Privacy Policy

Privacy Policy for the CertX website and e-learning platform · Version 2.0 · 3 November 2026

1.Who we are and how to contact us

This privacy policy explains what personal data CertX AG collects through certx.com and its e-learning platform, why, and what rights you have. It replaces the 2021 “Data protection” statement and the page “Privacy for trainings and inquiries”.

The controller is CertX AG, Passage du Cardinal 5, 1700 Fribourg, Switzerland, +41 26 309 29 99, info@certx.com. CertX AG is a certification body for functional safety, cybersecurity and artificial intelligence and is part of the SGS group.

We process personal data under the Swiss Federal Act on Data Protection (FADP / nLPD) and, where it applies to you (for example if you are in the EU or EEA), under the EU General Data Protection Regulation (GDPR).

For any question about your data, or to exercise your rights, write to info@certx.com with the subject “Data protection”.

2.Scope

This policy covers personal data processed through:

• the website certx.com in English, French and German;
• user accounts and the e-learning platform (online courses, quizzes, exams and course certificates);
• the online shop (training bookings, orders and invoices);
• the public certificate registers (Certificate Finder and Personnel Certifinder);
• contact, quote and registration forms, and emails sent to us from the website.

Certification, assessment and training contracts, and personnel certification schemes, can carry their own privacy notices. Where they do, those notices apply in addition to this policy. Websites we link to are covered by their owners’ policies, not this one.

3.When you visit the website

To deliver the pages you request, our servers process your IP address, the date and time, the page or file requested, the referring page, and your browser and operating system. We use this data to run the website, to detect and block attacks and misuse, and to fix errors.

• Hosting. The website is hosted by Infomaniak Network SA in Switzerland. Server logs are kept by the host for a short period and are not combined with other data.
• Security. A security plugin (Wordfence) checks requests for attacks, limits failed login attempts and can block IP addresses that behave abusively. A honeypot field filters spam on forms without tracking you.
• Cache and performance. Pages are cached on our server to load faster. Fonts (Raleway) are hosted on our own server, so loading a page sends no data to Google Fonts.
• Language. The language you choose (EN, FR or DE) is remembered with a technical cookie.

The legal basis is our legitimate interest in a secure, working website (GDPR Art. 6(1)(f)). Without this processing the website cannot be displayed.

4.Cookies and analytics

We set only necessary cookies unless you agree to more in the cookie banner. You can change or withdraw your choice at any time with the cookie settings button at the bottom of every page.

The consent banner is provided by CookieYes. It stores your choice in a cookie on your device and loads its script from the CookieYes servers. The full, current cookie list with durations is shown in the banner’s settings.

Google Analytics 4. With your consent, we use Google Analytics 4, a service of Google Ireland Ltd (Dublin) and Google LLC (USA). It records which pages you visit, how long you stay, the device and browser type and your approximate location. Google Analytics 4 does not store full IP addresses. Google can process the data in the USA (see section 10). We use the reports only to improve the website and do not use them to identify you. Legal basis: your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time in the cookie settings.

You can also block or delete cookies in your browser settings. If you block necessary cookies, login, the shop and the e-learning platform will not work.

5.Contact forms and quote requests

When you send a contact, quote or training-registration form, we process what you enter: usually your name, company, job title, email, phone number, country and message. We use it to answer you, prepare an offer or register you, and to keep a record of the exchange.

• Form submissions are stored in our website database and sent to our team by email through our own mail server (WP Mail SMTP).
• Forms are protected against spam by Google reCAPTCHA and a honeypot field. reCAPTCHA analyses your interaction with the page (for example mouse movement, IP address and browser data) and sends this data to Google.
• Fields marked as required are needed to handle your request. Without them we cannot answer.

Legal basis: steps prior to a contract or performance of a contract (GDPR Art. 6(1)(b)) and our legitimate interest in answering enquiries and protecting the forms (Art. 6(1)(f)). Enquiries that do not lead to a contract are deleted after two calendar years.

6.User accounts, e-learning, exams and certificates

To follow an online course you need a user account on certx.com. The e-learning platform runs on our own website (LearnDash) and is hosted in Switzerland with the rest of the site.

