PRIVACY POLICY

Who we are
1. Skiller Whale Limited ('Skiller Whale', 'our', 'us' or 'we') is a company registered in England and Wales (company number 11583344) at 75 Shelton Street, Covent Garden, London, and ICO registration number ZA765372.
2. For the purposes of the UK Data Protection Act 2018 and the General Data Protection Regulation (EU) 2016/679 as it forms part of domestic law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018 ('UK GDPR') Skiller Whale is the controller and can be contacted as follows:
  - By post at: 71-75 Shelton Street, London, WC2H 9JQ, United Kingdom
  - By email at: hi@skillerwhale.com
Scope
1. We operate https://skillerwhale.com/ and its subdomains (the 'Websites'). We offer targeted capability training sessions to software development and tech teams (the 'Services'). The delivery, management, improvement and promotion of our Services and Websites requires the processing of certain personal data about our suppliers' and customers' employees, contractors and any other representatives ('you', 'your').
2. This policy applies to our processing of such personal data. Please read it carefully to understand the types of personal data we collect, how we use such personal data, the circumstances under which we will share it with third parties, and your rights in relation to personal data about you.
Personal data we process
1. Personal data we need to deliver, manage and improve our Services - justified on the basis of our legitimate business interests
  1. You will be asked to provide us with some basic information so that we can set you up with an account and so that we can manage this account. We will ask you to provide some contact information so that we can reach out to you when that is necessary in relation to our Services, for example when scheduling training sessions and assessments and when formulating training plans. We will also use the same information to respond to any queries you may have in relation to our Services. We continuously improve our Services on the basis of any relevant information or feedback that you decide to share with us. Often some of the aforementioned information will be provided to us by your manager or employer.
  2. The information we need to deliver, manage and improve our Services typically includes a user name and a password, your name, corporate email address, phone number, your assessment-related information, your attendance record, information about your availability for training, files and materials you work on, training session (audio and video) live streams featuring you, and any feedback about our Services that you decide to provide or questions you decide to ask. Where a training session involves sharing or cloning code from GitHub we may receive your GitHub username.
2. Personal data contained in recordings of training sessions – justified on the basis of our legitimate business interests or on the basis of your consent
  
  We may want to record some of our training sessions for a number of reasons (such as quality assurance and training). Training session recordings are kept for no longer than six months, unless anonymised.
  1. Having access to recordings is important for us to be able to monitor the quality of training delivered by any trainers we engage to deliver the Services. This is part of our legitimate interests.
  2. Recordings help us monitor and evidence your compliance with our Terms of Service which is also part of our legitimate interests.
  3. We can train staff on the basis of recordings which helps us learn from our mistakes and improve our Services which is also part of our legitimate interests.
  4. Using recordings for any other purposes, including advertisement, will be conditional on your consent.
3. Personal data we need to promote and advertise our Services - justified on the basis our legitimate business interests
  1. We may use your publicly available name and contact details to promote and advertise our Services. For example, we may approach you or your employer online, on social media or via email. We may approach you or your employer offline, for example during an event or a conference, whether organised by us or anyone else.
  2. Your name and contact details may be provided to us by other third parties, such as job boards like RecWorks, membership organisations like CTO Craft or existing customers by way of a referral, when you have asked such parties to make such disclosures.
  3. We will contact you if you fill in any of the web forms on https://skillerwhale.com/ or if you request us to contact you via the live chat feature available on our Websites. When we do that we will use all the information you have decided to provide in the relevant form or chat.
  4. We will send you our blog updates if you follow us on Medium.com. We will use your Medium user profile to do that.
  5. We sometimes instruct third parties, such as DurhamLane, to do lead generation on our behalf in which case your name and contact details will be supplied to us by such third parties for us to inquire whether you are interested in our Services. In such instances the third party is responsible for obtaining personal data about you lawfully.
  6. We sometimes run advertising campaigns on search engines and social media like Google, LinkedIn and Facebook. In such instances the lawfulness of the underlying personal data processing is a responsibility of such third parties.
4. Personal data about others that you give to us - justified on the basis of our legitimate business interests
  
  In order to use some of our Services, you may need to provide us with information about others, such as other representatives of your company. Where that is the case, we will rely on you to inform the concerned individuals that their data is being transferred over to us.
5. Personal data we need to receive third party services - justified on the basis of our legitimate business interests
  
  If the organisation you represent is our supplier (as opposed to customer) we will ask you to provide us with some basic information so that we can receive and pay for the services your organisation provides. Such information typically includes your name, corporate email address and phone number.
6. Personal data generated when you browse our Websites - justified on the basis of your consent
  
  When you visit our Websites certain technical information about the device you use to access our Websites that may identify you will be generated by 'cookies', web-beacons and other similar tracking technologies. Please see the 'cookies' section below for the technical details about this type of data processing. Please use the 'cookies' banner on our Websites to exercise your choice regarding accepting or rejecting cookies.

