What we collect, why, who else sees it and what you can do about it. We collect what the service needs to work and to keep certificates trustworthy, and nothing for advertising.
1. Who is responsible
The controller of your personal data is TakeGuard, Finland. For anything about your data, write to [email protected].
2. What we collect
Your account
Username, email address, password (stored only as a one-way hash, never in readable form), name, preferred language and, if you add one, a profile picture. If you join through an organisation's invitation, also your first and last name and, optionally, a phone number.
Organisation details
If you register an organisation: its type (company or education institute), name, website, country, registration number if given, and your role there. We use these to verify the organisation before approving it.
Your learning
Which lessons you have opened and finished, your exam attempts, answers and scores, and the certificates you earn. Lessons and exams carry a faint watermark showing your email address and the IP address you are using, so that leaked material can be traced.
Exam integrity signals
While you sit an exam, the page records how answers were written: paste attempts, how much was typed, time spent active, and trips away from the exam window. It also keeps the exam open in one window at a time. These signals exist to keep certificates trustworthy; an unusual attempt is reviewed by a person.
The security toolkit
The domains you add, their verification tokens, whether they are verified, and which one is your current target.
Orders
The plan, number of seats, price, chosen payment method and an order reference. Card details are handled by the payment provider and never reach us.
Technical data
The IP address you created your account from, the IP address you most recently used it from, and when you were last active. The browser identifier (user agent) is stored with your sign-in session. Your IP address is also used briefly to limit repeated sign-in attempts.
Newsletter
The email address you subscribe with, if you subscribe.
3. Why we use it, and on what basis
- To provide the service you signed up for: your account, courses, exams, certificates, the toolkit and your orders. Basis: our contract with you.
- To keep it secure and fair: protecting accounts, limiting abuse, recording the IP addresses an account is created and used from, watermarking course material, exam integrity checks, verifying organisations and making sure the toolkit is only used on verified domains. Basis: our legitimate interest in a safe service and certificates that can be trusted.
- To send the newsletter. Basis: your consent, which you can withdraw at any time from any issue.
- To keep accounting records once payments are taken. Basis: legal obligation.
4. AI and automated marking
We use an AI provider (Anthropic) to translate courses into your language and to help mark written exam answers. For marking, your written answer is sent to the provider together with the question. Your name and email are not included. Under our agreement the provider does not use this data to train its models.
Multiple-choice answers are marked automatically. Written answers may be marked with AI assistance, and any attempt flagged by the integrity checks is decided by a person. You can always ask for a person to review a result.
6. Transfers outside the EU
Some providers, including our AI and email providers, are based in the United States. When data leaves the European Economic Area we rely on safeguards the law recognises, such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
7. How long we keep it
- Account and learning data: for as long as you have an account.
- When you delete your account (yourself in account settings, or by asking us, which we do within 30 days): your sign-in details and personal information are removed at once. Scores, results and course progress stay without your name, so an organisation that assigned you training keeps its records, which show a former member. Your certificates are withdrawn and your name removed from them, unless you choose to keep them verifiable. A withdrawn certificate's record is kept so that anyone checking it is told it is no longer valid rather than that it never existed.
- Sign-in sessions: they expire after 7 days of not being renewed.
- IP addresses: the one you signed up from for as long as you have an account; the most recent one is replaced whenever it changes.
- Exam integrity signals: kept with the attempt they belong to.
- Order and accounting records: as long as accounting law requires.
- Newsletter: until you unsubscribe.
8. Your rights
You have the right to:
- get a copy of the personal data we hold about you;
- have incorrect data corrected;
- have your data deleted (you can delete your account yourself in account settings);
- restrict or object to how we use it, including processing based on legitimate interest;
- receive your data in a portable format;
- withdraw consent, such as for the newsletter, at any time.
To use any of these, write to [email protected]. We answer within one month. You can also complain to the Office of the Data Protection Ombudsman, though we would like the chance to put it right first.
9. How we protect it
Passwords are stored as salted hashes. Sign-in uses secure, HTTP-only cookies that page scripts cannot read, and all traffic is encrypted. Access to personal data inside TakeGuard is limited to the people who need it, and every request is checked on the server, not just in the page.
10. Children
You must be at least 16 to open an account yourself. Younger learners can use TakeGuard only through a school or education institute, which is responsible for any consent the law requires for them.
12. Changes to this policy
If we change how we use your data in a way that matters, we will tell you by email or in the service before the change applies. The date at the top shows the latest version.