Privacy Policy

1. Who we are

RegNexus Limited ("we", "us", "our") is the data controller for personal data processed through Lumen by RegNexus. We are registered in England and Wales.

2. Data we collect

We collect the following categories of personal data:

• Account information: name, email address, organisation
• Learning data: course progress, assessment scores, exercise submissions
• Session data: attendance records, live teaching interactions
• Competence records: hash-chained evidence of demonstrated knowledge
• Usage data: feature usage, login timestamps, IP addresses

3. How we use your data

We process personal data for the following purposes:

• Providing the Lumen platform and its features
• Generating competence transcripts and compliance records
• Maintaining hash-chained audit trails for regulatory purposes
• AI-assisted content generation and teaching support
• Platform analytics and service improvement
• Communication about your account and service updates

4. Legal basis for processing

We process your data under the following legal bases: performance of a contract (providing the service), legitimate interest (platform security and improvement), consent (where applicable), and legal obligation (regulatory record-keeping).

5. Data retention

Account data is retained for the duration of your account. Competence records and hash-chained evidence are retained for a minimum of 7 years to meet regulatory requirements. You may request deletion of non-regulatory data at any time.

6. Data sharing

We do not sell your personal data. We share data only with: infrastructure providers (Supabase, Vercel) for platform operation, AI providers (Anthropic, OpenAI) for AI-assisted features (no personal data is sent to AI models without anonymisation), and regulators or auditors when required by law.

7. International transfers

Our primary infrastructure is hosted in EU regions (eu-west-2). Where data is transferred outside the UK/EEA, appropriate safeguards are in place including Standard Contractual Clauses.

8. Your rights

Under UK GDPR, you have the right to: access your data, rectify inaccurate data, erase your data (subject to regulatory retention requirements), restrict processing, data portability, and object to processing. To exercise these rights, contact us at privacy@reg-nexus.com.

9. Cookies

We use essential cookies for authentication and session management. We do not use third-party tracking or advertising cookies.

10. Contact

For privacy enquiries, contact us at privacy@reg-nexus.com. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).