the purposes for which we keep it, and we delete it when the retention period ends. Closing an Account ends your access to Products and does not by itself entitle you to a refund.

13.5 Anonymised data. We may keep anonymised or aggregated data, which no longer identifies you, without time limit.

13.6 Backups. Deleted data may remain in backups for the period shown in the table. We do not use backups to restore data that you have asked us to delete, except where a restoration of our systems is needed, and we then delete the data again.

14. Security and Personal Data breaches

14.1 Our measures. We use reasonable measures, such as encryption of data in transit, access controls based on the principle of least privilege, hashed passwords, hosting with reputable providers, confidentiality commitments from staff and contractors, regular backups and periodic review of our practices. We choose these measures with regard to the risk, the cost and the nature of the data.

14.2 No guarantee. No method of transmission or storage is completely secure, and we cannot promise absolute security. You use the Website and share Personal Data at your own risk to that extent.

14.3 Your part. You should keep your login details confidential, use a strong password that you do not use elsewhere, and tell us at [email protected] if you think someone has used your Account without permission.

14.4 Our providers. We expect our Processors to use appropriate security measures, and we ask them to tell us promptly if they become aware of a breach that affects our Personal Data.

14.5 Breach response. If a breach of Personal Data occurs, we will assess it, contain it and work out its likely effect. Where Applicable Data Protection Law requires it, we will tell the Regulator and the people affected within the time that the law sets, which can be as short as seventy-two (72) hours under some laws.

14.6 Content of a notice. A breach notice will say what happened, what data was involved, what we are doing about it and what you can do to protect yourself. We will send it by email or by a prominent notice on the Website.

14.7 Review. After a breach, we review what happened and take steps to reduce the chance of it happening again.

14.8 Limits on access. We limit access to Personal Data to the people who need it to do their work, and we ask them to keep it confidential. We remove access when it is no longer needed.

15. Your rights and how to exercise them

15.1 Your rights. Depending on where you live and Applicable Data Protection Law, you may have the right to:

(a) be informed about how we Process your Personal Data;

(b) access the Personal Data that we hold about you;

(d) have your Personal Data erased;

(e) restrict the Processing of your Personal Data;

(f) receive your Personal Data in a portable format;

(g) object to Processing, including Processing for direct marketing and Processing based on legitimate interests;

(h) withdraw your consent at any time;

(i) not be subject to a decision based solely on automated Processing that has legal or similarly significant effects;

(j) opt out of sale, sharing, targeted advertising and profiling;

(k) limit our use of Sensitive Data;

(l) not be treated unfairly for exercising your rights;

(m) complain to a Regulator; and

(n) appeal a refusal of your request, where that right is available.

15.2 How to make a request. To exercise a right, write to [email protected]. Please tell us what you want and give enough detail for us to find your Personal Data.

15.3 Verifying your identity. We may ask you for information to confirm that you are the person whose Personal Data the request concerns. The checks that we make are in proportion to the request and the sensitivity of the data.

15.4 Authorised agents. You may ask another person to make a request for you. We may ask for written authority from you and may verify your identity directly.

15.5 Time for a response. We respond within one month of receiving a complete request. Where the law allows, we may extend that period, and we will tell you if we do. If the law of your region sets a shorter or longer period, that period applies.

15.6 No fee. We do not charge a fee for dealing with a request. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse it, and we will tell you why.

15.7 Limits on rights. Your rights are not absolute. We may limit or refuse a request where it would affect the rights of others, where we need the data for legal claims, where the law requires us to keep it, or where it would reveal a trade secret.

15.8 Retention and deletion. Clause 13 explains what we keep after you ask for deletion and why.

15.9 Effect of your choices. If you withdraw your consent or ask us to delete your Personal Data, we may be unable to provide some Products or Services, and your access may end. Doing so does not by itself entitle you to a refund, which our Terms of Use govern.

15.10 Complaints. If you are unhappy with how we handle your Personal Data, please contact us first at [email protected]. You may also complain to the Regulator in your country, and the regional supplements name the Regulators for the regions that they cover.

15.11 Appeals. If we refuse your request and the law of your region gives you a right to appeal, you may appeal by replying to our refusal and asking for a review by a different person. We will respond within the time that the law of your region sets.

15.12 Marketing and Cookies. You can exercise your rights over marketing and Cookies without making a formal request, by using the unsubscribe link in our emails and the cookie settings link in the footer of the Website.

16. Children

16.1 Age. The Website and the Products are for people aged eighteen (18) or over. We do not knowingly collect Personal Data from children.

16.2 Products designed for children. Where a Product is designed for children, it is sold to a parent or legal guardian, who must create the Account and make the purchase. We do not offer Accounts to children and we collect only the minimum Personal Data needed to deliver the Product.

16.3 Deleting a child’s data. If we learn that we hold Personal Data about a child without proper authority, we will delete it. We will take reasonable steps to do so promptly once we are aware of it.

16.4 Parents and guardians. A parent or guardian who has a concern about a child’s Personal Data may contact us at [email protected]. We will respond as clause 15 describes.

16.5 Children’s privacy laws. We respect the children’s privacy laws that apply to us, such as the Children’s Online Privacy Protection Act in the United States and the Age Appropriate Design Code in the United Kingdom, to the extent that they apply.

16.6 Age checks. We may ask you to confirm that you are aged eighteen (18) or over when you create an Account or place an Order. If we reasonably believe that a user is under that age, we may suspend the Account until we have checked.

16.7 Marketing to children. We do not direct our marketing at children. We do not knowingly add a child to a marketing list, and we remove any child whom we find on one.

