On this page
Who this notice is for
This draft covers the ZubLMS public website and hosted learning platform. If your employer or another organisation provides your workspace, it determines the purposes of its training and membership records. Ask that organisation for its own privacy notice and the identity of the party responsible for your information.
ZubLMS is the product name. The operator’s full legal name, business address, country and privacy contact designation must be confirmed before this notice becomes effective. The existing general contact is [email protected]. Hosting and data-processing responsibilities must be recorded in each customer agreement; the software’s role labels do not determine legal responsibilities.
Information used by the platform
Account and company information can include your name, email, profile details you provide, company membership, roles, teams and sign-in identifiers. Identity providers handle credentials and federation; the LMS uses the resulting identity and session information.
Learning information can include assignments, course and lesson progress, assessment responses and outcomes, completion records, video playback checkpoints, resources you save and report exports. Authors supply courses and resources. Messaging features handle message content, recipients and delivery records.
Operational information includes security and audit events, request information processed by hosting infrastructure, session identifiers and privacy preferences. If you contact us, we receive the details you choose to send. Optional activity events are handled separately from records needed to deliver learning.
Purposes and legal grounds
Information supports sign-in, access control, learning delivery, progress reporting, company administration, requested communications, troubleshooting and protection against misuse. Your organisation supplies or approves some account and training information; other information comes from your use of the service.
The responsible organisation must identify and disclose the applicable legal grounds for these purposes under the laws that apply to its deployment. This draft does not assume that all processing is based on consent or that one jurisdiction’s rules apply everywhere. Optional analytics and marketing sharing use separate, revocable preference controls.
Who can receive information
People with authorised company roles can access records within their permitted scope, including training progress and reports. Do not assume that a workplace learning record is private from your organisation. Message access follows the messaging permissions; an administrator role does not automatically grant access to every message body.
When the optional author AI pilot is enabled, an author’s brief, audience or question and explicitly selected resource titles and text are sent to the company-configured AI provider. Selected-resource processing requires an acknowledgement before submission. The LMS records request metadata and source references/digests, not the prompt, source text or answer in its AI usage ledger. Accepted course drafts use normal course storage. Provider processing and retention policies require separate review; enabling this feature does not make its output accurate or approved for publication.
Hosting, storage, identity, mail and other approved service providers may process information needed to operate the installation. This hosted deployment uses private AWS S3 application storage in the US East (Ohio) region. Mail, network services and company identity providers have separate processing arrangements that must be confirmed in the deployment’s provider register.
If configured and enabled, optional destinations can include Google Analytics 4, Mixpanel, Klaviyo and Meta. Supporting an adapter does not mean it is active. Embedded YouTube or Vimeo content may send request information to those providers when you choose to load it, under their own notices. Customer contracts must identify relevant providers, processing locations and international-transfer safeguards before use.
Retention and deletion
Retention depends on the record’s purpose, your organisation’s training obligations, the service agreement and applicable law. The final policy must specify periods or meaningful retention criteria for accounts, learning records, messages, activity, logs and exports. A complete installation-wide automatic deletion schedule has not been established by this draft.
Removing current content is not necessarily immediate removal from retained storage versions, snapshots or provider systems. Those copies need an agreed retention and deletion process. Signing out or clearing your browser does not delete your account or learning records.
Your choices and requests
Use Privacy choices, where available, to choose analytics and marketing independently or withdraw a choice. Withdrawal stops future optional submissions through those controls; it cannot recall events already received by another service. Essential sign-in, security and learning records are separate.
For access, correction, deletion, portability, restriction or an objection, contact your organisation’s learning administrator first for company-managed records. Available rights and exceptions depend on the applicable law and the responsible organisation’s role. For public-site questions or help finding the right contact, email [email protected] with “Privacy request” in the subject. Do not email passwords, identity documents or sensitive learning records unless a secure verification process has been agreed.
You may also have a right to complain to the relevant data-protection authority. Its identity and contact details must be established for the deployment. Verification may be needed before information is disclosed or changed.
Security, young learners and changes
Access controls, protected transport and operational safeguards reduce risk; they do not guarantee that an incident cannot occur. See Trust & readiness for current product boundaries. This policy does not claim a security certification.
ZubLMS is currently presented for organisational training. A deployment involving children requires a separately reviewed age-appropriate notice, permissions and safeguards. Do not use this draft as approval for that deployment.
Material changes need a dated, reviewed notice and appropriate communication before they take effect. The date on this page identifies the draft revision, not a contractual effective date.
Need a little clarity?
Start with your company administrator for workspace records. For platform questions, use our existing general contact.
[email protected]