Privacy Notice

1. Controller and DPO contact

540Learning (Riyadh) is the controller of your personal data. Our Data Protection Officer can be reached at gsarwar@540learning.com.

2. Data we collect

• Account data: name, email, phone, city, preferred language and currency, profile photo.
• Identity data for certificates (optional): name on certificate, national ID/Iqama number.
• Learning data: enrolments, lesson progress, quiz and exam attempts, assignments, notes, questions and reviews.
• Exam integrity data: identity confirmation, focus/tab events and (where enabled) webcam snapshots during proctored exams.
• Commerce data: orders, invoices, buyer details (CR/VAT number for corporate buyers). Card details are handled by our payment providers, never by us.
• Partner certification data: exam vouchers, registration status, exam dates, credential IDs.
• Technical data: IP address, device/browser, analytics events and cookies.

3. Purposes and lawful basis

• Delivering courses, exams and certificates — performance of our contract with you.
• Issuing tax invoices and keeping accounting records — legal obligation (ZATCA, Companies Law).
• Fulfilling partner certifications — contract; your name, email and voucher are shared with the partner.
• Exam proctoring and fraud prevention — legitimate interest in the integrity of certifications.
• Marketing emails and WhatsApp messages — your consent, which you can withdraw at any time from Privacy & data settings.
• Platform security, analytics and improvement — legitimate interest.

4. Sharing and sub-processors

We share data only with providers that help us operate the platform, each bound by contract:

• Payments: Moyasar (Saudi Arabia), Stripe (Ireland/USA) and PayPal.
• Email: Resend.
• WhatsApp Business messaging: Meta Platforms.
• Video hosting and streaming: Mux / YouTube / Vimeo, depending on the lesson.
• AI study assistant and role-play: Anthropic (only the text you submit to the assistant).
• Certification partners (for example SCRUMstudy) for partner programmes you purchase.
• Cloud hosting and storage providers.
• Authorities where required by law.

5. Cross-border transfers

Some providers process data outside the Kingdom of Saudi Arabia. Transfers are made only where permitted by the PDPL and its transfer regulations, with appropriate safeguards (contractual clauses, data-minimisation and encryption in transit and at rest).

6. Retention

• Account and learning data: for the life of your account and 12 months after deletion request handling.
• Tax invoices, credit notes and payment records: 10 years, as required by Saudi tax and commercial law.
• Certificates: retained indefinitely (pseudonymised name only) so employers can verify them.
• Exam integrity logs and webcam snapshots: 12 months after the attempt.
• Notification logs: 24 months.

7. Your rights

Under the PDPL you have the right to be informed, to access and download your data, to correct it, to request deletion, to withdraw consent and to object to certain processing. Use Privacy & data in your account to export or delete your data, or write to gsarwar@540learning.com. We respond within 30 days. You may also lodge a complaint with the Saudi Data & AI Authority (SDAIA).

8. Cookies

We use strictly necessary cookies for sign-in, language and currency, and first-party analytics to improve the platform. We do not use third-party advertising cookies.

9. Security

Data is encrypted in transit (TLS) and at rest, access is role-based and audited, and passwords are hashed. Please notify gsarwar@540learning.com immediately if you suspect unauthorised access to your account.

10. Children

The platform is intended for learners aged 16 and over. We do not knowingly collect data from younger children.

11. Changes to this notice

This notice is version 2026-09-12. We will notify you of material changes by email or in-app notice; your consent record references the version you accepted.