Privacy Policy

This Privacy Policy (“Policy”) describes how we collect, use, share, and secure the personal information you provide when you visit the Websites and Mobile Applications owned and operated by us (listed below), and when you use our Service(s). It also describes your choices regarding the use, access, withdrawal of consent (as per the terms hereof), and correction of your personal information. The use of information collected through our Service(s) shall be limited to the purpose of providing the service that you have chosen. The capitalized terms used in this Policy but not defined herein shall have the same meaning as defined in our Terms and Conditions.

For the purpose of this Privacy Policy, sensitive personal data or information of a personal nature is as defined under applicable privacy laws (including the Digital Personal Data Protection Act, 2023 of India (“DPDP Act”), the California Consumer Privacy Act (“CCPA”), the California Privacy Rights Act (“CPRA”), the General Data Protection Regulation (“GDPR”), and the Personal Information Protection and Electronic Documents Act of Canada (“PIPEDA”)). Please note that the use of the terms “personal information,” “personally identifiable information,” or “personal data” in this Privacy Policy includes sensitive personal data or information, wherever appropriate and/or mandated under applicable privacy laws.

Our Websites and Digital Properties Include, but Are Not Limited to:

• Website: www.hanux.org
• Learning Management System (LMS): To be launched at *.lms.hanux.org
• Mobile Applications: iOS and Android apps under development. URLs will be added upon release.

Please read this Privacy Policy carefully, as it governs your use of our Website and the Service(s). If you do not agree to this Privacy Policy, please do not use our Services.

In some cases, an administrator may create an account on behalf of an “End-User” and may provide his/her information, including personal information. In such cases, the administrator — who may be your Employer, a Corporate Client, or an Authorized Training Partner (“ATP”) — is our “Client.” We collect information under the direction of our Clients and have no direct relationship with the End-User whose personal data we process.

An End-User's use of our Website may be subject to the Client's policies, if any. Our Client must have the authority to act on behalf of the End-User and to consent to the collection and use of their personal information as described in this Privacy Policy.

If you are an End-User using our Website, please direct your privacy inquiries to your administrator. We are not responsible for the privacy or security practices of our Clients, which may differ from those set forth in this Privacy Policy.

Personal data collected by us may be stored and processed in your region and in any other country where Hanux Learning, its affiliates, or its data sub-processors operate facilities. To facilitate our global operations, we may transfer and access such information from around the world, including from other countries in which Hanux Learning has operations. This Privacy Policy shall apply even if we transfer data to other countries.

Currently, Hanux Learning operates entities in:

• India: Hanux Learning Private Limited (CIN: U85500DL2025PTC450795)
• United States: Hanux Learning LLC (Sheridan, Wyoming)

Our data and that of our data sub-processors are hosted primarily on Amazon Web Services (AWS) infrastructure with data centers located in India and the United States. Data may also be processed by employees and contractors operating in these countries, who may be engaged in product development, customer support, and technical operations.

The data protection and other laws of these countries might not be as comprehensive as those in your country. By submitting your data and/or using our Services, you consent to the transfer, storage, and processing of your data in these countries.

Cross-Border Transfers — Standard Contractual Clauses

For data transferred between Hanux Learning Private Limited (India) and Hanux Learning LLC (USA), and between us and our third-party service providers, we rely on Standard Contractual Clauses (SCCs) and data processing agreements to ensure adequate protection of your personal data, in accordance with the GDPR, UK GDPR, and other applicable cross-border transfer regulations.

Hanux Learning uses this Privacy Policy to govern the use of personal information you provide to us. We use your personal information solely to provide our Services to you. We also use your Personally Identifiable Information (“PII”) together with other Non-Personally Identifiable Information (“Non-PII”) to help us better understand our users and to improve the content and functionality of our Site.

4.1 Personally Identifiable Information (PII)

We may collect the following personal information from you in the following situations:

When you visit our Website or Mobile Apps and voluntarily provide information via a contact form, chat, phone session, or as part of a purchase or registration:

• Full Name
• Email Address
• Phone Number
• Mailing Address (Country, State, ZIP/Postal Code, City)
• Business Information: company name, company size, business type, job role.
• Account Details: billing information and account password (stored in hashed form).

