Privacy Policy

At Prepr Foundation (collectively with Prepr Inc. and any affiliated or related entities, “Prepr”, “we”, “us”, or “our”), we are committed to protecting privacy and safeguarding personal information. This Privacy Policy (“Policy”) explains how we collect, use, share, store, and protect personal information when you access or use our websites, platforms, programs, challenges, labs, marketplace services, AI Features, credentials, events, and related services (collectively, the “Platform” and “Services”).

This Policy is designed to address privacy requirements applicable in Canada (including under PIPEDA and Quebec’s Law 25), the United States (including under the California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), and other applicable state privacy laws), the United Kingdom (under the UK GDPR and Data Protection Act 2018), and the European Union and European Economic Area (under the General Data Protection Regulation (EU) 2016/679 (“GDPR”)). Your privacy rights vary depending on where you live, the laws that apply to you, and how you interact with us.

1. What Personal Information Means

“Personal Information” (also referred to as “Personal Data” in some jurisdictions) means information that identifies you or could reasonably be linked to you.

This may include information such as your name, contact details, account information, profile information, program activity, communications, payment information, and device or usage information.

Personal information does not include information that has been anonymized so that it can no longer reasonably identify you.

Prepr is accountable for Personal Information under its control and has designated a Privacy Information Officer responsible for privacy compliance. Prepr maintains policies and practices designed to protect Personal Information, respond to privacy inquiries, manage privacy risks, oversee service providers and data processors, support compliance with Applicable Law, and ensure that Personal Information is used only for the purposes for which it was collected or as otherwise permitted by law.

In this Policy, the following terms have the meanings given to them in our Platform Terms of Use (available at https://Prepr.org/terms), and are summarized here for convenience:

“AI Features” means any artificial intelligence, machine learning, automated, algorithmic, generative, recommendation, scoring, summarization, coaching, analytics, inference, classification, or decision-support functionality made available by or through the Platform, whether branded as LearnBot, a virtual coach, a recommendation engine, an analytics assistant, or otherwise.

“Aggregated Data” means data that has been combined with data from multiple users, organizations, programs, cohorts, or sources and is not intended to identify a particular individual.

“De-identified Data” means data that has been processed so that it does not identify and is not reasonably capable of being associated with an identified or identifiable individual, subject to applicable law.

“Derived Data” means data, metadata, analytics, inferences, measurements, benchmarks, classifications, scores, trends, statistics, outputs, and insights generated, calculated, derived, or inferred from use of the Platform, User Content, Organizational Data, Impact Data, or other Platform activity.

“Impact Data” means information and metrics generated through participation in Prepr programs, labs, challenges, workforce initiatives, learning experiences, assessments, credentials, or other Platform activities, including skills development, participation, engagement, completion, competency, outcomes, workforce readiness, program effectiveness, and impact measurement data.

“Platform” means Prepr websites, including Prepr.org, PreprLabs, web applications, mobile applications, portals, dashboards, APIs, integrations, AI Features, credentials/badges, digital learning environments, lab/challenge environments, skills development tools, workforce readiness programs, event tools, marketplace features, partner deployment environments, and all related online or offline services operated or made available by Prepr in Canada, the United States, the United Kingdom, the European Union, or any other jurisdiction.

“Organization” means an employer, government, educational institution, employment service provider, association, program sponsor, funder, corporate client, partner, or other entity that invites users to the Platform or administers, sponsors, funds, purchases, or participates in Services.

“Organizational Data” means data, records, lists, workforce information, cohort information, employee/participant information, program requirements, business information, and other materials provided by or on behalf of an Organization.

“Applicable Law” means all applicable laws, regulations, rules, orders, directives, regulatory guidance, industry requirements, and legal requirements applicable to Prepr, the Platform, the Services, or your access to or use of them, including privacy, data protection, consumer protection, intellectual property, employment, education, accessibility, and anti-spam laws, and includes, where applicable, PIPEDA, provincial privacy statutes (including Quebec’s Law 25), the GDPR, the UK GDPR, the CCPA, the CPRA, the VCDPA, the CPA, the CTDPA, and other applicable data protection and privacy frameworks.

“User Content” means content, data, information, materials, projects, submissions, communications, feedback, ideas, portfolios, challenge responses, assessments, comments, or other materials uploaded, posted, transmitted, submitted, displayed, or otherwise made available by or on behalf of a user through or in connection with the Platform.

2. Personal Information We Collect

We may collect the following types of personal information:

We collect personal information depending on how you interact with Prepr and which services you use.

Information you provide. This may include your name, contact details, account information, profile information, preferences, registrations, applications, resumes, project work, submissions, survey responses, support requests, feedback, and messages to us.

