Privacy Policy

Last updated: 2026-10-26 · Version 1.2

SkillUp Space ("Platform", "we") respects the privacy of its users. This policy explains what personal data we collect, why we process it, on what legal basis, how long we retain it, and what rights you have under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and applicable national law.

1. Data Controller

The data controller is CYBILAS Ltd. („СИБИЛАС" ЕООД), UIC 208819078, the company operating skill-up.space (cybilas.com). Contact for any privacy-related question or to exercise your rights: office@skill-up.space.

2. What we process and why

• Registration data (name, email, hashed password) — to create and maintain an account. Legal basis: contract performance, Art. 6(1)(b). Retention: until you delete your account.
• Course progress, completed lessons, certificates — to deliver the service. Same basis.
• Payment data — processed by Stripe; we never see your card. Legal basis: contract + accounting law obligations. Retention: 10 years (accounting requirement).
• IP, audit log on login/admin actions — security and rate limiting. Legal basis: legitimate interest, Art. 6(1)(f). Retention: 90 days.
• Transactional email — verification, password reset, course materials. Legal basis: contract performance.
• AI Readiness Assessment answers — processed entirely in your browser. Not sent to us, not stored on our servers.

3. Third-party processors

We share limited data with carefully chosen processors, each under a DPA: Stripe Payments Europe (PCI DSS Level 1) for payments, Cloudflare for bot protection (Turnstile), SuperHosting.bg (EU-based servers) for hosting, our SMTP provider for transactional email. We do not sell or rent your personal data.

Google Forms. Registration for live cohorts (for example “Detailed Production Planning with Claude Projects”) is collected through a Google Forms form (Google Ireland Ltd. / Google LLC). You provide the data you enter in the form — typically name, company, email address, phone (if requested) and number of participants. We use it only to reserve your seat, invoice you and communicate about the course (Art. 6(1)(b) GDPR — steps prior to entering into a contract, and contract performance). Google processes the data on our behalf in our Google account; transfers to the United States, where they occur, rely on the EU–US Data Privacy Framework and/or standard contractual clauses. We keep the responses only as long as needed to run the course and meet accounting obligations, and delete them afterwards. Please do not enter sensitive data in free-text fields.

4. Transfers outside the EEA

Where processors are in a third country, we rely on EU Standard Contractual Clauses and additional safeguards.

5. Security

• TLS 1.2+ on all connections (HSTS enabled).
• Passwords hashed with bcrypt; never stored in clear text.
• HttpOnly, Secure and SameSite=Lax cookies; CSRF protection.
• Rate limiting on login and registration.
• Audit log of critical administrative actions.
• Cloudflare Turnstile CAPTCHA against automated attacks.

6. Your GDPR rights

• Right of access (Art. 15) — JSON data export available in /account.
• Right to rectification (Art. 16).
• Right to erasure (Art. 17) — also self-serve via the account page.
• Right to restriction (Art. 18) and portability (Art. 20).
• Right to object to processing based on legitimate interest (Art. 21).
• You are not subject to fully automated individual decisions under Art. 22. The AI Readiness Assessment is a self-assessment tool, not an automated decision.
• Right to lodge a complaint with the supervisory authority — in Bulgaria, the Commission for Personal Data Protection (www.cpdp.bg).

7. Marketing and consent

Transactional emails are sent on contract basis. Marketing emails only with explicit consent — you can withdraw at any time.

8. Cookies

See our Cookie Policy.

9. Children

The platform targets professionals 18+. We do not knowingly collect data from children under 16.

10. EU AI Act and educational frameworks

When we use AI in our services we ensure transparency and human oversight. The AI Readiness Assessment is not a high-risk AI system under the EU AI Act — it is a static questionnaire whose results are interpreted by the user.

Our courses and tools reference the EU JRC competency frameworks — DigComp 3.0, EntreComp, LifeComp, and GreenComp (2022) — and the 2018 Council Recommendation on Key Competences for Lifelong Learning. This makes them usable for upskilling and reskilling aligned with European quality standards.

11. Changes

For material changes we will notify you by email (if you have an account) and via a notice on the site. The last-updated date is shown above.

Questions: office@skill-up.space