Privacy Policy

1. Introduction and Acceptance

This Privacy Policy ("Policy") governs the manner in which Qlearna ("we," "us," "our," "Company," "Platform," or "Service Provider") collects, uses, maintains, discloses, and disposes of information collected from users (each, a "User," "you," "your," or "Data Subject") of the Qlearna platform, website, mobile applications, and all related services, features, content, and applications offered by Qlearna (collectively, the "Service" or "Platform").

By accessing, browsing, or otherwise using the Platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy and consent to the collection, use, disclosure, retention, and protection of your personal information as described herein. If you do not agree with the terms of this Privacy Policy, you must immediately cease all use of the Platform and any associated services.

This Policy is incorporated by reference into our Terms of Service and constitutes a legally binding agreement between you and Qlearna. We reserve the right to modify, amend, or update this Policy at any time, in our sole and absolute discretion, without prior notice. Your continued use of the Platform following any such modifications constitutes your acceptance of the revised Policy.

2. Information Collection and Data Categories

We may collect, process, store, transfer, and otherwise handle various categories of personal data and non-personal data about you through multiple collection mechanisms, including but not limited to:

2.1 Personal Identification Information

Including but not limited to: full legal name, maiden name, aliases, pseudonyms, usernames, display names, titles, date of birth, age, gender, nationality, citizenship status, government-issued identification numbers, passport numbers, driver's license numbers, social security numbers (where applicable), tax identification numbers, biometric identifiers, photographs, video recordings, voice recordings, and any other information that can be used to identify you personally or in combination with other data.

2.2 Contact Information

Including but not limited to: email addresses (primary and secondary), telephone numbers (mobile, landline, work, home), fax numbers, physical mailing addresses (current and previous), billing addresses, shipping addresses, emergency contact information, and any other means by which you may be contacted or identified.

2.3 Technical and Device Information

Including but not limited to: Internet Protocol (IP) addresses (both IPv4 and IPv6), Media Access Control (MAC) addresses, device identifiers (UDID, IMEI, MEID), advertising identifiers (IDFA, GAID), browser type and version, browser fingerprints, operating system and version, device type and model, screen resolution, hardware specifications, installed fonts, plugins and extensions, time zone settings, language preferences, referring/exit pages, clickstream data, cookies, web beacons, pixel tags, local storage, session storage, cache data, and any other technical information transmitted by your device.

2.4 Usage and Behavioral Data

Including but not limited to: pages visited, features accessed, content viewed, search queries, interaction patterns, mouse movements, scroll depth, keystroke dynamics, session duration, frequency of use, navigation paths, conversion events, A/B test assignments, feature flags, error logs, crash reports, performance metrics, bandwidth usage, and any other information regarding your interaction with the Platform.

2.5 Financial and Transaction Information

Including but not limited to: credit card numbers, debit card numbers, bank account numbers, routing numbers, payment processor account information, billing history, transaction history, purchase history, refund history, subscription status, payment method preferences, invoices, receipts, and any other financial information necessary to process payments and maintain records.

2.6 Profile and Preference Data

Including but not limited to: account credentials (usernames and encrypted passwords), security questions and answers, profile information, biographical information, educational background, professional qualifications, certifications, skills, interests, preferences, settings, customizations, saved items, favorites, bookmarks, ratings, reviews, feedback, survey responses, and any other information you voluntarily provide.

2.7 Communications and Content

Including but not limited to: messages sent through the Platform, emails, chat transcripts, video conference recordings, audio recordings, screen recordings, shared files, uploaded content, user-generated content, comments, posts, metadata associated with communications, and any other content you create, transmit, or share through the Service.

2.8 Location Data

Including but not limited to: precise geolocation data (GPS coordinates), approximate location (derived from IP address), Wi-Fi access points, Bluetooth beacons, cell tower triangulation, and any other location-based information that may be collected with or without your explicit consent, depending on your device settings and applicable law.

2.9 Third-Party and Derived Data

We may also collect information about you from third-party sources, including but not limited to: social media platforms, data brokers, marketing partners, analytics providers, advertising networks, public databases, credit bureaus, identity verification services, and other users of the Platform. We may combine this third-party data with information we collect directly from you to create inferred data, derived insights, predictive analytics, user segments, and behavioral profiles.

