Privacy Policy

WoxLearn Ltd. Privacy Policy

WoxLearn Ltd. (“WoxLearn”, “we”, “us” or “our”) respects your privacy and is committed to protecting personal data. This Privacy Policy explains how we collect, use, disclose, store and otherwise process personal data when you visit our websites, request a demo, create or use a WoxLearn account, access our products and services, communicate with us, attend an event, receive marketing from us, or otherwise interact with us.

This Privacy Policy is intended to provide a general, global notice. Depending on how you use WoxLearn, WoxLearn services, WoxLearn products, other documents may also apply, including our Cookie Notice, Terms of Service, Data Processing Addendum, institution-specific agreements, and product-specific or jurisdiction-specific notices.

This Privacy Policy does not apply to third-party websites, platforms, applications or services that are not owned or controlled by WoxLearn, even where they are linked from our services.

Who We Are and How Our Role Changes

WoxLearn may act as a controller, joint controller, or processor/service provider depending on the context.

When WoxLearn decides why and how personal data are processed for its own purposes - such as operating the website, managing demo requests, administering direct customer relationships, handling billing contacts, securing the platform, complying with law, maintaining suppression lists, or sending marketing where permitted - we act as a controller.

When WoxLearn processes personal data on behalf of a school, university, tutoring center, employer or other institution that uses our services to manage learners, course delivery, assessment content, results, attendance, participation or other institution-managed records, that institution will generally be the controller, and WoxLearn will act as its processor, handling personal data only on documented instructions and under the relevant contract.

In some circumstances, WoxLearn and an institution may each act as independent controllers for different categories of data. For example, institution-managed student records may remain under the institution’s control, while WoxLearn may separately control certain account, billing, website and security records necessary to operate our business.

If you are a student or other end user whose data are provided to WoxLearn by an institution, your institution’s privacy notice may also apply. Where WoxLearn acts as a processor, requests relating to institution-controlled data should normally be directed to the relevant institution, although WoxLearn may assist the institution where required by law or contract.

Personal Data WoxLearn May Collect

Depending on the product, customer relationship and configuration, WoxLearn may collect the following categories of personal data:

• Account and profile data, such as names, usernames, email addresses, passwords or password hashes, profile photos, job titles, institutional affiliations, roles, class or cohort memberships, and account preferences.
• Institutional and commercial data, such as institution names, department or program details, billing contacts, contract data, payment-related records, purchase history, administrative configuration data, and correspondence related to procurement, onboarding, or renewals.
• Student and learner data, where applicable, such as identifiers assigned by the institution, educational content submitted through the platform, question responses, grades or scores, formative or summative assessment results, attendance or participation data, progress records, engagement metrics, feedback, learning pathways, and other records needed to deliver the relevant educational service.
• Usage and event data, such as log data, page views or screen interactions, timestamps, feature usage, search queries, session data, activity trails, crash data, performance diagnostics, and service telemetry.
• Device and network data, such as IP addresses, approximate location inferred from IP, browser type and version, device type, operating system, language settings, referring URLs, and unique device or browser identifiers.
• Cookies and similar technologies, such as cookies, pixels, local storage, scripts, tags and consent preference settings, in accordance with our Cookie Notice.
• Support and communication data, including emails, chat messages, call notes, tickets, screenshots, documents, recordings where lawful, and attachments provided to support or success teams.
• Marketing and lead-generation data, such as data submitted through “Book a Demo”, “Contact Us”, webinar or event forms, newsletter preferences, and records of consent or objection.
• Special-category or sensitive data, only where necessary, lawful and appropriately safeguarded. Depending on product configuration, this may include accessibility or accommodation information, certain health-related information, or other sensitive data uploaded by institutions or users. 

How WoxLearn Uses Personal Data and the Main Lawful Bases

WoxLearn may use personal data for the following purposes and on the following legal bases:

