Privacy Policy

This Privacy Policy (“Policy”) is issued by Artix Solutions and applies to all websites, web applications, APIs, and digital services operated under the Artix Solutions brand (“Services”). It describes how we collect, use, store, share, and protect personal information when you interact with any of our Services.

This Policy covers the following service types:

• Corporate / Software Website — our public-facing marketing and product information sites.
• Education Platform — e-learning courses, assessments, career tools, and CV/profile management, including LinkedIn OAuth sign-in.

Where a specific Service has supplemental privacy terms — for example, our Trading Platform — those terms are presented alongside this Policy and should be read together with it. In case of conflict, the supplemental terms prevail for that Service.

This Policy does not apply to third-party websites or services that may be linked from our Services. We are not responsible for the privacy practices of those third parties and encourage you to review their policies directly.

We are required by data protection law to identify a lawful basis for each processing activity. The bases we rely on are explained below.

Contract

Processing is necessary to perform a contract with you or to take steps at your request before entering into a contract. For example, creating your account or processing a trade order.

Legal Obligation

Processing is necessary to comply with a legal obligation, such as anti-money laundering (AML) rules, tax reporting, or regulatory requirements imposed on financial services providers.

Legitimate Interests

Processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and interests. We rely on this basis for fraud prevention, security monitoring, product analytics, and internal administration. You have the right to object to processing on this basis.

Consent

You have given clear, freely given, specific, and informed consent for a specific purpose — for example, uploading your CV for job matching, authorising LinkedIn profile access, subscribing to marketing emails, or allowing non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Vital Interests

Processing is necessary to protect someone's life. We do not ordinarily rely on this basis but may do so in genuine emergencies.

Where we process special categories of personal data (e.g. health information disclosed in a CV, or biometric data used for KYC verification on the Trading Platform), we rely on one of the additional conditions in Article 9 GDPR / Schedule 1 DPA 2018 — typically explicit consent or substantial public interest. We will identify the applicable condition clearly at the point of collection.

Artix Solutions does not sell personal data. We do not share your personal information with third parties except in the circumstances described below.

On our Education Platform you may choose to sign in or register using your LinkedIn account via the OAuth 2.0 protocol. This is an optional convenience — you can always register with an email and password instead.

What data LinkedIn shares with us

• Basic profile — first name, last name, LinkedIn profile URL, profile picture.
• Email address — your primary LinkedIn email address.
• Professional headline — your current title/role as shown on LinkedIn.
• We request only the r_liteprofile and r_emailaddress scopes. We do not request access to your connections, messages, or activity feed.

How we use LinkedIn data

• To create or log you in to your account without requiring a separate password.
• To pre-populate your profile fields (name, email, headline) — you can edit or delete these at any time.
• We do not post to LinkedIn on your behalf.
• We do not store your LinkedIn password — authentication is handled entirely by LinkedIn.

Revoking access

You can revoke our access to your LinkedIn account at any time through your LinkedIn permitted services settings. Revoking access will not delete your account on our platform but will require you to set a password to continue logging in. You may also request deletion of all LinkedIn-sourced data by contacting us.

Token handling

• Access tokens are stored encrypted and are used only to validate your identity at login.
• Refresh tokens (where issued) are retained for up to 90 days and then purged.
• Token data is never shared with third parties outside the scope of authentication.

Our Education Platform allows you to upload your CV or résumé to enhance your profile and be considered for relevant opportunities. By uploading a CV you are providing us with data under your explicit consent.

What we do with your CV

• Parsing & indexing — we use automated tools to extract structured data (skills, job titles, employment history, education) from your document to populate your profile.
• Profile display — extracted data is shown on your candidate profile within our platform.
• Matching — your profile data is used by our matching algorithms to identify relevant courses, resources, and (where you opt in) job opportunities.
• Recruiter visibility — your CV and profile are visible to authorised recruiters only if you switch your profile to “Open to Opportunities” in your privacy settings.

Your controls

• Download or delete your uploaded CV file at any time from your account settings.
• Hide your profile from recruiters by switching your visibility to “Private”.
• Request full erasure of all CV-derived data by contacting us (subject to retention obligations).
• Withdraw consent for CV-based job matching — this removes your profile from recruiter searches within 48 hours.

Special category data in CVs

CVs sometimes contain special category personal data such as health information, disability disclosures, political opinions, or religious beliefs. We do not actively collect this data and do not use it in automated decision-making. If your CV contains such information and you wish us to redact it, please contact our Privacy team. We rely on your explicit consent as the legal basis for processing any special category data incidentally contained in your CV.

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. The table below summarises our standard retention periods. At the end of each retention period, data is securely deleted or anonymised.

Retention periods may be extended where required to defend legal claims, comply with regulatory investigations, or fulfil ongoing contractual obligations. You may request early deletion of your data (see Your Rights below), subject to overriding legal obligations.

Depending on your location, you have the following rights regarding your personal data. We aim to respond to all legitimate requests within 30 days. We will not charge a fee for exercising your rights unless a request is unfounded, excessive, or repetitive.

