Legal
Privacy Policy
Effective date: 16 September 2026
1. Scope of This Policy
This Privacy Policy explains how SmartSec Academy collects, uses, stores, and protects personal information.
SmartSec Academy OÜ operates the website and supports the international SmartSec Academy service. SmartSec Academy Ltd supports the UK operation.
The relevant SmartSec Academy entity is responsible for personal information connected with the services it provides and the customer relationships it manages.
This policy applies only to information processed by SmartSec Academy. It does not cover third-party websites or services reached through outbound links.
- visitors to the SmartSec Academy website
- organisations using SmartSec Academy for cybersecurity awareness training
- employees and users enrolled in training programmes
- individuals who contact us or interact with our services
- certificate holders and individuals whose certificates are verified through our website
2. Information We Collect
SmartSec Academy collects information reasonably necessary to operate the website, fulfil purchases, deliver training, issue certificates, support organisations, and maintain service security.
2.1 Information You or Your Organisation Provide
- name and work email address
- organisation name
- role, department, or team, where relevant to training delivery
- purchased plan, seat entitlement, currency, access dates, and payment or order references
- learner enrolment and account information
- training progress, playback progress, completion, Final Check outcomes, and certificate records
- messages, enquiries, or support requests sent by email
2.2 Payment Information
Payments are processed by Stripe. SmartSec Academy receives order and payment references, purchaser details, plan and seat information, currency, payment status, and access dates needed to fulfil and administer the purchase.
SmartSec Academy does not receive or store full payment-card details through the website purchase flow.
2.3 Information Collected Automatically
When you use the website or platform, limited technical and operational information may be processed for functionality, security, service delivery, troubleshooting, and abuse prevention.
- IP address or a one-way hash derived from it for security controls
- browser, device, request, and session information
- access timestamps
- training-video playback events and watch progress
- security, authentication, delivery, and diagnostic information
2.4 Where Information Comes From
Information may come directly from a visitor, purchaser, customer administrator, or learner; from the organisation providing the learner’s access; or from the service providers used to complete a payment, authenticate an account, deliver an email or video, secure a request, or operate the platform.
SmartSec Academy does not purchase marketing lists or obtain learner data from public sources for the training service.
3. How We Use Personal Information
We do not sell personal data.
We do not use personal data for behavioural advertising, unrelated marketing, or decisions about employment, credit, insurance, legal rights, or regulatory compliance.
- fulfilling purchases and managing 12-month access entitlements
- creating and managing customer and learner access
- delivering training and recording video progress
- running the Final Check and confirming completion
- issuing, delivering, managing, and verifying certificates
- providing organisations with visibility into learner status
- sending service emails and operational notifications
- responding to enquiries and support requests
- maintaining website, platform, account, and administrative security
- troubleshooting and improving service reliability
- meeting contractual, legal, regulatory, accounting, or administrative obligations
- keeping appropriate business, security, and audit records
4. Training, Reporting, and Organisational Visibility
Where SmartSec Academy is used by an organisation, authorised customer administrators may receive information about their learners for training administration, assurance, and record keeping.
- whether a learner has been enrolled
- lesson and programme progress
- whether the Final Check and programme have been completed
- completion date
- certificate status and private certificate access
- relevant operational or completion records
5. Certificate Issuance and Verification
Certificates are issued only after the backend has confirmed completion of the required training and Final Check steps.
A private certificate contains the learner name, unique certificate ID, completion date, and valid-until date. It may be delivered to the learner and made available to authorised customer administrators, including through permitted historical account access after organisation training access expires. Operational copies or notifications may be available to authorised SmartSec Academy personnel.
A certificate’s 12-month validity runs from completion or issue and is separate from the organisation’s training-access period. Organisation access expiry does not automatically invalidate an otherwise-valid certificate.
Public verification uses a certificate ID and returns only Valid, Invalid, or Expired. It does not display the learner name, email address, completion date, or certificate document.
