14. CONFIDENTIALITY AND DATA PROTECTION
14.1 Qaf is committed to protecting the privacy of Users and safeguarding their personal data. Qaf does not maintain a separate privacy policy; this Section 14 sets out how Qaf collects, uses, discloses and protects personal data in connection with the Platform, and Users should read it to understand how their data is handled.
(a) Data collected: Qaf collects personal data that Users provide when registering an Account or making a purchase (such as name, email address and payment details, and, where applicable, Sponsor or Institutional Client information); data generated through use of the Platform (such as course progress and assessment results, and, where a Course or Module is proctored, the proctoring data described in Section 8.3); and data generated through AI Grading under Section 10.
(b) Purposes: Qaf uses this data to provide access to Courses, Modules and Certificates; to process payments and refunds; to maintain academic integrity and enforce this Agreement; to communicate with Users about their Account, Courses or this Agreement; to improve the Platform in accordance with Section 14.3; and to comply with applicable law.
(c) Sharing: Qaf may share personal data with third-party service providers who help operate the Platform (including payment processors, proctoring providers, and hosting providers), with a Sponsor or Institutional Client to the extent described in Sections 11 and 12, and where required by law, in each case subject to confidentiality and data protection obligations at least as protective as those in this Section 14.
(d) Retention: Qaf retains personal data only for as long as necessary for the purposes set out in this Section 14, or as otherwise required by applicable law.
14.2 Both Qaf and any Instructor, Mentor or other User may be given access to information which is proprietary or confidential to the other party. Each party agrees to hold such information in strict confidence and not to disclose or use it for any purpose other than performing its obligations under this Agreement.
14.3 Qaf may use aggregated or de-identified data derived from use of the Platform (including course performance and engagement data) for the purposes of improving the Platform, its curriculum and its services.
14.4 Where the UK or EU General Data Protection Regulation ("GDPR") applies to the processing of a User's personal data, Qaf will process that data on a lawful basis, for no longer than necessary for the purposes set out in Section 14.1, and will give effect to the User's rights of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with the competent supervisory authority, in each case as set out in this Agreement and applicable law. Where personal data is transferred outside the User's jurisdiction, Qaf will use an appropriate transfer mechanism recognised under applicable data protection law.
14.5 Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), applies to a User, Qaf will give effect to that User's rights to know what personal information is collected, to request deletion or correction of that information, to opt out of the sale or sharing of personal information (to the extent applicable), and to be free from discrimination for exercising these rights, in each case as set out in this Agreement and applicable law.