Data Processing Agreement

1. Scope

This Data Processing Agreement applies whenever Skillsolutions for Management Consultancy ("Processor") processes personal data on behalf of a customer organization ("Controller") using the SkillHQ platform. It forms part of the Terms of Service and takes precedence where the two conflict on data-protection matters.

2. Roles and responsibilities

Under this DPA:

• The customer is the Controller of personal data it uploads or generates on the platform.
• Skillsolutions is the Processor acting on the Controller's documented instructions.
• Each party is responsible for its own compliance with the data protection law that applies to it (for example the GDPR, or the personal data protection laws of Bahrain, Saudi Arabia, the UAE or Oman) in its respective role.
• The Controller must ensure its underlying legal basis for the processing (consent, contract, legitimate interest, etc.).
• The Controller sets, in its platform settings, the retention period after which switched-off Users are anonymized (2, 3 or 5 years, or never; never under 2 years), and whether two-step sign-in is required for its owner, admin and manager accounts.

3. Subprocessors

We maintain a current list of subprocessors on our public subprocessors page. Customers are notified at least 30 days before we engage a new subprocessor or make a material change.

4. International transfers

Personal data is hosted outside most customers' countries: the database and the application servers in India (Mumbai region, Amazon Web Services and Vercel), transactional email in the European Union (Ireland), and the error-monitoring and AI subprocessors in the United States. Customer accepts these locations by subscribing and, as controller, is responsible for any notices, consents or approvals its applicable law requires for these transfers (for example, individuals' express consent under the laws of the Sultanate of Oman). Where the GDPR or UK law applies, we rely on the EU Standard Contractual Clauses (2021/914, Module 2) and, where applicable, the UK International Data Transfer Addendum. For customers in the Kingdom of Saudi Arabia, the standard contractual clauses issued by the Saudi Data & AI Authority (SDAIA) are available as an annex on request. Supplementary measures are in place for each subprocessor.

5. Technical and organizational measures

We maintain the following safeguards:

• Encryption in transit (TLS 1.3) and at rest (AES-256).
• Role-based access control with the principle of least privilege.
• Your organization's owner can require two-step sign-in for every owner, admin and manager account.
• Audit logging of all sensitive operations.
• Daily backups with point-in-time recovery (7 days) and retained snapshots (30 days).
• Annual security and privacy training for all staff with access to customer data.
• Support access: Skillsolutions support staff may view a User's account read-only to investigate and fix issues. Each view requires a stated reason and two-step sign-in, is limited to 30 minutes, cannot change, send, download or export anything, excludes private 1:1, mentoring and coaching content, and is logged page by page. The log is kept for as long as the Controller's account exists (the IP address and device details in it are removed after 90 days) and is available to the Controller on request.
• Retention: the personal details of switched-off Users are removed after the Controller's chosen period (section 2); learning records continue without the name. Answers given inside courses and tests are kept with the learning record for as long as the Controller's account exists, and stay without the name once a person is anonymized. IP address and device details are removed from sign-in logs after 90 days.

6. Data subject rights

We provide tools for the Controller to fulfill data subject requests directly: Users can download their own data (My account › Your data); the Controller's administrators can correct a person's details, delete an account (personal details removed, learning records kept without the name), and remove a person's name from a certificate on request. Where a request cannot be fulfilled through in-product features, we assist the Controller within the deadline its applicable law sets (30 days under the GDPR, or shorter where the Controller's law requires).

7. Breach notification

We will notify the Controller without undue delay, and in any case within 72 hours of becoming aware, of any personal data breach affecting the Controller's data, with the information the Controller needs for its own notification to its authority and to affected individuals. Our incident response procedure includes containment, impact assessment, Controller notification, and support for the Controller's regulatory notification where required.

8. End of the agreement (exit procedure)

When the Controller's subscription ends, by termination or non-renewal: (a) Export. For 30 days after the end date, the Controller can download its data: people lists and training records, test results and certificates (Reports › Download and People), its own course files, and each User's own data download (My account › Your data). (b) Deletion. We do not delete a Controller's data automatically. To have it deleted, the Controller's owner asks us in writing by email to support@skillsolutions.io. Skillsolutions then deletes the Controller's personal data from the live platform (User accounts, learning records, test and course answers, uploaded files and settings) and records the deletion. (c) Backups. Backups that still hold the data expire within a further 30 days (database snapshots are kept for 30 days, point-in-time recovery for 7 days); backups are restored only to recover from a failure, in which case the deletion is repeated. (d) Subprocessors. Data held by our subprocessors expires under their own periods (Resend 30 days, Sentry 90 days; the AI providers retain nothing). (e) Written confirmation. After deletion we send the Controller's primary contact written confirmation of what was deleted and when. (f) What we keep. Invoices, contracts and tax records required by Bahrain law (5 years); the anonymized aggregate statistics described in the Privacy Policy; and certificates with their verification pages (name, course and date), which keep working so the people who earned them can still prove their achievement. (g) Longer retention. If the Controller asks in writing before it requests deletion (for example for a pending transfer), we keep its data for the agreed period instead, under the same safeguards.