SKILLFULL PRIVACY POLICY

OVERVIEW

We take your privacy very seriously, and we never rent or sell personal data for any purpose to anyone.  While we use your data to process transactions for you, interact with you at your request, or to assist our customers who contact you, we have set ourselves very strict rules to ensure that your data is kept private and secure, and never sold or rented. We make it easy for you to request what information we have about you, and make it easy for you to request that we delete that information.   Whether you are a customer, an end consumer that has contact with one of our customers through our applications, or a casual visitor to our website, we keep your personal data secure using industry accepted procedures and controls. There are many specifics to our privacy policy.  If you want to learn more, you can read about the details below. 

TABLE OF CONTENTS

• APPLICABILITY AND SCOPE OF POLICY
• WHAT INFORMATION DO WE RECEIVE OR COLLECT?
• HOW DO WE USE YOUR INFORMATION THAT WE RECEIVE OR COLLECT?
• DO WE SHARE THIS INFORMATION WITH ANYONE?
• PROTECTION OF PRIVATE INFORMATION
• DATA RETENTION
• CAN YOU LIMIT OR OPT OUT OF THE INFORMATION COLLECTION?
• YOUR REQUESTS AND HOW WE RESPOND
• SPECIFICS ON THE EU-US PRIVACY SHIELD FRAMEWORK
• CCPA SPECIFIC DISCLOSURES
• PRIVACY OF MINORS
• CHANGES TO THIS PRIVACY POLICY
• CONTACT US

APPLICABILITY AND SCOPE OF POLICY

The Skillfull team (“We”) take your privacy very seriously, and make every reasonable effort to safeguard your personal data and to comply with all applicable laws, policies, and regulations related to the collection, storage and processing of personal information.    

This privacy policy is intended to inform you of what information we collect, how this information is used, and what steps we take to protect this information. This policy covers our websites, web and applications and is applicable worldwide. If you have any questions or concerns about our privacy policy and protections, please contact us at support@getskillfull.com.

This policy outlines our data handling practices and how we collect and use the Personal Data you provide during your online and offline interactions with us. As used in this Privacy Policy, “Personal Data” means any information that can be used to individually identify a person, and may include, but is not limited to, name, email address, postal or other physical address, credit or debit card number, title, and other personally identifiable information.

This policy is effective as of January 1, 2021 and may be updated from time to time for reasons such as operational practices or regulatory changes, so we recommend that you review our Privacy Policy when returning to our website.  When our privacy policy changes, we will post a notice at the home page for our websites and applications.  If you object to any changes of our privacy policy, you may discontinue visiting the website and suspend usage of any of our applications.

WHAT INFORMATION DO WE RECEIVE OR COLLECT?

DATA SUBJECTS	DEFINITION	DATA WE COLLECT / RECEIVE	HOW WE COLLECT IT
VISITORS & NEWSLETTER REQUESTORS	Persons who visit our marketing websites and/or request newsletters without setting up accounts.	> Device, browser and platform information.  ISP and IP address data.  Geolocation, Time-stamp related information.   > We may also collect visitor behavior data, including previous website, web-page hits, time spent on pages, web-page paths and other meta-data.	> This data is sent as part of the basic function of the internet, and also through the use of Cookies.   > Through the use of cookies or through the use of an analytic application (such as Google Analytics)
CUSTOMERS (INDIVIDUAL OR ORGAN-IZATIONS)	Customers and Organizations that utilize our services as customers of ours.	> Identifier information such as email address, first/last name, and phone number.   > End Customer Contact Data, such as first/last name, phone number, and other data you decide to use in the application.   > Content you provide for distribution to your customers, whether or not for a fee, including seminars, training, documents, video, or transcripts.   > We may also collect Information regarding application usage and user behavior, such as clicks, page views, input changes, key presses, form submissions and element selections.	> Provided by you directly to us at account registration.   > Provided by you during use of the applications.     > You provide us this information for you to use the application as a benefit to your customers.     > Through the use of cookies or through use of an analytic application (such as WalkMe)
OUR CUSTOMERS’ CLIENTS	Persons that utilize our service and applications to access content or communications with our customers, whether or not the content is delivered for a fee.	> Contact Data, such as first/last name, phone number and other data that the Customer or Customers’ Clients decided to use in the application.   > Content and communications information and meta data on content and communications.     > Information about usage such as content, response rate, data and time stamp, and other personal information supplied by the customers’ customer.	> Provided by our Customers during use of the applications.       > Sent by our Customers’ Clients while using our applications’ services. Meta-data is collected by our applications.   > Content and related data is sent by our Customers and their Clients while utilizing our applications’ services.  Meta-data is obtained by our applications during the processing of the communications.

