1. Who we are
SecByte LLC ("SecByte", "we") is a limited liability company registered in the State of Wyoming, United States, operating secbyte.org, learn.secbyte.org and services.secbyte.org. We act as the data controller for the personal data described below. Contact: contact@secbyte.org.
2. Data we collect
- Account data: name, email address, password hash, country, profile photo (optional).
- Examination data: attempts, answers, scores, timing, pass/fail outcome, proctoring flags.
- Credential data: certificate number, verification ID, issue and expiry dates, revocation status.
- Programme data: enrolments, module progress, assignment submissions, grades, uploaded documents.
- Payment data: transaction reference, amount, currency and status from our payment processor. We never receive or store full card numbers.
- Technical data: IP address, browser user agent, device type and access timestamps, used for security and exam integrity.
3. Why we process it
- To deliver examinations, issue credentials and maintain the public verification register (contractual necessity).
- To protect exam integrity, detect fraud and investigate misconduct (legitimate interest).
- To process payments, scholarships and refunds (contractual necessity).
- To send service notifications about your exams, credentials and account (contractual necessity).
- To meet accreditation, audit and legal record-keeping obligations (legal obligation).
4. Public verification
Credential verification is a core function of a certification authority. When a certificate is issued, a limited record — holder name, credential title, certificate number, issue/expiry date and status — becomes publicly checkable by verification ID. Your email address, exam answers, scores and payment details are never published. You may request suppression of your name from public lookup, but doing so limits third parties' ability to verify your credential.
5. Sharing
We share data only with processors that operate on our instructions: cloud hosting and database providers, our payment processor, and email delivery providers. We do not sell personal data and we do not use it for third-party advertising.
6. Retention
- Account and credential records: retained for the lifetime of the credential plus 10 years, so credentials remain verifiable.
- Exam attempt detail: 5 years, for appeals, audit and accreditation review.
- Security logs: 12 months.
- Payment records: as required by applicable financial law.
7. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interest. Write to contact@secbyte.org from your registered email address; we respond within 30 days. Deletion requests cannot remove statutory or accreditation-mandated credential records, but we will anonymise everything we are not required to keep.
8. Security
Data is encrypted in transit (TLS) and at rest. Access is role-based and enforced at the database layer with row-level security. Administrative access is restricted to named staff and logged. If a breach affecting your data occurs, we notify affected users and applicable regulators without undue delay.
9. Cookies
We use strictly necessary cookies for authentication and session integrity, and — only with your consent — analytics cookies to understand aggregate usage. You can change your choice at any time via the cookie banner.
10. Children
SecByte services are intended for candidates aged 16 and over. Candidates under 18 require verifiable consent from a parent or guardian before enrolling.
11. Changes
Material changes to this policy are announced on this page and, where they affect your rights, by email to your registered address at least 14 days before they take effect.