Information created when you use Prepr. This may include participation records, learning activity, challenge submissions, portfolios, assessments, badges, certificates, ratings, completion information, marketplace activity, project details, deliverables, communications, Impact Data, and related records.

Information about your device and use of our services. This may include your IP address, device identifiers, browser type, operating system, general location inferred from your IP address, pages viewed, links clicked, searches, session information, log data, and similar usage information.

Information from roles or relationships with Prepr. If relevant, this may include resumes, qualifications, references, interview notes, role information, payment or invoicing details, and related administration records for employees, contractors, volunteers, mentors, judges, advisors, applicants, and similar roles.

Sensitive information. We collect sensitive information only where needed and permitted by law, and only with appropriate consent or another lawful basis.

Sensitive information may include demographic information, accessibility needs, financial eligibility, government identifiers, information about minors, or other information considered sensitive under applicable law. You should not submit sensitive information unless requested or authorized.

Information generated by AI Features. When you use AI Features, we may collect information about your inputs, prompts, queries, selections, feedback, corrections, ratings, and interaction patterns with AI-generated outputs. We may also generate inferences, recommendations, scores, classifications, and other AI outputs based on your information and Platform activity. AI Features may include LearnBot, virtual coaching, learning recommendations, skills inference, competency scoring, content generation, analytics assistants, and automated feedback.

3. How We Collect Personal Information

We collect personal information from:

• you directly, such as when you create an account, register for a program, submit work, contact us, complete a survey, apply for an opportunity, or use our services;
• your device or browser when you use our websites, platforms, emails, and online services;
• organizations involved in programs or services, such as employers, clients, sponsors, funders, educational institutions, employment service providers, associations, government entities, mentors, judges, advisors, and program partners;
• service providers and vendors that help us operate our services; and
• other sources where permitted by law or with consent.

4. How We Use Personal Information

We use personal information to:

• provide, operate, secure, maintain, and improve Prepr websites, platforms, programs, labs, challenges, events, marketplace services, and related services;
• create, authenticate, administer, and manage accounts;
• process registrations, applications, submissions, participation, assessments, credentials, and completion records;
• support contractor, client, career, marketplace, project-based learning, mentorship, judging, advisory, and workforce development activities;
• match participants, contractors, learners, employers, clients, mentors, judges, advisors, sponsors, funders, and program partners where relevant to a service or program;
• administer projects, communications, deliverables, deadlines, feedback, ratings, outcomes, payments, invoices, tax records, and reporting obligations;
• communicate with you and respond to questions, comments, requests, and complaints;
• send service, administrative, security, account, program, and transactional messages;
• send newsletters, updates, event information, marketing, and opportunity notices where permitted by law;
• understand usage, measure program outcomes, assess impact, improve accessibility, improve user experience, and plan future services;
• conduct analytics, reporting, audience development, campaign measurement, and service improvement;
• protect against fraud, misuse, security incidents, unlawful activity, and policy violations;
• establish, exercise, or defend legal rights and claims;
• comply with legal, regulatory, contractual, audit, tax, accounting, funding, and reporting obligations; and
• use information for other purposes explained when we collect it or with your consent.
• operate, configure, test, validate, monitor, secure, improve, enhance, and optimize AI Features, machine learning models, algorithms, and automated systems;
• generate Aggregated Data, De-identified Data, Derived Data, and Impact Data for analytics, benchmarking, research, reporting, and service improvement.

5. Legal Reasons for Using Personal Information

Where privacy laws require a legal basis, we rely on one or more of the following:

• Consent, where you agree to the use of your information, such as for certain cookies, marketing, or sensitive information.
• Contract, where we need the information to provide a service, administer a program, or take steps you request.
• Legal obligation, where we need the information to comply with law.
• Legitimate interests, where we use information for reasonable business purposes such as security, fraud prevention, service improvement, ordinary operations, analytics, and program administration, where those interests are not overridden by your rights.
• Public or vital interests, where the law allows use to protect someone’s life or to support a recognized public interest purpose.

If we rely on consent, you may withdraw it at any time, subject to legal, contractual, and operational limits.

Where Canadian privacy laws (including PIPEDA and Quebec’s Law 25) require consent, Prepr obtains consent before or at the time of collection, use, or disclosure, except where permitted or required by law. Consent may be express or implied depending on the sensitivity of the information, the reasonable expectations of the individual, and the circumstances. You may withdraw consent at any time, subject to legal, contractual, and operational limitations and upon reasonable notice. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

6. Cookies and Similar Technologies

Where the GDPR or UK GDPR applies, Prepr relies on one or more of the following legal bases for processing: (a) performance of a contract to which you are a party or to take steps at your request prior to entering into a contract; (b) your consent, which may be withdrawn at any time; (c) compliance with a legal obligation to which Prepr is subject; (d) protection of vital interests of you or another natural person; (e) performance of a task carried out in the public interest, for certain government or publicly funded programs; and (f) Prepr’s legitimate interests or the legitimate interests of a third party, provided such interests are not overridden by your interests, rights, and fundamental freedoms.

