1. Introduction

Vicourse Learning LLC (“Vicourse,” “we,” “us,” or “our”) is committed to protecting your privacy and handling your personal information responsibly and transparently.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website www.vicourse.com, use our mobile application, complete identity verification (KYC), or enroll in our courses (collectively, the “Services”).

This Policy applies to all users of the Services. It does not apply to third-party websites, products, or services that we do not own or control, even if they are linked from our Services.

By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy. Where required by law, we will rely on your consent or another lawful basis (see Section 5) rather than implied agreement.

2. Definitions

• Personal Data / Personal Information: Any information relating to an identified or identifiable individual.
• Processing: Any operation performed on personal data (collection, storage, use, disclosure, deletion, etc.).
• Biometric Data: Personal data resulting from specific technical processing of physical or behavioral characteristics (e.g., facial geometry from a selfie or liveness check) that allows or confirms unique identification. Treated as a special category / sensitive data type.
• KYC: “Know Your Customer” — identity verification processes used to confirm that a user is who they claim to be.
• Controller: The entity that determines the purposes and means of processing (Vicourse, for the Services).
• Processor / Service Provider: A third party that processes personal data on our behalf and under our instructions.

3. Information We Collect

We collect only the information needed to operate the Services, verify identities where required, comply with the law, and improve your learning experience.

A. Information You Provide Directly

B. Identity Verification (KYC) & Biometric Data

Where you request an accredited certificate, a proctored exam, or where verification is required by law or by an institutional partner, we collect:

• Government-Issued ID Document: A photo or scan of an official identity document (e.g., passport, national ID, driver’s license), including the data printed on it (name, document number, date of birth, expiry, issuing authority).
• Facial Image & Liveness / Biometric Check: A live selfie and/or short liveness capture. This is processed to generate a facial biometric template that is compared against your ID photo to confirm a match and to detect spoofing or fraud.

Biometric data is sensitive. We treat it with heightened protection (see Section 8) and process it only with your explicit consent and only for identity verification and fraud prevention — never for advertising, profiling unrelated to verification, or sale. See Section 9 for the specific biometric notice, retention schedule, and destruction commitment.

KYC checks may be performed using a specialist third-party identity verification provider, who acts as our processor under a data processing agreement and may only use the data to perform verification on our behalf.

C. Information Collected Automatically

• Usage Data: Pages viewed, time on pages, courses started/completed, clickstream, feature interactions.
• Device & Connection Data: IP address, browser type, operating system, language, and unique device identifiers.
• Cookies & Similar Technologies: Cookies, pixels, SDKs, and local storage to keep you signed in, remember preferences, secure the Services, and analyze performance. You can manage these via our cookie banner / settings. See Section 7.

D. Information from Third Parties

• Linked Accounts: If you sign in via Google, Facebook, or LinkedIn, we receive basic profile information (name, email, photo) as permitted by those providers and your settings.
• Enterprise / Institutional Links: If you access the Services through an employer, sponsor, or educational institution, they may share your registration and enrollment data with us.
• Verification & Fraud Sources: Our KYC provider may return verification results and risk signals (e.g., document authenticity, match score, fraud indicators).

We do not knowingly collect more data than necessary for the stated purposes (data minimization).

4. How We Use Your Information

We use personal data to:

• Deliver education: Provide access to courses, grade assignments, run exams, and issue certificates.
• Verify identity (KYC): Confirm your identity for accredited certificates, proctored exams, regulatory compliance, and to prevent impersonation and certificate fraud.
• Provide support: Respond to inquiries and technical requests.
• Secure the Services & prevent fraud: Detect unauthorized access, academic dishonesty (e.g., plagiarism, exam fraud), and abuse.
• Improve the platform: Analyze aggregated/de-identified usage to improve course content and functionality.
• Communicate: Send service and transactional messages (e.g., enrollment, security alerts), and — only with your consent — marketing about new courses or features. You can withdraw marketing consent at any time.
• Comply with legal obligations: Tax, accounting, accreditation, and lawful requests.

Automated Processing & Decision-Making

Some checks are automated, including KYC document/biometric matching and fraud-risk scoring. These may influence whether a certificate is issued or an account is restricted. Where an automated decision produces a legal or similarly significant effect on you, you have the right to request human review, to express your point of view, and to contest the decision (see Section 6).

5. Legal Bases for Processing (EEA / UK)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

You may withdraw consent at any time without affecting processing carried out before withdrawal.

6. How We Share Your Information

We do not sell your personal data. We share information only as described below, and only with appropriate contracts and safeguards in place:

• Instructors & Course Partners: May see your profile and grades for courses you take with them, to facilitate teaching and assessment.
• Service Providers / Processors: Trusted vendors who process data on our behalf under data processing agreements — for example, hosting, payments, live sessions, and identity verification. They may use data only to provide services to us.
• Employers / Sponsors: If a company or institution pays for your subscription, we may share progress and completion data with them, consistent with your agreement with that organization.
• Legal & Safety: We may disclose information where required by law, subpoena, or lawful request, or to protect the rights, property, or safety of users, the public, or Vicourse.
• Corporate Transactions: In a merger, acquisition, or asset sale, data may be transferred subject to this Policy and applicable law; we will notify you of any material change.

We do not disclose your biometric data to any party except the KYC processor strictly necessary to perform verification, and never for commercial purposes.

