Privacy Policy
Introduction
TechClass is committed to protecting your personal data and being transparent about how we process it. This Privacy Policy sets out your data protection rights and explains what personal data we process, the purposes and legal bases for processing, and how information is shared and retained. We process personal data in accordance with applicable data protection legislation, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Finnish Data Protection Act (1050/2018).
1. Identity of the Data Controller and Contact Details
TechClass Ltd, Business ID 2837636-8, Sinikantie 2 B, 01400 Vantaa, (“TechClass”, “we” or “us”), acts as controller for the processing carried out for its own purposes, as described in this Policy.
For questions about this Policy or requests concerning your personal data, contact us at privacy@techclass.com.
2. Scope of this Privacy Policy
This Privacy Policy applies to personal data processed by TechClass in connection with its websites, learning platforms, mobile applications, training services, communications and business operations where TechClass acts as a controller of that personal data.
If you apply for or participate in a funded training programme, our Funded Training Privacy Policy provides additional and, where applicable, more specific information about the processing of your personal data in connection with that programme.
3. Personal Data Processed
The information we process depends on your relationship with TechClass and the services you use. Where information is required by law or necessary to provide a requested service, we will indicate this when the information is collected. If you do not provide it, we may be unable to process your application, create an account or provide the relevant service.
We process the following categories of personal data:
| Category | Examples |
|---|---|
| Identity, contact and account data | Name, email address, telephone number, account identifiers, organisation, user role, access permissions and authentication information. |
| Profile and preference data | Profile picture, job title, country, city, language and communication preferences. |
| Training and learning data | Selected programmes, enrolments, participation, learning paths, course and section visits, submissions, attempts, assessments, feedback, progress, completion status and certificates, including associated dates and times, and reported study-effort figures based on predefined course metrics. |
| Instructor and expert recordings | Images, voices and presentation content captured in recordings of instructors and experts for use in courses and training materials. |
| AI interaction records | Messages, responses, recent conversation history, personal data contained in submitted content, and relevant account, course, group or profile information used by the AI feature. For navigation assistance, this includes information about the portals and features available to the user. |
| Support, feedback and correspondence data | Support requests and correspondence, including ticket details, messages, attachments, status, timestamps and related account, contact, workspace and course information. This also includes feedback you provide about our courses. |
| Security and technical data | IP addresses, browser information, approximate location derived from IP addresses, session identifiers, login and activity timestamps, security events, upload logs, error reports and session replay records. Error reports may include information submitted through the service, such as support request text. |
| Website and marketing data | Website usage and interaction, cookie identifiers, subscriptions, marketing preferences, consent and objection records, campaign interactions, feedback and information about how you learned about a programme. |
| Business and transaction records | Business contact details, customer and account identifiers, contractual responsibilities, organisational orders and subscriptions, invoices, billing information, payment references and related correspondence. |
| Funded-training application and reporting data | Application details, employment and educational background, mother tongue, selection information, date of birth, personal identity code or learner ID, and required study information, as described in the Funded Training Privacy Policy. |
| Recruitment and employment records | Employee identification and contact details, personal identity codes, applications, qualifications, employment history, recruitment assessments, employment terms and contracts, job responsibilities, payroll information, bank and tax details, working-time and absence records, benefits, work email and IT account details, professional profile links provided by the individual (such as LinkedIn), and information necessary to administer occupational healthcare and insurance arrangements, including limited health information where permitted by applicable law. |
| Event and promotional content | Photographs, video and audio recordings, interviews, testimonials, quotations, case studies and other event-related or promotional content captured or created in connection with TechClass events, webinars, other activities, marketing and communications, including a person’s image, voice and, where relevant, name, job title, organisation, statements and other information associated with the content. |
| Event and webinar participation records | Registrations, attendance records, check-in information, participation status, event or webinar selected, related communications and, where relevant, organisation and job title. |
4. Legal Basis for Processing Personal Data
TechClass relies on the following legal bases, depending on the purpose and circumstances of the processing:
- Performance of a contract: Processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.