3. Legal Basis and Purposes for Data Processing

We process your personal data based on one or more of the following legal grounds, and for the purposes described below. The specific legal basis may vary depending on your jurisdiction and the nature of the processing activity:

3.1 Contractual Necessity

Processing necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract, including: account creation and management, service provision, payment processing, customer support, order fulfillment, subscription management, and enforcement of our Terms of Service.

3.2 Legitimate Interests

Processing necessary for the purposes of our legitimate interests or those of a third party, except where such interests are overridden by your fundamental rights and freedoms, including: fraud prevention and detection, security monitoring, network and information security, business analytics, product development and improvement, marketing and advertising, customer relationship management, internal record keeping, legal compliance, dispute resolution, and protection of our rights and property.

3.3 Legal Obligation

Processing necessary for compliance with legal obligations to which we are subject, including: tax reporting, financial record keeping, regulatory compliance, law enforcement requests, court orders, subpoenas, national security requirements, and any other legal or regulatory obligations imposed by applicable law.

3.4 Consent

Processing based on your explicit consent, which you may withdraw at any time, including: marketing communications, cookies and tracking technologies (where required by law), sensitive personal data processing (where applicable), and any other processing activities for which we have obtained your specific, informed, and freely given consent.

3.5 Vital Interests

Processing necessary to protect the vital interests of you or another natural person, including emergency situations, health and safety concerns, and prevention of harm.

3.6 Public Interest

Processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us, where applicable under the laws of your jurisdiction.

4. Data Sharing, Disclosure, and Third-Party Access

We may share, disclose, transfer, or otherwise make available your personal data to third parties under the following circumstances and for the following purposes. By using the Platform, you expressly consent to such sharing and disclosure:

4.1 Service Providers and Processors

We engage third-party companies and individuals to facilitate our Service, provide services on our behalf, perform service-related activities, or assist us in analyzing how our Service is used. These third parties may include, but are not limited to: cloud hosting providers, content delivery networks (CDNs), database management services, backup and disaster recovery services, email service providers, SMS and communication platforms, payment processors, fraud detection services, identity verification services, customer support platforms, analytics providers, marketing automation tools, advertising networks, and any other service providers necessary for the operation of our business.

4.2 Business Transfers and Corporate Transactions

In the event of a merger, acquisition, reorganization, bankruptcy, receivership, sale of assets, or other corporate transaction, your personal data may be transferred, sold, or assigned to a successor entity or third party. We reserve the right to transfer your information in connection with any such transaction, and you hereby consent to such transfer. The successor entity will be bound by the terms of this Privacy Policy unless you consent to a revised policy.

4.3 Legal Requirements and Law Enforcement

We may disclose your personal data if required to do so by law, court order, subpoena, legal process, or governmental request, or when we believe in good faith that disclosure is necessary to: (a) comply with applicable laws, regulations, or legal obligations; (b) protect and defend our rights, property, or safety, or that of our users or the public; (c) prevent or investigate possible wrongdoing, fraud, or abuse; (d) enforce our Terms of Service or other agreements; (e) respond to claims that any content violates the rights of third parties; or (f) cooperate with law enforcement, regulatory authorities, or national security agencies.

4.4 Affiliates and Subsidiaries

We may share your information with our parent company, subsidiaries, affiliates, joint ventures, and other entities under common control for purposes consistent with this Privacy Policy, including business operations, marketing, analytics, and service improvement.

4.5 Business Partners and Third-Party Integrations

We may share your information with business partners, co-marketing partners, and third-party services that you choose to integrate with our Platform. These integrations may include, but are not limited to: social media platforms, calendar applications, productivity tools, learning management systems, and other third-party services. Your use of such integrations is subject to the privacy policies of those third parties.

4.6 Aggregated and De-identified Data

We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you with third parties for any purpose, including research, analytics, marketing, and business intelligence. We reserve the right to use and disclose such information without restriction.

4.7 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so, including for specific marketing campaigns, promotional activities, or other purposes you have authorized.

5. International Data Transfers and Cross-Border Processing

Your personal data may be transferred to, processed, and stored in countries other than your country of residence, including countries that may not provide the same level of data protection as your home jurisdiction. By using the Platform, you expressly consent to the transfer of your data to New Zealand, the United States, the European Union, and any other country where we, our affiliates, or our service providers maintain facilities or conduct operations.

