Privacy Policy

Last updated: 2026-10-06

This policy explains what personal data Kwizmo Litoria ("the platform", "we") processes when your organization uses this training platform, and what happens to it.

Who is the data controller?

For your employees' training data (name, email, job function, lesson progress, exam results, certificates), your organization is normally the data controller - you decide who to enrol and why. Kwizmo Litoria acts as a data processor, handling that data on your organization's behalf and instructions. See our Data Processing Agreement for the terms that govern this relationship. For account data relating to your organization's own administrators, and for anyone who signs up directly (e.g. via the demo sign-up form), Kwizmo Litoria acts as the controller.

What data we process

Account data: name, email address, password (stored as a salted hash, never in plain text), organization, role (employee/admin), preferred language.
Training data: lesson and video-viewing progress, exam attempts, scores, answers given, time spent, chosen course format (written/video), optional job function and industry selections.
Certificate data: a unique certificate code, issue and expiry dates - designed to be publicly verifiable by code, without exposing other personal data.
Security data: login timestamps, session identifiers, and, if your organization enables two-factor authentication, a TOTP secret (used only to verify 6-digit codes, never sent anywhere by email).
Technical data: standard web server logs (IP address, browser type) for security and troubleshooting purposes.

Why we process it

To provide the training, exam, and certification service you or your employer signed up for (performance of a contract).
To help your organization document AI literacy measures as required by Article 4 of the EU AI Act (legal obligation / legitimate interest).
To secure accounts (login, password reset, optional 2FA) and prevent abuse.
To send service-related email (password resets, 2FA recovery, recertification reminders) - only if your organization or platform operator has configured an email provider.

Who we share data with

We use SendGrid (Twilio Inc.) as a sub-processor for transactional email (password resets, reminders, invitations), when configured. We do not sell personal data, and we do not use it for advertising. Data may be disclosed if required by law.

Optional AI features (your own Anthropic account)

Two features - the AI use-case risk assessment and the "Can I use AI for this?" assistant - are optional and only active if your organization's administrator configures its own Anthropic API key (Admin > Settings). When this is not configured, no data is sent to Anthropic and these features stay hidden. When it is configured: text your employees enter into these features (the use-case description you write, or the question you ask the assistant) is transmitted to Anthropic PBC to generate a response, under your organization's own agreement with Anthropic - Anthropic is not engaged by us on your behalf for this processing, and we make no representation about how Anthropic itself retains, uses, or trains on that data. Please refer to your own Anthropic agreement and Anthropic's own terms for that. Separately, Kwizmo Litoria does store the text you submitted and the AI-generated response in our own database, as part of your organization's use-case register or assistant history, for as long as described below.

How long we keep it

Training and certificate records are kept for as long as your organization's account is active, since they serve as ongoing evidence of AI literacy measures. Your organization's administrator can request deletion of specific employee records; certificate verification codes may be retained longer where needed to honor verification requests already issued to third parties.

Your rights

Depending on your location, you may have the right to access, correct, delete, or export your personal data, and to object to certain processing. Employees should generally contact their own organization's administrator first, since the organization controls the data; for anything Kwizmo Litoria controls directly, contact us.

Contact

Kwizmo d.o.o. · Contact us