Legal

GDPR & Data Protection

Updated 20 February 2026

SkillForgeLearning Academy LLC serves learners in Ukraine and across the European Union and EEA. Where we process personal data of individuals located in the EU or EEA, we do so in compliance with Regulation (EU) 2016/679 — the General Data Protection Regulation (GDPR). This page explains who we are as a data controller, the lawful bases on which we process your data, and how you can exercise your rights.

1. Data controller

The data controller responsible for your personal data is:

We have designated a data protection contact for all privacy enquiries. You can reach them at the email address above.

2. Lawful bases for processing

Under the GDPR, we must have a valid lawful basis for each category of processing. The bases we rely on are:

  • Consent (Art. 6(1)(a)): when you submit our contact form, accept analytics cookies, or opt in to marketing emails. You may withdraw consent at any time without affecting the lawfulness of prior processing.
  • Contract performance (Art. 6(1)(b)): to process your enrolment, manage your learner account, deliver course content and issue completion certificates.
  • Legitimate interests (Art. 6(1)(f)): to operate and improve our website and learning platform, prevent fraud and abuse, and communicate with enrolled learners about related programmes — where such interests are not overridden by your fundamental rights.
  • Legal obligation (Art. 6(1)(c)): to comply with applicable Ukrainian and EU legislation, including tax, consumer protection and educational record-keeping requirements.

3. Your rights as a data subject

If you are located in the EU or EEA, you have the following rights under the GDPR. These rights are not absolute and are subject to certain exceptions under applicable law:

3.1 Right of access (Art. 15)

You have the right to obtain a copy of the personal data we hold about you, together with information about how and why we process it, who we share it with, and how long we retain it. We will provide this information within one month of receiving a valid request.

3.2 Right to rectification (Art. 16)

You have the right to have inaccurate or incomplete personal data corrected without undue delay. If you have a learner account, you can update many of your details directly in your account settings.

3.3 Right to erasure — "right to be forgotten" (Art. 17)

You have the right to request the deletion of your personal data where: the data is no longer necessary for the purpose for which it was collected; you withdraw consent and no other lawful basis applies; you object and we have no overriding legitimate grounds; the data has been unlawfully processed; or erasure is required to comply with a legal obligation. Note that we may be required to retain certain data (e.g. financial records) for legal compliance purposes.

3.4 Right to restriction of processing (Art. 18)

You have the right to request that we restrict processing of your personal data — meaning we store it but do not actively use it — in certain circumstances, such as when you contest the accuracy of the data or have objected to processing pending our verification of legitimate grounds.

3.5 Right to data portability (Art. 20)

Where we process your data by automated means on the basis of consent or contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV) and to transmit it to another controller where technically feasible.

3.6 Right to object (Art. 21)

You have the right to object at any time to the processing of your personal data where we rely on legitimate interests or where we process it for direct marketing purposes. Where you object to direct marketing, we will cease processing immediately. Where you object on the basis of legitimate interests, we will cease processing unless we can demonstrate compelling legitimate grounds that override your rights.

3.7 Right to withdraw consent (Art. 7(3))

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of any processing carried out before withdrawal. To withdraw consent to marketing emails, use the unsubscribe link in any email we send you. To withdraw consent to analytics cookies, adjust your browser settings or re-open the cookie banner.

3.8 Rights related to automated decision-making (Art. 22)

We do not make automated decisions about you that produce legal or similarly significant effects without human review. If we introduce such processes in the future, we will update this page and ensure appropriate safeguards are in place.

4. How to exercise your rights

To exercise any of the rights listed above, send a written request to privacy@skillforgelearning.com. Please include your full name and, where applicable, the email address associated with your learner account so we can identify you. We may ask for additional information to verify your identity before acting on a request — this is to protect you and other learners.

We will respond to all verifiable requests within one calendar month. In complex or multiple cases, we may extend this by a further two months and will notify you of any extension within the first month.

There is no fee for exercising your rights in standard cases. If requests are manifestly unfounded or excessive, we reserve the right to charge a reasonable administrative fee or decline the request, as permitted under Art. 12(5) GDPR.

5. International data transfers

SkillForgeLearning Academy is based in Ukraine. Some of our third-party service providers — including cloud hosting, video delivery and analytics providers — may process your data in countries outside the EEA. Where such transfers occur, we ensure appropriate safeguards are in place, which may include:

  • Standard Contractual Clauses (SCCs) approved by the European Commission;
  • Transfers to countries that the European Commission has determined provide an adequate level of protection;
  • Binding corporate rules where applicable.

You can request details of the specific safeguards we have in place for any particular transfer by contacting privacy@skillforgelearning.com.

6. Data retention

We do not retain personal data longer than is necessary. Please see our Privacy Policy (Section 7) for the specific retention periods applicable to each category of data. After the applicable retention period, data is securely deleted or anonymised.

7. Lodging a complaint with a supervisory authority

If you are located in the EU or EEA and believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the data protection supervisory authority in your EU member state of residence, place of work or the place of the alleged infringement.

In Ukraine, oversight of personal data protection is provided by the Ukrainian Parliament Commissioner for Human Rights (Ombudsperson). We ask that you contact us first so that we can try to resolve any concern directly — but you are always free to approach the supervisory authority directly.

8. Contact our data protection contact

For any question or concern about how we handle your personal data, or to exercise any of the rights described above, please contact us at: