Data Protection & Privacy Compliance Policy
Overview
This policy details the standards and procedures enforced by Learnille to protect Personally Identifiable Information (PII), financial records, and user data in compliance with global data privacy frameworks (GDPR, NDPR).
🔒 1. Data Classification & Protection
| Data Tier | Examples | Protection Controls |
|---|---|---|
| Tier 1: Highly Sensitive PII | Passwords, OTP tokens, bank account numbers, payout account keys. | Encrypted at rest (AES-256), salted password hashing (argon2), never logged in plain text. |
| Tier 2: Personal Identifiable Info | Full name, email address, phone number, avatar URL. | Encrypted in transit (TLS 1.3), restricted access via RBAC, audit logged on mutation. |
| Tier 3: Platform & Learning Data | Course progress, video timestamps, consultation bookings, comments. | Standard database indexing, isolated per tenant/user ID. |
🇪🇺 2. GDPR & NDPR Compliance Rights
1. Right to Access (Data Export)
- Users can request a complete archive of their personal profile, course enrollments, consultation history, and wallet transactions.
- Automated export job packages user data into encrypted JSON/ZIP format within 48 hours.
2. Right to Erasure (Account Deletion & Soft-Delete)
- Account deletion soft-deletes user credentials and anonymizes historical audit logs to comply with financial retention mandates while removing PII.
- Financial payout records are retained for 7 years as required by tax and anti-money laundering (AML) laws.