We and our service providers may use cookies, pixels, tags, local storage, analytics tools, heatmaps, session replay tools, and similar technologies to operate, secure, improve, personalize, measure, and market our websites, platforms, emails, and services.

These technologies may help us remember preferences, keep you signed in, understand usage, improve accessibility and functionality, measure campaign performance, support advertising, and detect security issues.

You can manage cookies through your browser settings, device settings, platform settings, or any cookie preference tool we make available. If you disable some technologies, parts of our websites or platforms may not work properly.

We use the following types of cookies and similar technologies:

• Essential cookies: These cookies are necessary for the Platform to function and cannot be switched off. They are usually set in response to actions you take, such as setting your privacy preferences, logging in, or filling in forms.
• Analytics and performance cookies: These cookies help us understand how visitors interact with the Platform by collecting and reporting information. This helps us improve the Platform.
• Functional cookies: These cookies enable enhanced functionality and personalization, such as remembering your preferences and settings.
• Advertising and targeting cookies: These cookies may be set through our Platform by our advertising partners to build a profile of your interests and show you relevant advertisements on other sites. Where required by law, we obtain your consent before using these cookies.

Our websites may not respond to browser “Do Not Track” signals unless required by law. Where applicable law requires us to recognize a browser-based opt-out, Global Privacy Control, consent preference, or similar signal, we will do so as required. We honor Global Privacy Control signals as required by applicable US state privacy laws and recognize this signal as a valid opt-out request for sale, sharing, and targeted advertising where required.

7. When We Share Personal Information

We may share personal information with:

• Affiliates and related entities, including Prepr Inc. and other Prepr affiliated or related entities.
• Service providers and vendors, such as hosting, storage, technology, analytics, communications, customer support, payment, security, marketing, and professional service providers.
• AI and technology providers, including providers of artificial intelligence, machine learning, cloud computing, hosting, and data processing services that help us operate AI Features and the Platform. These may include third-party AI systems that power or supplement Prepr’s AI Features, such as generative AI providers, natural language processing services, and machine learning platforms.
• Program and marketplace participants, such as clients, employers, sponsors, funders, educational institutions, employment service providers, associations, mentors, judges, advisors, administrators, contractors, learners, and other users, where needed to deliver or administer a program, project, challenge, marketplace activity, credential, or service.
• Professional advisors, such as lawyers, accountants, auditors, consultants, and insurers.
• Government entities, regulators, courts, law enforcement, and other parties, where required or permitted by law or needed to protect rights, safety, security, or property.
• Parties involved in a business transaction, such as a merger, financing, reorganization, sale of assets, or similar transaction, where permitted by law.
• Other parties, where you consent or direct us to share the information.

We do not sell personal information for money. Some U.S. privacy laws define “sale,” “sharing,” or “targeted advertising” broadly to include certain advertising or analytics activities. Where required, we provide a way to opt out. To the extent we share personal information with third parties for purposes that may be considered “selling” or “sharing” under applicable law, we provide notice and the opportunity to opt out as required.

We require our service providers and data processors to use Personal Information only for the purposes for which it was disclosed and in accordance with our instructions. We enter into appropriate data processing agreements with service providers that process Personal Information on our behalf, as required by Applicable Law. Where we engage third-party AI providers, we require contractual commitments regarding data use, security, and confidentiality. We do not authorize our service providers to use Personal Information for their own purposes except as necessary to perform services on our behalf.

Controller and Processor Roles. Depending on the context, Prepr may act in different capacities:

(a) Independent Controller/Business: When you create an account directly with Prepr, participate in Prepr-administered programs, or use the Platform outside of an Organization relationship, Prepr acts as an independent data controller (or “business” under U.S. privacy laws) and determines the purposes and means of processing your Personal Information.

(b) Processor/Service Provider: When an Organization deploys the Platform for its employees, students, or participants under a Customer Agreement, Prepr may act as a data processor (or “service provider” or “contractor” under U.S. privacy laws) processing Personal Information on behalf of and under the instructions of that Organization. In such cases, the Organization is the controller and determines the purposes of processing.

(c) Organization-Controlled Processing: Where an Organization controls the purposes and means of processing, you should refer to that Organization’s privacy policy for information about how your Personal Information is handled. Prepr’s processing activities for Organizations are governed by the applicable Customer Agreement, data processing addendum, or similar contractual arrangement.

