PRIVACY NOTICE

Last updated January 20, 2025

This privacy notice for getTWOit Platforms ('Company', 'we', 'us', or 'our',), describes how and why we may collect, store, use, and/or share ('process') your information when you engage with us in relation to what we provide (our 'Products'), such as making enquiries, entering a contract or engage with us in other ways, including any sales, marketing, events, competitions, surveys, queries or complaints.

SUMMARY OF KEY POINTS

What personal information do we process?

When you engage with us we process personal information depending on how you interact with us and the Products, the choices you make, and what you ask, choose, order or use. The information is that which you provide us personally and other information generated during the relationship including through cookies or obtained from third parties. You may disable cookies but that may impact on how you interact with us or our Products.

How do we process your information?

We process your information to provide our Products to you, improve, and administer them, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. If you choose to register with us or log in to our Products using a social media account, we may have access to their information about you. We will not do any profiling without notifying you.

Do we share personal information?

We may share information in specific situations and with specific third parties in relation to the Products and other information you may request from time to time. Some third parties are based outside the UK/EEA and where that is the case we ensure that appropriate legal protections are in place.

How do we keep your information safe?

We have appropriate and proportionate organisational and technical processes and procedures in place to protect your personal information.

What are your rights?

privacy law means you have certain rights regarding your personal information. See the Full Privacy notice for details on this.

How do you exercise your rights?

The easiest way to exercise your rights is by emailing us here, or by contacting us at our address. We will consider and act upon any request in accordance with applicable data protection laws.

OUR FULL PRIVACY NOTICE FOLLOWS

FULL PRIVACY NOTICE

This Privacy Notice explains how we collect and process your personal information through our websites, devices, Products, interactions, third parties and applications (together "Our Products").

This Privacy Notice does not apply to any website, application, product, or service that links in our Privacy Notice to its own Privacy Notice.

Who are we?

We are the data controller of your personal information where we determine how and why your personal information is to be used. This Privacy Notice does not apply where we act as a data processor to another controller.

The personal information we may collect and process

Generally, we collect and use the following categories of personal data. How we interact with you will determine the kinds of data we collect and how we use it:

Category of Personal Data collected	What this means
Basic Identity Information	includes email, first name, last name, residential address, telephone number, username
Professional Information	includes certifications, degrees earned, job descriptions, job titles, languages spoken, schools attended, technical skills

Social Media Login Data

Where we provide you with the option to register with us using your existing social media account details, like your Facebook, X, or other social media account, we will collect the information described below.

Our Services offer you the ability to register and log in using your third-party social media account details (like your Facebook or X logins). Where you choose to do this, we will receive certain profile information about you from your social media provider. The profile information we receive may vary depending on the social media provider concerned, but will often include your name, email address, friends list, and profile picture, as well as other information you choose to make public on such a social media platform. We may use this to find lookalike audiences.

We will use the information we receive only for the purposes in this privacy notice or that are otherwise made clear to you at the time. We do not control uses of your personal information by your third-party social media provider.

A note on children's privacy

We do not knowingly collect any personal information from children (under the age of sixteen (16)).

We collect personal information these ways:

• Direct Interactions: You provide your personal information when you interact with us, such as when you buy our goods or Products, fill in forms or otherwise communicate with us.
• User Contributions: We collect your personal information when you or others upload, share, send, that to us, or when you or they communicate with us.
• Automatically: We automatically collect personal information about you when you interact with us, such as when you buy our Products visit our offices or events, open emails, view advertisements from us, or communicate with us. We may collect some of this personal information by using cookies and other similar technologies over our website or in the email or social media interactions.
• Third Party or Publicly Available Sources: We may receive your personal information from third parties, such as our third party business partners (including credit reference agencies, data brokers and advertising partners), your organisations, government and other authorities who publish publicly available records, and other publicly or generally available sources (including online websites).

• Customer Interactions - Interaction data
• Email Registration - Signing up to the platform
• Onboarding Process - To share personal data to communities

What we do with your personal information

These are the main purposes for which we use your personal information and the different legal bases we rely on for processing that personal information.

Purpose	Category(ies) of Personal Data involved	Why we do this?
Account Creation	Basic Identity Information	To establish user accounts that allow access to micro-credentials and community features.
Customer Services	Basic Identity Information	To provide personalized support and communication to users engaging with micro-credentials.
Human Resources	Professional Information	To manage employee information for those working to develop and maintain the community platform and micro-credentials.
Job	Professional Information	To recruit and select qualified personnel to support the development and management of micro-credentials.
Payroll	Professional Information	To process compensation for employees involved in the platform and micro-credential services.
Third-party Services	Basic Identity Information	To integrate additional services that enhance the user experience on the community platform for micro-credentials.

What are the GDPR Lawful bases for us processing your personal data?