- Compliance with a legal obligation: Processing is necessary to comply with a legal obligation to which TechClass is subject.
- Legitimate interests: Processing is necessary for the legitimate interests of TechClass or a third party, provided those interests are not overridden by your interests or fundamental rights and freedoms.
- Consent: Processing is based on your consent for specified purposes, such as certain marketing communications and the use of non-essential cookies or similar technologies. You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
5. Purposes of Processing Personal Data
The personal data used for each purpose depends on the relevant service or relationship and is limited to the information described in this Policy that is relevant and necessary for that purpose.
TechClass processes personal data for the following purposes when acting as controller.
| Purpose | Legal basis |
|---|---|
| Creating and administering accounts, providing access to training, managing enrolments and participation, assessing submissions, issuing certificates and sending essential account and course communications. | Performance of a contract. |
| Maintaining limited completion and certificate records after training to verify achievements and respond to related enquiries. | Legitimate interests in maintaining reliable records of completed training and certificates. |
| Providing optional profile personalisation and account preferences. | Legitimate interests in enabling users to personalise their profiles and manage their preferences. |
| Providing learning histories and using proportionate activity information to support participation and progress. | Legitimate interests in supporting learner participation, progress and the provision of appropriate study support. |
| Handling support requests and resolving account, course and certificate issues. | Performance of a contract for necessary service support; legitimate interests in responding to other service and business enquiries. |
| Collecting and reviewing course feedback to evaluate and improve our training and learning services. | Legitimate interests. |
| Producing and providing courses and training materials, including recorded lectures and presentations by instructors and experts. | Performance of a contract. |
| Introducing instructors and experts on course information and registration pages, including their professional background and links to their professional profiles. | Legitimate interests in informing prospective learners about our instructors and their expertise. |
| Protecting accounts, preventing unauthorised access and misuse, investigating incidents, identifying and resolving technical errors, and monitoring service performance and reliability. | Legitimate interests in maintaining service security and reliability; compliance with applicable legal obligations relating to personal data breach handling and reporting. |
| Providing AI assistance with platform navigation and, where personal data is involved, learning support and the creation of training content. | Legitimate interests in providing AI-assisted platform and learning functionality. |
| Measuring website and platform use, improving usability and evaluating the effectiveness of online advertising through non-essential cookies and similar technologies. | Consent. |
| Sending newsletters and promotional communications about TechClass courses, services and features. | Consent where required; legitimate interests in promoting relevant services where prior consent is not required by applicable law. |
| Managing customer, partner, supplier, subcontractor and external instructor relationships, including enquiries, agreements, payments and invoicing. | Legitimate interests in administering business relationships; performance of a contract where the individual is a party; compliance with accounting and tax obligations. |
| Assessing job applications and managing recruitment. | Pre-contractual steps at the applicant’s request; legitimate interests in recruitment administration and handling related claims. |
| Preparing and administering employment contracts, onboarding employees, managing employment relationships, providing work email and system access, and administering remuneration, benefits, absences, occupational healthcare arrangements and insurance arrangements. | Performance of a contract; compliance with employment, tax and social-security obligations; legitimate interests in administering workplace accounts and access. Where health data is processed, this is done only where necessary and permitted under applicable law, including on the basis of Article 9(2)(b) GDPR. |
| Handling privacy requests, complaints, legal claims and compliance records. | Compliance with legal obligations for responding to data protection requests and maintaining required records; legitimate interests in resolving complaints and disputes and establishing, exercising or defending legal claims. |
| Documenting TechClass events and using general event photographs and recordings in communications about those events. | Legitimate interests in documenting and communicating about TechClass events. |
| Capturing and using promotional content involving identifiable individuals, including photographs, video and audio recordings, interviews, testimonials, quotations and case studies, for TechClass’s marketing and communications. | Consent where the individual voluntarily agrees to appear in or contribute to promotional content; performance of a contract where the individual’s participation in or the use of such content forms part of an agreement with the individual. |
| Administering registrations and participation in TechClass events and webinars, including related communications and attendance management. | Legitimate interests in administering business events and webinars where no contract applies. |
6. Principles for Processing of Personal Data
We limit processing to information relevant and necessary for the stated purposes and take reasonable steps to keep personal data accurate. We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and disclosure. These include access controls, authentication measures, confidentiality requirements and security monitoring.
