Privacy Policy

Effective Date: Sept 26th, 2025

1) Who we are and scope

This Privacy Policy explains how Personal Protection (“we,” “us,” “our”) collects, uses, shares, and protects personal information when you use our websites, online courses, events, coaching, and community platforms (collectively, the “Services”). It applies to all users, including trainees, community members, instructors, contractors, and site visitors.

Regulatory context. Our audience includes security professionals and candidates for executive protection roles. We may process information needed to verify identity, credentials, relevant training completions, and compliance with applicable laws and licensing bodies (e.g., VA. DCJS#88-1843 requirements). If you are located in the EEA/UK, this Policy also explains our processing under the GDPR/UK GDPR. If you are a California resident, see the CCPA/CPRA section below.

2) The data we collect

We collect and process the following categories of data:

A. Identity & contact

• Name, alias, photo (optional), phone, email, mailing/billing address, employer/agency, role.
• Government ID fragments or license identifiers where permitted/required (e.g., state license numbers, training certificate IDs) for identity and credential verification.

B. Account & profile

• Username, hashed password, security settings, preferences, time zone, community bio, badges, progress, certifications earned.

C. Training & community activity

• Course enrollments, lesson completions, quiz results, certificates, coaching notes, submitted assignments, forum posts, messages, reactions, attendance at live sessions, scheduling data, and support tickets.

D. Compliance & screening (where applicable)

• Documentation you choose to provide for eligibility or compliance (e.g., proof of prior training, employment verification letters).
• Background or credential checks are conducted only with your express consent and via vetted third-party providers; we receive pass/fail indicators and necessary metadata, not full investigative reports.

E. Payment & commercial

• Transaction amounts, timestamps, last four digits of card, tokenized payment IDs, refund or chargeback records. We do not store full card numbers; payments are processed by PCI-compliant processors.

F. Device & usage

• IP address, device type, browser type, OS, language, referring/exit pages, clickstream, session duration, page views, error logs, and coarse location (derived from IP).
• Cookies, local storage, and similar technologies (see Section 7).

G. Audio/visual (optional/feature-dependent)

• Recording of live classes or webinars; your image/voice if you participate on camera/mic.
• If proctoring or identity checks are enabled for a specific exam or certification, we will give clear advance notice describing what’s captured (e.g., webcam snapshots, screen events) and why.

H. User-submitted content

• Documents, images, videos, and other materials you upload or publish in the community or coursework.

I. Communications

• Email engagement (opens/clicks), SMS logs (where used), in-app notices, and your messages to support.

3) Sources of data

• Directly from you when you register, enroll, post, upload, pay, or contact support.
• Automatically via cookies, logs, and analytics when you use the Services.
• From third parties that you authorize (e.g., identity verification vendors, payment processors, webinar/video platforms, learning tools).
• From enterprise clients (if your employer buys seats and provisions your access).

4) Why we process your data (purposes) and legal bases

We process data to:

1. Provide and secure the Services (create accounts, deliver lessons, track progress, issue certificates, operate community features, prevent fraud/abuse).
2. Verify identity, eligibility, and credentials (where required for compliance or certification).
3. Process payments (subscriptions, one-time purchases, refunds).
4. Support, communicate, and notify (password resets, service announcements, schedule changes, policy updates).
5. Improve and develop the platform (analytics, feature performance, debugging).
6. Comply with law and respond to lawful requests.
7. Marketing (newsletters, product updates, event invitations). You can opt out anytime.

Legal bases (EEA/UK users):

• Contract (Art. 6(1)(b)): to deliver courses/community and manage your account.
• Legitimate interests (Art. 6(1)(f)): service security, minimal analytics, preventing misuse, improving UX.
• Consent (Art. 6(1)(a)): marketing emails, optional proctoring, certain cookies.
• Legal obligation (Art. 6(1)(c)): tax records, regulatory compliance (e.g., licensing).
• Vital interests (rare): safety incidents during live trainings.

5) Disclosures and sharing

We do not sell personal data. We share only as needed:

• Service providers / processors under contract (e.g., hosting, LMS/community software, email/SMS delivery, analytics, webinar/video platforms, identity/credential verification, payment processors, helpdesk).
• Instructors/mentors: limited access to your training progress, assignments, and community participation to deliver instruction and feedback.
• Enterprise clients (your employer/agency): if your seat is enterprise-provisioned, we may share your enrollment, completion status, and certificates per the client agreement.
• Legal and safety: to comply with law, enforce our Terms, or protect rights, property, or safety.
• Business transfers: as part of a merger, acquisition, or asset sale with appropriate safeguards.

All vendors are bound by confidentiality and security obligations appropriate to the sensitivity of data processed.

6) International transfers

If data is transferred outside your jurisdiction (e.g., from the EEA/UK to the U.S.), we use appropriate transfer safeguards such as Standard Contractual Clauses (SCCs) and implement technical and organizational measures to protect your data.

7) Cookies, local storage, and analytics

We use:

• Strictly necessary cookies for login, session continuity, and security (cannot be turned off).
• Functional cookies to remember preferences and improve usability.
• Analytics cookies (privacy-aware configurations) to understand usage and improve performance.
• Advertising cookies are not used for third-party behavioral ads in our training environment. If we ever test limited retargeting (e.g., to notify past visitors of new cohorts), it will be opt-in and disclosed.

You can manage cookies in your browser. “Do Not Track” signals are not consistently honored across the industry; we apply privacy-respecting defaults and allow opt-outs where feasible.

8) Identity verification, background checks, and proctoring

Some certifications or roles may require additional checks:

• Identity/credential verification: limited data points (e.g., name, photo match, license ID) via third-party providers; stored only as long as necessary to confirm status.
• Background checks (if required): conducted only with your explicit consent and handled by accredited providers; we receive only necessary outcomes (e.g., eligible/not eligible).
• Exam proctoring (if applicable): separate notice will explain what is captured (e.g., webcam, mic, screen events), retention periods, and your options.

9) Data retention

We retain data only as long as necessary for the purposes in this Policy:

• Account/profile: for the life of your account and for up to 24 months after closure (to enable certificate verification and resolve disputes), unless longer is required by law.
• Training records & certificates: typically 7 years for defensibility/compliance.
• Payment records: 7 years for tax/financial compliance.
• Support tickets: 24 months.
• Proctoring/ID artifacts: shortest feasible period, typically 30–180 days unless regulations require longer.
• Server logs/analytics: 12–24 months in aggregate form.
  When retention expires, we delete or anonymize data.

10) Security measures

We implement technical and organizational safeguards proportionate to risk, including:

• Encryption in transit (TLS) and at rest for key systems.
• Role-based access controls, least-privilege permissions, SSO/MFA for staff.
• Network segregation, secure key management, vulnerability management, logging/alerting.
• Vendor due diligence and data processing addenda (DPAs).
• Staff training on data protection and acceptable use.
• Incident response plan with breach assessment and notification obligations as required by law.

No system is perfectly secure; we continuously improve our posture and encourage you to use strong, unique passwords and MFA where available.

11) Your privacy choices and rights

Email/SMS: Unsubscribe links are included in non-essential communications. Transactional/operational emails will still be sent.
Cookies: Manage via browser settings; opt-out of non-essential cookies where presented.

If you’re in the EEA/UK, you may have the right to access, rectify, erase, restrict, object to processing, and data portability. You may also withdraw consent at any time (does not affect prior lawful processing).
If you’re in California, you may have the right to know, delete, correct, opt-out of sharing/sale (we don’t sell), and to non-discrimination under the CCPA/CPRA.

To exercise rights, contact us (Section 15). We will verify your request (e.g., email confirmation or logged-in request). Authorized agents may submit requests with appropriate proof.

12) Children’s privacy

Our Services are not intended for individuals under 16. We do not knowingly collect personal data from children. If you believe a minor has provided data, contact us and we will take appropriate steps to delete it.

13) Community conduct and user-generated content

Content you post in forums, chats, or class areas may be visible to other members in that space. Do not share confidential or operationally sensitive information (e.g., live client details, assignments, secure routes). We moderate for safety and policy compliance but are not responsible for user postings; report concerns to support.

14) Third-party links and integrations

Our Services may link to external sites or integrate with tools (e.g., video platforms, file storage, whiteboards). Your use of those services is governed by their privacy policies. Review them before use.

15) How to contact us

Personal Protection
New York, NY 10001 USA
Call Now! (212) 268-4555
Email: info@personalprotection.com (privacy & data rights)
Website: https://www.personalprotection.com
License: VA. DCJS#88-1843

If you are in the EEA/UK and wish to raise a concern, you may also contact your local data protection authority. We will cooperate in good faith to resolve any complaint.

16) Changes to this Policy

We may update this Policy to reflect changes in law or our Services. We’ll post the new Effective Date and, if changes are material, provide prominent notice (e.g., email or in-app). Continued use of the Services after an update constitutes acceptance of the revised Policy.

---

Retention Summary

Category	Typical Retention
Account/Profile	Account life + up to 24 months
Training Records/Certificates	7 years
Payments/Invoices	7 years
Support Tickets	24 months
Logs/Analytics (aggregated)	12–24 months
Proctoring/ID Artifacts	30–180 days

---