8. International Transfers

We may store and process Personal Information in Canada, the United States, the United Kingdom, the European Union, the European Economic Area, and other jurisdictions where we or our service providers (including AI providers and cloud infrastructure providers) operate. Your information may be subject to the laws of those jurisdictions, including lawful access by courts, law enforcement, regulators, national security authorities, or government agencies.

Where required by Applicable Law, we use safeguards for cross-border transfers, such as contractual protections, standard contractual clauses (including the EU Standard Contractual Clauses approved by the European Commission and the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses), adequacy decisions (including UK adequacy regulations), binding corporate rules, transfer impact assessments, or other lawful transfer mechanisms recognized under Applicable Law. For transfers to countries that have not received an adequacy decision, we implement appropriate supplementary measures where necessary.

9. How Long We Keep Personal Information

We keep personal information only for as long as needed for the purposes described in this Policy, unless a longer period is required or permitted by law.

The length of time we keep information depends on the type of information and why we use it. For example:

Account information is kept while your account is active and for a reasonable period after that to administer the account, resolve issues, maintain records, and comply with legal obligations.

Program, challenge, lab, credential, marketplace, and project records are kept for as long as needed to deliver the program or service, verify participation or completion, manage outcomes, administer reporting obligations, and maintain appropriate records.

Payment, invoice, tax, accounting, and transaction records are kept for as long as needed for billing, audit, tax, accounting, contractual, and legal purposes.

Marketing information is kept until you unsubscribe or withdraw consent, unless we need to keep limited information to record your preferences and ensure we honour your choice.

Support, security, fraud prevention, and legal records are kept for as long as needed to respond to requests, protect our services, investigate incidents, prevent misuse, resolve disputes, enforce terms, or establish, exercise, or defend legal rights.

When personal information is no longer needed, we will delete it, anonymize it, or manage it according to our retention practices and applicable law.

Aggregated, De-identified, Derived, and Impact Data may be retained indefinitely where permitted by applicable law and applicable agreements, provided it is not reasonably capable of identifying an individual or is otherwise maintained with appropriate safeguards.

10. How We Protect Personal Information

We use reasonable physical, organizational, contractual, and technical safeguards designed to protect personal information from loss, theft, misuse, unauthorized access, disclosure, copying, use, modification, and disposal.

You are responsible for maintaining the confidentiality of your credentials and for using appropriate security measures on devices and networks used to access the Platform.

These safeguards may include access controls, authentication, role-based permissions, confidentiality obligations, contractual controls, secure hosting, monitoring, backup and recovery measures, encryption or similar protections, privacy guidance or training, and incident response procedures.

Prepr maintains incident response procedures designed to assess, respond to, mitigate, document, and notify as required in connection with security incidents or confidentiality incidents involving personal information.

No security measure is perfect, and we cannot guarantee absolute security.

In the event of a security incident or breach affecting your Personal Information, Prepr will investigate and remediate the incident using commercially reasonable efforts. Where required by Applicable Law, Prepr will notify affected individuals, Organizations, regulators, or other parties regarding incidents presenting a legally reportable risk, including: (a) notification to the Office of the Privacy Commissioner of Canada under PIPEDA’s breach notification requirements; (b) notification to supervisory authorities under the GDPR within 72 hours where feasible and to affected individuals where the breach is likely to result in a high risk to their rights and freedoms; (c) notification to the UK Information Commissioner’s Office under the UK GDPR; and (d) notification as required by applicable U.S. state breach notification laws. Prepr maintains incident response procedures designed to assess, respond to, mitigate, document, and notify as required.

11. Your Privacy Rights

Depending on where you live and the laws that apply, you may have the right to:

• access the personal information we hold about you;
• receive information about how we collect, use, share, store, and protect your information;
• receive a copy of your information in a portable format;
• correct inaccurate or incomplete information;
• request data portability (where required by applicable law, including Quebec Law 25 and GDPR requirements);
• ask us to delete information;
• withdraw consent, where we rely on consent;
• restrict or object to certain uses of information;
• opt out of marketing communications;
• opt out of certain targeted advertising, profiling, sale, or sharing of personal information, where applicable;
• appeal our decision if we deny a privacy request, where applicable;
• challenge our compliance with privacy law or this Policy; and
• complain to a privacy regulator or data protection authority.

These rights are not absolute. We may refuse or limit a request where the law allows, including where information is legally privileged, relates to another person, is needed for security or fraud prevention, is needed to comply with law, or is subject to another legal exception.

Prepr may require reasonable information to verify your identity and authority before responding to a privacy request. Prepr will not charge a fee for access unless permitted by applicable law and disclosed in advance.