Automatically Collected Information:

When you visit our Website, we may automatically collect certain information about your device and usage, including:

• IP address
• Browser type and version
• Operating system
• Referring URLs
• Pages visited, time, and date of visit
• Device identifiers
• Cookies and tracking data

When you use our Learning Management System, Mobile Applications, support system, or respond to our surveys:

• Personal and Contact Information: name, gender, date of birth, email address, mailing address, professional experience, educational details, IP address, geographic location, phone number.
• Unique Identifiers: username, password, learner ID.
• Learning Data: course enrollments, progress, assessment results, certificates, and instructor feedback.

When you use our blog, community website, or public forums: Please refer to our section on Public Forums below. Users may visit our Site anonymously. We will collect personally identifiable information from Users only if they voluntarily submit such information to us. Users can always refuse to supply personally identifiable information, except that doing so may prevent them from engaging in certain Site-related activities.

4.2 Non-Personally Identifiable Information (Non-PII)

We capture some non-identifiable data in our logs. This data includes:

• Device type
• Browser type
• Approximate location
• Language preference
• Time zone
• Screen size
• Referring and exit pages
• Operating system

We may use the personal information collected from within the Websites, chat, mobile, email, or when you use the Service(s) to:

• Provide you with the Service(s) and deliver the course/program you have enrolled in.
• Send you communications relating to the Service(s).
• Assess the needs of your business to determine or suggest suitable products.
• Send you requested product or service information.
• Respond to customer service requests, queries, and complaints.
• Administer your account, process payments, and issue invoices.
• Send you promotional and marketing communications (you can opt out at any time).
• Facilitate your transactions with other users when you use our Service(s).
• Perform statistical analyses of user behavior and characteristics at an aggregate level to measure interest in and use of various areas of the Site.
• Detect, prevent, and respond to fraud, abuse, security risks, and technical issues.
• Comply with legal and regulatory obligations.

We use your personal information to communicate with you in relation to our Services, including information regarding content, courseware, products, inquiries, and Services via different channels (e.g., phone, email, chat, WhatsApp, SMS), and by agreeing to this Privacy Policy, you give us explicit permission to do so. Regardless of whether you have registered yourself under DND, DNC, or NCPR services, you still authorize us to contact you for the above-mentioned purposes.

When you provide us with personal information about your contacts (e.g., through our referral program), we will only use this information for the specific reason for which it is provided.

We do not sell, rent, or transfer your personal information, SMS/text-messaging consent, or phone number to third parties for marketing or promotional purposes. We may share your information only in the following circumstances:

• If access to your Participant Account was provided by your Employer or an Authorized Training Partner, we will share information, including personal information, with them.
• Service Providers: We may share your information with service providers performing functions such as hosting, marketing, customer service, payment processing, or technical support. They are contractually obligated to protect your data and may not use it for any other purpose.
• Legal Compliance: We may disclose your information if required by law, regulation, legal process, or to protect our rights, property, or the safety of users and others.

We may transfer personal information to our affiliates and sub-contractors that help us provide our Service(s). Transfers to subsequent third parties are covered by the service agreements with our data processors. Our key sub-processors include:

• Cloud hosting: Amazon Web Services (AWS)
• Payment gateways: Razorpay (India), PayPal (Global)
• Email and communications: industry-standard email and messaging providers
• Analytics: Google Analytics and other approved analytics providers
• Advertising: Google Ads, Meta Ads, and LinkedIn Ads (for marketing campaigns)

We may also disclose your personal information — including, without limitation, your name and email address — to academic institutions and certification bodies for their and our business and educational purposes, where you have enrolled in a co-branded or accredited program.

No mobile information will be shared with third parties for marketing or promotional purposes. All the above categories exclude text-messaging originator opt-in data and consent; this information will not be shared with any third parties.

We reserve the right to disclose your personal data as required by applicable law, in response to lawful requests by public authorities (including to meet national security or law enforcement requirements), and when we believe that disclosure is necessary to protect our rights and/or to comply with a judicial proceeding, court order, or other legal process served on us.