- confirm certificate authenticity
- maintain the certificate’s 12-month validity record
- avoid disclosure of unnecessary personal information in public verification
- support organisational assurance and audit needs
6. AI-Assisted Tools
6.1 SmartSecGPT
SmartSecGPT is a public information assistant. A visitor’s current question is sent through Cloudflare infrastructure to the OpenAI Responses API to produce a reply. Browser chat history is not forwarded.
SmartSecGPT requests use store:false, so OpenAI Responses application state is not deliberately retained for later retrieval by SmartSec Academy. OpenAI may separately process limited content under its applicable API abuse-monitoring and data-control arrangements.
Cloudflare Turnstile checks for automated misuse. A one-way hash derived from the request IP address is used for rate limiting and as a safety identifier; the plain IP address is not sent to OpenAI as that identifier.
SmartSecGPT does not provide cybersecurity training or personalised technical, legal, compliance, financial, or professional advice. Do not submit passwords, payment details, security credentials, sensitive personal data, or confidential business information.
6.2 Final Check
Final Check is part of the learner journey and is separate from SmartSecGPT. It sends the learner’s response to each of three behavioural scenarios to the OpenAI API for evaluation against a defined behavioural rubric.
The raw learner response is processed to produce an outcome, brief feedback, any permitted follow-up question, language information, and behavioural signals. SmartSec Academy stores the evaluation and completion records in Supabase; the raw response is not deliberately stored in the SmartSec Academy database.
Final Check requests use store:false. OpenAI may separately process limited content under its applicable API abuse-monitoring and data-control arrangements.
The AI evaluation does not make employment, legal, regulatory, compliance, credit, insurance, or similarly significant decisions. Authoritative programme completion is controlled separately by the SmartSec Academy backend.
7. Legal Basis and Required Information
The applicable basis depends on the purpose and the relationship with the individual or organisation.
Account, purchaser, learner, and payment-reference information required to create access, deliver training, administer the purchased entitlement, or issue a certificate is needed to perform the service. If required information is not provided, SmartSec Academy may be unable to create the account, allocate training, confirm completion, or issue the certificate.
Where consent is used for a non-essential technology, consent may be withdrawn through the available consent control. Withdrawal does not affect processing that occurred before withdrawal.
- contract: fulfilling purchases, providing access, delivering training, recording completion, and issuing certificates
- legitimate interests: service security, fraud and misuse prevention, operational administration, troubleshooting, audit records, and service reliability
- legal obligation: records or disclosures required by applicable accounting, tax, court, regulatory, or other legal requirements
- consent: non-essential cookies or optional communications where consent is the selected basis
8. Data Sharing and Disclosure
SmartSec Academy does not sell personal data.
Service providers are expected to process personal information only as needed to provide their services and subject to appropriate confidentiality, security, or contractual obligations.
- with the organisation sponsoring or managing the training
- with trusted service providers who support website, platform, payment, hosting, security, analytics, communication, or certificate operations
- where required by law, regulation, court order, or legal process
- where necessary to protect the security, rights, or legitimate interests of SmartSec Academy, users, or others
9. Third-Party Service Providers
SmartSec Academy uses service providers to operate the website and training platform. They process information according to their role, SmartSec Academy’s configuration, and their applicable contractual and privacy terms.
Legacy certificate assets may still be requested from Webflow’s content-delivery service; Webflow is not the current application host.
- Cloudflare: website delivery, Workers, video streaming, security, Turnstile, and founder-access controls
- Stripe: hosted checkout and payment processing
- Memberstack: customer and learner accounts, authentication, password handling, and sessions
- Supabase: operational database records
- Resend: service email delivery and delivery status
- Cookiebot: public-site consent preferences
- Google Workspace: authorised founder identity used through Cloudflare Access
- OpenAI: SmartSecGPT responses and Final Check behavioural evaluation
10. Cookies and Similar Technologies
SmartSec Academy uses cookies and similar technologies for consent preferences, essential authentication sessions, platform security, video delivery, and abuse prevention.