12. Your choices

You have choices about how we use some personal information:

Marketing emails. You may unsubscribe from marketing emails by using the unsubscribe link in the email or by contacting us. We may still send you non-marketing messages, such as account, security, service, program, transaction, or administrative messages.

Cookies and similar technologies. You can manage cookies through your browser settings, device settings, platform settings, or any cookie preference tool we make available. If you disable some technologies, parts of our websites or platforms may not work properly.

Targeted advertising, sale, or sharing under U.S. privacy laws. We do not sell personal information for money. Some U.S. privacy laws define “sale,” “sharing,” or “targeted advertising” broadly to include certain advertising or analytics activities. Where required by law, you may opt out by using our cookie preference tool, a recognized opt-out preference signal, such as Global Privacy Control, or another opt-out method we make available.

Privacy requests. Depending on where you live, you may ask to access, correct, delete, or receive a copy of your personal information, withdraw consent, object to or restrict certain uses, or appeal a decision where applicable. You can make a request by contacting our Privacy Information Officer.

13. How to Make a Privacy Request

You can make a privacy request or ask a privacy question by contacting our Privacy Information Officer:

• Attn: Salar Chagpar, Privacy Information Officer
• Organization: Prepr Foundation
• Address: 200 Wellington Street West, Suite 500, Toronto, Ontario, M5V 3C7, Canada
• Email: privacy@prepr.org

We may need to verify your identity before responding. If an authorized agent makes a request for you, we may ask for proof that the agent is allowed to act for you.

We will respond within the time required by applicable law. For Canadian access requests, we will try to respond within 30 days after receiving the written request, unless an extension is permitted by law.

If Prepr processes personal information on behalf of an organization, Prepr may direct you to that organization or coordinate with that organization to respond to your request.

14. Canada Privacy Notice

If you are in Canada, your Personal Information is protected under the Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial privacy legislation (including Alberta’s Personal Information Protection Act and British Columbia’s Personal Information Protection Act, where applicable), and Quebec’s Law 25. Prepr is subject to PIPEDA and complies with its requirements for the collection, use, and disclosure of Personal Information in the course of commercial activities. Prepr maintains records of breaches of security safeguards as required by PIPEDA, including breaches that may not meet the reporting threshold. You have the right to access your Personal Information held by us, request correction of inaccurate information, withdraw consent (subject to legal or contractual restrictions), challenge our privacy practices, and request information about our use of service providers outside Canada. We will respond to access requests within 30 days after receiving the written request, unless an extension is permitted by law.

If you are a Quebec resident, you have additional rights under Quebec’s Act respecting the protection of personal information in the private sector (Law 25 / Bill 64), including: (a) the right to data portability, allowing you to request a copy of your Personal Information in a structured, commonly used technological format; (b) the right to request de-indexing or cessation of dissemination of Personal Information in certain circumstances, particularly where dissemination contravenes law or a court order; (c) the right to be informed of automated decision-making; and (d) where we use automated decision-making that produces a decision affecting you, the right to be informed of that decision, the reasons and principal factors that led to the decision, and to have the decision reviewed by a person at Prepr. Prepr has implemented a privacy governance framework as required by Law 25, including privacy impact assessments for projects involving Personal Information. Prepr conducts privacy impact assessments before communicating personal information outside Quebec where required by Law 25 and before acquiring, developing, or overhauling information systems or electronic service delivery systems involving personal information.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or an applicable provincial or territorial privacy regulator.

In Quebec, you may also contact the Commission d’accès à l’information du Québec. For residents of other provinces with applicable privacy legislation, you may contact your provincial or territorial privacy commissioner.

15. United States Privacy Notice

If you live in a U.S. state with a comprehensive privacy law—such as California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), or other states with applicable consumer privacy legislation—you may have additional rights, including the right to: (a) know what Personal Information we collect and how we use it; (b) access your Personal Information; (c) correct inaccurate Personal Information; (d) delete your Personal Information; (e) obtain a copy of your Personal Information in a portable format; and (f) opt out of certain uses of Personal Information, such as targeted advertising, sale, sharing, or certain profiling. The specific rights available to you depend on which state’s law applies.

We will not discriminate against you for exercising your privacy rights, except where permitted by law.

If required by law, we will honour recognized opt-out preference signals, such as Global Privacy Control, for the browser or device that sends the signal.

Depending on the state where you reside, you may also have the right to appeal our decision if we deny a privacy request. If we deny your request and you wish to appeal, please contact our Privacy Information Officer in writing within 45 days after receiving our response. Provide your original request details and explain why you believe the denial was in error. We will respond to your appeal within 45 days (or as otherwise required by applicable state law). If we deny your appeal, we will inform you of the reasons and, where required by applicable state law, provide information about how to contact the applicable state attorney general or other regulator to submit a complaint.

