GDPR & UK-GDPR

Data Controller & Representative

ArcProof is the data controller for personal data submitted through our platform. EU and UK data subjects can contact our representative at dpo@skilluparc.com.

Lawful Basis

• Contract (Art. 6(1)(b)) — account creation, course delivery, credential issuance.
• Legitimate interests (Art. 6(1)(f)) — product analytics, fraud prevention, security.
• Consent (Art. 6(1)(a)) — marketing emails, optional analytics cookies, AI proctoring.
• Legal obligation (Art. 6(1)(c)) — tax, accounting, lawful requests.

Your Rights

• Access, rectification, erasure, restriction, portability, objection.
• Withdraw consent at any time without affecting prior processing.
• Lodge a complaint with your supervisory authority (e.g., ICO in the UK, CNIL in France).
• Request human review of any automated decision (e.g., AI scoring of submissions).

Submit requests to privacy@skilluparc.com. We respond within 30 days.

International Transfers

Data may be processed in the United States and other regions where our subprocessors operate. We rely on the EU Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum, supplemented with technical measures (encryption in transit and at rest). See our subprocessor list.

Data Processing Agreement (DPA)

Educational institutions and enterprise customers can request a counter-signed DPA including EU SCCs and UK Addendum at trust@skilluparc.com.

Retention

Personal data is retained for the life of your account. On deletion request, identifying data is removed within 30 days; encrypted backups are purged within 90 days. Issued credentials remain verifiable via cryptographic hash unless you revoke them.