In the event we go through a business transition, such as a merger or acquisition by another company, or sale of all or a portion of our assets, your user account and personal data will likely be among the assets transferred. We may also disclose your personal information to any other third party with your prior consent.

We also obtain data from third parties. We protect data obtained from third parties according to the practices described in this Policy, plus any additional restrictions imposed by the source of the data. These third-party sources vary over time, but may include:

• Data brokers from whom we purchase demographic data to supplement the data we collect.
• Social networks when you grant permission to make your data public on these networks, including permission to access your data on one or more of these networks.
• An enterprise customer where you are an employee using our Services.
• Existing or past learners who participate in our referral program.
• Service providers that help us determine a location based on your IP address in order to customize certain products to your location.
• Partners with which we offer co-branded services or engage in joint marketing activities.
• Publicly available sources such as open government databases or other data in the public domain.

We may receive personal information about you from other sources, like postal mail, telephone, or fax. We may add this information to the information we have already collected from you via the Site in order to improve the products and services we provide.

You have certain rights in relation to your personal information. You can request access to your personal information, confirm that it remains correct and up-to-date, and request that we delete your personal information. Please also note that certain personal information may be exempt from such requests in certain circumstances, including if we need to retain your personal information to comply with any legal and regulatory purposes or obligations under applicable laws.

Right to Access

We acknowledge that you have the right to access your personal information at any time. Upon such request, we will provide you with reasonable access to the personal information we collect about you. There may, however, be limits to the amount of information we can practically provide you. For example, we may limit access where the burden or expense of providing access would be disproportionate to the risks to the individual's privacy, or where doing so would violate others' rights under applicable laws.

Right to Correction

We acknowledge that you have the right to edit, correct, amend, or update any inaccurate or incomplete personal information, along with supporting documentation. We provide access to edit, correct, amend, or update your personal information at any time by logging into your account. Even after your edit, correction, amendment, or update, we may maintain and store older versions of such personal information within our databases, access logs, and other records in order to comply with routine data audits and for legitimate business or any other legal or regulatory purposes or obligations under applicable laws.

Right to Deletion

We acknowledge that you have the right to delete your personal information, unless we are required to retain that personal information for legitimate business or legal purposes or obligations. We aim to maintain our services in a manner that protects personal information from accidental or malicious destruction. Because of this, after you delete your personal information from our services, we may not immediately delete residual copies of information from our active servers or backup systems, which may or may not contain your personal information.

Even after your account is deleted or terminated, we retain your personal information or any data in relation thereof, for as long as we have any legitimate purpose in accordance with applicable laws, including to assist with legal and regulatory purposes and obligations, resolve disputes, and enforce our agreements. We may retain and disclose such personal information or any data in relation thereof pursuant to this Privacy Policy and in accordance with applicable laws.

Withdrawal of Consent

Where the processing of your personal information is based on your consent, you have the right to withdraw your consent granted for processing of your personal information by issuing a written request to the Grievance Officer (contact details provided at the end of this Policy).

You will have the opportunity to edit, correct, amend, update, or delete your personal information or withdraw your consent as follows:

• If you have independently signed up for our Services, you may access, update, or export your personal information included in your online account at any time by logging into your account and going to your profile, or by reaching out to us.
• If you are using an enterprise-provided account (an Authorized Training Partner or your Employer), please review the section “Notice to End Users.”

Users in India

If you are an Indian resident, you have rights under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. If you have a complaint regarding the collection, use, disclosure, or protection of your personal data, you may first contact our Grievance Officer (details at the end of this Policy). If your complaint is not resolved to your satisfaction, you may approach the Data Protection Board of India, once constituted.

Users in the United States — California Residents (CCPA / CPRA)

If you are a California resident, you have specific rights under the CCPA and CPRA, including the right to know, the right to delete, the right to opt-out of the sale or sharing of personal information, the right to correct, and the right to limit the use and disclosure of sensitive personal information. Hanux Learning does not sell your personal information.