The specific lawful basis depends on the manner of our interaction and your choices but consist of:

• To answer pre-contract enquiries - so where you ask for a brochure or send an enquiry email for example;
• To enable us to perform the contract - here we will need to use personal data in order to fulfil our contract with you, to keep in touch for service purposes and to administer the contract to its end;
• For Legitimate interests - this is where we need to use your personal data for a proper reason related to our business, and our arrangements with you, such as send you postal marketing, or use third party systems or services, or to detect or prevent fraud;
• Where we are under a legal obligation - this is where we need to comply with the law, such respond to HMRC, Regulators, fulfil an order of the Court of other legal necessity;
• Where you have given consent - this can be a range of things and we will have asked you at the time;
• To protect your or another's vital interests - this is where we need to disclose information to protect you or another person, or to detect or prevent fraud

We may share your personal information with these parties or categories

Your employer (if you sign up for a business service),
Your next of kin, your linked organisations, Social Media providers and contacts.
Any other company in our Group of companies.
Third party business partners that support our business, such as vendors and subcontractors, analytics providers, advertising and marketing agencies, credit agencies, lawyers, insurers, accountants, other advisers and other third parties we engage.
Third parties to market their products or our Products to you.
With governmental agencies and third parties involved in our sale or purchase of a business
With law enforcement, government agencies, or other third parties in order to comply with any law, court order, legal request, or other legal process, as well as to enforce our agreements or protect the rights, property, or safety of our business, employees, customers, or others (including for the purposes of cybersecurity, fraud protection, and credit risk reduction).
With others when necessary to fulfil your consents or to follow your instructions.

We share with these specific organisations for the reasons stated:

Software Name	Category of Personal Data involved
ChargeBee	Basic Identity Information
Cloud Storage For Firebase	Basic Identity Information, Professional Information
Sendgrid	Basic Identity Information
Stripe	Basic Identity Information
Google Drive	Basic Identity Information, Professional Information

Where your personal information is stored

We use the products or services of third parties who may have their operational centres or computing facilities abroad. Whilst we endeavour to ensure they process your data in the UK/EEA, where they a global organisation (such as Google or Amazon) your personal information may be transferred outside the UK/EEA and may be stored in and accessed from multiple countries, including the United States. When you interact with us, you authorise us to transfer your personal information to such places and you acknowledge there is a risk that some countries may provide less protection than our country’s privacy laws. We ensure these third parties have appropriate contractual safeguards in place in accordance with UK law.

What steps do we take to secure personal information?

We work to implement suitable technical and organisational measures to protect the security of personal information. However, nothing that connects to the internet now is 100% secure, and we cannot its guarantee security. The security of your information also depends on you applying suitable cyber hygiene to your devices. We are not responsible for the circumvention of any privacy settings or cybersecurity measures, and any transmission of personal information is at your own risk.

How long we keep personal information

We retain personal information as required by law, which is usually 6 years from the date of our last interaction but is based upon the time the personal information is needed to: (a) fulfil the purposes described in this Privacy Notice, (b) meet the timelines required or recommended by regulators, professional bodies, or associations, (c) comply with applicable laws, legal holds, and other legal obligations (including contractual obligations), and (d) comply with your requests.

Your rights

Request access to your Personal Data. This is commonly known as a "data subject access request" and enables you to receive a copy of the Personal Data we hold about you and to check that we are lawfully processing it.

Request correction of the Personal Data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.

Request erasure of your Personal Data. This enables you to ask us to delete or remove Personal Data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Data where you have exercised your right to object to processing (see below). Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Object to processing of your Personal Data. This right exists where we are relying on a Legitimate Interest (or those of a third party) as the legal basis for our processing and there is something about your particular situation, which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your Personal Data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Request the restriction of processing of your Personal Data. This enables you to ask us to suspend the processing of Personal Data about you, for example if you want us to establish its accuracy or the reason for processing it.

Request the transfer of your Personal Data. We will provide to you, or a third party you have chosen, your Personal Data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw consent. This right only exists where we are relying on consent to process your Personal Data ("Consent Withdrawal"). If you withdraw your consent, we may not be able to provide you with access to the certain specific functionalities of our Platform. We will advise you if this is the case at the time you withdraw your consent.

Our contact details for you to exercise Your Rights

You may opt-out of our marketing communications at any time by clicking the 'unsubscribe' link in at the end of our marketing emails or by sending us an "opt-out" text message, following the instructions we provide you in our initial text.

When you indicate that you do not wish to be contacted by us for marketing purposes, we will retain your details on a 'do not contact' list to help ensure that we do not contact you accidentally. However, we may still need to retain data for these reasons (but not limited to): Processing payments; To meet legal obligations we have to you and others; Providing you with information you need in order to participate in an activity or event for which you have registered; Explaining and apologising where we have made a mistake; and Dealing with future legal claims in connection with a contract we have with you

To exercise any of these rights, please send a description of the personal information in question to our Data Protection Office at the address shown in the Contact us section below. Please note that some of these rights may be subject to legal restrictions, which we'll tell you about if they apply.

For more information about your rights or if you are not happy with our response to any request, you can contact the Information Commissioner's Office (ICO) - for more details, see https://ico.org.uk

Data Protection Office queries and address to write to us is

ICO Registration number

Companies House Reg No: 12648419

Changes to this Privacy Notice

This Privacy Notice is expected to change over time. We reserve the right to update it at any time, for any reason. We may e-mail reminders (but are not obliged to do so) but you should check our website frequently to see the current Privacy Notice and any changes made to it as they take effect from the date of publication.

First published: January 20, 2025

Last Updated: January 20, 2025