SecuraMentis Corp – Privacy Policy

Last updated: October 27th 2025

1. Controller and Contact Information

SecuraMentis Corp (“SecuraMentis”, “we”, “us”) is responsible for the processing of your personal data.
Registered Office: c/o Intershore Chambers, Road Town, Tortola, VG1110 – British Virgin Islands
Email: privacy@securamentis.com
For data subjects in the EU/EEA or Switzerland, SecuraMentis ensures data protection in line with the GDPR and Swiss FADP by applying equivalent safeguards.

EU/EEA Representative (Art. 27 GDPR).
As SecuraMentis is established outside the EU/EEA, we appoint an EU/EEA representative under Art. 27 GDPR. Our EU/EEA Representative is authorised in writing to act on our behalf regarding GDPR compliance and to serve as a contact for supervisory authorities and data subjects.
WPS Frederic Grossmann 20459, Lonzaring 11, 79761 Waldshut-Tiengen,
Email: privacy@securamentis.com

Data Protection Officer (DPO).
A formal DPO is not required under Art. 37 GDPR at this time, as SecuraMentis does not carry out large-scale monitoring or process special categories of data.

2. Legal Bases for Processing

We process personal data only when permitted under Article 6 GDPR:

·         Art. 6(1)(b) Contract performance (WBT access, login, support)

·         Art. 6(1)(a) Consent (newsletter subscription via MailerLite pop-up)

·         Art. 6(1)(f) Legitimate interest (website security, fraud prevention)

3. Data Protection Principles

Processing is lawful, fair, and transparent; limited to the stated purpose; data minimization and accuracy are ensured; retention occurs only as long as necessary.

4.Categories, Purposes, Legal Bases

Personal Data We Process (summary):

           I.            Website/server logs (IP, timestamp, URL, UA)

·         — Purpose: security, delivery

·          — Legal basis: Art. 6(1)(f)

·         — Retention: ≤ 30 days (Framer).

         II.            Checkout/billing data (name, email, billing address, payment token, VAT info) inactive in pre-launch

·         — Purpose: contract & tax

·         — Legal basis: Art. 6(1)(b)/(c)

·         — Retention: per tax law (typically 10 years).

·         — Controller: No active checkout during pre-launch.

       III.            Account data (LearnWorlds) (email, password hash, enrolments/progress)

·         — Purpose: authentication, account and course access

·         — Legal basis: Art. 6(1)(b)

·         — Retention: account life + statutory.

       IV.            Learning data (LearnWorlds, SCORM Cloud) (course enrolments, timestamps, completion/progress,member-access area and password)

·         — Purpose: deliver WBT, certification, member-access area

·         — Legal basis: Art. 6(1)(b)/(f)

·         — Retention: product life or as contractually agreed; minimisation applied.

         V.            Support/contact (Pipedrive) (name, email, tags, campaign activity)

·         — Purpose: lead and customer management

·         — Legal basis: Art. 6(1)(b) /(f)

·         — Retention: 6 Monate.

       VI.            Newsletter MailerLite (email, DOI metadata) We may use webhooks to update subscription status and segments in our CRM.

·         — Purpose: marketing

·         — Legal basis: Art. 6(1)(a)

·         — Retention: until withdrawal or 24 months after last activity (whichever comes first).

    VII.            CMP – CookieYes, consent management tool (cookie banner) to collect and store your choices regarding non-essential cookies and similar technologies.

·         Purpose: consent capture and proof (timestamp, preference string, country, browser data, IP truncated where available).

·         Legal basis: Art. 6(1)(c) (compliance) and Art. 6(1)(f) (accountability).

·         Retention: consent logs are retained for audit purposes in line with statutory limitation periods.

5. Rights of Data Subjects (Art. 12–21 GDPR)

You have the right to:

·         access and obtain a copy of your data (Art. 15)

·         rectification (Art. 16) and erasure (Art. 17)

·         restriction of processing (Art. 18)

·         data portability (Art. 20)

·         object to processing based on Art. 6 (1)(f) (Art. 21)

·         withdraw consent at any time without affecting prior lawfulness

Please send requests to privacy@securamentis.com.
You may also file a complaint with your local supervisory authority.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement (Art. 77 GDPR).

6. Data Collected When Visiting Our Website

When you visit our website without otherwise submitting information, Framer (our hosting provider) automatically collects data technically necessary to display the site and ensure stability and security (Art. 6 (1)(f) GDPR):

·         IP address

·         date and time of request and time zone

·         content of request (URL)

·         HTTP status code and transferred data volume

·         referring website

·         browser type and version

·         operating system and interface language

·         log data are stored on Framer servers located in the EU (Netherlands)

These server log files are stored temporarily and automatically deleted after no later than 30 days. We do not combine this information with other data sources nor use it for profiling.