If you believe a business has violated the CCPA, you may file a consumer complaint with the California Office of the Attorney General. If you choose to file a complaint, explain exactly how the business violated the CCPA and describe when and how the violation occurred. Only the Attorney General can file an action against businesses; using consumer complaints and other information, the Attorney General may identify patterns of misconduct that may lead to investigations and actions on behalf of the collective legal interests of the people of California. Please note that the Attorney General does not represent individual California consumers and hence cannot represent you or give you legal advice on how to resolve your individual complaint.

Users in Canada (PIPEDA)

If you are a Canadian resident, you have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. You have the right to access your personal information, request corrections, and lodge a complaint. If your concern is not resolved to your satisfaction by our Grievance Officer, you may file a complaint with the Office of the Privacy Commissioner of Canada (OPC).

Users in the European Economic Area (EEA) and United Kingdom (UK)

If you are located in the EEA or UK, you have the right to request access to your data in a portable format and to request the rectification, erasure, restriction of processing, or objection to processing of your personal data. You may contact us via the means stated at the end of this Privacy Policy to submit your request. Additionally, if you are located in the EEA, UK, or Switzerland, you also have the right to lodge a complaint with the relevant Supervisory Authority in your jurisdiction if you have concerns about our collection and use of your personal information that we cannot resolve to your satisfaction.

Personal data is also processed outside of the UK, Switzerland, and the EEA by us or our service providers, including to process transactions, facilitate payments, and provide support services, as described in the “How We Use Your Information” and “How We Share Your Information” sections. We use Standard Contractual Clauses adopted by the European Commission to facilitate transfers of personal data from the EEA to third countries and have entered into data processing agreements with our service providers or third parties to restrict and regulate their processing of your data. By submitting your data or using our Services, you consent to this transfer, storage, and processing by us and our sub-processors.

Users Outside the United States

In order to provide the Services to you, we may transfer your data to the United States and India and process it there. If you are using the Services from outside the United States or India, you consent to the transfer, storage, and processing of your data in and to the United States, India, or other countries in which we operate.

Hanux Learning and our third-party partners (including our advertising and analytics partners) use cookies and other tracking technologies (e.g., web beacons, device identifiers, and pixels) to provide functionality and to recognize you across different Services and devices.

The types of cookies we use include:

• Essential Cookies: These cookies are essential for the basic functionalities offered by the Site and Service(s). They help keep a user logged in to the Service(s) and remember relevant information when they return to the Service(s).
• Insight (Analytics) Cookies: These are used for tracking user activities within the Service(s), which in turn helps us improve your user experience.
• Marketing Cookies: These are used to provide you with customized and interest-based ads based on your browsing behavior and other similar activities on our Websites.

You can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies. You do this through your browser settings. Since each browser is different, look at your browser's Help Menu to learn the correct way to modify your cookies.

If you turn cookies off, some of the features that make your site experience more efficient may not function properly.

We partner with third parties — including Google Ads, Meta (Facebook/Instagram) Ads, and LinkedIn Ads — to manage our advertising on other sites. Our third-party partners may use technologies such as cookies and pixels to gather information about your activities on our Website and other sites in order to provide you advertising based upon your browsing activities and interests. If you wish to not have this information used for the purpose of serving you interest-based ads, you may opt out via the relevant advertising preference settings of each platform (e.g., Google Ad Settings, Meta Ad Preferences, LinkedIn Ad Settings). Please note that this does not opt you out of being served ads; you will continue to receive generic ads.

We use third-party software for analytics. All metrics information collected from your usage of the Service(s) shall be transmitted to our analytics provider. This information is then used to evaluate how users use our Website and to compile statistical reports on user activity for us. We may further use the same statistical analytics tool to track or collect your Personally Identifiable Information (PII). We will use this information in order to maintain, enhance, or add to the functionality of the Service(s) and to personalize the experience for you. Aggregated information and analysis may be made public where desired by us.

We and our third-party advertising partners use technologies such as web beacons in analyzing trends, administering the Website, tracking users' movements around the Site, and gathering demographic information about our user base as a whole. We may receive reports based on the use of these technologies by these companies on an individual and aggregated basis.