To exercise any of these rights, or to raise a concern about our data handling, please contact our Privacy team (see the Contact section below). You also have the right to complain to your local data protection supervisory authority — in the UK, this is the Information Commissioner's Office (ICO).

Some of our service providers and business partners are located outside the UK and European Economic Area (EEA). When we transfer personal data internationally, we ensure that an appropriate safeguard is in place.

Adequacy Decisions

Transfers to countries that the UK Government or the European Commission has determined offer an adequate level of protection (e.g. transfers to the EEA from the UK under the UK GDPR).

Standard Contractual Clauses (SCCs)

EU Commission-approved or UK International Data Transfer Agreements (IDTAs) incorporated into our contracts with third-party processors in non-adequate countries such as the United States.

Binding Corporate Rules (BCRs)

Approved internal rules for intra-group transfers where applicable.

Derogations

In limited circumstances (e.g. your explicit consent, performance of a contract in your interest), we may rely on a derogation under Article 49 GDPR.

You may request a copy of the specific transfer mechanism used for any given transfer by contacting us.

We implement a layered programme of technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure.

• Encryption in transit — all data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
• Encryption at rest — databases and file stores containing personal data are encrypted using AES-256.
• Access controls — role-based access controls (RBAC) ensure that only authorised personnel can access personal data, on a need-to-know basis.
• Multi-Factor Authentication (MFA) — required for all staff accessing systems containing personal data; available and encouraged for users.
• Penetration testing — we commission independent security assessments at least annually.
• Incident response — we maintain a documented data breach response plan; material breaches are reported to the ICO within 72 hours and to affected individuals without undue delay, as required by law.
• Vendor security — all third-party processors are assessed against our security standards before engagement and periodically thereafter.

Despite these measures, no system is completely secure. If you believe your account has been compromised, please contact us immediately.

We use cookies and similar tracking technologies (web beacons, pixels, local storage) to operate our Services and, with your consent, to analyse usage and deliver personalised content. Our full Cookie Policy details every cookie we use, its purpose, provider, and duration.

You can manage your cookie preferences at any time via the Cookie Consent Manager. Withdrawing consent for non-essential cookies will not affect your ability to use our core Services.

Our Services are not directed at children under the age of 16 (or the applicable age of digital consent in your jurisdiction — 13 in the US under COPPA). We do not knowingly collect personal data from children without verifiable parental or guardian consent.

If you believe we have inadvertently collected data from a child, please contact us immediately. We will delete such data promptly upon verification.

Educational institutions deploying our Education Platform on behalf of students who may be under 16 must obtain appropriate consents and have a signed Data Processing Agreement with us in place before granting student access.

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you the following additional rights:

Right to Know

Request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, our business purpose for collecting or sharing it, and the categories of third parties with whom we share it.

Right to Delete

Request deletion of personal information we have collected from you, subject to certain exceptions.

Right to Correct

Request correction of inaccurate personal information.

Right to Opt-Out of Sale / Sharing

We do not sell personal information. We do not share personal information for cross-context behavioural advertising without your consent. Should this change, we will update this Policy and provide an opt-out mechanism.

Right to Limit Use of Sensitive Personal Information

Request that we limit our use of sensitive personal information (as defined by CPRA) to purposes strictly necessary to provide the Services.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To submit a verifiable consumer request, email us with “California Privacy Request” in the subject line. We will respond within 45 days (extendable by a further 45 days with notice). We may need to verify your identity before processing your request.

This Policy is designed to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as well as the EU GDPR where applicable. Our Services are governed by the laws of England and Wales.

Data Controller

The entity that determines the purposes and means of processing is Artix Solutions Inc.

Data Protection Officer (DPO)

We have appointed a Privacy Lead responsible for overseeing compliance. Contact details are in the Contact section below.

Supervisory Authority

In the UK, the supervisory authority is the Information Commissioner's Office (ICO). You have the right to lodge a complaint with them if you believe we have infringed your data protection rights.

Representative in the EU

Where required under Article 27 GDPR, we have appointed an EU representative. Please contact us for their details.

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Artix Solutions will notify you of material changes by:

• Posting a notice on our website homepage or within the relevant Service.
• Sending an email notification to the address associated with your account (for registered users).
• Displaying an in-app banner on your next login.

We will update the “Effective Date” at the top of this Policy whenever it changes. Where a change requires your fresh consent (e.g. a new purpose for processing), we will seek that consent before the change takes effect.

We encourage you to review this Policy periodically. Continued use of our Services after the effective date of a revised Policy constitutes your acceptance of the changes, to the extent permitted by applicable law.

If you have any questions, concerns, or requests regarding this Privacy Policy or how Artix Solutions processes your personal data, please contact our Privacy team:

• Email: helpline@artix.solutions
• Postal address: 822 Herman Way Sykesville MD 21784 USA

We aim to respond to all privacy enquiries within 30 days. Where your request is complex or numerous, we may extend this period by a further two months, in which case we will notify you.