Privacy policy

Last updated: 31 July 2026

This Privacy Policy explains how skillsHR GmbH collects, uses, stores and protects personal data when you visit or use SkillsHR Academy, including its website, learning platform, mobile application, courses, live sessions, assessments, community features and related services.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Austrian Data Protection Act and other applicable data-protection laws.

1. Data Controller

The controller responsible for the processing described in this Privacy Policy is:

skillsHR GmbH
Bahnhofgürtel 59
8020 Graz
Austria

Email: office@skillshr.at
Telephone: +43 664 8144 670
Website: https://academy.skillshr.at
Company registration number: FN 511049 v
Company register court: Landesgericht für ZRS Graz

2. Scope of This Policy

This Privacy Policy applies to personal data processed through SkillsHR Academy, including data relating to:

• Website visitors and prospective learners.
• Registered students and course participants.
• Instructors, administrators and support users.
• Employees or learners registered by an employer or organization.
• Purchasers and billing contacts.
• Users of the SkillsHR Academy mobile application.
• People who contact us or subscribe to optional communications.

3. Personal Data We Process

Depending on how you use SkillsHR Academy, we may process the following categories of personal data.

3.1 Account and Identity Data

• Name and email address.
• User ID, username and account status.
• Profile photo and preferred language.
• Assigned role, permissions, academy, group or organization.
• Authentication and account-security information.
• Two-factor authentication and account-recovery information, if enabled.

Passwords are not stored in readable form. They are processed using appropriate cryptographic password-protection methods.

3.2 Learning and Course Data

• Course registrations, enrollments and assigned learning paths.
• Course progress, lesson completion and time-related learning records.
• Quiz answers, examination attempts, scores and results.
• Homework submissions, attachments, feedback and grades.
• Attendance, absences and participation in live sessions.
• Certificates, achievements and completion records.
• Flashcard, practice and learning-activity statistics.
• Instructor comments and administrative learning notes.

3.3 Communication and Community Data

• Private messages and support requests.
• Community posts, comments, reactions and uploaded attachments.
• Poll responses and group participation.
• Notification and email preferences.
• Responses to surveys, ratings, feedback pop-ups and optional comments.
• Messages sent through contact forms or customer-support channels.

3.4 Technical and Security Data

• IP address and approximate location derived from the IP address.
• Browser type, operating system, device type and screen information.
• Login dates, session identifiers and authentication events.
• Requested pages, technical events and error logs.
• Security, fraud-prevention and access-control records.
• Cookie identifiers and similar technical storage information.

3.5 Mobile Application Data

When the mobile application is used, we may additionally process:

• Application version and device operating-system version.
• Device or installation identifiers required for application operation.
• Push-notification tokens and notification preferences.
• Application errors, crash information and diagnostic events.
• Camera, microphone, photo or file access only when requested by a feature and authorized through the device settings.

Device permissions can be reviewed or withdrawn through your device settings. Disabling a permission may prevent the related feature from working.

3.6 Transaction and Billing Data

• Purchased courses, packages, vouchers and subscription information.
• Order status, amount, currency, tax and invoice information.
• Billing name, address and organizational billing details.
• Payment status and transaction reference.

Full payment-card details are normally collected and processed directly by the selected payment provider and are not stored by SkillsHR Academy.

4. Sources of Personal Data

We may receive personal data:

• Directly from you when you register, study, communicate or make a purchase.
• From your employer, educational organization or Academy administrator when they create or manage your account.
• Automatically from your browser, device or Academy activity.
• From payment, authentication or communication service providers.
• From instructors or authorized administrators who maintain learning and attendance records.

5. Purposes and Legal Bases

5.1 Providing the Academy Services

We process account, enrollment, learning and transaction data to create and manage accounts, deliver courses, track progress, conduct assessments, issue certificates and provide purchased services.

The legal basis is Article 6(1)(b) GDPR, where processing is necessary to enter into or perform a contract.

5.2 Organizational and Employer-Sponsored Learning

If your account is provided by an employer or another organization, data may be processed to administer assigned training, document attendance, evaluate learning progress and provide authorized reports to that organization.

Depending on the circumstances, the legal basis may be performance of a contract, compliance with a legal obligation or a legitimate interest in managing and documenting professional education.

5.3 Legal and Accounting Obligations

We process invoices, transaction records and other required information to comply with accounting, tax, consumer-protection and regulatory obligations.

The legal basis is Article 6(1)(c) GDPR.