Access is restricted according to the responsibilities of authorised personnel. Access to central administration tools is subject to additional network access restrictions. Personal data is deleted or anonymised when it is no longer needed, subject to applicable retention requirements.
7. Sources of Personal Data
We obtain personal data:
- Directly from you through applications and other forms, profiles, newsletter subscriptions, business transactions, messages, support requests, assignments, feedback and employment-related interactions.
- From your organisation or the organisation arranging your training, including account, enrolment and access information.
- From instructors and administrators who record participation, assessments, feedback and support information.
- Automatically through your use of our websites, learning platforms and mobile applications, including learning activity, login and session records, and technical information.
- From service providers and business partners in connection with payments, payroll, business relationships and the provision of our services.
- From other TechClass systems, where information previously collected in connection with your application, account or relationship with us is used for the purposes described in this Policy.
- Employee information is primarily collected directly from the employee.
8. Retention of Personal Data
We retain personal data for as long as necessary for the purposes described in this Policy and to meet applicable legal requirements. Retention periods depend on the information concerned, our relationship with you and the purpose of processing.
8.1. Processing for TechClass’s own purposes
The following retention periods apply where TechClass acts as controller.
| Personal data category | Retention period |
|---|---|
| Identity, contact and account data; profile and preference data; course participation and learning activity data; AI interaction records; support, feedback and correspondence data | Retained throughout training and any agreed period of account access, and for up to 12 months after access ends. Where no end date applies, accounts and related information are deleted after 12 consecutive months without sign-in or learning activity, unless ongoing training or agreed access requires the account to remain available. If you request earlier account closure or erasure, continued retention is limited to information needed for a lawful purpose. Some course feedback may be retained in anonymised form for evaluation and service improvement. |
| Study completion and certification records | Where TechClass acts as controller, limited records of completed training and certificates may be retained for up to five years after completion of the relevant training to verify completed studies, provide or reissue certificates, respond to related enquiries, and, where applicable, for audit or verification purposes relating to the training. |
| Security and technical data | Login and session records are retained for up to 60 days after the associated device was last used to access the platform. Security logs are retained for up to one year. Error reports, diagnostic information and session-replay recordings are retained for up to 90 days. |
| Website and marketing data | Identifiable website and analytics information, including personal data collected through cookies and similar technologies, is typically retained for no longer than twelve (12) months. The storage duration of individual cookies and similar technologies varies depending on their purpose and configuration and is described in our Cookie Policy. Newsletter subscription and other marketing contact information is retained while the subscription or relevant marketing relationship remains active and, where appropriate, for a reasonable period following the last relevant interaction. Marketing use ends when consent is withdrawn or an objection to direct marketing is received. Records of consent are retained for as long as necessary to demonstrate that consent was obtained and to comply with applicable requirements. Limited records of withdrawals, objections and other marketing preferences may be retained for as long as necessary to respect those preferences and demonstrate compliance. |
| Business contact, contract and correspondence records | Business contact information and routine correspondence are retained for as long as necessary for the administration of the relevant business relationship and the resolution of any outstanding matters. Agreements and related contractual records are retained while needed for the contractual relationship and for the applicable periods for establishing, exercising or defending legal claims. |
| Accounting, transaction and payroll records | Accounting, transaction and payroll records are retained in accordance with the statutory retention periods applicable under accounting, tax, payroll and employment legislation. |
| Funded-training assessment and verification records | Personal data processed by TechClass as controller for assessing applicants against the applicable criteria is retained until the application and admission process has concluded and the information is no longer needed for related administrative purposes. Records necessary to substantiate funding-related reporting and invoicing are retained for as long as necessary for applicable audit and verification purposes, subject to any statutory retention periods that may apply to the relevant records. |
| Recruitment data | Unsuccessful applications and related recruitment assessment records are retained for up to 12 months after applicants are notified of the recruitment decision. Information necessary for a successful applicant’s employment is transferred to and retained with the relevant employment records. |
| Employment and personnel records | Employment and personnel records are retained for the duration of employment and thereafter as necessary to fulfil post-employment obligations, comply with statutory requirements and establish, exercise or defend employment-related claims, taking into account applicable limitation periods. Information necessary for issuing employment certificates is retained in accordance with the requirements of applicable employment legislation. Employee health information is retained only for as long as the lawful grounds for its processing continue to apply and is erased when those grounds cease to exist. |
| Instructor and expert profile and recording data | Instructor and expert profiles, including professional profile links where provided, are retained for as long as they are used in connection with the relevant courses or training services. Recorded lectures and presentations are retained for as long as they are used to provide the relevant training and in accordance with the agreed terms governing their use. |
| Event and promotional content | General event photographs and recordings are retained for as long as they remain necessary or relevant for documenting and communicating the relevant event and TechClass’s activities. Promotional materials featuring identifiable individuals are retained for as long as they remain necessary or relevant for the applicable promotional purpose or for the period agreed with the individual. |
| Event and webinar participation records | Event and webinar participation data is retained for as long as necessary in connection with the relevant event or webinar and related communications. |
We may retain relevant information for longer where necessary to comply with applicable legal obligations or to establish, exercise or defend legal claims. Any such retention is limited to the information necessary for that purpose.
8.2. Processing on behalf of another controller
Where TechClass processes personal data on behalf of a customer organisation or other controller, retention, return and deletion are handled in accordance with that controller’s documented instructions, unless continued retention is required by applicable law.
8.3. Deletion and backups
When personal data is no longer required, we delete it or anonymise it so that individuals can no longer be identified. Residual copies may remain in backup systems for a limited period until they are deleted or overwritten in accordance with our backup retention schedules.
9. Disclosure and Transfer of Personal Data
9.1. Service providers
We use service providers for hosting, storage, communications, AI services, technical monitoring, payments and other business operations. These providers receive personal data only to the extent necessary for the relevant services.
Where a provider processes personal data on our behalf, the processing is governed by an applicable data processing agreement. If TechClass uses another provider to help process personal data for a customer or other controller, that provider must comply with the relevant data protection and subprocessor requirements.
Service providers used for our platform and funded-training services include:
| Provider | Service |
|---|---|
| Microsoft Azure | Cloud hosting and infrastructure for the LMS. |
| Cloudflare | Infrastructure supporting funded-training registration services. |
| Google Cloud - Vertex AI | Providing AI services for platform navigation, learning support and content generation, including processing personal data contained in messages, submitted content and relevant context. |
| Sentry | Error tracking and performance monitoring. |
| Resend | Delivery of transactional emails. |
| Stripe | Billing and payment services. |
Payments for our services are processed through Stripe. TechClass processes business billing information and payment references for payment administration and does not store full payment card details on its platform.
TechClass also uses other service providers across its business activities, which may include providers of website analytics, recruitment, accounting, payroll and other business administration services.
Personal data may also be disclosed, where necessary, to occupational healthcare providers, insurers and other service providers or organisations involved in employment-related administration. Personal data may also be disclosed to competent authorities, courts, legal advisers and other relevant recipients where required by applicable law or where necessary for the establishment, exercise or defence of legal claims.
9.2. Access by Customer Organisations and Authorised Instructors
Where a customer organisation provides or administers your LMS access, its authorised users may access learner information for training administration. Authorised instructors may also access learner information for teaching and support purposes, depending on the permissions assigned to them.
9.3. International transfers
Personal data is primarily processed within the European Economic Area, but may also be processed in other countries, including the United States, depending on the service provider and processing activity.