17. Automated processing, profiling and artificial intelligence

17.1 Automated tools. We use automated tools for fraud screening, personalisation, email segmentation and licence monitoring. These tools help us to protect the Website and to send relevant messages, and they work on the categories of data described in this Privacy Policy.

17.2 No solely automated significant decisions. We do not make decisions that have legal or similarly significant effects on you solely by automated means without human review. Decisions on refunds and Accounts involve a person.

17.3 Human review. You may ask for a person to review any decision that affects you and that was made with the help of automated tools. Write to [email protected], and we will arrange a review.

17.4 AI features. Where we offer AI features, your inputs are sent to AI providers that act as Processors under contract. We do not use your private inputs or outputs to train general-purpose models unless you agree.

17.5 Accuracy of output. The output of an AI feature may be inaccurate. You should review it before you rely on it.

17.6 What you should not enter. You should not enter Sensitive Data, or the personal data of other people, into an AI feature unless you have a proper basis for doing so. Clause 23 explains your responsibilities where Products Process data about others.

17.7 Our own use of AI. We may use AI-assisted tools to create content and to support our work, such as drafting materials and answering support questions. Our internal use does not involve selling data.

17.8 Advertising profiles. Building profiles for advertising is covered by clause 24. You can opt out of it as that clause describes.

17.9 Consistency with the Terms. This clause matches the terms on AI features in our Terms of Use. If you want to know more about how an AI feature handles data, you may write to [email protected].

17.10 Training of models. If we ever want to use your private inputs or outputs to train a general-purpose model, we will ask for your agreement first. You can refuse without losing access to the feature that you use.

17.11 Safeguards for providers. The AI providers that we use are bound by contract to Process your inputs only to provide the feature to us, to protect them, and not to use them for their own purposes except as the law requires.

18. Reviews, comments and testimonials

18.1 Public content. Comments and reviews that you post are public. Your name, your avatar and the text of your comment may be visible to anyone who visits the page.

18.2 What not to post. You should not post Sensitive Data or the details of other people in a comment or review. If you do, we may remove it.

18.3 Testimonials. We use your name and likeness in a testimonial only with your consent. You may withdraw your consent for future use at any time by writing to [email protected].

18.4 Moderation. We moderate comments and reviews and may remove content that breaks our Terms of Use or that we think is inappropriate. Moderation involves a person reading the content.

18.5 Retention. We keep a comment, review or testimonial while it is published. Clause 13 describes the periods for related records.

18.6 Removal and anonymisation. You may ask us to remove or anonymise your content by writing to [email protected], subject to clause 13. We will act on a reasonable request within a reasonable time.

18.7 Comment Cookies. If you choose to save your details for your next comment, we set Cookies that remember them, as Schedule 1 describes.

18.8 Spam filtering. We may send a comment and the IP address from which it was sent to a spam-filtering service, which acts as a Processor on our instructions.

18.9 Responsibility for your content. You are responsible for the content that you submit. By submitting it, you confirm that you have the right to share any Personal Data that it contains.

18.10 Contact. If you have a concern about content that mentions you and that someone else has posted, you may write to [email protected], and we will consider removing it.

19. Coaching and consulting services

19.1 Application. Where we offer Coaching Services, this clause explains how we handle Personal Data in connection with them. It applies together with the rest of this Privacy Policy.

19.2 Data we collect. We may collect intake forms, your goals, notes about our sessions, scheduling data and, with notice to you, recordings of sessions. We collect what we need to provide the service and to keep a proper record of it.

19.3 Purposes. We use this data to prepare for and deliver sessions, to follow up with you, to keep records and to improve the quality of the service. We do not use it for advertising.

19.4 Confidentiality. We keep what you share with us confidential. We may disclose it only where the law requires it, where a competent authority asks for it, or where it is needed to protect someone from serious harm.

19.5 Recordings. We record a session only after we have told you that we will. We keep recordings for the period shown in clause 13.

19.6 Sensitive Data. You should not share Sensitive Data in a session unless it is necessary and you choose to do so. If you do, we use it only for the purposes of the session and treat it with particular care.

19.7 Providers. The scheduling and video-conferencing providers that we use act as Processors on our instructions. They may keep technical records of the sessions that they host, under their own terms.

19.8 No regulated professional relationship. Coaching Services do not create a regulated professional relationship, and what we collect is not kept as a clinical, legal or financial record. Our Terms of Use explain this in more detail.

19.9 Your rights. You may ask to see, correct or delete the notes we hold about you, as clause 15 explains, subject to the retention periods in clause 13.

19.10 Scheduling data. Our scheduling provider may record the time zone, the booking time and any message you add when you book. We use that data to confirm the session and to send reminders, and we keep it for the period in clause 13.

19.11 Sharing notes. We do not share the notes of your sessions with anyone else without your permission, except with our advisers where we need advice or as the law requires.

20. Affiliate and referral programme

20.1 Application. Where we offer an affiliate programme, this clause explains how we handle Personal Data in connection with it.

20.2 Data about affiliates. We collect the identity and contact details of Affiliate Partners, their tax and payout details, their referral links and information about the performance of those links. We use the data to run the programme and to meet our legal duties.

20.3 Data about referred visitors. When a visitor arrives through an Affiliate Partner’s link, a referral Cookie records the source. If the visitor buys, the Cookie lets us attribute the purchase to the Affiliate Partner.

20.4 Purposes. We Process this data to track referrals, calculate and pay commission, meet tax obligations and detect fraud. We do not tell Affiliate Partners the identity of the people who buy, except where it is needed for a purpose that the law allows.

20.5 Providers. The affiliate platform and the payout providers that we use act as Processors or independent Controllers, as the recipients table in clause 10 shows.