HOW WE USE YOUR INFORMATION THAT WE RECEIVE OR COLLECT?

Whether you are a Visitor, a Customer, or a Customer’s Client, we never sell your information, and we use the data we receive or collect to respond to your requests for services or information, and only in accordance with this Privacy Policy.

For each type of information, we receive or collect, we use it according to the table below:

DATA SUBJECTS	DATA WE COLLECT / RECEIVE	HOW WE USE THE INFORMATION
VISITORS & NEWSLETTER REQUESTORS	> Device, browser and platform information.        > Visitor behavior data.	> This data is used to offer you optimized experiences based on your device or location, and to respond to your requests.  For example, if you signed up for one of our email newsletters, we will send the newsletter to you; or if you request a demo, we will schedule the demo with you.   > This data is used to generate reports for website optimization.
CUSTOMERS (INDIVIDUALS AND ORGAN-IZATIONS)	> Identifier information.                 > Content that you provide to us     > Information regarding application usage and user behavior.	> This data is stored within the application and used for display and identification purposes within communications with customers’ customers or during the administration of your usage of the applications.  Your email address is used as your login user name and is stored within your user record. We use this email address to send you information about your account, notifications about your assignments, and password reset notifications, and to respond to service or account requests from you.   > This information is used to provide you and your customers with the content sharing services of our applications.   > We use this information for analyzing our websites and applications to improve the customer experience.
CUSTOMERS’ CLIENTS’  INFORMATION	> End User Contact Data       > Content information and meta-data of communications.	> This data is received from our Customer or our Customer’s Clients and used to facilitating your use of the applications for content provisioning or information dissemination.   > Used for the provisioning of our apps/services to our customers and their customers and shared with their agents or administrators. Meta-data is used for analytical purposes and for optimizing and improving our service.

DO WE SHARE THIS INFORMATION WITH ANYONE?

We do not sell your information to any third party.  We limit sharing of information to the extent possible any only share as required for your use of our applications or to be able to respond to your service or information requests, or to third parties for the purposes of analyzing website and application usage and improving visitor and customer experience and improving our applications and services.  Specifics on the sharing of your information is given in the table below:

DATA SUBJECTS	DATA WE COLLECT / RECEIVE	HOW WE SHARE THE INFORMATION
VISITORS & NEWSLETTER REQUESTORS	> Device, browser and platform information.      > Visitor behavior data.	> We do not share this information with third-parties.  As a visitor, when you give us your data, you agree to share that data with us for the purpose of supplying you with the information or service you seek.   > We do not share this information with third-parties.   See below for More information about user analytics.
CUSTOMERS (INDIVDIUALS AND ORGAN-IZATIONS)	> Identifier information.               > Content that you provide to us.         > Information regarding application usage and user behavior.	> We do not share this information with third-parties, other than with third-party processes as part of supplying our application or service. Some of this information is made available to your customers for communications with you as a part of supplying our services to you through our applications. By signing up, you agree that this information is available to our support staff. This information is never released to a customer unless you take action to release it to them.   > We do not share this information with third-parties other than with third-party processors as part of supplying our application or service.  This data is available to you and, as a part of our service, to your customers.   > We do not share this information with third-parties.  See below for More information about user analytics.
CUSTOMERS’ CLIENTS	> Contact Data.         > Content information and meta-data of text / talk communications.	> We receive this information from our Customers or directly from their Clients and share it only with them to support both parties utilizing our applications for the benefits designed.  We do not share this information with third-parties.    > We do not share this information with third-parties, other than with third-party processors as part of supplying our application or service.  By using our service, you agree that this data is available to those content providers from whom you are requesting content.

