PRIVACY POLICY
This Privacy Policy describes how Pro Vision Multimedia Enterprises, LLC collects, uses, shares, and protects information about you when you use the Pro Vision Multimedia Enterprises Training Division platform (the "Service"). It also explains your rights under the European Union General Data Protection Regulation ("GDPR"), the United Kingdom General Data Protection Regulation ("UK GDPR"), and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA").
1. Information We Collect
1.1 Information you provide directly
| Category | Examples |
|---|---|
| Account information | Full name, email address, password (stored only as a cryptographic hash — we never see or store your plaintext password) |
| Payment information | Card details submitted to Stripe; we store only Stripe customer IDs and payment status. We do not see or store your card number, CVC, or expiration date. |
| Course activity | Lessons opened, lessons completed, exam attempts, exam responses, exam scores, certifications earned |
| Feedback submissions | Course ratings and free-text feedback you submit through the course-review feature |
| Capstone submissions | Photographs and written documentation you submit for graded review |
| Support communications | Emails and messages you send us for support |
1.2 Information we collect automatically
| Category | Examples |
|---|---|
| Device and browser | Browser type and version, operating system, screen size, language, time zone. Combined into a hashed device fingerprint for exam-integrity monitoring. |
| Exam telemetry | Per-question response time in milliseconds, total exam duration, integrity flags computed from the above |
| Log data | IP address, request timestamps, page URLs, referring URLs, error events |
| Local storage | See our Cookie & Tracking Disclosure |
2. How We Use Your Information
We use the information described above for the following purposes and on the following legal bases (where GDPR / UK GDPR applies):
- Providing the Service — creating your account, delivering lessons, grading exams, issuing certificates, syncing offline progress. Legal basis: performance of a contract.
- Processing payments — via Stripe, including tax and dispute handling. Legal basis: performance of a contract.
- Preventing fraud, abuse, and cheating — including exam-integrity monitoring, rate limiting, and revocation of certifications where warranted. Legal basis: our legitimate interests in protecting the Service, our customers, and the value of our certifications.
- Sending transactional messages — sign-in credentials, password resets, exam results, receipt of payment, refund confirmations. Legal basis: performance of a contract.
- Improving the Service — analyzing aggregate progress data and feedback to improve lessons and exams. Where possible we use anonymized or aggregated data. Legal basis: our legitimate interests in improving the product.
- Complying with legal obligations — tax, accounting, responding to lawful requests. Legal basis: legal obligation.
- Marketing (only with your consent) — we may email you about new courses or platform news if you opt in. You can opt out at any time by clicking "unsubscribe" in any marketing email or contacting us. Legal basis: consent.
3. Who We Share Your Information With
We do not sell your personal information. We share it only with the following categories of recipients, and only as needed:
| Recipient | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database, authentication backend, and edge function hosting | United States |
| Cloudflare, Inc. | Website hosting, CDN, DDoS protection, analytics | United States |
| Stripe, Inc. | Payment processing | United States |
| Resend, Inc. | Transactional email delivery | United States |
| Legal & regulatory authorities | Where required by valid legal process | Varies |
| Advisors | Accountants, attorneys, insurers — under professional confidentiality | United States |
Each of the above processors is contractually bound to handle your data only on our instructions and to maintain appropriate security. We do not permit them to sell your data or use it for their own advertising purposes.
4. International Data Transfers
Our servers and service providers are located primarily in the United States. If you access the Service from outside the United States, your personal data will be transferred to and processed in the United States. For transfers from the European Economic Area, United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (SCCs) with our processors and on the UK International Data Transfer Agreement where applicable.
5. Data Retention
We retain your personal data only as long as necessary for the purposes for which it was collected, or as required by law:
- Account and progress data — retained while your account is active. If you close your account, we delete or anonymize your personal data within thirty (30) days, except as noted below.
- Certificates — the record of any certificate issued, and its revocation status if applicable, is retained indefinitely so that third parties can verify the certificate at its public URL. On account deletion, your name is anonymized on any retained certificate record; the certificate ID remains valid.
- Financial and tax records — retained for at least seven (7) years to comply with U.S. tax and accounting requirements.
- Audit logs — including exam integrity flags and email delivery logs, retained for twenty-four (24) months.
6. Your Rights
6.1 Rights available to all users
You may request at any time to (a) access the personal data we hold about you, (b) correct inaccurate data, (c) delete your account and associated personal data, and (d) receive an export of your data in a portable machine-readable format. To exercise any of these rights, email [email protected]. We will respond within thirty (30) days.
6.2 Additional rights for residents of the EEA, United Kingdom, and Switzerland (GDPR / UK GDPR)
You additionally have the right to (i) restrict our processing of your data, (ii) object to processing based on legitimate interests, (iii) withdraw consent at any time where processing is based on consent, and (iv) lodge a complaint with your local data protection authority (for the UK, the Information Commissioner's Office; for the EU, the relevant national authority).
6.3 Additional rights for California residents (CCPA / CPRA)
If you are a California resident, you have the additional rights to (i) know what personal information we collect, use, disclose, and sell about you, (ii) request deletion of your personal information, (iii) opt out of the sale or sharing of your personal information (we do not sell or share your personal information for cross-context behavioral advertising), (iv) correct inaccurate personal information, and (v) limit the use of sensitive personal information. To exercise these rights, email [email protected] with "California Privacy Rights Request" in the subject line. We will not discriminate against you for exercising these rights.
7. Children
The Service is not intended for and may not be used by anyone under sixteen (16) years old. We do not knowingly collect personal information from anyone under 16. If you believe we have collected information from a child under 16, please email [email protected] and we will investigate and delete promptly. See also our Terms of Service, Section 1 (Eligibility).
8. Security
We take reasonable measures to protect your personal data, including (a) encryption in transit (TLS 1.2 or higher), (b) storage of passwords only as cryptographic hashes with per-user salt, (c) role-based access controls on our database, (d) audit logging of administrative actions, (e) automated exam-integrity monitoring, and (f) revocable certifications. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
9. Data Breach Notification
If we discover a personal data breach affecting your information, we will notify you and the appropriate regulatory authorities as required by applicable law, without undue delay and where feasible within seventy-two (72) hours of becoming aware of the breach.
10. Do Not Track
Some browsers offer a "Do Not Track" signal. Because no consistent industry standard exists for how to respond to this signal, we do not currently take action based on it. We do not use third-party advertising trackers.
11. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes we will notify you by email or by a prominent notice on the Service before the changes take effect. The "Last updated" date at the top of this policy indicates when it was most recently revised.
12. Contact Us
Questions about this Privacy Policy, or requests to exercise your privacy rights, can be sent to [email protected].
Postal address: [TO BE FILLED IN] — Virginia, United States.