Currently, various browsers — including Chrome, Edge, Firefox, and Safari — offer a “Do Not Track” or “DNT” option that relies on a technology known as a DNT header, which sends a signal to websites visited by the user about the user's browser DNT preference setting. We do not currently commit to responding to browsers' DNT signals with respect to Hanux Learning's websites, in part because no common industry standard for DNT has been adopted by industry groups, technology companies, or regulators, including no consistent standard of interpreting user intent. We take privacy and meaningful choice seriously and will make efforts to continue to monitor developments around DNT browser technology and the implementation of a standard.

Our Websites contain links to other websites that are not owned or controlled by us. Please be aware that we are not responsible for the privacy practices of such other websites or third parties. We encourage you to be aware when you leave our Websites and to read the privacy policies of each and every website that collects personal information.

We may provide bulletin boards, blogs, or community threads on the Hanux Learning Websites. Any personal information you choose to submit in such a forum may be read, collected, or used by others who visit these forums and may be used to send you unsolicited messages. We are not responsible for the personal information you choose to submit in these forums.

Remember that when you share information publicly, it may be indexable by search engines.

Our Websites may include social media features, such as the Facebook “Like” button, the “Share This” button, or interactive mini-programs. Where we have your consent, these features may collect your IP address, the page you are visiting on our Websites, and may set a cookie to enable the feature to function properly. Social media features and widgets are either hosted by a third party or hosted directly on our Websites. Your interactions with these features are governed by the privacy policy of the company providing them.

You may be able to log in to our Websites using sign-in services such as Google, LinkedIn, or other approved providers. These services will authenticate your identity and provide you with the option to share certain personal information with us, such as your name and email address.

Hanux Learning takes account security seriously. We implement industry-standard authentication controls designed to protect access to your account and your personal information.

Authentication Measures

• Password Standards: All passwords must meet minimum complexity standards (length, mixed case, numbers, symbols). Passwords are stored using strong one-way hashing algorithms (e.g., bcrypt/Argon2) and are never stored or transmitted in plain text.
• Multi-Factor Authentication (MFA): Where supported, you may enable multi-factor authentication on your account for an additional layer of security.
• Single Sign-On (SSO): We support secure SSO via approved identity providers (e.g., Google, LinkedIn). Authentication tokens issued via SSO are validated and protected against tampering and replay.
• Session Management: Sessions are time-limited and automatically expire after a defined period of inactivity. You may log out manually at any time.
• Account Recovery: Password resets are performed via secure links sent to your verified email address. Reset links expire after a short period.
• Brute-Force Protection: Login attempts are monitored, and abusive patterns trigger rate limiting, CAPTCHA challenges, or temporary account lockouts.
• Suspicious Activity Alerts: We may notify you of login attempts from new devices or unusual locations.

Your Responsibilities

You are responsible for:

• Maintaining the confidentiality of your account credentials.
• Not sharing your account credentials with any third party.
• Promptly notifying us at security@hanux.org of any unauthorized access or suspected breach of your account.
• Logging out from shared or public devices.

By providing your phone number and opting in, you consent to receive text messages (SMS/MMS) from Hanux Learning regarding your inquiries, course enrollments, payment confirmations, class reminders, account-related notices, customer support, promotional offers, and other Service-related updates.

• Message Frequency: Message frequency varies based on your interaction with our Services. Message and data rates may apply, depending on your mobile carrier and plan.
• Opt-Out: You can opt out at any time by replying “STOP” to any text message you receive from us. After you send “STOP,” you will receive a one-time confirmation message and will not receive further SMS communications. Opting out may limit our ability to communicate with you regarding services, transactions, or support.
• Help: For help, reply “HELP” to any text message you receive from us, or contact us at support@hanux.org.
• No Sharing of SMS Consent: Your mobile phone number and SMS/text-messaging opt-in consent will not be shared with any third party or affiliate for marketing or promotional purposes. This information is excluded from any data-sharing categories described elsewhere in this Policy.
• Supported Carriers: Carriers are not liable for delayed or undelivered messages. SMS is available on most major US, Canadian, and Indian mobile carriers.

