Privacy Policy
Last updated: 25 October 2026
Governance, risk and compliance (GRC) Engineering Academy ("we", "us") runs grcengineeringlab.com, a site for learning GRC engineering. This policy explains what personal information we use and why. It also explains your rights under the European Union (EU) and United Kingdom (UK) General Data Protection Regulation (GDPR) and similar laws. We are the data controller, responsible for how your information is used.
1. Data we collect
- Account details: full name, email address, password (stored only as a secure hash, a scrambled form), telephone number, city, country and, if you give it, street address.
- Google sign-in: your name, email and profile picture from Google, if you choose that option.
- Learning activity: lessons started and completed, answers sent, practice task submissions, hints used, experience points (XP), streaks (consecutive learning days), badges, daily tasks and certificates.
- Content you post: lesson discussion posts, votes, written guides and practice task problem reports.
- Public profile choices: your username, short introduction, and whether you appear in learner rankings or have a public profile. Both are off by default.
- Technical data: anonymous records of page views and steps you take through the site, plus error reports. Our hosting provider keeps basic request records for security, including your Internet Protocol (IP) address (your device's network address) and browser type.
- Newsletter: your email, if you subscribe.
2. Why we use it and what the law allows
| Purpose | Legal basis |
|---|---|
| Create and secure your account, grade answers, track progress, issue certificates | Contract (providing the service you signed up for) |
| Contact details (phone, city, country) to check accounts, provide help and understand where learners are | Contract and legitimate interest (a valid business reason) |
| Learner rankings and public profiles | Consent (you choose to take part and can stop at any time) |
| Security, abuse prevention, fixing errors | Legitimate interest (a valid business reason) |
| Study how the site is used to improve lessons and practice tasks | Legitimate interest (a valid business reason). Activity records are not used for advertising. |
| Newsletter | Consent (unsubscribe at any time) |
3. Who can see your data
Your phone number and address are private. Only you and a small number of site administrators can see them. They never appear in learner rankings, public profiles, certificates or shared pages. Certificates show your display name, rank and results. Anyone with the certificate's checking link can check them.
We use data processors, companies contracted to handle information for us. These include our hosting and database provider (Lovable Cloud, with systems in the EU and United States (US)). They also include Google (only if you use Google sign-in) and our email delivery provider. We do not sell your information or share it for advertising.
4. International transfers
Some companies that process information for us may store it outside the EU or UK. These transfers use EU Standard Contractual Clauses (approved contract terms) or an adequacy decision (official approval of a country's data protection).
5. How long we keep it
- Account and learning data: while your account is open. When you delete your account, we delete it within 30 days.
- Issued certificates: kept so people can still check them, unless you ask us to cancel them.
- Security logs: up to 90 days.
- Newsletter: until you unsubscribe.
6. Your rights
You can ask to view, correct, delete or download your information. You can object to its use or ask us to limit its use. You can withdraw consent at any time. You can also download a progress report from your dashboard. To use any right, email us at the address below. You can complain to your local data protection authority. In Sweden, this is Integritetsskyddsmyndigheten (IMY), the Swedish Authority for Privacy Protection.
7. Security
Passwords are stored as hashes (scrambled forms) and checked against lists of passwords exposed in known data leaks. Information is encrypted (scrambled for protection) while being sent. Database rules control what each user can access. Answers are scored on the server (the computer running the site).
8. Children
The site is not aimed at children under 16. We do not knowingly collect their information.
9. Cookies
See our Cookie Policy.
10. Changes and contact
We will post changes here and update the date above. We will tell signed-in learners about important changes. Questions: privacy@grcengineeringlab.com.