Privacy Policy

1. Who is responsible

Arctic Safety Academy, a subsidiary of Actpen CTR LLC, Longyearbyen, 9170 Svalbard, Norway is the data controller. Privacy questions can be sent through our enquiry form.

2. What we collect

• Account data: name, email address, date of birth and password (stored only as a secure hash).
• Training data: module progress, test scores, exam attempts, completion dates and certificate codes.
• Verification data: the trade, issuing body and country you declare, and up to two PDF documents you upload.
• Company data: company name, contact person, booked seats and employee completion status.
• Payment data: the amount, currency, date and provider transaction reference. Card and wallet details are handled entirely by Paddle.com, our Merchant of Record and payment reseller, and never reach our servers.
• Enquiries: the name, email, organisation and message you send through the contact form.

3. Why we use it

• To deliver training, record results and issue certificates in your name (performance of a contract).
• To assess verification requests and let employers confirm a code you choose to share with them (contract and legitimate interest).
• To prevent exam fraud and misuse of accounts (legitimate interest).
• To answer enquiries and provide support (legitimate interest / pre-contractual steps).
• To meet bookkeeping and training-record obligations (legal obligation).

We do not sell personal data and we do not use it for third-party advertising.

4. Who sees your data

• Employers: only the information visible on the public verification lookup — that a code is valid, the trade and the decision date. Employers never see your uploaded documents.
• Companies that booked your seat: your name and completion status for the courses they paid for.
• Service providers: our hosting, database and email providers, and Paddle.com as Merchant of Record for order processing, payments, tax compliance and refunds, who act on our instructions under data-processing agreements on behalf of Arctic Safety Academy and Actpen CTR LLC. Data is hosted within the EU/EEA.
• Authorities: only where required by law or to investigate forged documents.

5. How long we keep it

• Training records and certificate codes: 10 years, so certificates can still be verified by future employers.
• Uploaded verification documents: deleted 12 months after the decision; the decision and code remain.
• Enquiries: 24 months after the last reply.
• Accounts inactive for 5 years are anonymised, except records we must keep by law.

6. How we protect it

Data is encrypted in transit, access is restricted by role so candidates only see their own records and staff only see what their desk requires, uploaded documents are held in private storage that is never publicly linkable, and admin access is logged.

7. Your rights

You can access, correct, export or ask us to delete your data, object to processing based on legitimate interest, and withdraw consent where processing relies on it. Most account details can be edited in your dashboard; for anything else, contact us and we respond within 30 days. You may also complain to Datatilsynet (the Norwegian Data Protection Authority) or your local authority.

8. Cookies

We use only strictly necessary cookies and local storage to keep you signed in and remember exam progress. No analytics or advertising cookies are set, so no cookie banner is required.

9. Changes

We will post any changes here and update the date above. Significant changes are emailed to account holders.