Privacy Policy
What we collect, why we collect it, who else sees it, where it is kept, and what you can make us do about it.
1.Who is responsible
Kuiper Belt Works Pty Ltd trading as Cuabity (ACN 703 421 505, ABN 83 703 421 505), a company incorporated in Australia, decides how and why the personal information described here is used, and is responsible for it.
We are bound by the Australian Privacy Act 1988 and its Australian Privacy Principles. People use our courses in many countries, and privacy laws differ between them. Rather than run a different standard for each, we apply one: the rights in section 9 are given to every user, wherever they live. If the law where you live gives you a right or protection this policy does not mention, you have it too, and we will honour it.
2.What we collect
Only what the platform needs. There is no tracking pixel, no advertising network and no data broker anywhere in this list.
| Category | What it is | Where it comes from |
|---|---|---|
| Account | Your first and last name, a username, your email address and a password (stored only as a cryptographic hash, never in readable form). Optionally, your city and country. Your timezone and language preference, which you can change in your profile. Your confirmation that you are 16 or older, and — each time you buy an assessment — that you are 18 or older, with the time you gave it. We do not ask for your date of birth. | You, at registration |
| Profile | All optional: your company or organisation, how you heard about us, job function, industry sector, and organisation size. Whether you want marketing email (section 11) — and each time you tick or untick that box, when, the wording of the box as you saw it, and whether you or we made the change (for example, recording an unsubscribe). | You, at registration or later |
| Learning | Which courses you enrol in, which activities you complete, your knowledge-check and exam attempts including the answers you chose and the scores, and the badges and certificates you earn. If we give you a free exam re-sit or a free place on an assessment, a record of it: when, who gave it, and a short note of why. If you buy an assessment again, a record of the fresh attempts that came with it. If a certificate is revoked or withdrawn, a record of when and why (section 4). | Generated as you use the platform |
| Certificates | Your name, the assessment, the date, and a unique verification code. See section 4 — this one is public. | Generated when you pass |
| Payments | That a payment was made, what it was for, the amount, currency and date, and Stripe's references for the payment and for you as its customer. We never receive or store your card number. | Stripe, our payment processor |
| Agreements | Which version of the Terms of Service, this policy and the Refund Policy you accepted, and when. | You, when you accept them |
| Technical | Web server log entries: IP address, browser user-agent, the page requested, and the time. The platform's activity log: the pages you open and the actions you take on the platform, with your IP address and the time — linked to your account when you are signed in. The time of your first and most recent sign-in, and the IP address of your most recent one. | Automatically, when you visit |
| Correspondence | Emails and enquiries you send us, and our replies. | You |
We do not collect special-category or sensitive information — health, racial or ethnic origin, political or religious belief, sexual orientation, biometrics, or criminal records — and you should not send it to us.
What we do not have
No analytics. The site currently runs no analytics or statistics package of any kind. If we add one it will be self-hosted, it will not profile you across other websites, and we will update this policy and ask for consent where consent is required before it goes live.
3.Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account; giving you the courses; running the assessment; issuing and verifying your certificate | Performance of a contract with you |
| Taking payment and keeping the financial record | Contract, and legal obligation (tax and company law) |
| Keeping the platform secure, preventing fraud and cheating, and protecting the integrity of certificates | Our legitimate interests — a certificate anyone could forge would be worth nothing to the people who earn one honestly |
| Understanding which courses are used and improving them | Our legitimate interests, using aggregate figures rather than individual behaviour wherever we can |
| Sending you service email you cannot opt out of while you hold an account — password resets, receipts, certificate delivery, and material changes to these documents | Contract |
| Reporting to an organisation on the private course it arranged for its own people (section 6) | The legitimate interests of that organisation in knowing its training was completed, under our contract with it — limited to the fixed report in section 6, and never extended to the public platform |
| Sending you marketing email about new courses | Your consent, which you give by ticking an unticked box and can withdraw at any time |
We do not sell your personal information, and we never will. We do not share it with advertisers and we do not use it to build a profile of you for anyone else's purposes.
4.Public certificate verification — read this one
A Cuabity certificate is publicly verifiable. Anyone who has the certificate code — from the certificate itself, its QR code, or because you gave it to them — can open the verification page and see your name, the assessment you passed, and the date.
That is deliberate, and it is the whole value of the certificate: an employer or auditor can confirm it without asking us. It is also, unavoidably, a publication of your name.
