We teach people how to protect information, so we try to be plain about how we handle yours.
This policy explains what we collect, why we collect it, how long we keep it, and what you can ask us to do with it.
At a glance
What we do: We provide online professional training to individuals and organizations.
What we collect: The information needed to create accounts, deliver training, track completion, issue certificates, process payments, and secure the platform.
What we don't do: We do not sell your personal information, and we do not use learner training records to build advertising profiles.
Cookies: Strictly necessary cookies always; analytics and marketing cookies only if you accept them.
If you were enrolled: Where an organization enrolls you, its authorized administrators can see your training activity and results.
Your controls: Access, correct, delete, port, or object (see Section 10).
1 of 16 expanded
Simple Training Center ("STC," "we," "us," or "our") is an online professional training platform operated by Backup Solutions, Inc., a Florida corporation. This policy covers simpletrainingcenter.com, the STC learning platform, and the related pages, emails, and support channels that link to it (together, the "Services").
Two different relationships
How we handle personal information depends on how you reached us:
- You signed up directly. If you bought a seat on your own, or as an administrator for your business, we act as the controller (or "business") for your account data and are responsible for the choices described in this policy.
- An organization enrolled you. If an employer, association, or partner assigned you training, that organization is the controller of your training data and we act as its processor (or "service provider"). We handle that data on the organization's documented instructions and under our agreement with it.
If your employer assigned your training
Your employer controls the training assignment, and its authorized administrators can see your completion status, assessment results, certificates, and other training records. Your employer's own privacy notice governs how it uses that information, including whether completing training is tied to an employment requirement. Requests to access or delete your training records go to your employer, not to us. See Section 11.
Where our agreement or Data Processing Addendum ("DPA") with an organization conflicts with this policy for data we process on that organization's behalf, the agreement controls.
Information you or your organization provide
- Account and profile data: name, email address, password (stored in hashed form), job title, department, company name, phone number, and a profile photo if you add one.
- Roster data: where an administrator enrolls learners, we receive the details that administrator chooses to provide, typically name, work email, department, and any start date used to set training due dates.
- Billing data: billing contact, billing address, seat counts, plan, invoices, and tax identifiers. We do not store full payment card numbers. Card details are entered directly with our payment processor, which returns only a token, the card brand, and the last four digits.
- Content you submit: support requests, survey and feedback responses, quiz and assessment answers, free-text responses inside a course, policy acknowledgements, and anything you send to our email or support channels.
Training and assessment records
Delivering training necessarily creates a record of it. We collect:
- Courses assigned, started, and completed, with timestamps
- Module and lesson progress, time spent, and resume position
- Quiz scores, attempt counts, and pass or fail results
- Certificates issued, certificate identifiers, and any retraining due date
- Policy attestations and acknowledgements completed in the platform
- Whether reminder and notification emails were sent and successfully delivered
Information collected automatically
- Device and connection data: IP address, browser type and version, operating system, device type, language, and time zone.
- Usage data: pages and courses viewed, actions taken in the platform, referring page, session start and end, and error logs.
- Security data: sign-in attempts, authentication events, session information, and records of administrator actions.
Information from third parties
- Payment processor: transaction status, a tokenized card reference, and fraud signals.
- Single sign-on or directory providers, if your organization chooses to connect one: name, email, a unique identifier, group membership, and account status.
- Referral and reseller partners: your business contact details when a partner refers you, and the attribution data needed to calculate a commission.
- Public and business sources: business contact information from public web pages, business directories, and events where you gave us your details.
We do not intentionally collect sensitive personal information. Please do not enter Social Security numbers, financial account numbers, health information, biometric data, or government identification numbers into course fields, support requests, or roster uploads. If you do, we will delete it once identified.
- Deliver the Services: create accounts, assign and stream courses, score assessments, issue certificates, track retraining dates, and send reminders.
- Report to administrators: produce completion dashboards, training reports, and exportable records an organization can use as evidence of training.
- Billing and account management: process payments, manage seats and renewals, apply discounts, calculate partner commissions, and collect unpaid amounts.
- Support: answer questions, restore access, troubleshoot problems, and follow up on requests.
- Security and abuse prevention: authenticate users, detect fraud and account sharing, investigate suspected misuse, and enforce our Terms.
- Improve the platform: review how courses are used in the aggregate so we can fix broken content, shorten confusing modules, and decide what to build next.
- Communicate with you: send service notices, security alerts, policy updates, and, where permitted, occasional marketing about STC products. Every marketing email has an unsubscribe link. Service and training notices are not optional while your account is active.
- Comply with law: meet tax, accounting, and recordkeeping obligations and respond to lawful requests.
We do not use learner training records to build advertising profiles, and we do not make automated decisions that produce legal or similarly significant effects about you. Any employment consequence of failing or skipping training is your organization's decision, not ours.
If the GDPR or UK GDPR applies to you, we rely on these legal bases:
| Basis | Where we rely on it |
|---|---|
| Contract | Creating your account, delivering courses, issuing certificates, billing, and support. |
| Legitimate interests | Securing the platform, preventing fraud and abuse, improving our courses, and direct marketing to business contacts, balanced against your rights. |
| Legal obligation | Tax and accounting records, and responding to lawful requests. |
| Consent | Where required, marketing email and any future non-essential cookies. You may withdraw consent at any time. |
Where we act as a processor for an organization that enrolled you, that organization determines the legal basis for its use of your training data.
Training records are often the evidence an organization needs to show that training happened, so they generally outlive the account that created them. Our general practice:
| Data | General retention practice |
|---|---|
| Account & profile | For the life of the account, then a limited period after closure. |
| Training & certificate records | Up to 7 years from completion, unless a different period is required by law, configured by the organization, or established in our agreement with the customer. |
| Billing & tax records | As long as applicable tax and accounting rules require. |
| Support requests | A limited period after the request is resolved. |
| Security & system logs | A limited rolling period appropriate to their security purpose. |
| Marketing contacts | Until you unsubscribe. We then keep a suppression record so we do not contact you again. |
| Backups | Deleted data ages out of routine backups on our normal backup cycle. |
Organizations can arrange shorter retention periods by agreement. We may keep information longer where a legal hold, dispute, or investigation requires it. When we no longer need information, we delete it or de-identify it.
We maintain administrative, technical, and organizational safeguards designed to protect personal information, including access controls, encryption where appropriate, authentication safeguards, logging, monitoring, vendor review, and internal security procedures. We review these measures as the Services change.
No system is perfectly secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential, using any additional authentication options we make available, and telling us promptly at security@simpletrainingcenter.com if you suspect unauthorized access to your account. If a security incident affects your personal information, we will notify you and any relevant authority as applicable law requires.
We operate in the United States and store data on servers located there. If you access the Services from outside the United States, your information will be transferred to, stored in, and processed in the United States, where data protection laws differ from those in your country.
For transfers of personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK Addendum where applicable. Contact us for information about the mechanism relevant to you.
Choices available to everyone
Whoever and wherever you are, you can ask us to:
- Access the personal information we hold about you and how we use it
- Correct information that is inaccurate or incomplete
- Delete your personal information, subject to the retention practices and legal exceptions described above
- Receive a copy of your data in a portable, machine-readable format
- Unsubscribe from marketing email at any time
U.S. state privacy rights
Residents of U.S. states with applicable comprehensive consumer privacy laws may have additional rights, depending on their state of residence and whether that law applies to us. Those rights commonly include the right to confirm whether we process your personal information, to access, correct, delete, and obtain a portable copy of it, to opt out of targeted advertising, sale, and certain profiling, and to appeal a decision we make on a request.
We do not sell or share personal information for cross-context behavioral advertising, so there is currently nothing to opt out of on that front. We will not discriminate against you for exercising any privacy right.
EEA, UK, and Swiss rights
You additionally have the right to object to processing based on legitimate interests, to request restriction of processing, to withdraw consent without affecting processing already carried out, and to lodge a complaint with your supervisory authority.
How to make a request
Email privacy@simpletrainingcenter.com with your request and the email address associated with your account. We will take reasonable steps to verify your identity (usually by confirming control of that email address and details only an account holder would know), and we will respond within the timeframe required by applicable law, generally 45 days under applicable U.S. state privacy laws and one month under the GDPR. Those periods may be extended where the law permits, and we will tell you if we need an extension. There is no charge unless a request is manifestly unfounded or excessive.
An authorized agent may submit a request on your behalf with written permission; we may still contact you to confirm. If we deny a request and you have a right of appeal, you may appeal by replying to our decision with the subject line "Privacy Appeal."
When we process your training data as a processor for an organization, we route your request to that organization rather than acting on it ourselves. Deleting a learner's completion record on request would remove the evidence of training that our customer relies on and may be required to keep.
Send your request to your organization's HR, IT, or compliance contact. If you send it to us instead, we will forward it to that organization's administrator and let you know we have done so. We assist our customers in responding to these requests within the timeframes applicable law requires.
The Services are professional training tools built for adults and are not directed to children. We do not knowingly collect personal information from anyone under 16, and accounts may not be created by anyone under 18. If we learn we have collected information from a child under 16, we will delete it. A parent or guardian who believes a child has provided us information can contact privacy@simpletrainingcenter.com.
Our courses and site link to outside resources, and some courses embed content hosted by third parties. We do not control those sites and are not responsible for their privacy practices. Review their policies before providing information to them.
We update this policy as the Services and the law change. When we do, we revise the "Last updated" date and version number at the top. For material changes, we will provide at least 30 days' notice by email to account administrators or by an in-product notice before the change takes effect. Continuing to use the Services after the effective date means you accept the updated policy. Prior versions are available on request.
For any question about this policy, a privacy request, or a suspected security issue:
Backup Solutions, Inc. (Simple Training Center)
3225 McLeod Dr, Suite 100
Las Vegas, NV 89121, United States
Privacy: privacy@simpletrainingcenter.com
Security: security@simpletrainingcenter.com
Support: support@simpletrainingcenter.com
This policy is governed by the laws of the State of Florida, without regard to its conflict-of-laws rules, except where a data protection law that applies to you provides otherwise.