5.4 Security and Platform Operation

Technical and security data is processed to authenticate users, protect accounts, prevent abuse, maintain system availability, investigate incidents and improve technical reliability.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are operating a secure, reliable and efficient learning platform and protecting users and business systems.

5.5 Support and Service Communications

We use contact and account information to answer requests and send essential communications concerning account security, verification, course access, schedules, assignments, assessments, payments and service changes.

Depending on the communication, the legal basis is Article 6(1)(b) or Article 6(1)(f) GDPR.

5.6 Consent-Based Processing

Where required, we request consent before processing data for purposes such as:

• Optional marketing emails.
• Optional analytics or marketing technologies.
• Recordings where consent is the appropriate legal basis.
• Optional mobile-device permissions.
• Other optional features clearly presented as consent-based.

The legal basis is Article 6(1)(a) GDPR. Consent may be withdrawn at any time without affecting processing performed before withdrawal.

6. Employer and Organization Access

If your account is created, funded or administered by an employer, school, training provider or another organization, authorized representatives of that organization may access information necessary to manage the learning service.

This may include:

• Enrollment and assigned courses.
• Progress and course-completion status.
• Attendance and participation.
• Assessment results and certificates.
• Organizational reports and account status.

The organization may act as an independent controller for its use of this information. Questions about how an employer or organization uses exported learning records should also be directed to that organization.

7. Emails and Notifications

SkillsHR Academy may send essential account, security, verification, payment and learning-related communications. These messages are necessary to operate the service and may not be controlled by optional marketing preferences.

Optional email and notification preferences can be managed through your profile or application settings where available.

Marketing messages are sent only when legally permitted. You can unsubscribe using the link in the message or by contacting us.

8. Push Notifications

If push notifications are enabled in the mobile application, a device-specific push token is used to deliver selected notifications.

Push delivery may involve platform providers such as Google Firebase Cloud Messaging and, where applicable, Apple Push Notification service. These providers receive the technical information required to deliver the notification.

Push notifications can be disabled through the application settings or the notification settings of your device.

9. Live Sessions, Camera and Microphone

Live-session features may process your display name, participation information, audio, video and chat messages when you choose to use them.

Camera and microphone access occurs only after device or browser permission has been granted. You may disable your camera or microphone unless participation requirements communicated for the session require their use.

If a session is recorded, participants will be informed appropriately. The recording will be available only for the communicated purpose and authorized audience.

10. Artificial Intelligence Features

SkillsHR Academy may provide optional artificial intelligence features, such as learning assistance, practice feedback, speaking exercises, content generation or educational recommendations.

When you actively use an AI feature, the submitted text, audio or relevant learning context may be processed to generate the requested response. Depending on the configured service, authorized AI technology providers may process this information on our behalf.

You should not enter confidential information, passwords, payment information or unnecessary sensitive personal data into an AI prompt.

AI-generated content may contain errors and should not be treated as a legally, medically or professionally binding decision. Human review remains available where an outcome could materially affect a learner.

11. Feedback, Surveys and Ratings

We may display feedback requests, ratings, surveys or notices to selected users. Depending on the configuration, responses may include a rating, selected option and optional written comment.

Feedback data is used to evaluate service quality, understand user needs and improve learning services. The legal basis is our legitimate interest under Article 6(1)(f) GDPR or consent where required.

12. Cookies and Similar Technologies

SkillsHR Academy uses cookies and similar storage technologies required for secure login, session management, language selection, account protection and essential platform functions.

Essential technologies are used because they are necessary to provide the requested service and protect the platform.

Where optional analytics, personalization or marketing technologies are used, they are activated only in accordance with applicable consent requirements. You may adjust or withdraw your consent through the available cookie settings.

You may also configure your browser to block or delete cookies. Blocking essential cookies may prevent login or other Academy functions from working correctly.

13. Recipients and Service Providers

Personal data is accessible only to authorized persons who require it for their responsibilities. Depending on the features used, data may be shared with:

• Authorized SkillsHR Academy employees, instructors and administrators.
• Your employer or sponsoring organization, where applicable.
• Hosting, database, storage and technical-infrastructure providers.
• Email, notification and communication providers.
• Video-conferencing and live-session providers.
• Payment and invoicing providers.
• Mobile push-notification and application-service providers.
• Artificial intelligence providers when an AI feature is enabled and used.
• Professional advisers, auditors or insurers where necessary.
• Public authorities when disclosure is legally required.

Providers processing data on our behalf are contractually required to process it only according to documented instructions, protect confidentiality and apply appropriate security measures.