• To provide and administer the services. We use personal data to create accounts, authenticate users, host educational content, facilitate assessments, support teaching and learner engagement, generate performance reporting, and otherwise provide the products and services you or your institution request. Where we contract directly with you, we normally rely on contract. Where an institution uses our services, the institution will normally determine the lawful basis for institution-controlled personal data, and WoxLearn will process such data on the institution’s documented instructions.
• To operate, support and improve the services. We use personal data to troubleshoot issues, answer queries, maintain product functionality, monitor performance, test features, measure adoption and improve usability. We usually rely on contract where support is part of the service, and legitimate interests where processing is necessary to secure and improve our services in ways that do not override individuals’ rights.
• To maintain security and prevent misuse. We use personal data to protect our services, users, systems, institutions and intellectual property, including through logging, access controls, rate-limiting, detection of suspicious activity, fraud prevention, vulnerability management and incident response. We ordinarily rely on legitimate interests, and in some cases legal obligation or contract.
• To manage our commercial relationship. We use personal data for onboarding, procurement, billing, invoicing, tax, collections, contract administration, renewals, customer success and related account management. We ordinarily rely on contract and legal obligation.
• To communicate with you and send service messages. We use contact and account data to send transactional communications, product notices, changes to terms, security notifications, and support updates. We ordinarily rely on contract, legitimate interests, or legal obligation, depending on the message.
• To send marketing where permitted. We may use personal data to send newsletters, product updates, event invitations and other promotional communications where we have your consent, where the law allows us to rely on legitimate interests, or where another lawful basis applies. Where PECR requires consent for electronic marketing, we will seek that consent and provide an easy opt-out. You have an absolute right to object to direct marketing.
• To comply with law and protect rights. We may use personal data to comply with legal, regulatory, tax, accounting, safeguarding, law-enforcement or court obligations; respond to legal requests; enforce contracts; establish, exercise or defend legal claims; and manage audits, investigations or corporate transactions. We ordinarily rely on legal obligation and, where appropriate, legitimate interests.
• Where we rely on consent. If we ask for consent, for example for certain marketing, cookies, optional features or some sensitive processing, you can withdraw it at any time. Withdrawal does not affect processing already carried out lawfully before withdrawal.

Data Sharing and Disclosure

WoxLearn may disclose personal data to the following categories of recipient where necessary and lawful:

• Service providers and subprocessors. We may share personal data with hosting providers, cloud infrastructure and storage providers, identity and authentication providers, analytics providers, customer support tools, payment processors, communications providers, professional advisers, security vendors and other providers that help us operate the services. Where we use processors, we require them to act only on appropriate instructions, maintain confidentiality, implement suitable security measures and support compliance obligations.
• Institutional customers and authorized users. If you use WoxLearn through a school, university, tutoring center, employer or other organization, personal data may be visible to that organization and to authorized teachers, administrators, proctors, support staff or other users, depending on the relevant configuration and permissions.
• Affiliates and corporate group entities. We may share personal data within our corporate group where reasonably necessary for internal administration, support, security, reporting or restructuring, subject to appropriate confidentiality and transfer safeguards.
• Legal and regulatory recipients. We may disclose personal data where required by law, regulation, court order or other valid legal process, or where necessary to investigate fraud, enforce our agreements, protect rights, safety or property, or respond to lawful requests from public authorities.
• Corporate transaction counterparties. If WoxLearn is involved in a merger, acquisition, investment, financing, restructuring, asset sale or similar transaction, personal data may be disclosed to counterparties and advisers subject to confidentiality obligations and, where required, further safeguards.
• With your instruction or consent. We may also disclose personal data where you or your institution ask us to do so or where you have otherwise consented.

Where WoxLearn acts as a processor for an institution, data sharing is governed by the applicable contract and documented customer instructions. 

International Transfers

WoxLearn may process personal data in countries where WoxLearn or its service providers operate. Because our exact hosting and vendor locations may change over time, we do not commit in this Privacy Policy to an exhaustive static list of jurisdictions.

Where personal data are transferred internationally, and the transfer is restricted under applicable data protection law, WoxLearn will use an appropriate transfer mechanism. Where required, WoxLearn will provide information about the relevant safeguard and how to obtain a copy, subject to confidentiality and redactions where lawful.

Retention

WoxLearn keeps personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide services, maintain security and records, resolve disputes, comply with law, and enforce our agreements. Retention periods may vary depending on the category of data, the service configuration, whether WoxLearn acts as controller or processor, your institution’s instructions, and applicable legal requirements.

When deciding how long to keep personal data, we consider factors such as the nature and sensitivity of the data, the purposes for which it was collected, whether the data remain necessary to provide the service, contractual requirements, limitation periods, legal and accounting obligations, safeguarding considerations, and the risk of harm from unauthorized use or disclosure.

