GDPR compliance

Who is responsible for the data

For trainee data, your organization is the controller and BHP VR sp. z o.o., the company behind Skillsive, is the processor. We process that data only on your instructions, under the data processing agreement your administrator accepts in the panel. For panel accounts and our contract with your organization, BHP VR sp. z o.o. is the controller.

What data we process

Each trainee needs only a 6-digit code and a nickname. Your organization decides whether to add first and last name, e-mail, phone number, employee ID, position, address, date of birth or sex. We also store training results and certificates. For people with a panel account we process their name, e-mail and sign-in data. Security-relevant actions, such as certificate downloads, are logged with the time, IP address and device.

Where the data is stored

Trainee data stored in the platform stays in the European Union. Voice recordings from VR lessons with voice commands are processed by Meta Wit.ai in the USA (see Sub-processors).

• Database: Azure SQL (Microsoft SQL Server) in the West Europe region (Netherlands).
• Certificate files: Azure Blob Storage in the West Europe region (Netherlands).
• Technical logs: Azure, Germany West Central region, kept for up to 90 days.
• Backups: automatic database backups with point-in-time restore for 35 days and weekly backups kept for 2 weeks, in geo-redundant backup storage within the EU (North Europe, Ireland). There is no database replica in another region.

Who helps us process the data

Four sub-processors handle trainee data: Microsoft (Azure hosting), Cloudflare (network protection and content delivery), Twilio SendGrid (system e-mails and training reminders) and Meta Wit.ai (speech recognition for voice commands in VR lessons that have them). The sub-processors page lists what each of them does and which safeguards apply.

How we protect the data

Data is encrypted in transit with HTTPS (TLS) and at rest with AES-256 in the database and file storage. Access depends on roles, each organization's data is separated on the server, and administrative access uses multi-factor authentication.

Anonymization and certificates

When your organization withdraws consent or instructs us to, the details that identify trainees are anonymized for good. Certificates are not deleted at that moment: they move to a restricted archive for the retention period set by your organization (10 years by default) and are then deleted permanently.

How long we keep data

We keep trainee data for as long as your organization uses the platform. When the service ends, we delete or return the data, as your organization chooses. Backups expire after 35 days and technical logs after 90 days at the latest.

Trainees' rights

Trainees can ask to access, correct, erase, restrict or port their data, or object to its processing. Your organization, as the controller, handles these requests. If a trainee writes to us directly, we pass the request on without delay and help you respond. Anyone can also lodge a complaint with a data protection authority.