- The verification page is not a directory. There is no list of certificate holders, and no way to search by name — a code only shows the certificate it belongs to.
- Your email address, profile details, exam answers and scores are never shown. Only name, assessment, date and status.
- If you would prefer your name not to be published in this way, do not buy an assessment. If you have already bought one, contact us before you sit it and we will refund it.
- You can ask us to withdraw a certificate from verification at any time. It then stops verifying for everyone, permanently — we cannot make it private to some people and public to others.
5.Automated grading
Your exam is marked automatically by the platform against a fixed answer key, and a certificate is issued automatically if you reach the pass mark. No human reviews it in the ordinary course.
If you believe a question was marked wrongly, you can ask us to review it. A person will look at the question, your answer and the key, and will correct the result if the marking was wrong. Email us using the address in section 17.
6.Who else sees it
We use a small number of service providers, each of which handles data on our instructions and for no purpose of their own — with the one exception for Stripe set out in the table:
| Provider | What for | Where |
|---|---|---|
| Stripe | Taking payment by card. When you buy an assessment we send Stripe your name, email address, username and account number on the platform, and what you are buying. Stripe collects your card details, the name on the card and your billing country directly from you, and gives us only the transaction record. Stripe also uses payment information for purposes of its own — detecting and preventing fraud, and meeting its own legal obligations — under its own privacy policy. | Australia, Ireland and the United States |
| Hetzner Online GmbH | Hosting the servers the platform runs on, and the encrypted backups. | Germany and Finland (EU) |
| Zoho Corporation Pty Limited | Our business mailboxes. When you email us, your message, your email address and anything you include are stored in our mailbox, together with our reply. | Australia |
| Brevo SAS | Delivering the emails the platform sends you: confirming your account, resetting your password, receipts, and notices about your courses and certificates. Brevo receives your name, your email address and the content of each email, and keeps a record of its delivery. | European Union (France, Germany and Belgium) |
We may also disclose personal information where the law requires it, to establish or defend a legal claim, or to a buyer if the business is sold — in which case the buyer is bound by this policy or one no less protective, and we will tell you before it happens.
Your employer does not get access to your account, your results or your activity on the public platform, even if they paid for your assessment.
The one exception is a private course an organisation has arranged with us for its own people (Terms of Service, section 2). If your organisation enrols you in one, it receives a report on that course only: your name, the course, the date you completed it, whether you passed and your score, and your certificate's code. You are told this when you are enrolled. It does not receive your answers, your individual attempts, or anything about the rest of your account or any other course.
7.Where your information is stored
Overseas storage — Australian Privacy Principle 8
We are an Australian company, but the platform runs on servers located in Germany and Finland, in the European Union. Your personal information is therefore stored outside Australia, and by using the platform you acknowledge that. We have taken reasonable steps to ensure our hosting provider handles it consistently with the Australian Privacy Principles.
Payment data is processed by Stripe in Australia, Ireland and the United States, under the data-transfer safeguards in Stripe's own data processing agreement. Whenever a service provider handles your information in another country, we use safeguards of that kind, and section 6 names the provider and the country.
Emails you send us, and our replies, are stored by our email provider in Australia. Emails the platform sends you are delivered by Brevo from the European Union.
8.How long we keep it
| What | How long | Why |
|---|---|---|
| Account and profile | While your account is open, then deleted within 30 days of closure | It is yours; we have no reason to keep it once you leave |
| Learning and exam records | Same as the account | They exist to show you your own progress |
| Issued certificates | At least 3 years from issue, and for as long as we offer verification | A certificate that cannot be verified is not a certificate |
| Financial records of a purchase | 5 years | Required by Australian tax law; kept even if you close your account |
| Web server and platform activity logs | 90 days | Security, fault diagnosis and investigating misuse |
| Correspondence | 2 years after the matter is closed | So we can pick up a conversation, and answer a later dispute |
| Backups of the platform | Daily copies 30 days; monthly copies 12 months; then destroyed | So the platform can be restored after a failure. They are encrypted and used for nothing else |
Information deleted from the platform — when you close your account, or at your request — remains in the encrypted backups until they are destroyed on that schedule, within 12 months at most. We do not restore it from a backup except to recover the platform after a failure, and if we ever have to, we delete it again.