7. Cookies

Our website uses only technically necessary cookies (set by Framer) for basic functions such as session management. We only set essential cookies required for site operation and consent storage. Non-essential cookies are off by default and require your prior consent via our cookie banner. No analytics/marketing cookies are currently used. If analytics tools are introduced later, this Policy will be updated and a cookie banner implemented for EU/EEA visitors.

8. Contact Form and Email Communication

When you contact us via form or email, we collect your name, email address and message content to process your inquiry (Art. 6(1)(b) GDPR). Data are deleted after six months unless required for contractual or legal purposes.

9. Newsletter via MailerLite

If you subscribe to our newsletter, we collect your email address and name to send information about our services. We use MailerLite. Processing occurs based on your consent (Art. 6(1)(a)) using a Double-Opt-In procedure. You can withdraw consent at any time via unsubscribe link or email to privacy@securamentis.com. MailerLite stores consent data and uses SCCs.

10. Login Area and User Accounts via LearnWorlds

When you register or log in, LearnWorlds processes your credentials (email and password) for authentication (Art. 6(1)(b)). Data are retained for the duration of the user account and deleted upon termination unless statutory retention applies.

11. Payment Processing

No active online checkout at launch. If a Merchant of Record (e.g., PayPro Global or Paddle) is appointed later, payment/billing data will then be processed under the MoR’s privacy policy; this Policy will be updated accordingly.
For B2B invoices or consulting services, payments will be processed through invoice process in bank transfer; data processing follows the same security and SCC standards.

12. Automation and Data Transfer via Zapier

We use Zapier Inc. (US) and Make to automate workflows (e.g., transferring contact form data to Pipedrive and / or LearnWorlds. Zapier and make acts as data processor under SCCs and stores data only temporarily for transmission (Art. 6 (1)(b) GDPR).

13. Third-Party Processors and Integrations

We share data with the following processors:

·         Framer B.V. (NL) – Website hosting and infrastructure

·         Merchant of Records (MoR) – inactive at this phase of pre-launch

·         LearnWorlds – Online-course platform (User Authentication and Member-area)

o    Training Center (LearnWorlds). Access to our courses is provided via a separate domain operated by LearnWorlds. For account creation, authentication and enrolments, LearnWorlds acts as our processor (Art. 28 GDPR). For its own site operation and analytics/cookies, LearnWorlds may act as an independent controller. When you follow the link from our site to the Training Center, LearnWorlds’ own privacy policy also applies in addition to this Policy.

·         Pipedrive – CRM

·         MailerLite – Newsletter

·         Rustici Software LLC (US) – SCORM Cloud Learning Platform as backup

·         Zapier, Make– Process automation

·         LinkedIn Corp. (US/EU) – LinkedIn buttons on our website are simple hyperlinks; no data are transmitted before you click the link.

·         Microsoft – Office, Booking of appointments and Email

·         CookieYes - consent capture and proof (timestamp, preference string, country, browser data, IP truncated where available).

·         Links to third-party platforms: (e.g., YouTube, LinkedIn). Our website contains icons or links that lead to our presence on third-party platforms. No data is transmitted to these platforms before you click the link. Once you follow the link, the respective provider’s privacy policy applies. We open such links in a new tab and use technical measures

All providers outside the EU/EEA use Standard Contractual Clauses approved by the European Commission.
Links to their privacy notices are provided on their site.

14. International Data Transfers

International data transfers. Where personal data are transferred outside the EU/EEA (e.g., to the United States for SCORM Cloud), SecuraMentis enters into the European Commission’s Standard Contractual Clauses (SCCs) with the relevant recipients and assesses their technical and organisational measures (e.g. encryption, access controls, data minimisation). Where necessary, we implement supplementary measures in line with the EDPB Recommendations to ensure an essentially equivalent level of protection. We minimise the exported data (e.g., SCORM Cloud stores technical progress data only)

15. Data Retention

We retain data only for as long as necessary to fulfil the purpose collected or as required by law. After this period, data are securely deleted or anonymized.

16. Children

Our services are intended for adults (16+). We do not knowingly process children’s data; if you believe we have, contact us for prompt deletion.

17 Security Measures

All data transmissions are SSL/TLS-encrypted. Access to personal data is restricted to authorized staff and protected by multi-factor authentication where possible.

18. Policy Updates

We may update this Privacy Policy to reflect legal or technical changes. The current version is available at www.securamentis.com/en/privacy. We encourage users to review this Policy periodically. If significant changes affect your rights, we will inform you by email or via our website.

Previous versions will be archived for audit purposes.

— End of privacy —