20.6 Duties of Affiliate Partners. Affiliate Partners must comply with privacy and marketing law when they promote our Products. They must not send us the Personal Data of people unless they have a lawful basis to do so.

20.7 Retention. We keep affiliate records and tax documents for the period shown in clause 13.

20.8 Payments to Affiliate Partners. To pay commission, we share an Affiliate Partner’s payout details with the payout provider. We may also hold the tax information that the law requires us to collect before we pay.

20.9 Disclosure of the relationship. Affiliate Partners must tell the people they promote to that they may earn commission. We do not control what an Affiliate Partner says, and we may end the relationship if they break these rules.

20.10 Your rights. An Affiliate Partner may ask to see or correct their data, as clause 15 explains, subject to the retention periods in clause 13.

21. Subscriptions and recurring billing

21.1 Application. Where we offer Subscriptions, this clause explains how we handle Personal Data in connection with them.

21.2 Renewal data. The Payment Processor holds the tokenised payment method that is used for renewals, and we do not see your full card details. We receive the status of each renewal and any failed payment.

21.3 Reminders and notices. We send renewal reminders and billing notices by email. These are service messages, and they are sent even if you have opted out of marketing.

21.4 Cancellations and failed payments. We keep records of cancellations and failed payments so that we can manage your access and answer questions. We use these records only for those purposes.

21.5 Retention. We keep Subscription records for the periods shown in clause 13.

21.6 Legal basis. We Process Subscription data to perform our contract with you, to meet our tax and accounting duties and, for security and fraud prevention, in our legitimate interests. Clause 4 sets out the legal bases in full.

21.7 Price changes and notices. When we notify you of a price change or an upcoming renewal, we use the email address on your Account. We keep a record of the notice so that we can show that we sent it.

21.8 Changing your payment method. If you change the payment method for a Subscription, the Payment Processor stores the new method and we receive only a confirmation. We do not see your full card details at any point.

21.9 Your rights. You may ask to see or correct the Subscription data that we hold, as clause 15 explains. You may cancel a Subscription at any time under our Terms of Use.

22. Software, apps and telemetry

22.1 Application. Where we offer Software or apps, this clause explains the data that they collect. It applies together with the rest of this Privacy Policy.

22.2 Licence checks. Software may check that its licence is valid and may record activation data. We use this data to run licences and to prevent unauthorised use, as clause 7 describes.

22.3 Diagnostic and crash data. Software may send diagnostic and crash data to us. We use it to find and fix faults and to improve stability.

22.4 Usage telemetry. Software may collect usage telemetry, which is limited to the categories that we describe in the Software or on its Product Page. Where the law requires your consent for telemetry, we ask for it, and telemetry is optional in that case.

22.5 Updates. Software may send us version and device data so that we can deliver the right update. We use this data only for that purpose.

22.6 Your files. We do not collect the content of your files through Software unless you choose to send it to us, for example when you submit it for support.

22.7 Turning telemetry off. Where the Software offers a setting to turn off telemetry, you can use it at any time. If you turn it off, some diagnostic features may not work.

22.8 Retention. We keep Software data for the periods shown in clause 13.

22.9 Legal basis. We Process Software data to perform our contract with you, to protect our Intellectual Property Rights and, for diagnostics and improvement, in our legitimate interests. Where the law requires your consent for telemetry, we rely on that consent.

22.10 Offline use. Some Software can work offline. Where it does, it may store data about its licence and use on your device and send it to us when it next connects to the internet.

22.11 Mobile apps. Where we offer an app for a mobile device, the app store through which you get it may collect data under its own terms. We do not control that collection.

22.12 Sharing. We share Software data only with the providers that help us to run the Software, such as those that host licence checks and receive crash reports, and who act as Processors on our instructions.

23. Users’ own data processed through Products

23.1 Application. Where Products process data that you provide about others, this clause explains the roles of the parties. For example, a Product may help you to keep records about your own customers.

23.2 You decide. You decide what data you put into a Product, and you are the Controller of it. We do not decide why that data is Processed.

23.3 Our role as Processor. If a Product Processes the data of your customers on your behalf, we act as your Processor. We do so under a data processing agreement, which we will provide on request to [email protected].

23.4 Your responsibilities. You are responsible for having a lawful basis to Process that data and for telling the people whose data you enter. You must not put in data that you have no right to use.

23.5 Our use. We do not use this data for our own purposes, except to provide the Product to you and to keep it secure. We do not look at it unless it is needed to provide support that you ask for.

23.6 Deletion. When your access to a Product ends, we delete this data, subject to the backup cycles described in clause 13. You should export what you need before your access ends.

23.7 Security. We apply the security measures in clause 14 to this data. We ask you to use strong credentials and to limit access to the people in your organisation who need it.

24. Analytics, advertising and retargeting

24.1 Analytics. We use Cookies and similar tools to measure traffic and to improve the Website. Where the tool offers it, we truncate or anonymise IP addresses so that they are less easily linked to you.

24.2 What analytics tells us. Analytics tells us which pages are visited, how people reach the Website and how long they stay. We use it to see what works and to fix problems, and we look at it in aggregate where we can.

24.3 Advertising and retargeting. We may use pixels and tags that allow advertising platforms to show our adverts and to measure conversions. This can involve sharing hashed identifiers and event data, such as the fact that you viewed a page or bought a Product.

24.4 “Sharing” and “targeted advertising”. Under some laws, this kind of activity may be considered “sharing” or “targeted advertising”. Schedule 4 and Schedule 1 explain how it is treated.

24.5 Your choices. You can opt out through the cookie banner, through the cookie settings link in the footer, and through the Global Privacy Control signal. You can also change the advertising settings of the platforms that you use, and use the industry opt-out sites that exist for advertising, which we describe here without endorsing any of them.

24.6 No sale for money. We do not sell Personal Data for money.

24.7 Custom and lookalike audiences. We use custom audiences and lookalike audiences only with the consent that the law requires. Where consent is not required, we still respect your opt-out.

24.8 Retention. We keep analytics and advertising data for the periods in Schedule 1 and clause 13.

24.9 Changes. If we change the analytics or advertising tools that we use, we update Schedule 1 and Schedule 2.

24.10 Platform controls. The advertising platforms that we use give you controls in your own account, such as the option to limit personalised adverts or to view and delete the data that the platform holds about you. Those controls are provided by the platforms, and their policies govern them.

24.11 Hashed identifiers. When we share a hashed identifier, such as a hashed email address, with an advertising platform, the platform may match it against its own records. We share these identifiers only where you have consented or where the law allows it.

24.12 Measurement. We use conversion measurement to find out whether our adverts led to a purchase. We look at the results in aggregate, and we do not use them to make decisions about individual people.

25. Webinars and events

25.1 Application. Where we offer webinars, live sessions or events, this clause explains how we handle Personal Data in connection with them.

25.2 Registration data. We collect your name, your email address, any question that you submit, whether you attend and, for a paid event, the payment data that the Payment Processor handles. We use this data to run the event and to follow up with you.

25.3 Providers. The video-conferencing provider that we use acts as a Processor on our instructions. It may record technical data about your connection.

25.4 Recordings. If you speak or appear on camera, you appear in the recording. You can turn off your camera and microphone to avoid this.

25.5 Replays. We store a replay of an event if the event page says that one will be available. We keep it for as long as it is offered.

25.6 Names. We share the names of speakers and attendees only as the person concerned permits.

25.7 Follow-up emails. We may send you follow-up emails about the event. Marketing emails need your consent or another basis that the law permits, as clause 8 explains.

25.8 Retention. We keep event data for the periods shown in clause 13.

25.9 Legal basis. We Process event data to perform our contract with you when you register, and, for recordings, we rely on your consent. For follow-up and improvement, we rely on our legitimate interests. Clause 4 sets out the legal bases in full.

25.10 Questions you submit. If you submit a question during an event, we may read it aloud with or without your name. Please do not include Sensitive Data in a question.

26. Website contact form

26.1 What we collect. When you use the contact form on the Website, we collect your name, your email address, the topic that you choose, your message, and the tick box that shows that you have read this Privacy Policy. The form tool on the Website and any spam protection also record technical data when the form is sent, such as your IP address, the date and time, browser information and spam signals.

26.2 Why we collect it. We collect this data to read and answer your message, to provide support, to keep a record of what was said, and to protect the Website from spam and abuse.

26.3 Legal basis. Our legal basis is our legitimate interest in answering enquiries and running the Website. Where your message concerns an Order, an Account or a request that you made before buying, our basis is also to perform or prepare a contract with you. Where the law requires your consent for a purpose, we rely on your consent, as clause 4 explains.

26.4 The tick box. The tick box confirms that you have read this Privacy Policy. It is not a request for your consent.

26.5 Your choice. You are not obliged to use the form. You may write to [email protected] instead.

26.6 Where it goes. We store messages in the database of the Website and send them by email to our support mailbox. The hosting provider of the Website, the email provider and any spam-protection service act as Processors on our instructions, as clause 10 and Schedule 2 describe.

26.7 Retention. We keep general enquiries for twelve (12) months after the enquiry is closed. Messages about an Order, an Account or a refund are kept for the longer periods shown in clause 13.

26.8 What not to send. Please do not send payment card details, passwords or Sensitive Data through the form. If you do, we use it only to respond to you.

26.9 Your rights. To see, correct or delete what you sent, write to [email protected]. Clause 15 explains how we deal with your request.

27. Regional supplements

27.1 The supplements. This Privacy Policy has three regional supplements, which add rights and information for people in particular regions: Schedule 3 covers the European Economic Area, Switzerland and the United Kingdom; Schedule 4 covers the United States; and Schedule 5 covers Nigeria, Canada, Australia, Brazil and South Africa.

27.2 Which prevails. For people whom a supplement covers, the supplement prevails over the main body of this Privacy Policy where the two differ. The supplements form part of this Privacy Policy.

27.3 To the extent the law applies. The supplements apply to the extent that the relevant law applies to us. A supplement does not mean that we accept that a law applies to us where it does not.

27.4 Other regions. If you live in a region that is not listed, you still have the rights described in clause 15 that the law of your region gives you. You may use the contact details in clause 29 to exercise them.

27.5 Choosing the right supplement. If more than one supplement could apply to you, for example because you live in one region and use the Website from another, the supplement for the region where you live applies first.

27.6 Updates to the supplements. We may update the supplements when the law of a region changes. Clause 28 applies to those updates.

28. Changes to this Privacy Policy

28.1 Updates. We may update this Privacy Policy from time to time, for example when we change our practices or when the law changes. We will post the updated version on the Website with a new “Last updated” date.

28.2 Notice of material changes. For material changes, we will tell you by email or by a prominent notice on the Website before they take effect. Where the law requires it, we will ask for your consent again.

28.3 Previous versions. You may ask for earlier versions of this Privacy Policy by writing to [email protected]. We will send you the versions that apply to the periods for which you ask.

28.4 Reviewing it. You should review this Privacy Policy from time to time to stay informed about how we handle Personal Data. Your continued use of the Website after a change takes effect does not take away your rights.

28.5 Changes that need your agreement. If a change would use your Personal Data for a new purpose that needs your consent, we will not apply it to you until you have agreed.

28.6 Where to find it. The current version of this Privacy Policy is always at https://www.scribecrest.com/privacy-policy/. The date at the top shows when it was last updated.

29. Contact, privacy requests and complaints

29.1 How to reach us. To exercise your rights or ask a question, contact us at [email protected]. Please put “Privacy request” in the subject line so that we can route your message quickly.

29.2 Complaints. If you have a complaint about how we handle Personal Data, please contact us first, so that we can try to put things right. You may also complain to the Regulator in your country, and the regional supplements name the Regulators for the regions that they cover.

29.3 Response times. We respond to requests within the times that clause 15 sets. We will tell you if we need more time and why.

29.4 Website. The Website is https://www.scribecrest.com.

29.5 Date of last update. This Privacy Policy was last updated on 12 October 2026.

29.6 Language. You may write to us in English. We will reply to the email address from which your message came, and we keep a record of the correspondence under clause 13.

29.7 Identity checks. We may need to confirm who you are before we deal with a request that concerns Personal Data, as clause 15 explains. We will not use the information that you give us for this check for any other purpose.

29.8 Escalating a complaint. If you are not satisfied with our reply, you may ask us to have it reviewed by a different person. You keep your right to complain to a Regulator at any time, whether or not you have used this step.

29.9 Requests by other people. If someone else writes to us about your Personal Data, we will not reveal it without your permission or another lawful basis. We may ask them for proof of their authority.

Schedule 1 – Cookie policy

This Schedule is our cookie policy. Cookies are small text files stored on your device; similar technologies include pixels, local storage and device identifiers. Strictly necessary cookies do not need your consent. For all other cookies we ask for your consent through our cookie banner, where Applicable Data Protection Law requires it, and you can change your choice at any time through the cookie settings link in the footer of the Website or through your browser. We honour the Global Privacy Control signal as an opt-out of sale, sharing and targeted advertising where Applicable Data Protection Law requires it. Blocking some cookies may affect how the Website works. The table lists the types of cookies we use; the exact cookies depend on the tools in use at the time.

Name or type	Provider and purpose	Category	Duration	First or third party
Session and login cookies	Our website platform or learning platform. Keep you logged in and identify your session	Strictly necessary	Session to 14 days	First party
Security and form-protection tokens	Our website platform. Protect forms and Accounts against forgery and abuse	Strictly necessary	Session	First party
Checkout and cart cookies	The Payment Processor. Support checkout and fraud prevention	Strictly necessary	Session to 12 months	Third party
Cookie consent record	Our consent tool. Remembers your cookie choices	Strictly necessary	Up to 12 months	First party
Preference cookies	Our website platform. Remember language, region and display settings	Functional	Up to 12 months	First party
Comment cookies	Our website platform. Remember your name, email address and website for your next comment, if you opt in	Functional	Up to 12 months	First party
Analytics cookies	Our analytics provider. Measure visits, pages viewed and traffic sources	Analytics	Up to 25 months	First or third party
Video player cookies	Our video host. Play and measure embedded video	Functional or analytics	Up to 12 months	Third party
Advertising pixels and cookies	Our advertising platforms. Measure conversions and enable retargeting	Marketing	Up to 12 months	Third party
Affiliate referral cookie	Our affiliate platform or Payment Processor. Attributes a purchase to the referring Affiliate Partner	Marketing	Up to 90 days	First or third party
Email tracking pixels	Our email service provider. Record whether an email was opened and which links were clicked	Analytics or marketing	Not applicable	Third party

S1.1 Managing Cookies through the banner. When you first visit the Website, a cookie banner asks for your choice about Cookies that are not strictly necessary. You can accept all of them, refuse them, or choose by category, and your choice is recorded so that we do not ask you again on every visit.

S1.2 Managing Cookies through the footer link. You can change your choice at any time by using the cookie settings link in the footer of the Website. If you withdraw your consent, we stop using the Cookies concerned for future visits.

S1.3 Managing Cookies through your browser. Most browsers let you see, block or delete Cookies. The steps differ between browsers and devices, so you should look at the help pages of the browser that you use. If you block all Cookies, including those that are strictly necessary, parts of the Website, such as signing in and checking out, may not work.

S1.4 Do Not Track. Some browsers send a “Do Not Track” signal. Not all browsers or sites support it, and there is no common standard for how to respond to it. We treat the Global Privacy Control as an opt-out signal, as described in this Schedule, and we do not treat a “Do Not Track” signal as a choice about Cookies.

S1.5 Local storage and device identifiers in apps. Some of our tools use local storage on your device, and Software or an app may use device identifiers instead of Cookies. They work in a similar way, and we treat them in the same way as Cookies under this Schedule. You can usually clear them through your browser settings or the settings of the app or your device.

S1.6 Changes to the list. The Cookies that we use depend on the tools that we use at the time, and they change when those tools change. We update this Schedule when the types of Cookies change in a way that affects you, and, where the law requires it, we ask for your consent again.

S1.7 Analytics and advertising. Clause 24 of this Privacy Policy explains how we use analytics, advertising and retargeting, and clause 9 explains Cookies in general. Both clauses form part of this cookie policy.

S1.8 Fonts. The fonts on the Website may be provided by a third party, and clause 11 explains what that means for your Personal Data.

S1.9 Questions. If you have a question about Cookies or want to know which Cookies are set on your device, you may write to [email protected]. We will tell you in plain words which tools are in use at the time.

Schedule 2 – Register of main service providers

The table lists the categories of providers we use, with examples of well-known providers in each category. The examples show the kind of provider; the providers we actually use at any time may differ, and we will give you the names of the current providers on request to [email protected].

Provider category	Examples	Role	Personal Data shared	Typical location	Transfer safeguard
Payment and merchant of record	Paddle, Lemon Squeezy, FastSpring	Independent Controller or Processor	Identity, contact, order, billing country, transaction data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Website hosting and database	WP Engine, Kinsta, SiteGround	Processor	Account, order, usage and log data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
File storage and delivery	Amazon Web Services, Cloudflare, Bunny	Processor	Product files, access and download data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Course or learning platform	Teachable, Thinkific, Kajabi	Processor or Controller	Account, enrolment, progress and video data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Email marketing and customer relationship management	Mailchimp, MailerLite, Kit	Processor	Name, email, preferences, email interaction data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Help desk and customer support	Zendesk, Freshdesk, Help Scout	Processor	Contact data, support messages	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Analytics	Google Analytics, Plausible, Matomo	Processor or Controller	Device, usage and cookie data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Advertising and measurement	Meta, Google Ads, TikTok	Controller or joint Controller	Device, usage, hashed identifiers, conversion events	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Video hosting and streaming	Vimeo, Wistia, Bunny Stream	Processor or Controller	Playback and device data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Scheduling and video conferencing	Calendly, Zoom, Google Meet	Processor	Name, email, session data, recordings	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Affiliate platform and payouts	Rewardful, FirstPromoter, or the built-in tool of the Payment Processor	Processor or Controller	Affiliate and payout data, referral attribution	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Code repository and software delivery	GitHub, GitLab	Independent Controller	Username, email, access status	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Artificial-intelligence services	OpenAI, Anthropic, Google	Processor	Prompts, inputs and transcripts as submitted by users	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Fraud prevention and identity verification	The Payment Processor’s own tools	Processor or Controller	Identity, device, IP, order data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Accounting and tax	Xero, QuickBooks, FreshBooks	Processor or Controller	Transaction and invoice data	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable
Fonts and content delivery	Google Fonts	Processor or Controller	IP address and device information (only if fonts are loaded from a third party; see clause 11)	United States, the EEA, the United Kingdom, or another country where the provider operates	Adequacy decision, standard contractual clauses or an equivalent mechanism, as applicable

S2.1 Purpose of the register. This register helps you to see the kinds of providers that Process Personal Data for us and why. It supports clause 10, which describes the categories of recipients, and clause 12, which describes international transfers.

S2.2 Examples only. The names in the “Examples” column are examples of providers in each category. They do not mean that we use every provider named, and they do not mean that any provider named endorses us.

S2.3 Roles. Where the register says that a provider is a Processor, it acts on our instructions. Where it says that a provider is a Controller, it decides for itself why and how it Processes the Personal Data that it holds, and its own privacy policy applies to that Processing.

S2.4 Fonts. The register lists Google Fonts because the Website loads fonts from a third party, as clause 11 states. If we host the fonts on our own server instead, this row will be removed.

S2.5 Keeping the register up to date. We review the register from time to time and update it when the categories of providers that we use change. The date at the top of this Privacy Policy shows when it was last updated.

S2.6 Requests. To ask which providers we use now, or for a copy of the safeguards that apply to a transfer, write to [email protected]. Clause 12 explains the safeguards.

Schedule 3 – Regional supplement A: European Economic Area, Switzerland and the United Kingdom

S3.1 Application. This supplement applies if you are in the European Economic Area, Switzerland or the United Kingdom. It adds to the main body of this Privacy Policy and, as clause 27 states, it prevails over the main body where the two differ. It applies to the extent that the relevant law applies to us.

S3.2 Controller and representative. We have appointed a person responsible for data protection matters, who can be contacted at [email protected]. Where Applicable Data Protection Law requires us to appoint a representative in the European Economic Area or the United Kingdom, we will do so and publish the contact details here.

S3.3 Legal bases. The legal bases on which we rely are set out in the table in clause 4. We have carried out an assessment of our legitimate interests for each purpose that relies on them, and you may ask for a summary of it by writing to [email protected].

S3.4 Your rights. Under the EU General Data Protection Regulation, the UK GDPR and Swiss law, you may have the right to:

(a) access your Personal Data and receive a copy of it;

(b) have inaccurate Personal Data corrected;

(d) restrict the Processing of your Personal Data;

(e) receive the Personal Data that you gave us in a portable format;

(f) object to Processing that is based on legitimate interests or that is for direct marketing;

(g) withdraw your consent at any time where we rely on it; and

(h) not be subject to a decision based solely on automated Processing that has legal or similarly significant effects.

S3.5 Time for a response. We respond to a request within one month. For complex or numerous requests, we may extend that period by up to two further months, and we will tell you within the first month and explain why.

S3.6 Marketing and Cookies. Under the electronic privacy rules that apply in the European Economic Area and under the Privacy and Electronic Communications Regulations in the United Kingdom, we ask for your consent before we set Cookies that are not strictly necessary. Where the law allows it, we may send marketing emails to existing customers about similar Products, and we give you a simple way to opt out in every message.

S3.7 International transfers. Where we transfer Personal Data out of the European Economic Area, the United Kingdom or Switzerland, we use the mechanisms described in clause 12. These include adequacy decisions, standard contractual clauses, the United Kingdom International Data Transfer Agreement or Addendum, and the Swiss addendum to the standard contractual clauses. You may ask us for a copy of the safeguards that apply.

S3.8 Complaints. You have the right to complain to the supervisory authority in the country where you live or work, or where you believe an infringement took place. In the United Kingdom, that authority is the Information Commissioner’s Office. In Switzerland, it is the Federal Data Protection and Information Commissioner. We would welcome the chance to deal with your concern first, so please contact us at [email protected] if you can.