No dedicated advertising pixels or behavioural-advertising tools are currently configured on the website or training platform.
Cookiebot manages consent preferences for non-essential technologies on public pages. Essential account and security technologies may operate where required for login, access control, or misuse prevention.
For more information, please refer to our Cookies Policy.
11. Data Retention
Retention depends on the type of record and why it is required. SmartSec Academy does not claim that every record is deleted automatically when an account is deactivated or organisation access expires.
After organisation training access expires, the customer may retain a read-only historical account view containing permitted learner, completion, and certificate information. Customer, learner, order, progress, completion, certificate, assessment, security, and audit records may be archived and retained where needed for service delivery, certificate verification, organisational records, accounting, security, dispute handling, or other legitimate and applicable requirements.
Deletion, correction, restriction, or anonymisation requests are assessed against the relevant record, the customer relationship, certificate integrity, and any applicable legal, contractual, accounting, security, or operational need. A fixed retention period is not stated where one has not been operationally established.
- deliver and administer training access
- maintain completion and certificate records
- support public certificate verification
- respond to enquiries or rights requests
- meet contractual, accounting, tax, audit, or other applicable requirements
- protect against misuse, disputes, fraud, or security incidents
12. Data Security
SmartSec Academy implements appropriate technical and organisational measures to protect personal information.
While no online system can guarantee absolute security, we take reasonable and proportionate steps to protect personal information against unauthorised access, loss, misuse, alteration, or disclosure.
- access controls
- secure systems and infrastructure
- controlled certificate issuance and verification processes
- use of reputable service providers
- website and platform security measures
- administrative safeguards and limited access to personal information
13. International Data Transfers
SmartSec Academy operates through Estonian and UK entities and uses service providers whose infrastructure or support operations may be located in different countries.
The location and transfer arrangement depends on the provider, service configuration, and customer relationship. Where an applicable transfer requires safeguards, SmartSec Academy relies on the relevant provider and contractual arrangement rather than claiming that all processing occurs in one country.
Contact [email protected] to request current information about the safeguards relevant to a particular service or transfer.
14. Your Rights
Depending on your location, the processing purpose, and the applicable law, you may have rights in relation to your personal information.
Requests can be made to [email protected]. SmartSec Academy may need to verify your identity and, where an organisation supplied or manages the record, coordinate with that organisation.
Where processing is based on legitimate interests, you may object to that processing. The request will be considered against the specific purpose, applicable rights, and any compelling legitimate grounds or legal requirements.
You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at aki.ee, the UK Information Commissioner’s Office at ico.org.uk, or another competent supervisory authority available to you under applicable law.
- access your personal information
- request correction of inaccurate or incomplete information
- request deletion of personal information, subject to applicable limits
- object to processing based on legitimate interests
- request restriction of processing
- request a copy in a portable format where the right applies
- withdraw consent where processing is based on consent
- complain to a competent supervisory authority
15. Organisational Training Users
If your access to SmartSec Academy was provided by your employer or another organisation, some requests may need to be handled together with that organisation.
For example, requests relating to training enrolment, completion records, or certificate status may involve both SmartSec Academy and the organisation responsible for managing the training relationship.
16. Children
SmartSec Academy’s core business training services are intended for organisations and working-age users.
Our services are not intended to knowingly collect personal information from children through the business training platform.
If we become aware that personal information has been collected from a child without appropriate authority or consent, we will take reasonable steps to delete or manage that information appropriately.
17. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements, third-party providers, or operational practices.
The latest version will always be published on our website.
18. Contact
For privacy-related questions or requests, contact: [email protected]
SmartSec Academy OÜ — registry code 17390985; registered address: Tartu mnt 67/1-13b, Tallinn 10115, Estonia.
SmartSec Academy Ltd — company number 16939562; registered in England and Wales; registered office: 167–169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom.