Effective: 5 September 2026 · Version 1.0

TShield Academy Privacy Policy

1. Scope

This Policy explains how Lusquan B.V. processes personal data when you visit, register for or use TShield Academy courses, laboratories, assessments, certification services, events and support. It should be read with the Academy Terms of Use and any specific notice shown for an examination, proctoring service or organisational programme.

2. Data we process

• Identity and account: name, email, country code, organisation, job role, public account identifier, account status and assigned roles.
• Authentication and security: password hash, verification and reset tokens, session identifiers, IP address, user agent, login history, failed attempts and security/audit events.
• Learning: enrolments, progress, lesson activity, assignments, laboratory actions, scores, attempts, instructor feedback and completion history.
• Certification: candidate identity, eligibility, examination events, integrity evidence, results, credential identifiers, issue/expiry/revocation status and continuing-education records.
• Communications: support requests, notices, survey responses and event participation.
• Technical usage: pages requested, timestamps, device/browser information, diagnostic logs and service-performance events.
• Organisation data: sponsoring organisation, seat assignment and permitted reporting relationships.

Please do not submit real credentials, sensitive personal data or confidential production data into laboratories unless expressly authorised and protected by a separate agreement.

3. Purposes and legal bases

• Contract: create and operate accounts; deliver courses, assessments, laboratories, support and credentials.
• Legitimate interests: secure the Academy, prevent fraud and examination misconduct, improve content, diagnose faults and maintain auditable operations, balanced against your rights.
• Legal obligations: tax/accounting records, lawful requests, sanctions controls and establishment or defence of legal claims.
• Consent: optional marketing, non-essential cookies, optional recordings or other processing where consent is specifically requested. Consent may be withdrawn without affecting earlier lawful processing.

4. Children and younger learners

The Academy is not limited to adults. Where a learner is not legally able to provide a required consent or enter the relevant agreement, a parent or legal guardian must provide the necessary authorisation. For consent-based online processing offered directly to a child in the Netherlands, parental authorisation may be required for a child under 16. Schools and sponsoring organisations must ensure that they have an appropriate basis and provide required notices before assigning accounts. We seek to minimise children’s data and do not knowingly use it for behavioural advertising.

5. Sharing and recipients

Access is limited to authorised Lusquan personnel and service providers that support hosting, infrastructure, email delivery, security, customer support, assessment or certification. Providers must act under appropriate confidentiality and data-protection terms. A sponsoring organisation may receive learner identity, enrolment, progress, results and credential status where authorised by contract and applicable law. We may disclose data to authorities or professional advisers where legally necessary, and during a properly safeguarded corporate transaction.

6. International transfers

We aim to host and process Academy data within the European Economic Area where practicable. If personal data is transferred outside the EEA, Lusquan will use an applicable lawful mechanism, such as an adequacy decision or European Commission Standard Contractual Clauses, together with supplementary safeguards where required. Information about relevant safeguards may be requested from the privacy contact.

7. Retention

We keep data only as long as reasonably necessary for the stated purposes. Active account and learning records are normally retained while the account or programme remains active. Security logs and sessions are retained for bounded operational periods; unused verification/reset tokens expire; financial records are retained for legally required periods. Certification records may be retained for the credential lifecycle and a reasonable verification/archive period. Examination-integrity evidence is retained only as long as needed for review, appeal, accreditation and legal defence. When no longer required, data is deleted, anonymised or securely archived subject to lawful holds.

8. Security

We use measures designed to protect confidentiality, integrity and availability, including password hashing, email verification, server-side session controls, role-based access, audit trails, network protections, backups and restricted administrative access. No system is completely secure; please report suspected incidents promptly to privacy@lusquan.com.

9. Cookies and similar storage

The Academy uses essential cookies or comparable storage for authenticated sessions, security and requested functionality. These are necessary to provide the service. Non-essential analytics or marketing technologies, if introduced, will be described and presented with required choices before use.

10. Automated decisions

The Academy may automatically calculate progress, scores, eligibility flags, security alerts or suspected-integrity indicators. Material certification or disciplinary decisions should include appropriate human review. We do not currently make solely automated decisions producing legal or similarly significant effects without a lawful basis and required safeguards.

11. Your rights

Subject to GDPR conditions, you may request access, correction, deletion, restriction, portability or objection; withdraw consent; and request information about relevant transfers. You may also contest a significant automated decision where applicable. We may verify identity and may retain data where law, security, certification integrity or legal claims require it.

Send requests to privacy@lusquan.com. You also have the right to complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or another competent EEA authority.

12. Changes

We may update this Policy when the Academy, law or processing changes. We will update the effective date and provide appropriate notice of material changes. Where a new purpose requires consent, we will request it separately.

13. Contact details

This policy is intended to provide the information required by Articles 12–14 GDPR. Programme-specific notices may supplement it but should not reduce your statutory rights.