Privacy & Cookie Policy

1. Introduction & Data Controller

Security Quotient is committed to protecting the privacy and security of your personal data. Because we operate globally, the specific legal entity acting as your Data Controller depends on your location and contracting entity:

• Singapore: Cyber Security Quotient Pte. Ltd. | 160 Robinson Road #14-04 068914
• India: Security Quotient Pvt. Ltd.
  Registered Office: CLRA 70, Opp: Kodankulangara School, Tripunithura, Ernakulam, Kerala 682301
  Operating from: COORBIT, 10th Floor, Noel Focus, Seaport-Airport Road, Kakkanad, Ernakulam, Kerala 682037
• UAE: Security Quotient L.L.C-FZ | Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai
• Malaysia: Security Quotient Sdn. Bhd.
  Registered Office: 7-2, Plaza Danau 2, Jalan 2/109f, Taman Danau Desa, Kuala Lumpur 58100
  Operating from: Regus, Level 3, Menara Axis, 2, Jalan 51a/223, Seksyen 51a, Petaling Jaya, Selangor 46100

2. Information We Collect

We collect information directly from you, automatically through our platform, and from your employer (if they provide you with an enterprise subscription). This includes:

• Identity & Contact Data: Name, business email, company name, phone number, and job title.
• Platform Usage Data: Course progress, quiz scores, certificate issuance dates, and audit trail logs required for compliance reporting.
• Technical Data: IP address, browser type, operating system, and login timestamps.

3. How We Use Your Information

We process your personal data for the following purposes:

• To provide, manage, and host your Learning Management System (LMS) access.
• To generate auditor-ready reports and compliance certificates for your organization.
• To detect, prevent, and investigate fraud or security breaches.
• To communicate important service updates, policy changes, or account notices.

4. Cookie & Tracking Technology Policy

Our website and LMS use cookies and similar tracking technologies to function securely and improve user experience. We categorize these as:

• Strictly Necessary Cookies: Essential for platform security, user authentication, and basic LMS functionality. These cannot be disabled.
• Performance & Analytics Cookies: Help us understand how visitors interact with our website (e.g., page views, traffic sources) using aggregated, anonymous data.

Managing Cookies: You can instruct your browser to refuse all non-essential cookies or to indicate when a cookie is being sent. However, disabling essential cookies may prevent you from logging into our training platform.

5. Data Sharing & International Transfers

We do not sell your personal information. We only share your data with:

• Your employer or the organization that provisioned your access (for compliance and progress reporting).
• Authorized third-party service providers (e.g., cloud hosting, email delivery) who are bound by strict data processing agreements.
• Law enforcement or regulatory bodies when strictly required by law.

International Transfers: Personal data may be stored or processed across our regional entities or by our secure cloud providers (e.g., AWS). We ensure appropriate safeguards, such as Standard Contractual Clauses, are in place for cross-border transfers. Note: Customers utilizing our "Data Sovereignty" add-on will have their training data localized to their specified region.

6. Data Security & Retention

We implement industry-standard technical and organizational measures to protect your data from unauthorized access, loss, or alteration. We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy, typically for the duration of your active subscription plus any legally required accounting or compliance retention periods.

7. Your Privacy Rights

Depending on your jurisdiction (e.g., under the GDPR, DPDP Act, or UAE PDPL), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your personal data (Right to be Forgotten), subject to legal and contractual constraints.
• Restrict or Object to certain types of processing.
• Export your data in a structured, machine-readable format.

If your access is provisioned by your employer, you may need to route specific data requests (like deletion) through your organization's LMS administrator.