Note that we do not share Sensitive Personal Information with any third-party except as directly required to perform a service or deliver an application or transaction to you at your request.

More Information about third-party analytics:  If we choose to use a data analytics third-party, we do not link the Personable Identifiable Data mentioned above to the data collected by the analytics application.  In addition to this, and following our own stringent data privacy policy, we will follow the third-party analytics Terms of Service and their Privacy Policy.

Customer / Organization Responsibilities: You and your organization, agents, administrators, users and volunteers must access and use the information you collect, send, provide or receive from using our applications and services only as allowed and described in your own privacy policy and only for your own legitimate business purposes. Training of your staff, agents, administrators, users and volunteers is your responsibility.

Data Sharing with third-party processors:  We may share Personal Data within Skillfull and with third party service providers, business partners, service vendors and/or authorized third-party agents or contractors for purposes of data processing or storage and to provide requested services, products or transactions, including processing orders, processing credit card transactions, providing our services, and providing customer support.    

In addition, we may transfer to a third-party processor standard personal information for the purposes of processing transactions, performing investigations of fraud, breaches, or technical issues, etc.  For example, if we took credit card information online to process a transaction for our service, we would transfer that information to a credit card processor to complete the transaction.  In these cases, we only use the information to complete the transaction you request and only such information we reasonably determine that the third-party requires. In addition, we instruct the third-party to process the information only within the confines of our instruction and agreement.

If any of the circumstances specified above do require us to transfer information to a third-party, we will only do so with reputable third-parties that are well-known and have standard agreements and privacy practices that are at least as strict as our own, or under the following additional conditions:   

• We have a written agreement with the 3rd party that defines time limited and specified purposes consistent with the consent provided by our users;
• The 3rd party agrees to provide the same level of privacy protection as Skillfull privacy policies, and where applicable as provided by the Privacy Shield Principles
• The 3^rd party agrees to notify Skillfull if it can no longer meet these obligations;
• The 3rd party agrees to take reasonable and appropriate steps to remediate if they can no longer meet the obligations.

Further, we will take reasonable and appropriate steps to ensure that the 3rd party effectively processes the personal information transferred in a manner consistent with our privacy policy.

Other than explicitly mentioned in this privacy policy, we do not share, trade, disclose, or sell your personal information to any 3^rd parties for any purposes, including advertising.

Legal Protections and Law Enforcement: We may access, use, preserve, transfer and disclose to third parties your Personal Information to: (1) satisfy any applicable law, regulation, subpoena, governmental request, or legal process if required by law; (2) protect and/or defend this Privacy Policy or other policies or terms of use applicable to our services, including investigations of potential violations thereof; (3) protect the safety, rights, property or security of Skillfull or any third party; and/or (4) detect, prevent or otherwise address fraud, security issues or breaches, or technical issues.

If Skillfull is required by law to disclose any of your data that directly identifies you, then we will use reasonable efforts to provide you with notice of that disclosure requirement, unless we are prohibited from doing so by statute, subpoena or court or administrative order. We will object to requests that we do not believe were issued properly.

PROTECTION OF PRIVATE INFORMATION

We are committed to protecting the Personal Data you share with us or that we otherwise receive or collect. We utilize a combination of industry-standard security technologies, procedures, and organizational measures to help protect your Personal Data from unauthorized access, use or disclosure. To prevent unauthorized access, maintain data accuracy and ensure the appropriate use of information, we have put in place commercially reasonable physical, technical and administrative controls to protect your information. Please note that no method of data protection is 100% secure.