14. International Data Transfers

We prefer processing within the European Economic Area where reasonably possible. Some technology providers may process data in countries outside the European Economic Area.

Where required, international transfers are protected using an adequacy decision, the European Commission's Standard Contractual Clauses or another legally recognized transfer mechanism. Additional safeguards are applied where appropriate.

Information about safeguards relevant to a specific service may be requested using the contact details in this policy.

15. Data Retention

Personal data is retained only for as long as necessary for the purpose for which it was collected and to comply with legal obligations.

Retention periods depend on the data and may include:

• Account data for the duration of the active account and a reasonable period following closure.
• Learning and certificate records for the period necessary to document participation and completion.
• Organizational learning records according to the applicable agreement and lawful instructions of the sponsoring organization.
• Financial and accounting records generally for seven years where required under Austrian tax or accounting law.
• Security and technical logs for a limited period appropriate for incident investigation and system protection.
• Support communications until the request is resolved and for a reasonable documentation period afterward.
• Consent records for as long as needed to demonstrate compliance.

Data may be retained longer when required for legal proceedings, establishment or defense of legal claims, fraud investigations or binding legal obligations. It is deleted or anonymized when retention is no longer necessary.

16. Data Security

We use appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration, disclosure or destruction.

Measures may include:

• Encrypted connections.
• Secure password hashing and authentication controls.
• Role-based access and academy-level data separation.
• Access logging, monitoring and rate limiting.
• Backups and recovery procedures.
• Software updates and security testing.
• Restricted administrative access.
• Confidentiality and data-processing agreements.

No online system can guarantee absolute security. Users must protect their passwords and notify us promptly if they suspect unauthorized account access.

17. Your Data-Protection Rights

Subject to the requirements and limitations of applicable law, you have the right to:

• Request confirmation of whether your personal data is processed.
• Request access to your personal data and related processing information.
• Request correction of inaccurate or incomplete personal data.
• Request deletion of personal data where the legal requirements are met.
• Request restriction of processing.
• Receive data you provided in a structured, commonly used and machine-readable format where data portability applies.
• Object to processing based on legitimate interests.
• Object to direct marketing at any time.
• Withdraw consent at any time for future processing.
• Request human intervention where a legally significant decision is based solely on automated processing.

To exercise your rights, contact office@skillshr.at. We may request reasonable information to verify your identity and protect your account.

Requests are generally answered within one month. This period may be extended where permitted by the GDPR for complex or numerous requests, in which case you will be informed.

18. Right to Object

If processing is based on Article 6(1)(f) GDPR, you have the right to object on grounds relating to your particular situation.

We will stop the relevant processing unless there are compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for legal claims.

Personal data will no longer be processed for direct marketing after an objection to that purpose.

19. Right to Lodge a Complaint

If you believe that your personal data has been processed unlawfully, you may contact us first so that we can investigate the matter.

You also have the right to lodge a complaint with the Austrian Data Protection Authority or another competent supervisory authority in the European Union.

Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
Austria

Email: dsb@dsb.gv.at
Website: https://dsb.gv.at/

20. Children and Minors

SkillsHR Academy is primarily intended for adult and professional education. Accounts for minors may be provided only with an appropriate legal basis and, where required, authorization from a parent, legal guardian or responsible organization.

If you believe that a minor's personal data has been provided without the required authorization, please contact us.

21. Special Categories of Personal Data

Users should not upload health information, biometric data, political opinions, religious beliefs or other sensitive personal data unless this is expressly required for an authorized service and an appropriate legal basis has been established.

22. Automated Decision-Making

SkillsHR Academy does not use personal data to make decisions producing legal or similarly significant effects based solely on automated processing unless this is specifically disclosed and legally permitted.

Automated scoring may be used for objectively graded learning activities. Such results may be reviewed or corrected by an authorized instructor or administrator where appropriate.

23. External Links

The Academy may contain links to external websites or services. Their operators are independently responsible for their privacy practices. We recommend reviewing their privacy policies before providing personal data.

24. Changes to This Privacy Policy

This Privacy Policy may be updated to reflect legal, technical or operational changes. The current version and its update date will be published on SkillsHR Academy.

Material changes will be communicated through the Academy, by email or through another appropriate channel where required.

25. Privacy Contact

Questions, privacy requests and concerns may be sent to:

skillsHR GmbH
Bahnhofgürtel 59
8020 Graz
Austria

Email: office@skillshr.at
Telephone: +43 664 8144 670