We will take appropriate measures to ensure that transfers of personal data are in accordance with applicable law and carefully managed to protect your privacy rights and interests. These measures may include, but are not limited to: Standard Contractual Clauses approved by the European Commission, adequacy decisions, Binding Corporate Rules, Privacy Shield certification (where applicable), and other lawful transfer mechanisms.

However, you acknowledge and agree that data protection laws in the countries to which your data is transferred may differ from those in your country of residence, and may not provide the same level of protection. You expressly waive any claims arising from such transfers to the fullest extent permitted by applicable law.

6. Data Security and Breach Notification

We implement commercially reasonable technical, administrative, and physical security measures designed to protect your personal data from unauthorized access, disclosure, alteration, and destruction. These measures may include, but are not limited to: encryption (both in transit and at rest), firewalls, intrusion detection systems, access controls, authentication mechanisms, security monitoring, regular security assessments, employee training, and incident response procedures.

However, no method of transmission over the Internet or electronic storage is 100% secure or error-free. Therefore, while we strive to use commercially acceptable means to protect your personal data, we cannot and do not guarantee its absolute security. You acknowledge and accept that any transmission of data is at your own risk, and we shall not be liable for any unauthorized access, hacking, data loss, or other security breaches.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and/or the relevant supervisory authority in accordance with applicable law. However, we reserve the right to delay notification if law enforcement or a regulatory authority determines that notification would impede a criminal investigation or national security matter.

You are responsible for maintaining the confidentiality of your account credentials and for all activities that occur under your account. You agree to immediately notify us of any unauthorized use of your account or any other breach of security.

7. Data Retention and Deletion

We will retain your personal data for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. The criteria used to determine our retention periods include:

• The duration of our relationship with you and provision of services to you
• Whether there is a legal obligation to which we are subject (e.g., tax, accounting, or regulatory requirements)
• Whether retention is advisable in light of our legal position (e.g., statutes of limitations, litigation, or regulatory investigations)
• Whether retention is necessary for our legitimate business interests

Even after you request deletion of your account or data, we may retain certain information: (a) as required by applicable law; (b) for legitimate business purposes, such as fraud prevention, dispute resolution, and enforcement of our agreements; (c) in backup or archival systems for a limited period of time; (d) in aggregated or anonymized form; or (e) where technically impractical or prohibitively expensive to remove.

Upon expiration of the applicable retention period, we will securely delete, destroy, or anonymize your personal data in accordance with applicable law and our internal policies. However, we shall not be liable for any failure to delete data due to technical limitations, backup retention policies, or legal requirements.

8. Your Rights and Choices

Depending on your jurisdiction, you may have certain rights regarding your personal data under applicable data protection laws, including but not limited to the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other privacy regulations. These rights may include:

8.1 Right of Access

You may have the right to request confirmation of whether we process your personal data and to obtain access to such data, along with certain information about the processing. We may charge a reasonable fee for providing copies of your data, particularly for subsequent requests or manifestly unfounded or excessive requests.

8.2 Right to Rectification

You may have the right to request correction of inaccurate personal data and to have incomplete data completed. However, we may require verification of the accuracy of the new data you provide and reserve the right to refuse rectification requests that are manifestly unfounded, excessive, or would require disproportionate effort.

8.3 Right to Erasure ("Right to be Forgotten")

Under certain circumstances, you may have the right to request deletion of your personal data. However, this right is not absolute and may be subject to exceptions, including where processing is necessary for: compliance with legal obligations, establishment or defense of legal claims, freedom of expression, public interest, or our legitimate interests. We reserve the right to refuse deletion requests where such exceptions apply.

8.4 Right to Restriction of Processing

You may have the right to request restriction of processing of your personal data under certain circumstances, such as when you contest the accuracy of the data or object to processing. During the period of restriction, we may continue to store your data but will not process it further without your consent, except for specific limited purposes.

8.5 Right to Data Portability

Where technically feasible, you may have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller. This right applies only to data you have provided to us and where processing is based on consent or contract and is carried out by automated means.

8.6 Right to Object

You may have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes. Upon receipt of an objection, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

8.7 Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw your consent at any time. However, withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal, and we may continue to process your data on other legal grounds.

8.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, particularly in the EU member state of your habitual residence, place of work, or place of the alleged infringement, if you believe that processing of your personal data violates applicable data protection law.