Prepr does not “sell” or “share” Personal Information as those terms are defined under the CCPA/CPRA, except to the extent that certain advertising or analytics technologies may constitute “sharing” under the broad statutory definition. Where required by law, you may opt out of such sharing by using our cookie preference tool, submitting a request to our Privacy Information Officer, or enabling a recognized opt-out preference signal such as Global Privacy Control in your browser. We will process opt-out requests within the timeframes required by applicable state law. Prepr does not use or disclose sensitive personal information for purposes other than those permitted under California Civil Code section 1798.121(a), and therefore does not offer a “Limit the Use of My Sensitive Personal Information” option.

16. California Notice at Collection

If the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) apply to you, this section provides additional information for California residents as required by Cal. Civ. Code § 1798.100 et seq.

In the last 12 months, we may have collected the following categories of personal information:

• identifiers, such as name, email address, mailing address, phone number, IP address, account identifiers, and device identifiers;
• commercial information, such as purchase, payment, transaction, invoice, or service records;
• internet or other electronic network activity, such as browsing activity and interactions with our websites, platforms, emails, and services;
• geolocation information, such as general location inferred from IP address;
• professional, employment, and education information, such as resumes, experience, skills, credentials, qualifications, program participation, and application information;
• audio, electronic, visual, or similar information, such as recordings or images where used for events, support, security, or program administration;
• inferences, such as preferences, interests, performance indicators, or user engagement patterns; and
• sensitive personal information, where needed and permitted by law.

We collect, use, disclose, and retain these categories for the purposes described in this Policy. We may disclose these categories to the recipients described in this Policy.

We do not sell personal information for money. We may use advertising or analytics technologies that may be considered a “sale,” “sharing,” or targeted advertising under some laws. You may opt out by using our cookie preference tool or another opt-out method we make available.

We do not knowingly sell or share personal information of children under 16.

California residents have the right to request, once per year, information about Personal Information we disclosed to third parties for direct marketing purposes in the preceding calendar year. If you are a California resident and would like to make such a request, please contact our Privacy Information Officer.

We retain personal information of California residents for as long as necessary for the purposes described in this Policy, unless a longer retention period is required or permitted by law. For specific categories of personal information, please see Section 9 (How Long We Keep Personal Information) of this Policy.

17. European Union and European Economic Area Privacy Notice

If you are in the European Union or European Economic Area, your Personal Data is protected under the General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”). You have rights to: (a) access your Personal Data and receive information about how it is processed; (b) rectify inaccurate or incomplete Personal Data; (c) request erasure of your Personal Data (“right to be forgotten”) in certain circumstances; (d) restrict processing of your Personal Data in certain circumstances; (e) object to processing of your Personal Data based on legitimate interests or for direct marketing; (f) receive your Personal Data in a structured, commonly used, machine-readable format (data portability); and (g) withdraw consent where processing is based on consent. You also have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you, except in limited circumstances permitted by the GDPR.

Where Prepr relies on legitimate interests as a legal basis, our legitimate interests include: (a) operating, securing, and improving the Platform; (b) providing, administering, and supporting Services; (c) preventing fraud, misuse, and security incidents; (d) conducting analytics and research to improve user experience; (e) developing and improving AI Features; (f) marketing and promoting our Services; and (g) establishing, exercising, or defending legal claims. You have the right to object to processing based on legitimate interests, and we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Where we rely on legitimate interests, you may object to that use. Where we use your personal data for direct marketing, you may object at any time.

For transfers of personal data from the EEA to countries outside the EEA that do not benefit from an EU adequacy decision, we rely on appropriate safeguards, such as the EU Standard Contractual Clauses adopted by the European Commission, binding corporate rules, or other lawful transfer mechanisms recognized under the GDPR.

If you are in the EU/EEA and wish to exercise your rights, contact our Privacy Information Officer at the address provided below. We will respond to valid requests within one month, which may be extended by a further two months where necessary, taking into account the complexity and number of requests. If we cannot comply with your request, we will inform you of the reasons. You have the right to lodge a complaint with your local supervisory authority. For a list of EU/EEA supervisory authorities, visit the European Data Protection Board website at https://edpb.europa.eu.

We will tell you if providing personal data is required by law or contract, or is needed to enter into a contract, and what may happen if you do not provide it.

If you are in the EU/EEA and Prepr processes personal information on your behalf as a processor, service provider, or equivalent role, the applicable Customer Agreement or data processing addendum may contain additional terms governing Prepr’s processing activities, security measures, subprocessors, and breach notification obligations.