7. Cookies & Tracking Technologies

We use cookies and similar technologies in the following categories:

• Strictly Necessary: Required for sign-in, security, and core functionality (cannot be disabled).
• Functional: Remember preferences (e.g., language).
• Analytics: Help us understand and improve usage (used in aggregate where possible).
• Marketing: Used only with consent, where applicable.

You can accept or reject non-essential cookies through our cookie banner or your browser settings. If you have any questions about the cookies we use, contact us using the details in Section 15.

8. Security of Your Data

We maintain administrative, technical, and physical safeguards designed to protect personal data, including:

• Encryption in transit (TLS/SSL) and encryption at rest for sensitive data, including KYC and biometric data.
• Access controls: Role-based access on a least-privilege, need-to-know basis, with logging and monitoring.
• Segregation: Identity/biometric data is stored separately from general account data with stricter access restrictions.
• Vendor due diligence: Contractual data protection terms (DPAs) and security review of processors.
• Testing: Periodic security assessments and vulnerability management.

No method of transmission or storage is 100% secure, so we cannot guarantee absolute security. In the event of a data breach affecting your personal data, we will notify affected users and relevant authorities without undue delay and within the timeframes required by applicable law.

9. Biometric Data Notice

This section provides additional disclosures regarding facial / biometric data collected during identity verification.

• What we collect: A facial image and a biometric template derived from your selfie/liveness capture, compared against your government ID photo.
• Why: Solely to verify your identity and detect fraud or spoofing for accredited certificates, proctored exams, or where legally required.
• Consent: We collect and process biometric data only with your explicit, informed consent, requested separately at the point of verification. You may decline; where an alternative verification method exists, it will be offered.
• No sale or unrelated use: We do not sell, lease, trade, or profit from biometric data, and do not use it for advertising or any purpose unrelated to verification and fraud prevention.
• Disclosure: Biometric data is shared only with the verification processor strictly necessary to perform the check, never with advertisers or data brokers.
• Retention & destruction: Biometric templates and verification images are retained only as long as necessary to complete and audit the verification, and are permanently destroyed within 90 days after the verification purpose is fulfilled, or upon withdrawal of consent, unless a longer period is strictly required by law (e.g., an active fraud investigation or legal hold).
• Your controls: You may withdraw consent and request deletion of biometric data at any time via the contact in Section 15, subject to legal retention requirements.

Several jurisdictions have specific biometric privacy laws (for example, Illinois BIPA, Texas CUBI, Washington, and others) that impose strict consent, notice, retention-schedule, and destruction requirements — some with significant penalties. We recommend you keep this section under periodic legal review.

10. Data Retention

We keep personal data only as long as necessary for the purposes described, then delete or anonymize it.

Specific periods are applied per legal and operational requirements; contact us for details.

11. Your Rights & Choices

General

• Access & Correction: View and edit profile data in your account settings.
• Marketing Opt-Out: Use the “Unsubscribe” link in any marketing email, or adjust notification settings.

EEA & UK (GDPR / UK GDPR)

You have the right to: access your data; rectify inaccurate data; request erasure (“right to be forgotten”); restrict or object to processing; data portability; withdraw consent; not be subject to solely automated decisions with significant effects without safeguards; and lodge a complaint with your local supervisory authority.

California (CCPA / CPRA)

You have the right to: know the categories and specific pieces of personal information collected, used, and disclosed; correct inaccurate information; delete personal information; limit the use and disclosure of sensitive personal information (which includes biometric and government ID data); and not receive discriminatory treatment for exercising your rights. Although we do not sell personal data for money, you may opt out of any sharing for cross-context behavioral advertising via the “Do Not Sell or Share My Personal Information” control.

Other Regions

If you are in another jurisdiction with data protection laws, comparable rights may apply; contact us and we will honor applicable rights.

We will verify requests before acting and respond within the timeframes required by law. You may appeal a denied request using the contact in Section 15.

12. Children’s Privacy

The Services are not directed to children under 13 (or under 16 where required by local law). We do not knowingly collect personal data — and do not perform biometric verification — on children below the applicable age without verifiable parental/guardian consent. If we learn we have collected such data improperly, we will delete it promptly. Contact us if you believe a child has provided us data.

13. International Data Transfers

Vicourse operates globally. Your information may be transferred to, stored in, and processed in countries other than your own, including the United States, which may have different data protection laws. Where we transfer personal data internationally, we use appropriate safeguards such as Standard Contractual Clauses (EU), the UK International Data Transfer Addendum, adequacy decisions, or other lawful mechanisms.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will revise the “Last Updated” date and, for material changes (including changes to biometric or KYC practices), provide a more prominent notice and, where required, obtain renewed consent.

15. Contact Us

For questions, requests, or to exercise your rights, contact our Data Protection Officer:

Vicourse Learning LLC — Data Protection Officer Email: [email protected]

To lodge a complaint, you may also contact your local data protection authority.

This Privacy Policy is provided as a drafting aid and starting point. It is not legal advice, and I am not a lawyer. Because your platform now processes government ID and biometric data, it is subject to heightened and varied legal requirements (e.g., GDPR Article 9, CCPA/CPRA sensitive data rules, and US state biometric laws such as Illinois BIPA). We recommend having this document reviewed by qualified privacy counsel before publishing.