General Data Protection Regulation (GDPR) Policy

Last Updated: 4 December 2024

This GDPR Policy describes how Docu Cut Lab ("we", "us", or "our") collects, processes, stores, and protects personal data in accordance with applicable data protection legislation. We are committed to ensuring that all personal data we handle is treated with the highest standards of care, transparency, and security.

1. Data Controller Information

Docu Cut Lab operates as the data controller for personal data collected through our platform and services. As data controller, we determine the purposes and means of processing your personal data.

You may contact us regarding any data protection matter using the following details:

2. Scope of This Policy

This policy applies to all individuals whose personal data we process, including but not limited to:

• Registered users of our platform
• Visitors to our website at docucutlab.com
• Individuals who contact us directly via email, phone, or web forms
• Participants in quizzes, assessments, or educational programmes we provide

This policy covers all personal data processing activities carried out by Docu Cut Lab, regardless of the medium through which data is collected.

3. Personal Data We Collect

3.1 Data You Provide Directly

We collect personal data that you voluntarily provide to us, including:

• Full name and display name
• Email address
• Password (stored in encrypted form)
• Billing and payment information
• Profile details and preferences
• Communications you send to us

3.2 Data Collected Automatically

When you use our platform, we may automatically collect certain technical and behavioural data, including:

• IP address and approximate geographic location
• Browser type, version, and operating system
• Device identifiers and screen resolution
• Pages visited, time spent, and navigation paths
• Quiz and assessment results and progress data
• Session duration and frequency of visits

3.3 Data from Third Parties

We may receive personal data from third-party services where you have chosen to connect or authenticate your account, such as single sign-on providers. We process such data only to the extent necessary and in accordance with this policy.

4. Legal Bases for Processing

We process your personal data only where we have a valid legal basis to do so. The legal bases we rely upon include:

Processing Purpose	Legal Basis
Providing and managing your account	Performance of a contract
Processing payments	Performance of a contract
Sending service-related communications	Performance of a contract
Sending marketing communications	Consent
Improving platform performance and features	Legitimate interests
Fraud prevention and security	Legitimate interests
Compliance with legal obligations	Legal obligation
Analytics and usage tracking	Legitimate interests / Consent

Where we rely on legitimate interests as our legal basis, we have conducted a balancing assessment to ensure our interests do not override your fundamental rights and freedoms.

5. How We Use Your Personal Data

We use personal data we collect for the following purposes:

• Creating and maintaining your user account
• Delivering our educational content, quizzes, and assessments
• Tracking your learning progress and providing personalised feedback
• Processing transactions and managing subscriptions
• Responding to your enquiries and support requests
• Sending important notices about your account or our services
• Sending promotional communications where you have consented
• Analysing usage patterns to improve our platform
• Detecting and preventing fraud, abuse, or security incidents
• Meeting our legal and regulatory obligations

6. Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law.

• Account data: Retained for the duration of your account and for a reasonable period thereafter in case of disputes or legal requirements
• Transaction records: Retained in accordance with applicable financial and tax obligations
• Learning and assessment data: Retained while your account is active and for a defined period following account closure
• Marketing preferences: Retained until you withdraw consent or request deletion
• Support communications: Retained for a reasonable period to resolve ongoing matters

When data is no longer required, it is securely deleted or anonymised in a manner that prevents re-identification.

7. Data Sharing and Disclosure

7.1 Service Providers

We engage trusted third-party service providers to assist in operating our platform. These providers act as data processors and are contractually bound to process data only on our instructions and in accordance with applicable data protection law. Categories of providers include:

• Cloud hosting and infrastructure providers
• Payment processing services
• Email delivery and communication services
• Analytics and performance monitoring tools
• Customer support platforms

7.2 Legal Disclosures

We may disclose personal data where required to do so by law, court order, or regulatory authority, or where we believe disclosure is necessary to protect the rights, property, or safety of Docu Cut Lab, our users, or others.

7.3 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of assets, personal data may be transferred as part of that transaction. We will notify affected individuals where required by applicable law.

7.4 No Sale of Personal Data

We do not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes.

8. International Data Transfers

As an international platform serving learners across multiple regions, we may transfer personal data to countries outside your country of residence. Where such transfers occur, we ensure that appropriate safeguards are in place, including:

• Standard contractual clauses approved by relevant data protection authorities
• Adequacy decisions where applicable
• Binding corporate rules or other recognised transfer mechanisms

You may request further information about the specific safeguards applied to your data transfers by contacting us at help@docucutlab.com.

9. Your Data Protection Rights

Depending on your location and applicable law, you may have the following rights in relation to your personal data:

9.1 Right of Access

You have the right to request a copy of the personal data we hold about you, along with information about how we process it.

9.2 Right to Rectification

You have the right to request correction of any inaccurate or incomplete personal data we hold about you.

9.3 Right to Erasure

You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies.

9.4 Right to Restriction of Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as while a dispute about accuracy is resolved.

9.5 Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.

9.6 Right to Object

You have the right to object to processing based on legitimate interests, including for direct marketing purposes. Where you object to direct marketing, we will cease processing your data for that purpose without delay.

9.7 Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

9.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe we have processed your personal data in a manner that does not comply with applicable data protection law.

To exercise any of the above rights, please contact us at help@docucutlab.com. We will respond to your request within the timeframes required by applicable law and will not charge a fee unless your request is manifestly unfounded or excessive.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve our platform. Cookies are small text files stored on your device that help us recognise you, remember your preferences, and understand how you use our services.

10.1 Types of Cookies We Use

• Strictly necessary cookies: Essential for the platform to function correctly and cannot be disabled
• Functional cookies: Enable enhanced features such as remembering your language preference or login state
• Analytical cookies: Help us understand how users interact with our platform so we can improve it
• Marketing cookies: Used to deliver relevant communications where you have provided consent

You may manage your cookie preferences through our cookie consent tool or your browser settings. Please note that disabling certain cookies may affect the functionality of our platform.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using industry-standard protocols
• Encryption of sensitive data at rest
• Access controls limiting data access to authorised personnel only
• Regular security assessments and vulnerability testing
• Staff training on data protection and information security
• Incident response procedures for managing potential data breaches

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority in accordance with our legal obligations.

12. Children's Privacy

Our platform is not directed at children under the age of 16. We do not knowingly collect personal data from children without appropriate parental or guardian consent. If we become aware that we have inadvertently collected personal data from a child without appropriate consent, we will take steps to delete that data promptly. If you believe a child has provided us with personal data without appropriate consent, please contact us at help@docucutlab.com.

13. Automated Decision-Making and Profiling

We may use automated processes to analyse your learning behaviour and progress in order to provide personalised recommendations and feedback. These processes are designed to enhance your learning experience and do not produce legal or similarly significant effects without human oversight. You have the right to request human review of any automated decision that significantly affects you.

14. Changes to This Policy

We may update this GDPR Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make material changes, we will notify you by updating the date at the top of this policy and, where appropriate, by sending you a direct notification. We encourage you to review this policy periodically to stay informed about how we protect your data.

Continued use of our platform following notification of changes constitutes your acknowledgement of the updated policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this GDPR Policy or the way we handle your personal data, please contact us:

We are committed to working with you to resolve any concerns about your personal data in a fair and timely manner.