If we are required to appoint an EU representative under Article 27 of the GDPR or a Data Protection Officer under Article 37 of the GDPR, we will make those contact details available on our website at https://Prepr.org/privacy or upon request. You may also contact our Privacy Information Officer for current representative or DPO information.

18. United Kingdom Privacy Notice

If you are in the United Kingdom, your Personal Data is protected under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. You have the same rights as users in the EU/EEA, including rights to: (a) access your Personal Data; (b) rectify inaccurate Personal Data; (c) request erasure in certain circumstances; (d) restrict processing in certain circumstances; (e) object to processing based on legitimate interests or for direct marketing; (f) receive your Personal Data in a portable format; and (g) withdraw consent where processing is based on consent. You also have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects on you.

Where we rely on legitimate interests as our legal basis for processing your personal data, you have the right to object to that processing. Where we process your personal data for direct marketing purposes, you may object at any time.

For transfers of personal data from the UK to countries outside the UK that do not benefit from a UK adequacy decision, we rely on appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as applicable.

If you are not satisfied with our response to a privacy request, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection. The ICO can be contacted at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom; Website: https://ico.org.uk.

19. Children’s Privacy

Our websites, platforms, programs, and services are not directed to children under 13 in the United States (pursuant to COPPA), under 16 in the European Union and United Kingdom (unless member state law provides for a lower age with appropriate safeguards), or under any other applicable age threshold in other jurisdictions, unless Prepr has implemented appropriate consent and program controls through a parent, guardian, school, institution, or Organization. Some Prepr programs or services may be available to minors aged 13–17. Where minors participate, we collect, use, and disclose their Personal Information only as permitted by law and, where required, with consent or authorization from a parent, guardian, school, institution, program partner, or the minor (where the minor has legal capacity to consent).

We do not knowingly collect personal information from children under 13 without required consent or authorization. For users in the United States, where COPPA applies, Prepr obtains verifiable parental consent before knowingly collecting personal information from children under 13, or relies on school or organization authorization where legally available under the COPPA school consent exception. If a parent or guardian believes that a child under 13, or a minor aged 13–17, has provided personal information to Prepr without appropriate consent or authorization, they may contact our Privacy Information Officer. We will review the matter and, where appropriate and required by law, delete the information, deactivate the account, or take other reasonable steps.

Prepr supports youth learning and workforce development programs. Where the Platform is used by minors, Prepr may require consent from a parent, guardian, school, institution, organization, or other authorized person, depending on age, jurisdiction, program design, and applicable law.

20. Marketing Communications

You may unsubscribe from marketing emails by using the unsubscribe link in the email or by contacting us. Even if you unsubscribe, we may still send non-marketing messages, such as account, transaction, security, service, program, or administrative messages.

21. Automated Decisions and Profiling

We do not make decisions based solely on automated processing that produce legal effects or similarly significant effects on individuals, unless: (a) necessary for the performance of a contract; (b) authorized by Applicable Law with appropriate safeguards; or (c) based on explicit consent. Where such automated decision-making occurs, you have the right to obtain human intervention, express your point of view, and contest the decision.

We may use limited profiling or analytics to personalize content, improve services, measure outcomes, prevent fraud, support advertising, or administer programs, where permitted by law and subject to applicable choices.

Where required by Applicable Law, including under Quebec’s Law 25, the GDPR, UK GDPR, and certain U.S. state privacy laws, you may request information about automated processing or AI Features used in relation to you and may have rights to: (a) be informed of automated decision-making; (b) obtain meaningful information about the logic involved; (c) contest decisions made by automated means; and (d) request human review of significant automated decisions. Prepr does not intend to make legally binding decisions about individuals solely through automated processing without appropriate human oversight.

22. AI Features and Automated Processing

The Platform includes AI Features that may generate, recommend, summarize, classify, score, analyze, translate, draft, coach, prompt, infer, or otherwise process information. AI Features may include LearnBot, virtual coaching, learning recommendations, skills inference, competency scoring, content generation, analytics assistants, and automated feedback. AI Features may be powered by Prepr systems, third-party systems, or a combination of both. Where required by applicable law, including the EU AI Act (Regulation (EU) 2024/1689), Prepr will inform users when they are interacting with an AI system, unless such interaction is obvious from the circumstances and context of use.

When you use AI Features, we process your inputs, prompts, feedback, corrections, and interaction data. We use this information, along with other Platform activity, to: (a) operate, configure, test, validate, monitor, secure, improve, enhance, and optimize AI Features and the Platform; (b) train, retrain, fine-tune, develop, and improve machine learning models, algorithms, and AI systems using Aggregated Data, De-identified Data, Derived Data, and Impact Data; (c) generate benchmarks, research, insights, reports, and analytics; and (d) develop new features, products, services, and AI functionalities. We will not use identifiable Personal Information to train general-purpose third-party AI models unless: (i) permitted by Applicable Law; (ii) authorized by explicit consent where required; or (iii) governed by an applicable Customer Agreement that expressly authorizes such use.

