PRIVACY POLICY

Auditiams Compliance & Risk Ltd ("Auditiams", "we", "us") is the data controller for personal data processed through AUDEDU, our compliance education platform at audedu.auditiams.com.

Registered office: Ground Floor, 59 Nikou Pattichi, 3070 Limassol, Cyprus

This Privacy Policy explains how we handle the personal data of learners, firm administrators, and visitors who use the Platform or the public register. The register is also covered by a dedicated notice — see "The Public Register" below.

Depending on how you use AUDEDU, we process: • Account and identity data — your name, email address, hashed password, country, the firm you belong to (if any), and two-factor authentication settings • Learning data — course enrolments, lesson progress, exam attempts and scores, CPD hours accrued, and certifications held (with issue and expiry dates) • Exam-integrity data — your honour-code attestation and, for monitored or proctored exams, browser-activity events (such as tab switches, loss of focus, fullscreen exit and paste) and, for proctored exams, on-device camera-integrity events (such as no face detected, multiple faces, or looking away) that are computed in your browser — no video, image or audio is recorded or uploaded • Firm data — firm membership, seat assignments, and oversight of your training where you belong to a firm • Payment data — order and invoice details; card payments are handled by our payment provider and we do not store your full card number • Public register data — where you consent, your name, the certifications you hold, and optionally your firm and jurisdiction • Technical data — cookies and similar technologies, as described in our Cookie Policy

We use your data to: • Provide the Platform, deliver courses and exams, and issue and renew certifications — necessary to perform our contract with you (Art. 6(1)(b) GDPR) • Maintain exam integrity, verify identity for higher-integrity exams, and prevent fraud or misconduct — our legitimate interests and the performance of our contract (Art. 6(1)(b) and (f) GDPR) • List you on the public register — only with your explicit consent (Art. 6(1)(a) GDPR) • Process payments, issue invoices, and meet tax and accounting duties — contract and legal obligation (Art. 6(1)(b) and (c) GDPR) • Keep the Platform secure and improve it, including analytics where you consent to non-essential cookies — our legitimate interests and your consent (Art. 6(1)(f) and (a) GDPR) • Communicate with you about your account, purchases and certifications

The register publishes personal data only where you have given explicit, informed consent. You choose whether to be listed and which fields (firm, jurisdiction) are public, and you can withdraw at any time, which removes your listing. Full details of what is shown, the purpose, the lawful basis and your rights are in the Register Privacy Notice.

Payments are processed by a third-party payment provider acting as an independent controller/processor for card data. We receive confirmation of payment and order/invoice metadata (amount, currency, tax, status) but not your full card details. The provider's own privacy terms apply to its processing of your payment information.

To keep certification credible, some exams are monitored or proctored. For monitored exams we record browser-activity signals (tab switches, loss of focus, fullscreen exit and paste) during the exam. For proctored exams we additionally use your device camera to check that you are present and alone — this analysis runs entirely in your browser using an on-device model, and no video, image or audio is ever recorded, stored or transmitted. Only integrity events (for example "no face" or "multiple faces") and their timestamps are sent to AUDEDU, where they may flag an attempt for a human reviewer who makes the final decision. Proctoring is used solely to protect the integrity of the assessment.

We do not sell your personal data. We share it only with service providers who process it on our behalf under appropriate agreements — including our hosting/cloud provider, payment provider, and email provider; with other parties where you ask us to (for example, sharing a certificate); and where required by law. Certification data you consent to publish is, by design, publicly accessible on the register and via our verification API.

We operate primarily within the EU/EEA. Where a provider processes personal data outside the EU/EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

We keep account and learning data for as long as your account is active and as needed to provide the service. Certification and CPD records are retained for their verification value and to meet reasonable audit and regulatory expectations. Register listings are kept only while your consent stands. Payment and invoice records are kept for the periods required by tax and accounting law. When data is no longer needed, we delete or anonymise it.

Subject to applicable law, you have the right to access, rectify, erase, restrict or object to the processing of your personal data, to data portability, and to withdraw consent (for example, to remove yourself from the register) at any time without affecting prior processing. To exercise these rights, contact us at info@auditiams.com; we respond within one month (Art. 12(3) GDPR). You also have the right to lodge a complaint with a supervisory authority — in Cyprus, the Office of the Commissioner for Personal Data Protection.

The Platform is intended for professionals and is not directed at persons under 18. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time; the "Last updated" date reflects the latest revision. For any privacy question or to exercise your rights, contact:

Auditiams Compliance & Risk Ltd Ground Floor, 59 Nikou Pattichi, 3070 Limassol, Cyprus info@auditiams.com