Group and company bookings. When your employer books a course for you, we share your enrolment, progress and results with the contact person who made the booking.

Online exams and live sessions. Online exams are taken on Exam.net and supervised through Microsoft Teams. Live online trainings also run on Microsoft Teams. The privacy policies of these providers also apply. If you switch on your camera, microphone, chat or polls, that data is processed too. Live sessions are not recorded unless we tell you beforehand. Videos of practical exercises in classroom trainings are used only for the debrief and deleted at the end of the training at the latest.

Personnel certification. If an exam leads to a personnel certification, we may pass your results to accreditation bodies or scheme owners when they ask for them as part of their audits.

Legal basis: performance of the training contract (GDPR Art. 6(1)(b)), legal obligations (Art. 6(1)(c)) and our legitimate interest in exam integrity and in reporting to the booking company (Art. 6(1)(f)). You can delete your account at any time by writing to us. We keep course and exam records and certificates for 10 years after the training, so that certificates can still be verified.

7.Online shop, orders and invoices

When you book a training or buy a product in our shop (WooCommerce), we process your name, company, billing address, VAT number if given, email, phone, the items ordered, the price and the payment method and status.

• We use this data to process the order, open your course access, send confirmations and issue the PDF invoice.
• Online payments are handled by PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, which receives your name, email, address and the order amount. PayPal’s own privacy policy applies to the payment. We do not see or store your card or PayPal account details.
• We keep orders and invoices for 10 years, as Swiss commercial and tax law requires (Swiss Code of Obligations, Art. 958f).

Legal basis: performance of the contract (GDPR Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)).

8.Public certificate registers

As a certification body, we publish valid certificates so that anyone can check them.

• Certificate Finder (product and system certificates) shows the certificate holder (a company), the product, the standard, the certificate number, the issue date and the status. It normally contains no personal data.
• Personnel Certifinder shows certified persons: name, certification scheme, certificate number, issue date, validity and status. Publication lets employers and customers verify a certification and is part of the certification scheme you agreed to when you applied.

Legal basis: the certification contract (GDPR Art. 6(1)(b)) and our legitimate interest, and that of the public, in verifying certificates (Art. 6(1)(f)). Your entry is removed or marked as withdrawn or expired when the certificate ends. If you have a specific reason to object to publication, write to us.

9.Embedded content, social media and links

Some pages show YouTube videos or LinkedIn content and link to our profiles on LinkedIn and YouTube. When such content loads, the provider (Google for YouTube, LinkedIn Ireland) receives your IP address and browser data. It can also link the visit to your account if you are logged in. We load this content only after you accept functional cookies, or when you click the video.

The share buttons on our blog are plain links. They send no data until you click them.

Profile pictures next to authors or comments can come from Gravatar (Automattic Inc., USA), which receives a coded form (hash) of the email address.

The providers’ own privacy policies apply to data they collect. We are not responsible for the content or data practices of websites we link to.

10.Who receives your data and transfers abroad

We do not sell your data. We share it only with the recipients below, and only as far as needed.

Our service providers process data only on our instructions and are bound by contract to confidentiality and data protection.

Some recipients are in countries outside Switzerland and the EU/EEA, in particular the USA. In those cases we transfer data only where the country has an adequate level of protection recognised by the Swiss Federal Council (for example the Swiss-US Data Privacy Framework, for certified companies), or on the basis of standard contractual clauses, or with your consent.

11.Retention, security, your rights and changes

How long we keep data

Security

We use technical and organisational measures to protect your data against loss, misuse and unauthorised access. These include encrypted connections (HTTPS), encrypted passwords, access rights on a need-to-know basis, a web application firewall and regular updates. We check and improve these measures over time.

Your rights

Under the FADP and, where it applies, the GDPR, you can:

• ask what data we hold about you and get a copy;
• have wrong data corrected;
• have data deleted or its use restricted, unless we must keep it by law;
• object to processing based on our legitimate interest, and to direct marketing at any time;
• withdraw your consent at any time, without affecting processing done before;
• receive data you gave us in a common electronic format.

To use these rights, write to info@certx.com. We may ask you to prove your identity. You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or to the data protection authority of your country in the EU/EEA.

Changes

We update this policy when our services or the law change. The version published on this page applies.