S3.9 Children. The Website and Products are for people aged eighteen (18) or over. Because of this, the ages of digital consent that apply in some countries do not apply to our Products.

S3.10 Retention. The periods in clause 13 apply. Where national rules in a country require us to keep records for longer, we apply the longer period to those records.

S3.11 Automated decisions. The information in clause 17 applies to you. You may ask for human review of any decision made with the help of automated tools.

S3.12 Contact. To exercise any right in this supplement, write to [email protected]. Clause 15 explains how we verify your identity and respond.

S3.13 Switzerland. If you are in Switzerland, the Swiss Federal Act on Data Protection applies to our Processing of your Personal Data, and the rights above apply as that Act provides. Where the Act gives you a right that is not listed here, we will respect it.

S3.14 United Kingdom. If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply. Our references to the supervisory authority are, for you, references to the Information Commissioner’s Office.

S3.15 Consent. Where we rely on your consent, it must be freely given, specific, informed and unambiguous. You can withdraw it as easily as you gave it, and withdrawing it does not affect the lawfulness of Processing before the withdrawal.

S3.16 Objection to marketing. You have an absolute right to object to the use of your Personal Data for direct marketing. If you do, we stop using it for that purpose, and we keep only the minimal suppression record that clause 13 describes.

Schedule 4 – Regional supplement B: United States

S4.1 Application. This supplement applies if you are a resident of the United States, including California, Colorado, Connecticut, Virginia, Utah, Texas and Oregon, and other states with comprehensive privacy laws and similar state laws. It adds to the main body of this Privacy Policy and prevails over it where the two differ. It applies to the extent that the relevant law applies to us. In this supplement, “Personal Data” includes “personal information” as those laws use the term.

S4.2 Categories of Personal Data. The table shows the categories of Personal Data that we have collected in the last twelve (12) months and how we treat them.

Category	Examples	Collected	Disclosed for a business purpose	Sold or shared
Identifiers	Name, email address, IP address, device identifiers, advertising identifiers	Yes	Yes	Shared for cross-context behavioural advertising only if you accept advertising cookies
Customer records and commercial information	Order history, billing country, Products purchased, support messages	Yes	Yes	No
Internet or network activity	Pages viewed, links clicked, browsing on the Website, interaction with emails	Yes	Yes	Shared for cross-context behavioural advertising only if you accept advertising cookies
Geolocation (approximate, from IP address)	City or region derived from your IP address	Yes	Yes	Shared for cross-context behavioural advertising only if you accept advertising cookies
Audio, visual or similar information	Recordings of live sessions, and photographs supplied for testimonials	Yes, where you take part	Yes	No
Professional or employment information	Job title or business details that you give us	Yes, where you provide it	Yes	No
Education information	Enrolment, progress and completion in a Course	Yes	Yes	No
Inferences	Segments and interests drawn from your purchases and use of the Website	Yes	Yes	Shared for cross-context behavioural advertising only if you accept advertising cookies
Sensitive personal information	Account login credentials, which we store in hashed form	Yes	Yes	No

S4.3 Sale and sharing. We do not sell Personal Data for money. Advertising Cookies and pixels may count as “sharing” or “targeted advertising” under some state laws. You can opt out through the cookie settings link in the footer of the Website, through the Global Privacy Control signal, or by writing to [email protected].

S4.4 Your rights. Depending on your state, you may have the right to:

(a) know what Personal Data we collect and access it;

(b) delete your Personal Data;

(d) receive your Personal Data in a portable format;

(e) opt out of the sale of your Personal Data, its sharing for cross-context advertising, targeted advertising and profiling;

(f) limit our use of sensitive personal information; and

(g) not be treated unfairly for exercising your rights.

If we refuse a request, you may appeal within a reasonable time, and we will respond within sixty (60) days where state law provides for an appeal.

S4.5 How to make a request and how we verify it. To make a request, write to [email protected]. We verify a request by matching the information you give us with the information that we already hold. You may use an authorised agent, and we may ask for written proof of the agent’s authority and ask you to confirm your own identity. We respond within forty-five (45) days, and we may extend that period by a further forty-five (45) days if we tell you why.

S4.6 Shine the Light. California residents may ask us once a year for details of any Personal Data that we have disclosed to third parties for their own direct marketing purposes. We do not disclose Personal Data to third parties for their own direct marketing purposes.

S4.7 Do Not Track. We do not respond to browsers’ “Do Not Track” signals, except that we treat the Global Privacy Control as an opt-out signal as described in Schedule 1.

S4.8 Financial incentives. We do not offer financial incentives in exchange for Personal Data. If we ever do, we will give you a separate notice that explains it.

S4.9 Minors. The Website and Products are not directed to people under eighteen (18). We do not knowingly sell or share the Personal Data of anyone under sixteen (16).

S4.10 Retention. Clause 13 states how long we keep each category of Personal Data.

S4.11 Notice at collection. This Privacy Policy and Schedule 1 are our notice at collection. They tell you which categories of Personal Data we collect, why we collect them and how long we keep them.

S4.12 Disclosures for a business purpose. We disclose Personal Data for a business purpose to the categories of recipients in the table in clause 10. Those recipients are bound by contract to use the data only for the services that they provide to us.

S4.13 Contact. If you have a question about this supplement, write to [email protected].

S4.14 Authorised requests and household data. We process a request that relates to household data only where we can verify it for the whole household, or where the law permits us to act on part of it. We tell you if we cannot do so.

S4.15 Deidentified data. Where we hold deidentified data, we commit to maintaining it in that form and not to attempt to re-identify it, except where the law permits us to test our processes. We apply the same commitment to the service providers that handle it for us.

