Privacy

Who is responsible for your data

This portal is operated by TSC Labs — the controller responsible for the personal data described on this page. For full registration details, see the imprint. Contact us at office@tsc-labs.eu with any privacy questions or requests.

Where your data comes from

Most of what we hold about you, you gave us directly by signing in (see below). Two exceptions:

• If you signed in with GitHub or Google, we received your verified email address, display name, and profile picture from that provider, not from you directly.
• Your name is usually entered by the organisation that enrolled you — a trainer or customer contact creates your course participant record, typically before you ever log in — not typed in by you.

Using the portal — your consent

The first time you sign in — and again whenever we materially update this notice — we ask you to agree to this privacy notice before you use the portal. This agreement covers using the portal itself: signing in, seeing your courses, and tracking your progress through them here — the lab steps you've completed, the quizzes you've attempted, and the Course Companion chapters you've read.

• Your enrolment doesn't depend on this agreement. The account your trainer created for you, and the fact that you're enrolled in a course, rest on the arrangement with the organisation that booked the course — not on your agreement here. If you decline, we don't delete or change anything; your enrolment stands and your existing data follows our normal retention policy. You simply won't be able to use the portal until you agree, and you can come back and agree at any time.
• Re-consent on changes. If we materially change this notice — a new purpose, a new provider, or a new category of data — we ask everyone to agree again the next time they use the portal. Small wording or typo fixes don't trigger that.

You can withdraw your agreement at any time from your profile page (Withdraw consent) once you're signed in — withdrawing is as easy as agreeing. It ends portal access and further processing based on your agreement, and signs you out of every device; your existing data isn't deleted and follows our normal retention policy. Deleting your data is a separate right — for that, contact us at office@tsc-labs.eu.

Signing in

• Email sign-in link — if you sign in with your email address, we send you a one-time sign-in link via our email provider, AhaSend, which receives your email address for that purpose only. This email is purely transactional — never marketing.
• GitHub or Google sign-in — if you choose to sign in with GitHub or Google, we receive your verified email address, display name, and profile picture from them, to match you to your existing course account.
• Bot protection — our login page uses Cloudflare Turnstile to tell human visitors apart from automated traffic. Cloudflare receives your IP address and some browser/device signals as part of that check.
• Login activity — when you successfully sign in, we record the time and the method you used (email link, Google, or GitHub) so an administrator can see when your account was last accessed. We do not record your IP address or device for this. See how long we keep it under retention below.
• Sign-in link requests — whenever a sign-in link is requested for an email address, we record the address that was submitted, whether we managed to send the link, and — if our email provider refused it — the status and message it gave us, so that an administrator can look into a "my link never arrived" report. Only administrators can see these records. We do not record your IP address or device for this either. See how long we keep them under retention below.

Your account and course progress

• Your profile — we store your name, email address(es), and (if applicable) your GitHub handle and trainer profile details, to identify you, show you the courses you're enrolled in, and — for trainers and admins — manage access to the admin area. Your GitHub handle is set either by a trainer when they invite you, or by you when you connect your GitHub account from your profile page; it lets you sign in with GitHub and is shown on your profile. You can disconnect it from your profile page at any time, which stops GitHub sign-in for your account (email sign-in still works).
• Company affiliation — an administrator may record which company you're affiliated with, so we can group and find people by their organisation in the admin area. This is a label only — it does not change what you can access.
• Lab progress — as you work through a course's labs, we keep track of which steps you've completed, so you can pick up where you left off.
• Quiz attempts — when you submit a quiz to be marked, we keep a record of that attempt: for each question, whether you answered it and whether your answer was right (including a right or wrong mark against each option), the score that worked out to, whether it was a pass, which version of the quiz you were marked against, when you started and submitted it, and which attempt of yours it was. That lets you read your own results back afterwards, and lets us apply any limit your trainer has set on the number of attempts. For quizzes that mark themselves as you go, we keep whether your first answer to each question was right and whether you've been through all of them. Your trainer sees group statistics for a quiz only — how many people took it, how many attempts and passes there were, the average score, how long an attempt typically takes, and which questions the group found hardest — never any individual's answers or score.
• Course Companion read state — if your course comes with a Course Companion (its written material), we keep track of which of its chapters you've opened, for each course separately, so you can see what you've already read and carry on from there. This is separate from lab progress, which covers lab steps.

We do not use your data for marketing

Your participant data — email, name, identity, and your course progress (lab steps, quiz attempts, and the Course Companion chapters you've read) — is used only to run the course you're enrolled in. It is never shared with anyone, or used by us, for promotional purposes. The sign-in email you receive is transactional only.

Future course offers

If your organisation ordered a course on your behalf, the person who placed that order (the ordering contact) may separately receive promotional emails about future courses, if they agreed to that when placing the order. This is entirely separate from the participant data above, and only applies to that ordering contact — never to course participants.

Security

We keep a record of security-relevant events (such as access denials or role changes) for operational and forensic purposes. These records identify the person involved only by an internal, pseudonymous identifier — never by name or email.

Who we share your data with

How long we keep your data

• Your account (name, email, course access) is kept for as long as you're a known participant, trainer, or admin — until it's explicitly deleted.
• Your lab progress is kept for 12 months after your last activity, and is removed immediately if your account or the course is deleted.
• Your quiz attempts are kept for 12 months after your last activity on that quiz, and are removed immediately if your account, the course, or the quiz itself is deleted.
• Your Course Companion read state is kept until your account or the course is deleted — there is no fixed period for it.
• Sign-in links expire after 15 minutes.
• Records of sign-in link requests (the address submitted and how the delivery went) are kept for 48 hours.
• Your login history (the time and method of each successful sign-in) is kept for 7 days; your most recent sign-in is kept for the life of your account. Both are removed immediately if your account is deleted.
• AhaSend, our email provider, keeps the sign-in email's message content (the body and recipient) for 3 days and its delivery metadata (timestamps, delivery status) for 30 days.
• Security records currently have no fixed retention period.
• If you've asked us not to contact you about future courses, we keep that preference until you tell us otherwise.

Your rights

You can ask us to see, correct, export, or delete the personal data we hold about you. You also have the right to object to processing and to complain to your national data protection authority.

Questions

Contact us at office@tsc-labs.eu with any privacy questions or requests. For org-level matters (such as the corporate website itself), see tsc-labs.eu/en/privacy.