Privacy Policy

1. Introduction

Axiona FZE, Registered in UAE, which operates the ISSAB website and its certification programmes ("ISSAB", "we", "our", or "us"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our platform at issab.org.

By accessing or using the ISSAB platform, you consent to the practices described in this policy. We encourage you to read this document in full so that you understand how your data is handled.

2. Who We Are

ISSAB is an international professional certification body offering Lean Six Sigma certification programmes. We operate online at www.issab.org.

The ISSAB website is operated by Axiona FZE, Registered in UAE. Axiona FZE is responsible for your personal data under this policy.

If you have any questions about this Privacy Policy or how we handle your data, you may contact us at info@issab.org.

3. Information We Collect

Information You Provide

• Account data: Your full name, email address, and an encrypted password when you register on the platform.
• Profile and progress data: Your enrolled belt level, the date you first open each belt's course materials, examination scores, examination attempts, certification records, and, for Black Belt and Master Black Belt, your project declaration (the belt, the number of projects declared, the declaration version, the Terms version and the date and time).
• Project records and audit evidence: Project documents submitted by candidates before 29 September 2026 (kept as historical records), and any evidence you provide if you are selected for a post-certification audit.
• Contact form data: Your name, email address, and message content when you submit an enquiry via our contact form.

Information Collected Automatically

• Server logs: Basic technical data including IP address, browser type, pages visited, and timestamps. This data is used for platform security, performance monitoring, and troubleshooting.

Information We Do Not Collect

ISSAB does not collect or store the following:

• Payment card details (payments are processed through third-party providers)
• Social media account information
• Precise geolocation or GPS tracking data
• Advertising or marketing cookies

4. How We Use Your Information

We use your personal information for the following purposes:

• Account management: To create and maintain your student account.
• Course delivery: To provide access to learning materials, track your progress, and record examination results.
• Certification: To issue digital certificates and maintain verification records.
• Project declarations and audits: To record your project declaration and, if you are selected, to review the evidence you provide in a post-certification audit.
• Student support: To respond to your enquiries and provide assistance.
• Essential communications: To send you important information about your account, examinations, certification status, and platform updates.

We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes.

5. Certificate Verification

ISSAB provides a public certificate verification service at issab.org. When an employer or third party enters a valid certificate ID, the following information is displayed:

• Certificate ID
• Certificate holder's name
• Belt level achieved
• Date of certification
• Certificate status (active or revoked). For a revoked certificate, the date of revocation is shown and the holder's name is not displayed.

No email address, contact details, or other personal information is disclosed through the verification service. By obtaining an ISSAB certification, you consent to the above information being publicly verifiable.

6. Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it. These include:

• Password protection: All passwords are hashed using bcrypt before storage. We never store passwords in plain text.
• Authentication: User sessions are managed using JSON Web Tokens (JWT) with secure expiry.
• Encryption in transit: All data transmitted between your browser and our servers is encrypted using HTTPS/TLS.
• Database security: Student data is stored in MongoDB Atlas with encryption at rest and network-level access controls.
• Access controls: Administrative access to student data is restricted to authorised ISSAB personnel only.

Whilst we take reasonable precautions to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security but are committed to maintaining industry-standard protections.

7. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this policy:

• Account data: Retained for the lifetime of your account.
• Examination records: Retained for verification and certification integrity purposes.
• Certification records: Retained permanently to support lifetime certificate verification.
• Project declarations: Retained for the lifetime of your account.
• Audit evidence: Retained for up to 2 years after the audit is closed, then deleted.
• Contact form messages: Retained for up to 12 months, then deleted.

Account Deletion

You may request deletion of your account and personal data by contacting support@issab.org. We will process deletion requests within 30 days. Please note that certification records (certificate ID, name, belt level, and date) will be retained to maintain the integrity of the public verification system, even after account deletion.

8. Your Rights

You have the following rights regarding your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to correction: You may request that we correct any inaccurate or incomplete personal data.
• Right to deletion: You may request that we delete your personal data, subject to the retention requirements described in Section 7.
• Right to data portability: You may request that we provide your personal data in a commonly used, machine-readable format.

To exercise any of these rights, please contact support@issab.org. We will respond to your request within 30 days.

9. Children's Privacy

The ISSAB platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a person under 18, we will take steps to delete that information promptly.

If you believe that a child under 18 has provided personal data to ISSAB, please contact us at support@issab.org so that we can take appropriate action.

10. Third-Party Services

ISSAB uses a limited number of third-party services to operate the platform. These services may process certain data on our behalf:

• YouTube (youtube-nocookie.com): Video lessons are embedded using YouTube's privacy-enhanced mode, which limits data collection by YouTube until the video is played.
• Brevo: Used for transactional email delivery (account verification, password resets, certification notifications).
• MongoDB Atlas (EU — Frankfurt): Cloud database hosting for student data, with encryption at rest and in transit.
• Paddle (Paddle.com Market Limited): Our payment provider and merchant of record, which processes your payment details when you buy a belt. As merchant of record, Paddle also processes that data under its own privacy policy.
• Zoho (Zoho Corporation): Hosts our @issab.org e-mail, including any audit evidence you send us.

We encourage you to review the privacy policies of these third-party services. ISSAB is not responsible for the privacy practices of external providers.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. The updated version will be indicated by the "Last Updated" date at the top of this page.

We encourage you to review this Privacy Policy periodically. Your continued use of the Platform following any changes constitutes your acceptance of the revised policy.

12. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us:

• General enquiries: info@issab.org
• Data and privacy requests: support@issab.org
• Website: www.issab.org