S4.16 Service providers and contractors. We disclose Personal Data for a business purpose only to service providers and contractors that are bound by contract to use it only to provide services to us. The contract also requires them to give the same level of protection to the data that the applicable law requires.

S4.17 No discrimination. If you exercise your rights, we do not deny you Products, charge you different prices, or give you a different quality of service because of it, except where the difference is reasonably related to the value of your Personal Data and the law allows it.

Schedule 5 – Regional supplement C: Nigeria, Canada, Australia, Brazil and South Africa

This supplement applies to people in the countries below to the extent that the relevant law applies to us. It adds to the main body of this Privacy Policy and prevails over it where the two differ.

S5.1 Nigeria: the law and your rights. If you are in Nigeria, the Nigeria Data Protection Act 2023 applies. You may have the right to be informed about our Processing, to access your Personal Data, to have it corrected or erased, to restrict or object to its Processing, to receive it in a portable format, to withdraw your consent, and not to be subject to a decision based solely on automated Processing.

S5.2 Nigeria: bases and transfers. We Process Personal Data on the lawful bases that the Act recognises, as the table in clause 4 shows. We transfer Personal Data out of Nigeria only where the recipient country or organisation provides adequate protection, or where another safeguard that the law allows applies.

S5.3 Nigeria: breaches and complaints. Where the law requires it, we will notify the Nigeria Data Protection Commission of a breach of Personal Data within seventy-two (72) hours. You may complain to the Nigeria Data Protection Commission, although we ask you to contact us first at [email protected].

S5.4 Canada: the law and your rights. If you are in Canada, the Personal Information Protection and Electronic Documents Act and provincial laws, including Quebec’s Law 25, may apply. We collect and use Personal Data for the purposes that we have described, and we ask for your consent where the law requires it. You may access your Personal Data and ask us to correct it, and you may withdraw your consent, subject to legal and contractual limits.

S5.5 Canada: Quebec. If you are in Quebec, our privacy contact is [email protected]. We assess the privacy risks of transferring Personal Data outside Quebec before we do so. Where the law provides, you also have the right to data portability and to ask that a link to your Personal Data be removed from search results.

S5.6 Canada: complaints and commercial email. You may complain to the Office of the Privacy Commissioner of Canada or to the provincial authority. We send commercial email only where Canada’s anti-spam legislation allows it, and in particular where we have the consent that it requires.

S5.7 Australia: the law and your rights. If you are in Australia, the Privacy Act 1988 and the Australian Privacy Principles apply. You may ask to access your Personal Data and to have it corrected.

S5.8 Australia: overseas recipients. Where we disclose Personal Data to a recipient overseas, we take reasonable steps under Australian Privacy Principle 8 to make sure that the recipient does not breach the Australian Privacy Principles in relation to it.

S5.9 Australia: complaints and spam. Please complain to us first at [email protected]. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner. We comply with the Spam Act 2003 when we send commercial email.

S5.10 Brazil: the law and your rights. If you are in Brazil, the Lei Geral de Proteção de Dados (LGPD) applies. The legal bases that we rely on include consent, performance of a contract, legal obligation and legitimate interest, as the table in clause 4 shows.

S5.11 Brazil: article 18 rights. Under article 18 of the LGPD, you may ask for confirmation that we Process your Personal Data and for access to it. You may ask for correction, for anonymisation, blocking or deletion, and for portability. You may also ask for information about the sharing of your Personal Data, for information about the consequences of refusing consent, for withdrawal of consent, and for review of automated decisions.

S5.12 Brazil: contact and transfers. The person responsible for data protection (the “encarregado”) can be reached at [email protected]. We carry out international transfers using the mechanisms that the LGPD allows, as clause 12 describes.

S5.13 Brazil: complaints and response times. You may complain to the Autoridade Nacional de Proteção de Dados (ANPD). Where the law sets a period, we give a full declaration within fifteen (15) days of a request.

S5.14 South Africa: the law and your rights. If you are in South Africa, the Protection of Personal Information Act (POPIA) applies, and we are the responsible party. We Process Personal Data in line with the conditions for lawful processing that the Act sets. You have the right to access your Personal Data, to have it corrected or deleted, to object to its Processing, to withdraw your consent, and to object to direct marketing.

S5.15 South Africa: transfers, contact and complaints. We transfer Personal Data across borders only where the Act allows it. Our information officer can be reached at [email protected]. You may complain to the Information Regulator, although we ask you to contact us first.

S5.16 Contact. To exercise any right in this supplement, write to [email protected]. Clause 15 explains how we verify your identity and respond.

S5.17 Nigeria: data subject requests. If you make a request under the Nigeria Data Protection Act 2023, we respond within the time that the Act sets or, if it sets none, within one month. We tell you if we need more time and why.

S5.18 Canada: openness. We make information about our policies and practices easy to understand and to find. You may ask for an explanation of how we handle your Personal Data by writing to [email protected].

S5.19 Australia: access and correction. We respond to a request to access or correct Personal Data within a reasonable period. If we refuse, we tell you why in writing and explain how to complain.

S5.20 Brazil: legitimate interest. Where we rely on legitimate interest, we do so only for purposes that are supported by a concrete situation, and we process the minimum data needed. You may ask for information about the balancing test that we applied.

S5.21 South Africa: openness and security. We take reasonable steps to make sure that you know what Personal Data we collect and why. We also apply the security safeguards that POPIA requires, and we tell the Information Regulator and the people affected if there is a compromise, as the Act requires.

S5.22 Consistency with the main body. The rights and processes in this supplement work together with clause 15. If a right in this supplement is wider than a right in that clause, the wider right applies to you.