We may use your email address, phone number, or messaging identifiers to send our newsletters, course recommendations, and marketing communications. If you no longer wish to receive these communications, you can opt out by following the instructions contained in the emails you receive or by contacting us at unsubscribe@hanux.org.

We will send you announcements related to the Service(s) on occasions when it is necessary to do so. For instance, if our Service is temporarily suspended for maintenance, we might send you an email. Generally, you may not opt out of communications that are not promotional in nature (such as transactional, security, or service-related notices). If you do not wish to receive them, you may delete your Account.

Our Websites and Service(s) have industry-standard security measures in place to protect against the loss, misuse, and alteration of the information under our control. When you provide us with sensitive information (such as login credentials), we encrypt that information via Transport Layer Security (TLS / SSL).

Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our Websites or via the Service(s), and any transmission is at your own risk. Once we receive your personal information, we will use strict procedures and security features to try to prevent unauthorized access.

We adopt appropriate data collection, storage, and processing practices and security measures to protect against unauthorized access, alteration, disclosure, or destruction of your personal information, username, password, transaction information, and data stored on our Site.

Our infrastructure is scanned on a regular basis for security holes and known vulnerabilities in order to make your visit to our Site as safe as possible. We use regular malware scanning and security monitoring tools.

Your personal information is stored on secured networks and is only accessible by a limited number of persons who have special access rights to such systems and are required to keep the information confidential. In addition, all sensitive information you supply is encrypted in transit via TLS/SSL and at rest where applicable.

All payment transactions are processed through secure third-party gateway providers (Razorpay and PayPal) and are not stored or processed on our servers.

We may post customer testimonials, comments, or reviews on our Websites, which may contain personal information. Prior to posting a testimonial, we obtain the customer's consent to post their name (and, where applicable, photo, role, or company) along with their testimonial. If you want your testimonial removed, please contact us at dpo@hanux.org.

Hanux Learning operates a referral program that allows existing learners to refer friends, family, or colleagues to our Services. When you participate in our referral program and share contact information of a referred individual, you confirm that you have obtained the referred individual's consent to share their information with us. We will use the referred individual's information solely to extend the referral invitation and, if they enroll, to deliver the Service(s) and applicable referral rewards. Referred individuals may opt out at any time by contacting unsubscribe@hanux.org.

Hanux Learning Services are intended for individuals who are 18 years of age or older. We do not knowingly collect personal information from children under the age of 18. If you are under the age of 18, please do not submit any personal information through our Websites or Service(s).

We encourage parents and legal guardians to monitor their children's internet usage and to help enforce this Policy by instructing their children never to provide personal information through our Service(s) or Websites without parental consent. If you have reason to believe that a child under the age of 18 has provided personal information to us through our Websites or Service(s), please contact us at dpo@hanux.org and we will endeavor to delete that information and terminate the child's account from our databases.

We have the discretion to update this Privacy Policy at any time. When we do, we will post a notification on the main page of our Site, revise the “Last Updated” date at the top of this page, and, where appropriate, send you an email. We encourage Users to frequently check this page for any changes to stay informed about how we are helping to protect the personal information we collect. You acknowledge and agree that it is your responsibility to review this Privacy Policy periodically and become aware of modifications. Your continued use of these Websites or the Service(s) following the posting of any amendment, modification, or change to this Policy shall constitute your acceptance of the amendments to this Policy. You can choose to discontinue use of the Websites or Service(s) if you do not accept the terms of this Policy or any modified version of this Policy.

If you have a complaint or question regarding data privacy, you may contact our Grievance Officer / Data Privacy Officer at the details provided below, who is responsible for redressing your grievances:

Grievance Officer / Data Privacy Officer

Name:

Mr. Rakesh Kumar

Designation:

Data Privacy Officer & Grievance Officer

Email:

dpo@hanux.org

Alternate Email:

grievance@hanux.org

India Phone:

8482-911-630

India Phone (Alt):

+91-80767-26385

US Phone:

+1 (605) 846 9060

Postal Addresses

Registered Agent: Northwest Registered Agent Service Inc., 30 N Gould St Ste N, Sheridan, WY 82801