Disclosures of personal data

We will treat your information as confidential information and so shall our suppliers do. We use various technological solutions providers and external training providers in order to deliver, manage, improve, promote and advertise our Services. Our suppliers are prohibited from using personal data for any purpose other than the delivery of their services to us. Nevertheless, depending on their type, our suppliers may have limited access to your information. These suppliers include our external trainers, cloud storage providers, video conferencing providers, customer relationship management systems providers, email services providers, social media companies, analytics providers and others who assist us in, delivering, managing, improving and promoting our Services and our Websites.

In addition, we may also disclose your personal information to third parties in the following circumstances:

Purpose of disclosure	Justification
If we buy any business or assets, we may disclose your personal information to the prospective seller of such business or assets.	Legitimate interests (to enable the acquired business to offer services to our customers).
If Skiller Whale or substantially all of its assets are acquired by a third party, personal information about you will be one of the transferred assets.	Legitimate interests (to allow the prospective buyers to provide you the Services).
If we need to protect the rights, property, or safety of Skiller Whale, our customers, or others, we may disclose your personal information to third parties, such as professional advisors and official authorities.	Legitimate interests (to enforce our rights).
We may disclose your personal information to third parties, the court service and/or regulators or law enforcement agencies in connection with proceedings or investigations anywhere in the world where compelled to do so. Where permitted, we will direct any such request to you or notify you before responding unless to do so would prejudice the prevention or detection of a crime.	Legal obligation.

Exports outside the EEA or the UK
1. Your personal information will be stored electronically on computer systems located in the United Kingdom ('UK') and Ireland and managed by our suppliers. In certain limited circumstances your personal information may be accessed by staff, stored with or transferred by our suppliers in, a destination outside the UK or the European Economic Area ('EEA') in which data protection laws may be of a lower standard than in the UK or the EEA.
2. Regardless of location, we will impose data protection safeguards similar to those that we deploy inside the UK and the EEA. Where required by applicable law, we will transfer your personal information subject to European Commission and UK Information Commissioner's Office approved contractual terms that impose equivalent data protection obligations directly on the recipient. Please contact us if you would like further details of the specific safeguards applied to the export of your personal data.
How long we retain personal data about you
1. We will hold personal data about you for as long as is necessary in order to conduct the processing detailed above, deal with any specific issues that may raise, or otherwise as is required by law or any relevant regulatory body. Please note some personal data may need to be retained for up to six years to ensure Skiller Whale can comply with applicable laws and internal compliance procedures.
2. We restrict access to your personal information to those persons who need to use it for the relevant purpose(s). Our retention periods are based on business needs and your information that is no longer needed is either irreversibly anonymised (and the anonymised information may be retained indefinitely) or securely destroyed.
3. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the personal risk or harm from unauthorised use or disclosure, the purpose for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Your rights

Under the UK GDPR, you have various rights in relation to personal data about you that we process. All of these rights can be exercised by contacting us at the email address specified above.

You have the right to:


Be informed (of the processing).	Access (such information).	Rectification (of inaccurate information).
Erasure (of such information).	Restrict processing (in certain cases).	Object to profiling.
Data portability (in certain cases).	Complain to the Information Commissioner's Office.	Withdraw consent (if we have collected your personal information on this basis).

Detailed information on the full content of your rights (and any conditions that may apply) is provided by the UK Information Commissioner's Office and is available on their website: https://ico.org.uk/your-data-matters/.
Asking us to stop processing your personal data or deleting your personal data will likely mean that you and/or the organisation you represent will no longer be able to use our Services, or at least those aspects of the Services which require the processing of the types of personal data you have asked us to delete.
While we will not sell personal data about you (or any other data you provide us with) to third-parties, we reserve the right to share any data which has been anonymised. You acknowledge and accept that we own all right, title and interest in and to any derived data or aggregated and/or anonymised data collected or created by us.

'Cookies' on our Websites

Our Websites use 'cookies'. Some of these are essential or functional, while others help us to improve your experience by providing insights into how the sites are being used. We may also use 'cookies' for advertising. Some 'cookies' and similar technologies, particularly those that track browsing behaviour across the web are perceived by data protection regulators as privacy-intrusive. We are, therefore, presenting the below information to our Websites' visitors in order to explain why and how we use this technology. 'Cookies' work with the help of certain online identifiers and typically involve the processing of the following information that is considered personal data:
1. Internet Protocol (IP) addresses;
2. device or mobile IDs and/or device model and type;
3. browser information, operating system information, and/or language preferences;
4. the location and the preceding and succeeding websites you have visited, including which pages/part/icons on the Websites you interacted with;
5. applications you click on and how often; and
6. the pages of our Websites you visit, and how long you spend on each page.
Lawful grounds for processing

For the purposes of data protection law, we use the following justifications to process your online identifiers derived from 'cookies':
1. we use 'cookies' for the correct, efficient and viable delivery of online content. The processing is necessary for our legitimate interest (that are to ensure the availability of our Websites);
2. we use 'cookies' for the analysis and optimisation of our Websites' performance and engagement. The processing is necessary for the purpose of improving our services and is subject to your permission (consent); and
3. we use 'cookies' for the delivery (including via third parties) of targeted advertising tailored to your interests. The processing is necessary for the purpose of promoting our services and is subject to your permission (consent).

Details of the processing

The following 'cookies' are automatically downloaded on any device used to access our Websites.

'Cookie'	Party serving it	Purpose	Lifetime on device	Privacy policy
__hs_initial_opt_in, __hs_opt_out	HubSpot	Tracking your preferences for cookies and tracking from HubSpot, on our public marketing site	13 months (7 days for __hs_initial_opt_in)	https://legal.hubspot.com/privacy-policy
__hssc, __hssrc, __hstc, hubspotutk,	HubSpot	Tracking your activity on our public marketing site	13 months (30 minutes for __hssc)	https://legal.hubspot.com/privacy-policy
messagesUtk	HubSpot	Live chat on our public marketing site	13 months	https://legal.hubspot.com/privacy-policy
_ga, _gid, _gat_gtag_UA_157034171_1	Google Analytics	Tracking your activity on our public marketing site	_ga for 2 years, _gid for 24 hours, _gat_gtag_UA_157034171_1 for 1 minute	https://support.google.com/analytics/answer/6004245#zippy=%2Cour-privacy-policy
__stripe_mid, __stripe_orig_props, __stripe_sid, cookie-perms, lang, locale, machine_identifier, private_machine_identifier, recent-views, scfc, session, site-auth, stripe.csrf	Stripe	For entering payment details on our account management site	Up to 180 days	https://stripe.com/gb/privacy
AWSALB, AWSALBCORS	Skiller Whale	For making websockets work on our site; these cookies ensure your connection will terminate with a consistent backend instance.	7 days	This Privacy Policy
_account_session, _assessor_session, _skiller_whale_session, rack.session, session	Skiller Whale	For keeping you logged in to Skiller Whale services	The duration of a browser session	This Privacy Policy
login_idle_session_timeout, login_service_login_newrelic_com_tokens, TSNGUID, nr_zd_logged_in, JSESSIONID	New Relic	For monitoring performance and errors in your browser when you’re using Skiller Whale.	Up to 180 days	https://newrelic.com/termsandconditions/privacy
analytics_session, guid	Vonage	For using, and monitoring performance, of the video conferencing built into our Training site.	Up to 60 days.	https://www.vonage.com/legal/privacy-policy/

Exercising control
1. Please exercise your choice with respect to accepting or rejecting 'cookies' via the pop-up on our Websites.
2. In addition to the controls provided on our Websites via the pop-up, you can choose to block 'cookies' by activating the settings on your browser that allow you to refuse the setting of all or some 'cookies'. However, if you use your browser settings to block all 'cookies' (including essential 'cookies') you may not be able to access parts of our Websites. Your browser settings also allow you to delete all 'cookies' stored on your device whenever you wish.
Additional information

The UK Information Commissioner's Office provides the following guidance on controlling 'cookies':
1. a number of websites provide detailed information on 'cookies', including AboutCookies.org and AllAboutCookies.org;
2. the European Interactive Digital Advertising Alliance website Your Online Choices allows you to install opt-out 'cookies' across different advertising networks;
3. Google has developed a browser add-on to allow users to opt-out of Google Analytics across all websites which use it;
4. some browsers include a feature known as 'Do Not Track' or DNT. This allows you to indicate a preference that websites should not track you. However, whilst DNT is available in many browsers, websites are not required to recognise its request, so it may not always work. You can get help on how to use DNT in Microsoft Edge, Mozilla Firefox, Google Chrome and Opera; and
5. for more information on how private browsing works as well as its limitations, visit the support pages for your browser: Microsoft Edge, Microsoft Internet Explorer, Mozilla Firefox, Google Chrome and Safari (IOS (mobile) and desktop).
Additional steps you can take to protect your privacy online

If you are concerned about online tracking then we can recommend you to:
1. set your browser settings to delete all 'cookies' every time you close your browser;
2. consider adopting Global Privacy Control;
3. install a privacy-friendly browser on your device, such as Mozilla Firefox, Safari, or Brave;
4. install anti-tracking and ad-blocking plug-ins on that browser, such as Ad Block Plus, Ghostery or PrivacyBadger; and
5. use privacy-friendly web search engines, such as Ecosia or DuckDuckGo.

Changes to this policy

Any changes we make to our privacy policy in the future will be posted on this page. We therefore encourage you to review it from time to time to stay informed of how we are processing your information.
Date of last amendment

05 July 2021