To exercise any of these rights, please contact us using the contact information provided in Section 18. We may require verification of your identity before responding to your request and reserve the right to refuse requests that are manifestly unfounded, excessive, or otherwise not required by law. We will respond to your request within the timeframe required by applicable law, which may be extended in certain circumstances.

9. Cookies, Tracking Technologies, and Online Advertising

We and our third-party partners use cookies, web beacons, pixel tags, local storage, session storage, device fingerprinting, and other tracking technologies to collect and store information about your use of the Platform. These technologies enable us to recognize you, remember your preferences, track your interactions, analyze usage patterns, deliver personalized content and advertising, and improve our services.

9.1 Types of Cookies and Tracking Technologies

We use the following categories of cookies and tracking technologies:

• Strictly Necessary Cookies: Essential for the operation of the Platform, including authentication, security, and load balancing
• Performance and Analytics Cookies: Used to collect information about how visitors use the Platform, including page views, traffic sources, and user journeys
• Functionality Cookies: Used to remember your preferences and settings, such as language, region, and customization options
• Targeting and Advertising Cookies: Used to deliver relevant advertisements, track ad performance, and build user profiles for marketing purposes
• Social Media Cookies: Used to enable social media features and track social media interactions
• Third-Party Cookies: Set by third-party services integrated into the Platform, subject to their own privacy policies

9.2 Third-Party Analytics and Advertising

We use third-party analytics and advertising services, which may include but are not limited to: Google Analytics, Google Ads, Facebook Pixel, LinkedIn Insights, Twitter Analytics, and other similar services. These third parties may collect information about your online activities over time and across different websites and services. They may use this information to provide you with interest-based advertising and to analyze and report on advertising effectiveness.

9.3 Your Cookie Choices

Most web browsers are set to accept cookies by default. You can usually modify your browser settings to decline cookies or to alert you when cookies are being sent. However, if you disable or refuse cookies, some parts of the Platform may become inaccessible or not function properly. You may also opt out of certain third-party advertising cookies through industry opt-out mechanisms, such as the Network Advertising Initiative (NAI) or Digital Advertising Alliance (DAA), though such opt-outs may not be effective for all third parties.

9.4 Do Not Track Signals

Some browsers incorporate a "Do Not Track" (DNT) feature that signals to websites you visit that you do not want to have your online activity tracked. Because there is not yet a common understanding of how to interpret DNT signals, we do not currently respond to DNT signals on our Platform.

10. Children's Privacy

Our Platform is not intended for use by individuals under the age of 18 (or the age of majority in your jurisdiction), and we do not knowingly collect personal data from children. If you are under 18, you are not permitted to use the Platform or provide any personal information to us. If we become aware that we have collected personal data from a child without verification of parental consent, we will take steps to delete that information.

If you are a parent or guardian and believe that your child has provided us with personal data, please contact us immediately. We reserve the right to request proof of parental authority and to verify the age of users. By using the Platform, you represent and warrant that you are at least 18 years of age (or the age of majority in your jurisdiction).

11. Third-Party Links and Services

The Platform may contain links to third-party websites, applications, services, or resources that are not owned or controlled by us. We are not responsible for the privacy practices, content, or functionality of any third-party sites or services. This Privacy Policy does not apply to third-party sites or services, and we encourage you to review the privacy policies of any third party before providing them with your personal information.

Your interactions with third-party sites and services are solely between you and the third party. We shall not be liable for any damages, losses, or claims arising from your use of third-party sites or services, or from any data collection, use, or disclosure by such third parties. You access and use third-party sites and services at your own risk and subject to their terms and conditions.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information held by businesses and their service providers
• Right to opt-out of sale or sharing of personal information
• Right to correct inaccurate personal information
• Right to limit use and disclosure of sensitive personal information
• Right to non-discrimination for exercising your CCPA/CPRA rights

We do not sell personal information in the traditional sense. However, we may share personal information with third parties for advertising and analytics purposes, which may constitute a "sale" or "sharing" under California law. You may opt out of such sharing by contacting us.

To exercise your CCPA/CPRA rights, please submit a verifiable consumer request to us using the contact information in Section 18. We may require verification of your identity and California residency before processing your request. You may designate an authorized agent to make a request on your behalf, subject to proof of authorization.

13. European Union and UK Privacy Rights (GDPR/UK GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have certain rights under the General Data Protection Regulation (GDPR) and UK GDPR, as described in Section 8. We are the data controller for the personal data we collect through the Platform.