It is important that you protect and maintain the security of your account and that you notify us immediately of any unauthorized use of your account. Do not disclose your password to anyone.

Linked websites and third-party services:  Our websites and services may provide links to other third-party websites and services which are outside our control and not covered by this policy. We encourage you to review the privacy policies posted on these (and all) sites you visit or services you use.

DATA RETENTION

Personal Information used by Customers (individuals or Organizations) is retained for the life of their account.  Personal Information otherwise collected or received is retained until a deletion request is received or until it is no longer required for a legitimate business purpose.  Skillfull will only retain Personal Information as long as allowable by law or regulation. 

CAN YOU LIMIT OR OPT OUT OF THE INFORMATION COLLECTION?

For Visitors:  You do not have to provide us with any personal data to visit our marketing website.  You can limit personal data collection simply by not supplying us with this data.  For meta-data collected by cookies, please see the Special Note on Cookies, below.   Certain information or services available to visitors cannot be made available if you determine to limit the information you share with us. For example, if you select our newsletter request page and decide that you do not want to share the information, then you do not have to share it.  Unfortunately, we will not be able to send you the newsletter without the name and address of the recipient.

For Customers and their Organizations and their Administrators:  You cannot opt-out or limit the collection of personal information if you want to use the services and applications.   The information you provide to us is your responsibility.  In our capacity, we are a Service Provider and only use this information (including Sensitive PI) for the purposes of supplying you with the products and services for which you contract with us. You have the obligation to obtain any personal identifying information that you supply to us in a legitimate manner consistent with law, and you are responsible for maintaining an appropriate legal basis for obtaining, controlling and processing this data.  We process it for you at your request and under your legitimate basis.  We will make every reasonable attempt to respond in a timely manner to any legitimate requests, from you or passed on to us through you, to obtain, review or delete this information. If you lose the legitimate basis for the information or it otherwise should no longer be retained, you must notify us immediately so we can begin the process of deleting the information.  Note that we never sell personal information, including sensitive personal information.

For Customer’s Clients:  The customer’s clients may stop communications by requesting to opt-out from further communications.  A customer’s client may request access or deletion of personal data through us (using the mechanisms defined in this policy) or through the associated Customer.   Please note that we do not have the ability under the current regulations to maintain suppression records when we receive a deletion request of personal data.  In other words, if we receive the same personal data from another customer or from the same customers’ client in the future, we will not know that it was the subject of a previous deletion request and may process it until a further request to opt-out or a further request for deletion is received. As Customers and Clients are acquired from different Customers and Projects, there is currently no possibility for a platform-wide opt-out.  In other words, if we receive an opt-out request from a Customer’s Client on one project, we have no ability to prevent the same Client from accessing other projects with other customers or from utilizing our platform to obtain content from another Customer later on. However, we will diligently handle any opt-out request in a timely fashion for current information on the platform.

Special Note on the Use of Cookies:   Users can control the use of cookies at the individual browser level.  We inform you about the use of cookies with a banner when you enter our website. 

You may prevent the storage of cookies by a corresponding setting on your browser software.  There are certain cookies that are required for the operation of the website or applications.  Therefore, if you use this setting, you may not be able to use all of the features of our websites and applications.  

In addition, your browser may offer you a “Do Not Track” option, which allows you to signal to operators of websites and web applications and services (including behavioral advertising services) that you do not wish such operators to track certain of your online activities over time and across different websites. Our Products do not support Do Not Track requests at this time, which means that we collect information about your online activity both while you are using the services / applications and after you leave our web-sites / applications.              

The information generated by the cookie about your use of our website may be transmitted to a third-party analytics company’s servers in the USA and stored there. The information generated by the cookie about your use of our applications may also be transmitted to a third-party analytics company’s servers in the USA and stored there.  These third-parties may transmit this information to other vendors for analytic services.

YOUR REQUESTS AND HOW WE RESPOND

Access and Deletion of Personal Data from Customer (Individual and Organization) Accounts: You can request access or deletion of personal data, including your account and all profile information by emailing support@skillfull.com. If you are a member of an Organizational Customer, we must notify them of your request.  If an organization account deletion request is made, we must confirm with the contract holder in your organization before deletion. You may view or change your personal information at any time in your profile settings.

Access and Deletion of Personal Data from Customers’ Clients:  We recommend that Customers’ Clients request access or deletion of personal data through the associated Customer.  Customers’ Clients may also request access or deletion of personal data by emailing support@skillfull.com. 

Access and Deletion of Personal Data from Website Visitors: You can request that we show you what personal identifying information we have about you at any time by contacting us.  You can also request that this information be deleted at any time by contacting us.  Data requests should be sent to support@Skillfull.com.  You may opt out of our newsletter at any time by emailing support@skillfull.com or by using the link at the bottom of the email newsletter.

How we Handle Your Requests: When we receive a request for personal data access or deletion, we must take reasonable steps to confirm your identification prior to acting on your request. Each request will be logged and handled with a response to you in the time required by law, or, if there is no applicable law, within a reasonable amount of time.  We will react to requests for access by sending you a copy of your personal data we maintain.  We will react to requests for deletion by confirming the legal basis for the personal data and if we have legal reason to keep the data (for example, to complete a credit card transaction you initiated).  We will determine the appropriate timeframe for deletion, and then track your request until deletion is complete.  We will inform you of the completion of the request.

CCPA/CPRA SPECIFIC DISCLOSURES

The California Consumer Privacy Act of 2018 (“CCPA”) took effect on January 1, 2020, and the California Privacy Rights Act (“CPRA”) takes effect on January 1, 2023.  While these laws require certain companies to make disclosures about which Personal Information is collected, shared or sold with third parties, the regulations and regulatory impact of the CPRA have not been finalized.   We believe in being proactive and make the following disclosures in preparation for the CCPA/CPRA, and will modify these disclosures as regulations are finalized:

• At this point, Skillfull does not believe itself to be a “covered” business.  As our business changes, we will periodically evaluate this distinction and adjust our practices and disclosures if necessary.
• We will review and update our Privacy Policy at least annually, and will link to our privacy policy in a visible and noticeable location on the home page of our website.
• When responding to rights of access requests, as per the “Access and Deletion of Your Information” section above, we will respond within 45 days in a portable and easy to access format, and include categories of personal information collected, categories of sources of the information, the business purpose for our collection of the information, categories of any third-parties with whom we share the information, and the specific pieces of personal information collected about the requestor, with a disclosure that we do not sell personal information.
• When responding to deletion requests, we will determine if there are business or legal requirements to retain the information under the laws and regulations, and, if not, we will delete the information within 45 days, and we will pass on those deletion requirements to third-parties if appropriate.
• When responding to rights of correction requests and rights of data portability requests, we will respond in a reasonable timeframe, taking reasonable steps to ensure the party requesting the corrections is the rightful data subject, which may include requesting reasonable identifying information from you to ensure your identity.  We cannot act upon vague requests and will respond if we need more information to handle your request.  For data portability, only the data that is reasonably portable will be made available, and only on media or via methods that we can reasonably accommodate.
• There are two methods we make available for making such requests, which can be found in the “Contact Us” section below. 
• At this point in time, Skillfull does not share your information for the purpose of cross-context behavioral advertising.  If Skillfull determines to use such technology in the future, we will update this policy and our procedures to allow opt-out of information sharing for such purposes.
• At this point in time, Skillfull does not utilize automated decision-making technology or profiling. If we do, in the future, utilize such technology to provide additional services or features to you, we will update this Privacy Policy to describe how you can opt-out of such use.
• As we do not share Sensitive Personal Information with any third-party, except in the capacity required for transactions to supply you with the product or service you requested, we do not have a mechanism for opt-out of sharing Sensitive Personal Information with third-parties.  As we do not share it, except to process transactions you request, you are effectively already opted-out of that sharing.
• We specifically collect the following categories of personal information, as described in the CCPA, and sensitive personal information, as described in the CRPA:

Category	Examples
Identifiers	Name, Email Address, Unique Personal Identifier, IP Address, Account Name, Phone Number, or other similar identifiers
Commercial Information	Products or Services purchased or utilized, obtained or considered, or other purchase and consumer histories or tendencies.
Usage	Information on the User’s interaction with our products or services, through our applications, and possibly with the usage of cookies.
Internet Activity	Information on the User’s interaction with our web pages and free trials, and possibly with the usage of cookies.
Transaction Information	Information required to complete purchase transactions, such as credit card number, CCV number, credit card expiration date, or other information that allows us to complete transactions you request.

• We do not collect “sensitive personal information” such as Social Security numbers and driver’s licenses), financial account and login information, precise geolocation, race, ethnicity, religious or philosophical beliefs, or union membership, or content of nonpublic communications, genetic data; biometric or health information; and sex life or sexual orientation information.
• We describe the sources and purposes of collecting your information in the above section “What Information Do We Collect?”
• We do not sell your personal information, and, of the seven categories of information disclosure described in the CCPA, we have only disclosed personal information in the following categories in the last 12 months (as of the date of this policy version)  In this section, by “disclosing” privacy      data, we mean sharing that data to any other company or third-party for any purpose:

Disclosure Category	Have we disclosed personal data to another company or third party in the past 12 months?
Auditing	No
Security	No
Debugging	No
Short Term Advertising uses (contextualization but not profiling)	No
Performing Services	Yes. We have disclosed Identifiers and Commercial Information to our Third Parties for the purposes of delivering our products and services to our customers.
Internal Research	No
Testing or Improvement	Yes.  We have disclosed Usage and Internet Activity to Third Party analytic companies for the purposes of understanding usage and improving our products and services.
Other	No

You may make data access or deletion requests to us as per the “Contact Us” section below.  We will not discriminate against you for making these requests, including not denying you goods or services, charging you more for goods or services, denying benefits or imposing penalties, providing a different quality of service, or threatening you with any of the above in response to your data requests.  Note that we may not be able to provide you a good or service if the provisioning of the service requires certain personal data to deliver the good or service.  For example, we cannot provide you with a newsletter without a mailing address or email address to send it to.

PRIVACY OF MINORS:

We have certain contracts with Educational Institutions to assist them in delivering content to their students.  They maintain the legal basis for usage of their students’ privacy data for the purposes of communication, and we do not disclose the students’ private information to anyone other than back to the Educational Institution for the purpose of delivering our service to the students.  In addition, we require that our other clients do not communicate with children, but we have no control over their usage of our applications and the data that they supply.  

To the best of our knowledge, we do not solicit information directly from any minor.  If we determine that we have solicited personal information from a minor, we will delete that information in a timely fashion.  Please contact us (see “Contact Us” section below) if you believe we have personal information from a minor not connected with one of the Educational Institutions we serve, and we will review the information and delete it as appropriate.

CHANGES TO THIS PRIVACY POLICY

This privacy policy may be amended from time to time. Any such changes will be posted on this page. We will notify you of any significant or material changes in the way we treat your information by placing a prominent notice on our site and/or, for Customer Accounts, sending a notice to the primary email address specified in your account.

CONTACT US

California Privacy Rights: Under California Civil Code sections 1798.83-1798.84, California residents are entitled to ask us for a notice identifying the categories of personal customer information which we share with our affiliates and/or third parties for marketing purposes, and providing contact information for such affiliates and/or third parties. If you are a California resident and would like a copy of this notice, please submit a written request to support@skillfull.com.

To address your individual rights, make a request for access, deletion, correction or portability of personal data, or if you have any privacy-related questions or comments related to this privacy policy, please send an email to support@skillfull.com, or by writing to:

Skillfull
Attn: Privacy Officer
114 Shadewell Drive

Danville, CA 94506