Privacy Policy

This Privacy Policy ("Policy") governs the collection, processing, storage, disclosure, and protection of personal information by Skillnyx Private Limited ("Company", "we", "us", or "our"), a company incorporated under the Companies Act, 2013, in connection with SkillNyx and all associated products and services accessible at https://skillnyx.com ("Platform").

By accessing or using the Platform, you acknowledge that you have read, understood, and agree to be bound by this Policy. If you do not agree, you must immediately discontinue use of the Platform.

This Policy is published in compliance with: • The Information Technology Act, 2000, and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"); • The Digital Personal Data Protection Act, 2023 ("DPDPA"), to the extent applicable; • Applicable provisions of the General Data Protection Regulation (EU) 2016/679 ("GDPR"), for users in the European Economic Area.

The data controller responsible for your personal data is:

Skillnyx Private Limited Email: support@skillnyx.com Website: https://skillnyx.com

For all data protection enquiries, including requests to exercise your rights, please contact us at the above address. We acknowledge privacy enquiries within 5 business days and resolve them within 30 days.

We collect the following categories of information:

3.1 Information You Provide Directly • Account data: name, email address, username, profile information (headline, skills, experience, photo); • Payment and billing information collected through our payment processors; • Content you submit: posts, messages, code submissions, lab work, and assessment responses; • Communications via email, contact forms, or support channels.

3.2 Automatically Collected Information • Usage data: assessment and lab activity, scores, attempt history, streaks, and certifications earned; • Log data: IP address, browser type and version, OS, referring URLs, pages visited, and access timestamps; • Device information: device type, screen resolution, and technical identifiers; • Cookie data and similar tracking technologies (see Section 7); • Anti-cheat and proctoring signals collected during assessments (where applicable).

3.3 Third-Party Sources • Authentication data if you sign in via a third-party identity provider; • Aggregated analytics data from service providers; • Payment status and billing information from payment processors.

We do not knowingly collect sensitive personal data as defined under the SPDI Rules unless strictly necessary and with your explicit consent.

We process your personal data on the following legal bases:

• Contract Performance: To provide, operate, and deliver the services you have signed up for, including account management, assessments, labs, certifications, and subscriptions. • Legitimate Interests: To maintain and improve the Platform, detect and prevent fraud and abuse, conduct security monitoring, and enforce our Terms of Use. • Consent: Where you have provided explicit consent, including for newsletters, marketing communications, and optional cookie categories. • Legal Obligation: Where processing is necessary to comply with applicable law or regulatory direction.

You may withdraw consent at any time where consent is the legal basis, without affecting the lawfulness of prior processing.

We use information we collect for the following purposes:

• Creating and managing your account and providing services you have requested; • Operating, delivering, and improving assessments, labs, certifications, and social features; • Processing subscription payments and managing billing; • Personalising your experience, including recommended content and learning pathways; • Security and integrity: fraud prevention, abuse detection, anti-cheat monitoring, and incident response; • Communication: service updates, billing notifications, and optional marketing (opt out at any time); • Analytics: measuring platform performance, engagement, and product improvements; • Complying with applicable legal obligations and responding to lawful requests; • Enforcing our Terms of Use and other policies.

We will not use your personal data for purposes materially different from those above without prior notice and, where required, your consent.

We do not sell, rent, or trade your personal data. We may disclose information to:

6.1 Service Providers and Processors Trusted third-party vendors engaged on our behalf, including: cloud infrastructure and hosting providers; analytics providers; payment processors; email delivery services; identity and authentication providers; AI runtime providers.

All service providers are contractually required to process personal data only on our documented instructions and may not use it for their own purposes.

6.2 Certification and Verification Where you display a SkillNyx certificate, we may disclose limited verification data (credential ID, skill, result, date) to third parties querying our verification API.

6.3 Legal and Regulatory Disclosure We may disclose information where required by applicable law, court order, or regulatory enquiry. We will endeavour to notify you where legally permissible.

6.4 Business Transfers In the event of a merger, acquisition, or sale of assets, personal data may transfer to the successor entity subject to equivalent protections.

6.5 Protection of Rights We may disclose information where necessary to protect the rights, safety, or security of the Company, its personnel, or users.

7.1 What Are Cookies Cookies are small text files placed on your device by a website. We also use web beacons, pixels, and similar technologies.

