Loading...
Home
Policy // Privacy
Privacy policy
“This policy explains what we collect, why we collect it, how long we keep it, and how you can exercise your rights under GDPR and India's DPDP Act.”
Effective: Feb 20, 2026
Updated: Oct 18, 2026
Status: Active
Support: info@otsec.academy
01. Data We Collect
Identity and account data
Name, email, phone number, profile metadata, login identifiers.
Learning and activity data
Enrollments, lesson progress, quiz attempts, lab challenge completions, earned XP, flashcard activity, certificates.
Billing and transaction data
Invoices, payment records, transaction identifiers, tax details.
Support and communication data
Contact form messages, newsletter preferences, operational email logs.
Optional learner leaderboard
We calculate XP from learning records and store your participation preference and the notice version you accepted. Participation is off by default. With your permission, the top three participating learners' profile names, XP totals and ranks are visible to signed-in users. Admin accounts are excluded. Emails, phone numbers, individual quiz scores and payment details are not displayed. You can join or withdraw in your profile under Leaderboard privacy. Withdrawing removes your name from subsequent leaderboard requests without deleting your private learning records. Previously viewed names may remain on another user's screen until it refreshes.
Optional LinkedIn certificate sharing
When you connect LinkedIn, we store your LinkedIn member identifier, display name, permission expiry and an encrypted access token. This is separate from your academy login. Only when you confirm Publish do we send your certificate PDF and chosen caption to LinkedIn as a public document post, which others can view and download. We retain the caption and publication receipt with your academy account to show the outcome and prevent duplicate posts. We do not save a separate copy of the uploaded PDF. You can disconnect in the certificate sharing dialog to delete our saved access; this does not delete posts already on LinkedIn. You can also revoke access in LinkedIn settings and delete posts there. Expired connection credentials and temporary connection requests are removed by scheduled cleanup. Contact info@otsec.academy to request deletion of retained sharing records.
02. Purpose and Legal Basis
- ::Account creation, authentication, and platform security: contract performance and legitimate interests.
- ::Course delivery, assessments, certificates, and progress tracking: contract performance.
- ::Payments, invoicing, and tax compliance: legal obligation and contract performance.
- ::Support responses and service communications: legitimate interests and contract performance.
- ::Optional alerts/marketing updates: consent (you can revoke at any time).
03. Data Retention
- ::Account and profile records: retained while the account is active and for a limited period after closure for fraud/security handling.
- ::Learning records and certificates: retained to preserve your completion history unless deletion is requested and legally permissible.
- ::Billing and invoice records: retained as required by applicable tax/accounting laws.
- ::Support and contact records: retained for operational follow-up and security/audit needs, then deleted or anonymized.
- ::Cookie consent preferences: retained for compliance proof and renewed when policy version changes.
04. Your Rights
Depending on your jurisdiction, you may request access, correction, deletion, restriction, objection, portability, and consent withdrawal.
For unresolved concerns, you may escalate to relevant supervisory or statutory authorities in your jurisdiction.
05. Cross-Border Processing
Our infrastructure and service providers may process data across regions. We apply contractual, organizational, and technical safeguards to protect personal data during cross-border transfers.
06. Cookies and Consent
You can review and update cookie preferences any time from Cookie Preferences in the footer. We currently use the following first-party cookies:
- ::cookie_consent: stores your consent categories and consent version (retention
- ::otsec_cookie_analytics: stores analytics consent state (retention
- ::otsec_cookie_marketing: stores marketing consent state (retention
- ::otsec_cookie_personalization: stores personalization consent state (retention
- ::sidebar:state: stores dashboard sidebar open/collapsed preference (retention
Third-party platforms such as Google OAuth and Razorpay may set their own cookies during sign-in or payment actions. Those cookies are controlled by their respective providers.
07. Security and Incident Handling
We apply layered access controls, encryption in transit, and role-based restrictions for sensitive records. If a personal-data incident is confirmed, we follow applicable notification and remediation obligations.
“For inquiries regarding data governance, contact our privacy officer.”