9.Your rights
Wherever you live, you can ask us to:
- Access the personal information we hold about you, and get a copy;
- Correct anything inaccurate or out of date — you can edit most of it yourself in your profile;
- Erase it (see section 10 for how this interacts with a certificate);
- Restrict or object to what we do with it, including any processing based on our legitimate interests;
- Receive it in a portable form — a machine-readable export you can take elsewhere;
- Withdraw consent you have given, at any time, without affecting what was lawful before you withdrew it;
- Complain to a regulator (section 15).
Email us at the address in section 17. We will respond within 30 days. We may need to verify your identity first, and we will not charge you for a reasonable request. If we cannot do what you ask, we will tell you why and what you can do about it.
10.Erasure and your certificate
There is a real trade-off here and we would rather set it out plainly than have you discover it later.
A certificate is verifiable because we hold a record linking your name to the assessment and the date. If you ask us to erase your personal information, that record goes too, and the certificate stops verifying — permanently. Anyone checking it afterwards will be told it cannot be verified. We cannot undo this, and we cannot reissue the certificate.
So when you make an erasure request we will tell you which certificates it will invalidate, and ask you to confirm. If you would rather keep them, you can instead close your account and ask us to erase everything except the certificate record, and we will keep only the minimum that verification needs: your name, the assessment, the date and the code.
We also keep financial records for 5 years regardless, because tax law requires it. Those are not used for anything else.
11.Marketing email
We send marketing email only if you ticked the box asking for it. The box is unticked by default and ticking it is never a condition of anything.
Every marketing email has a one-click unsubscribe, and you can change the setting in your profile at any time. Unsubscribing does not stop the service email described in section 3 — you cannot opt out of a password reset.
This is also what the Australian Spam Act requires, and we apply it to everyone, not only Australian recipients.
12.Cookies
The platform uses the minimum a logged-in site can work with:
- Session cookie (
MoodleSession) — keeps you logged in as you move between pages. Strictly necessary; the site cannot work without it. It expires when your session ends.
Your language choice is kept in that session, or in your profile once you are signed in — not in a separate cookie. The public pages outside the platform set no cookies at all.
That is all of them. There are no advertising cookies, no third-party trackers and no cross-site tracking of any kind, which is why you are not being asked to dismiss a consent banner. If we ever add anything that needs consent, we will ask for it properly before setting it — not after.
13.Security
- All traffic is encrypted in transit (HTTPS).
- Passwords are stored as salted hashes and can never be read by us, including by an administrator.
- Administrative access is limited to the people who need it and protected by multi-factor authentication.
- Backups are encrypted and held separately from the running system.
- The platform software is kept patched against published security advisories.
No system is perfectly secure. If a breach occurs that is likely to cause you serious harm, we will tell you, and any regulator we are required to tell, without undue delay and within the time the applicable law sets — which in some countries is 72 hours.
14.Children
Cuabity is intended for adults working in regulated industry. Accounts require you to be at least 16, and purchases at least 18. We ask you to confirm each when you register and when you buy, and keep the time you did (section 2); we do not ask for your date of birth. We do not knowingly collect information from anyone younger, and will delete it if we find we have.
15.How to complain
Please raise it with us first, at the address in section 17 — we will acknowledge within 5 business days and respond within 30 days.
If you are not satisfied, you can complain to a data-protection regulator: the one in the country where you live or work, or ours — the Office of the Australian Information Commissioner (OAIC), oaic.gov.au. Nothing in this policy limits your right to do so.
No representative outside Australia
We have no office or appointed representative outside Australia. You can reach us directly using the contact details in section 17, and we answer requests from every country to the same standard and in the same time. We are keeping this under review as the platform grows.
16.Changes to this policy
We will update this policy when what we do changes — and, specifically, before we add analytics, before we change hosting provider, and before we add any new service provider that handles personal information.
If a change materially affects you, we will tell account holders by email and by a notice on the platform at least 14 days before it takes effect, so you have time to read it and, if you do not agree, to close your account first. The only exception is a change a law or an urgent security need requires sooner; we will then tell you as soon as we can, and why. Corrections that do not change what we do with your information are made without notice. Every version is kept, so you can see what changed and when.
17.Contact us
All enquiries, including privacy requests: hello@cuabity.com
Kuiper Belt Works Pty Ltd trading as Cuabity
ACN 703 421 505 · ABN 83 703 421 505
Incorporated in Australia