Our legal basis for processing your personal data is described in Section 3. We will only process your personal data when we have a lawful basis to do so, and we will not process your data in a manner incompatible with the purposes for which it was collected.

If you wish to exercise your rights under GDPR or UK GDPR, or if you have questions about our data processing activities, please contact us using the information in Section 18. You also have the right to lodge a complaint with your local data protection authority.

14. Automated Decision-Making and Profiling

We may use automated decision-making processes, including profiling, to analyze your personal data and make decisions or predictions about you. This may include, but is not limited to: personalized content recommendations, targeted advertising, fraud detection, credit risk assessment, user segmentation, and service optimization.

These automated processes may use algorithms, machine learning models, artificial intelligence, and other technologies to process your data and generate outputs. While we strive to ensure the accuracy and fairness of these processes, they may not always be perfect and may result in errors or unintended consequences.

If you are subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you, you may have the right to request human intervention, express your point of view, and contest the decision, subject to applicable law. However, this right does not apply where the decision is necessary for entering into or performing a contract, authorized by law, or based on your explicit consent.

15. Changes to This Privacy Policy

We reserve the right to modify, amend, update, or replace this Privacy Policy at any time, in our sole and absolute discretion, without prior notice or liability. Any changes will be effective immediately upon posting of the revised Policy on the Platform, unless otherwise specified. The "Last Updated" date at the top of this Policy indicates when it was last revised.

Your continued use of the Platform following the posting of changes constitutes your acceptance of such changes. If you do not agree to the modified Policy, you must immediately cease all use of the Platform. We may, but are not obligated to, notify you of material changes via email or through a notice on the Platform.

It is your responsibility to review this Privacy Policy periodically for changes. We will not be liable for any failure on your part to review the Policy or to be aware of any modifications.

16. Limitation of Liability and Disclaimers

TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, WE SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO DAMAGES FOR LOSS OF PROFITS, GOODWILL, USE, DATA, OR OTHER INTANGIBLE LOSSES, ARISING OUT OF OR RELATING TO YOUR USE OF THE PLATFORM, OUR COLLECTION, USE, OR DISCLOSURE OF YOUR PERSONAL DATA, OR ANY BREACH OF SECURITY OR PRIVACY, EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

IN NO EVENT SHALL OUR TOTAL LIABILITY TO YOU FOR ALL DAMAGES, LOSSES, AND CAUSES OF ACTION ARISING OUT OF OR RELATING TO THIS PRIVACY POLICY OR YOUR USE OF THE PLATFORM EXCEED THE AMOUNT YOU HAVE PAID TO US IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO LIABILITY, OR ONE HUNDRED DOLLARS ($100), WHICHEVER IS GREATER.

WE MAKE NO WARRANTIES OR REPRESENTATIONS ABOUT THE ACCURACY, COMPLETENESS, OR ADEQUACY OF THE INFORMATION CONTAINED IN OR LINKED TO THE PLATFORM. WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.

SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF CERTAIN DAMAGES OR WARRANTIES. IN SUCH JURISDICTIONS, OUR LIABILITY AND THE SCOPE OF WARRANTIES SHALL BE LIMITED TO THE FULLEST EXTENT PERMITTED BY LAW.

17. Governing Law and Dispute Resolution

This Privacy Policy and any disputes arising out of or relating to this Policy or our privacy practices shall be governed by and construed in accordance with the laws of New Zealand, without regard to its conflict of law principles. You agree to submit to the exclusive jurisdiction of the courts located in Auckland, New Zealand, for the resolution of any disputes.

Any dispute, controversy, or claim arising out of or relating to this Privacy Policy, or the breach, termination, or invalidity thereof, shall be resolved through binding arbitration in accordance with the arbitration rules of New Zealand, unless prohibited by applicable law. The arbitration shall be conducted in English in Auckland, New Zealand. The decision of the arbitrator shall be final and binding, and judgment may be entered in any court of competent jurisdiction.

Notwithstanding the foregoing, we may seek injunctive or other equitable relief in any court of competent jurisdiction to protect our intellectual property rights or confidential information. You waive any right to a jury trial and any right to participate in a class action or representative proceeding.

18. Contact Information and Data Protection Officer

If you have any questions, concerns, complaints, or requests regarding this Privacy Policy, our data processing practices, or the exercise of your privacy rights, please contact us at: