Privacy principles and scope

Definitions

For clarity, the following definitions apply throughout this policy and describe how terms are used in relation to MasterYTrack services.

Purposes of processing

Personal data is processed for specific, explicit and legitimate purposes aligned with the services MasterYTrack provides. We do not process data for unrelated objectives without appropriate notice or consent.

• Service delivery: to provide course content, certification preparation materials, assessments and progress tracking.
• Account management: to create and maintain user accounts, authenticate access and manage subscriptions and billing.
• Support and communications: to respond to inquiries, provide technical support and communicate important service updates.
• Product improvement: to analyse usage patterns and improve course quality, platform features and learning outcomes.
• Security and compliance: to detect and prevent fraud, troubleshoot issues and meet legal obligations.
• Marketing and outreach: to send promotional messages or course recommendations where a user has consented to receive such communications.
• Research and aggregated analytics: to produce non-identifiable insights for curriculum development and industry reporting.
• Third-party integrations: to enable optional integrations and data transfers initiated by the user (e.g., importing professional credentials).

Legal bases for processing

Where applicable under data protection law, we rely on appropriate legal bases for processing personal data, such as contract performance, legitimate interests, consent, and compliance with legal obligations.

• Contractual necessity: processing required to perform the services you have requested, including subscription management and course delivery.
• Legitimate interests: processing for platform security, fraud prevention, and improving services where such interests are balanced against individual rights.
• Consent: for optional marketing communications, cookies beyond strictly necessary functionality, and other optional features where consent is obtained.
• Legal compliance: processing necessary to comply with a legal obligation or to respond to law enforcement or regulatory requests.

Data subject rights (GDPR and applicable law)

Where applicable, users have rights regarding their personal data. We provide straightforward means to exercise these rights and will respond in accordance with legal timeframes.

• Right of access: request a copy of personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of personal data where legal conditions are met.
• Right to restriction: request limitation of processing in certain circumstances.
• Right to data portability: request transfer of provided data in a commonly used machine-readable format when processing is based on consent or contract.
• Right to object: object to certain processing based on legitimate interests or direct marketing activities.

Cookies and similar technologies

MasterYTrack uses cookies to enable essential platform functions, measure performance and provide personalized experiences. Users can manage cookie preferences via the cookie management controls on the website.

We use essential cookies for authentication and preferences, analytics cookies to measure and improve performance, and optional functional cookies for features like saved progress and language preferences.

Categories include strictly necessary, performance/analytics, functionality and marketing. Marketing cookies are used only with explicit consent where required.

You may manage or withdraw consent for non-essential cookies through your browser settings or the cookie preferences interface on our website. Disabling some cookies may affect site functionality.

Cookie Settings

Data sharing and disclosures

We share personal data only with service providers and partners necessary to deliver the service, protect security, or comply with legal requirements. All third parties are required to protect your information.

• Service providers that support hosting, analytics, email delivery, and payment processing.
• Third-party learning partners or assessment vendors when you enroll in joint courses or certify through partnered programs.
• Professional networks or prospective employers only where you explicitly choose to share certification results or profile data.
• Legal and regulatory authorities when disclosure is required to comply with law or respond to lawful requests.
• Affiliates and contractors engaged to provide technical or operational services under written confidentiality obligations.
• Aggregated or anonymised datasets that cannot reasonably be used to identify an individual, used for research and product improvement.

International transfers

Where data is transferred outside Switzerland or the European Economic Area for processing, we ensure appropriate safeguards such as standard contractual clauses or reliance on an adequacy decision where applicable to maintain an adequate level of protection.

We rely on contractual safeguards, data processing agreements and approved transfer mechanisms to protect personal data when engaging processors or sub-processors located in other jurisdictions.

Data retention

We retain personal data only as long as necessary to fulfil the purposes set out in this policy, comply with legal obligations, resolve disputes and enforce agreements.

Account information and subscription records are retained for the duration of the account plus a limited period to allow for reactivation, to comply with tax or accounting obligations, and to address disputes.

Communications and support records are retained for as long as needed to provide support and to maintain a history of interactions relevant to service quality and compliance.

Security logs and diagnostic records are retained for a limited period to contribute incidents, maintain system integrity and comply with applicable retention requirements.

When retention periods expire or upon valid deletion requests, we securely delete or anonymise personal data unless continued retention is required by law or legitimate business needs.

Security measures

MasterYTrack applies administrative, technical and physical measures proportionate to the nature of the data to protect against unauthorized access, loss, misuse and alteration. Measures include encrypted communications, role-based access controls, regular security assessments and vetted third-party processors. While we employ industry-standard protections, no system is invulnerable; we maintain incident response processes and will notify affected parties and authorities in accordance with legal obligations.

• Encryption and secure storage: Personal data is encrypted in transit (TLS) and at rest using industry-standard AES encryption. Databases containing identifying information are isolated from public networks and subject to role-based access controls.
• Access control and auditing: Access to personal data is restricted to authorized staff only, based on need-to-know. Access is logged and reviewed regularly; privileged actions require multi-factor authentication and periodic access reviews.
• Operational controls and staff training: Regular vulnerability scans, patch management, and third-party security assessments are performed. All employees receive data protection training and sign confidentiality obligations as part of onboarding.

Your data protection rights

As a user of MasterYTrack, you have defined rights concerning personal data we process about you. We explain these rights below and provide a straightforward process to exercise them. Requests are handled in line with applicable Swiss data protection standards and internal procedures to ensure timely, secure responses.

• Right of access: You may request confirmation whether we process your personal data and request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data, and we will update records after verifying your identity.
• Right to erasure: You may request deletion of personal data where retention is no longer necessary or processing lacks a lawful basis, subject to legal or contractual retention obligations.
• Right to restriction of processing: You may request that processing is restricted while we verify a dispute over accuracy or the lawfulness of processing.
• Right to data portability: Where processing is based on consent or contract and uses automated means, you may request a structured, commonly used, machine-readable copy of your personal data.
• Right to object: You may object to processing based on legitimate interests or direct marketing; we will assess your request and, where applicable, cease the processing.
• Right to withdraw consent: If you have provided consent for specific processing, you may withdraw it at any time; withdrawal does not affect processing carried out prior to the withdrawal.
• Right to lodge a complaint: If you consider our handling of your personal data to be unsatisfactory, you may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner or another competent supervisory authority.

How to exercise your rights

To submit a request related to your privacy rights, contact MasterYTrack by email at [email protected] or by postal mail to the address below. Include your full name, contact details, the right you wish to exercise, and any relevant documentation to help verify your identity. We may request additional information to verify your identity and to scope the request appropriately.

[email protected]

We aim to acknowledge receipt of rights requests within 5 business days and to provide a substantive response within 30 calendar days. Complex requests or those requiring verification may take longer; if so, we will inform you of the expected timeframe and reasons for the delay.