Where personal data is transferred outside the EEA, the transfer is based on an applicable European Commission adequacy decision, including the EU–U.S. Data Privacy Framework, or on other appropriate safeguards, such as the European Commission’s Standard Contractual Clauses. Information about the applicable transfer safeguards is available on request.
10. Cookies and Similar Technologies
We use cookies and similar technologies to operate our websites and platforms, maintain sessions, remember settings and support analytics and marketing activities.
Strictly necessary cookies and similar technologies are used where required to provide the website or service requested by the user. Non-essential cookies and similar technologies are used only with consent and include optional analytics and marketing technologies. You can accept or reject optional cookies and similar technologies and change your choices at any time through the relevant cookie settings. You can also manage cookies through your browser settings. Blocking strictly necessary cookies may affect the operation of certain features or services.
The duration of cookies and similar technologies varies depending on their purpose and configuration. Further information about the cookies and similar technologies we use and their purposes is available in our Cookie Policy.
11. Third-Party Websites and Services
Our websites and platforms may contain links to services operated by other organisations. Where those organisations process personal data as independent controllers, their processing is governed by their respective privacy notices.
12. Rights of Data Subjects
Subject to the conditions under applicable law, you have the right to:
- access your personal data and obtain information about its processing;
- have inaccurate information corrected and incomplete information completed;
- request deletion of your personal data;
- request restriction of processing;
- receive personal data you have provided in a structured, commonly used and machine-readable format where processing is automated and based on consent or a contract, and request its transmission to another controller where technically feasible;
- object, on grounds relating to your particular situation, to processing based on legitimate interests;
- object at any time to processing for direct marketing purposes, including related profiling;
- withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal; and
- lodge a complaint with a competent data protection supervisory authority.
You can object to direct marketing at any time. We will then stop processing your personal data for that purpose. For other processing based on legitimate interests, we will stop the relevant processing following an objection unless there are compelling legitimate grounds for continuing the processing that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.
The right to erasure is subject to the conditions and exceptions provided by applicable law. Certain information may therefore need to be retained despite an erasure request, including where retention is required by law or necessary for the establishment, exercise or defence of legal claims.
Requests can be submitted using the contact details provided. Where we have reasonable doubts about your identity, we may request additional information necessary to verify it. We respond to requests without undue delay and normally within one month. Where permitted because of the complexity or number of requests, this period may be extended by up to two further months. We will inform you of any such extension and the reasons for it within the first month. Requests are generally handled free of charge.
Where TechClass processes the relevant personal data on behalf of another controller, we assist the relevant controller in handling data-subject requests in accordance with applicable data protection requirements and the relevant data processing arrangements.
13. Account Closure and Data Downloads
You can request termination of your account and deletion of the personal data associated with your account in the TechClass LMS under Settings → Account, or by contacting TechClass. Terminating your account ends your access to the relevant learning environment. Associated personal data is deleted or retained in accordance with this Policy, applicable data protection law and, where TechClass processes the data on behalf of another controller, that controller’s instructions.
The Data Download feature is available through the Privacy Center in the LMS web interface and allows you to request a JSON archive of data associated with your account in the TechClass learning environment. The generated archive remains available for download for 72 hours after creation. Other requests concerning your personal data can be submitted as set out in this Policy.
14. AI Features, Automated Decision-Making and Profiling
TechClass uses AI services to provide assistance within the learning platform, including navigation guidance through the dashboard assistant. Depending on the feature, the personal data processed to provide the requested functionality may include messages, submitted content and relevant account, course, group or profile information.
TechClass does not use information submitted to its AI features to train AI models.
TechClass does not use solely automated processing, including profiling, to make decisions that have legal or similarly significant effects on you.
15. Changes to this Privacy Policy
We may update this Policy to reflect changes in our services, processing activities or applicable requirements. The latest version and its update date are published on this page.
Where required by law, we will provide additional notice or obtain consent before relevant changes take effect.
16. Complaints
You have the right to lodge a complaint with the competent supervisory authority under applicable data protection law. In Finland, the competent supervisory authority is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).