AI Output Disclaimers. AI-generated outputs may be inaccurate, incomplete, biased, non-unique, non-deterministic, outdated, or unsuitable for your purposes. The same or similar inputs may produce different outputs, and different users may receive identical or substantially similar outputs. Outputs may not reflect current law, current facts, professional standards, or the requirements of any particular Organization, employer, program, or regulator. You are solely responsible for reviewing, validating, and independently assessing AI outputs before relying on them, publishing them, submitting them, using them in a program, or making decisions based on them. Prepr does not guarantee the accuracy, reliability, or fitness of AI outputs for any particular purpose. Where required by applicable law, including the EU AI Act, Prepr will label or disclose AI-generated or AI-manipulated content, or implement appropriate technical measures for marking such content.

Organizational Responsibilities. Organizations are responsible for ensuring that their use of reports, analytics, AI outputs, or skills insights complies with Applicable Law, including employment, human rights, education, and privacy laws. Organizations must not use Impact Data, analytics, AI outputs, or benchmarks in a manner that violates Applicable Law, including by making employment, admission, eligibility, or other material decisions about individuals based solely on automated processing without appropriate human oversight.

Third-Party AI Providers. Prepr may engage third-party AI providers to operate or enhance AI Features. These third-party providers may process your inputs and Platform activity to generate outputs. We require third-party AI providers to: (a) use your data only to provide services to Prepr; (b) implement appropriate security measures; (c) comply with applicable data protection laws; and (d) not use your data to train their own general-purpose models without your consent. Our current AI providers may include providers of generative AI, natural language processing, machine learning infrastructure, and cloud computing services.

• Opting Out of AI Training. Where we use your information to improve AI Features, we primarily use Aggregated Data, De-identified Data, and Derived Data that does not identify you. If you wish to limit how your information is used in connection with AI Features, you may: (a) contact our Privacy Information Officer to request that your identifiable Personal Information not be used for AI training purposes; (b) where you are part of an Organization, request that your Organization negotiate AI use restrictions in a Customer Agreement; or (c) limit your use of AI Features on the Platform. Please note that opting out may affect the functionality and personalization of Services available to you.

23. Third-Party Links and Services

Our websites, platforms, programs, and services may include links to third-party websites, tools, services, or integrations. Those third parties may collect, use, and disclose personal information under their own privacy policies. We are not responsible for their independent privacy practices except where required by law or contract.

24. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, Applicable Law, Platform features, or other factors. If we make material changes, we will give notice as required by law, which may include posting a notice on the Platform, sending an email to the address associated with your Account, or other appropriate means. Your continued use of the Platform after notice of changes constitutes acceptance of the updated Policy. The “Last updated” date at the top of this Policy shows when this Policy was last revised. We encourage you to review this Policy periodically.

This Privacy Policy should be read together with the Platform Terms of Use (available at https://Prepr.org/terms), Cookie Policy (if applicable, available at https://Prepr.org/cookies), Impact Data Charter (if applicable), and any applicable Customer Agreement or data processing addendum. In the event of conflict between this Privacy Policy and a Customer Agreement, the Customer Agreement governs for the applicable Organization and Services. In the event of conflict between this Privacy Policy and Applicable Law, Applicable Law governs.

25. Contact Us

If you have questions, concerns, complaints, or requests about this Policy or our privacy practices, please contact our Privacy Information Officer:

• Attn: Salar Chagpar, Privacy Information Officer
• Organization: Prepr Foundation
• Address: 200 Wellington Street West, Suite 500, Toronto, Ontario, M5V 3C7, Canada
• Email: mailto:salar.chagpar@Prepr.org
• Alternative Email: mailto:privacy@prepr.org
• Website: https://Prepr.org/privacy

If you are not satisfied with our response, you may have the right to complain to the applicable privacy regulator, including: (a) in Canada, the Office of the Privacy Commissioner of Canada (https://priv.gc.ca) or an applicable provincial or territorial privacy commissioner (such as the Commission d’accès à l’information du Québec for Quebec residents); (b) in the United States, a state attorney general or applicable privacy regulator; (c) in the United Kingdom, the Information Commissioner’s Office (https://ico.org.uk); or (d) in the European Union or EEA, your local data protection supervisory authority (for a list, visit https://edpb.europa.eu).

For users in the European Union or European Economic Area, if Prepr is required to appoint an EU representative under Article 27 of the GDPR, we will make that representative’s contact details available on our website at https://Prepr.org/privacy or upon request to our Privacy Information Officer.