Where WoxLearn acts as a processor for an institution, we will return or delete customer personal data at the end of the contract, subject to the controller’s instructions, our backup and disaster-recovery cycles, and any legal obligation to retain certain records.

Your Rights and Choices

Subject to applicable law and any relevant exceptions, you may have the right to request:

• Access to personal data about you;
• Rectification of inaccurate or incomplete data;
• Erasure of data in certain circumstances;
• Restriction of processing in certain circumstances;
• Portability of personal data you provided to us, where the right applies;
• Objection to processing based on legitimate interests or public-interest grounds; and
• Withdrawal of consent where processing is based on consent.

You also have the right to object at any time to the use of your personal data for direct marketing. If you object, we will stop processing your personal data for direct-marketing purposes.

To exercise your rights, please contact us using the details below. We may need to verify your identity before responding. If WoxLearn acts only as a processor for your institution, we may refer your request to that institution or ask that you contact it directly, while providing assistance where required.

If you believe your rights have been infringed, you may also lodge a complaint with the relevant supervisory authority. 

Children, Students and Educational Records

WoxLearn’s services may be used by institutions, educators and learners, including minors where permitted and appropriately configured. If an institution provides access to WoxLearn for its learners, the institution is generally responsible for determining the legal basis for that use and for providing any institution-specific notices, permissions or consents required by law.

Where WoxLearn processes student personal data solely on behalf of a school or other educational institution for authorized educational purposes, WoxLearn will process that data in accordance with the institution’s instructions and the applicable contract.

If WoxLearn offers services directly to children or processes children’s personal data on the basis of consent in connection with an information-society service, WoxLearn will comply with applicable age-of-consent rules and, where required, will seek or verify consent from a parent or guardian or another person with parental responsibility. Because age thresholds vary by jurisdiction, WoxLearn may apply different age rules depending on the user’s location and the relevant service.

WoxLearn does not knowingly use student data obtained through institution-managed school services for targeted advertising. WoxLearn recommends adopting an express “no sale of student data / no targeted advertising / school-purpose only” commitment for school services if operationally accurate.

If you are a parent, guardian, student or eligible student and your school or institution uses WoxLearn, please contact your school or institution first regarding access, correction, deletion or similar requests. WoxLearn may assist the institution as required by law or contract.

Security, Incidents and Automated Decision-Making

WoxLearn uses technical and organizational measures designed to protect personal data, taking into account the nature of the data and the risks presented by the processing. These measures may include role-based access controls, least-privilege design, encryption in transit and at rest where appropriate, password protections, authentication controls, logging and monitoring, secure development practices, backup and recovery procedures, vendor due diligence, confidentiality obligations and staff training.

No method of transmission or storage is completely secure, and WoxLearn cannot guarantee absolute security. However, WoxLearn will maintain safeguards appropriate to the risk and will regularly review and improve them.

If WoxLearn becomes aware of a personal-data breach, we will respond in accordance with applicable law and contractual obligations. Where WoxLearn acts as a processor, we will notify the relevant controller without undue delay. Where WoxLearn acts as a controller and a reportable breach occurs, we will notify the competent supervisory authority and affected individuals where required by law.

WoxLearn may use analytics, profiling or recommendation systems - such as adaptive content recommendations, progress indicators or engagement insights - to support learning and product performance. Unless otherwise stated for a specific feature, WoxLearn does not intend to make decisions based solely on automated processing that produce legal effects or similarly significant effects on individuals. If that changes, WoxLearn will update this Privacy Policy and provide any additional information and safeguards required by law.

Cookies, Tracking, Third-Party Services and Contact Details

WoxLearn uses cookies and similar technologies to operate the website and, where permitted, to remember preferences, measure usage, improve performance and support communications or marketing. Non-essential cookies and similar technologies will be deployed only where permitted by applicable law and, where required, after obtaining valid consent through our consent-management tool. You can manage your preferences at any time through the cookie settings link on our website.

WoxLearn may integrate with or link to third-party services. Where you choose to interact with a third-party service, that provider’s own privacy notice and terms may apply to the information it collects.

WoxLearn may update this Privacy Policy from time to time. If we make material changes, we will post the updated version, revise the “last updated” date, and may provide additional notice where required.

If you have questions about this Privacy Policy or WoxLearn’s data practices, please contact:

WoxLearn Ltd

SUITE 102, WARRENS COURT 

WARRENS, SAINT MICHAEL

BARBADOS

Email: info@woxlearn.com