GDPR Compliance

Last updated: July 29, 2026

Our Commitment to Data Protection

We are committed to protecting the privacy and personal data of all individuals who interact with our platform, particularly those located in the European Economic Area. This page outlines how we comply with the General Data Protection Regulation and your rights under this framework.

Legal Basis for Processing

We process personal data only when we have a lawful basis to do so. The legal grounds we rely upon include:

• Contractual necessity: Processing required to fulfill our educational services contract with you
• Consent: Where you have explicitly agreed to specific processing activities
• Legitimate interests: For business operations, fraud prevention, and service improvement, where such interests do not override your rights
• Legal obligations: When required by applicable laws and regulations

Your Data Protection Rights

Under GDPR, you have comprehensive rights regarding your personal data:

• Right to access: Request copies of your personal data we hold
• Right to rectification: Request correction of inaccurate or incomplete information
• Right to erasure: Request deletion of your personal data under certain circumstances
• Right to restrict processing: Request limitation of how we use your data
• Right to data portability: Receive your data in a structured, commonly used format and transfer it to another service
• Right to object: Object to processing based on legitimate interests or for direct marketing purposes
• Rights related to automated decision-making: We do not engage in automated decision-making or profiling that produces legal or similarly significant effects

Exercising Your Rights

To exercise any of these rights, please submit a request to [email protected] with "GDPR Request" in the subject line. We will respond within one month of receiving your request, though this period may be extended by two additional months for complex requests.

We may require verification of your identity before processing your request to ensure we protect your personal information from unauthorized access.

Data Processing Activities

We process the following categories of personal data for the purposes specified:

• Identity data: Name and other identifiers for enrollment and service delivery
• Contact data: Email address for communication regarding your courses
• Educational data: Course selections, learning objectives, and proficiency assessments for instruction matching and program customization
• Technical data: IP address, browser information, and usage patterns for platform security and improvement

Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area. When we make such transfers, we ensure appropriate safeguards are in place, including:

• Standard contractual clauses approved by the European Commission
• Transfer to countries recognized by the European Commission as providing adequate data protection
• Other legally compliant transfer mechanisms as appropriate

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with legal obligations. Retention periods vary based on data type and purpose:

• Course enrollment and educational records: Duration of enrollment plus three years
• Communication records: Two years from last contact
• Technical and usage data: One year from collection

After these periods, we securely delete or anonymize your personal data.

Data Security

We implement technical and organizational measures to ensure appropriate security of personal data, including protection against unauthorized or unlawful processing and accidental loss, destruction, or damage. These measures include encryption, access controls, secure server infrastructure, and regular security assessments.

Data Protection Officer

For questions specifically related to data protection and GDPR compliance, you may contact our data protection officer at [email protected].

Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority, particularly in the European Economic Area member state where you reside, work, or where an alleged infringement occurred. A list of supervisory authorities is available at the European Data Protection Board website.

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our data processing practices or legal requirements. Material changes will be communicated through our website and, where appropriate, via email to registered users.

Contact Information

For questions or requests regarding GDPR compliance and data protection:

orchard-flow
Level 8, 140 William Street
Melbourne VIC 3000
Australia
Email: [email protected]