7.2 Types of Cookies We Use • Strictly Necessary Cookies: Required for the Platform to function (authentication, sessions, security). Cannot be disabled. • Performance & Analytics Cookies: Help us understand how users interact with the Platform (e.g., Google Analytics). Anonymised aggregate data. • Functionality Cookies: Remember your preferences such as theme and region. • Marketing Cookies: Used to serve relevant content or measure promotional effectiveness (only where consent is obtained).

7.3 Third-Party Cookies Third-party analytics and integration providers may set their own cookies. We do not control these — refer to their respective privacy policies.

7.4 Managing Cookies You may control cookie preferences through your browser settings. Disabling strictly necessary cookies may impair Platform functionality.

We retain personal data for as long as necessary to fulfil the purposes described in this Policy:

• Account data: Active account duration plus up to 3 years after closure for legal purposes. • Assessment and certification records: Retained to support credential verification, subject to deletion requests where permitted. • Server log data: Up to 90 days for security and diagnostic purposes. • Analytics data: Up to 26 months in anonymised or aggregated form. • Billing and payment records: Up to 7 years as required by financial regulation. • Support and correspondence records: Up to 3 years from last contact. • Marketing consent records: Until you withdraw consent.

Upon expiry, personal data is securely deleted or irreversibly anonymised.

Skillnyx Private Limited implements appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit using TLS/SSL; • Encryption of sensitive data at rest; • Role-based access controls and least-privilege principles; • Regular security assessments and vulnerability management; • Incident response and breach notification procedures.

No method of electronic storage is completely secure. We cannot guarantee absolute security and disclaim liability for breaches beyond our reasonable control.

In the event of a data breach likely to result in a high risk to your rights, we will notify you and the relevant supervisory authority as required by applicable law, including within timeframes mandated by the DPDPA and GDPR.

Your information may be transferred to, stored, and processed in countries other than India, including countries where our service providers operate (e.g., United States, European Union). Such transfers are carried out in accordance with applicable data protection law.

Where personal data is transferred outside India or the EEA, we rely on appropriate safeguards, including standard contractual clauses or adequacy decisions.

By using the Platform, you consent to the transfer of your information to countries that may have different data protection standards.

Depending on your jurisdiction and applicable law, you may have the following rights:

• Right of Access: Request a copy of personal data we hold about you. • Right to Rectification: Request correction of inaccurate or incomplete data. • Right to Erasure: Request deletion of your personal data, subject to our retention obligations. • Right to Restriction: Request that we restrict processing in certain circumstances. • Right to Data Portability: Receive your data in a structured, machine-readable format. • Right to Object: Object to processing based on legitimate interests or for direct marketing. • Right to Withdraw Consent: Withdraw consent at any time where processing is consent-based.

Contact us at support@skillnyx.com to exercise these rights. We respond within 30 days and may require identity verification. We will not discriminate against you for exercising your privacy rights.

12.1 Data Processing Addendum Where we process personal data on behalf of an enterprise client as a data processor, the parties may execute a Data Processing Addendum ("DPA"). Contact enterprise@skillnyx.com to request one.

12.2 Controller Responsibilities When acting as a data processor, the business customer (as data controller) is responsible for the lawful basis of processing and for informing their end users.

12.3 Sub-Processor Transparency We maintain a list of sub-processors for enterprise data, provided on request. We commit to notifying business customers of material changes in advance.

12.4 Data Segregation Enterprise customer data is logically segregated from other data. We do not use one customer's data to improve services for other customers without explicit consent.

12.5 Consulting Engagements Data processed in the course of AI consulting and professional services engagements is governed by the applicable SOW or MSA, supplemented by this Policy.

The Platform is not directed at children under 16 (or the age of digital consent in your jurisdiction, if higher). We do not knowingly collect personal data from children below this threshold. If you believe a child has provided data without appropriate consent, contact us at support@skillnyx.com and we will take prompt action.

The Platform may contain links to third-party websites or services. This Policy does not apply to those third-party properties. We are not responsible for their privacy practices. Review their policies before providing any personal information.

We may amend this Policy at any time. Material changes will be communicated by updating the effective date and, where appropriate, by notifying you via email or a prominent notice on the Platform.

Your continued use of the Platform after any amendment constitutes acceptance of the revised Policy.

This Policy is governed by the laws of India. Any dispute arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of courts of competent jurisdiction in India.

For any questions, concerns, or requests relating to this Privacy Policy:

Skillnyx Private Limited Email: support@skillnyx.com Website: https://skillnyx.com/privacy

For enterprise and B2B data enquiries: Email: contact@skillnyx.com

We acknowledge all privacy enquiries within 5 business days and resolve them within 30 days.