How ZSS Learning handles your personal information. Written in plain language, because the whole point of one of our courses is knowing what happens to your data.
ZSS Learning is the education branch of Zil Smart Solutions (BRN B8441574), based at Anse Aux Pins, Mahé, Seychelles. In this notice, "we", "us", and "ZSS Learning" refer to Zil Smart Solutions operating under the ZSS Learning brand. We are the data controller for the information described in this notice.
Data protection contact: Rimond Arnold Pillay, Founder and Principal Consultant, Zil Smart Solutions — zss-learning@zilsmartsolutions.com. This is the person responsible for the safe custody of your data and for our compliance with the Seychelles Data Protection Act 2023.
This notice covers the ZSS Learning website, your account, and every course you take with us. It explains what personal information we collect, why, where it is stored, who else may see it, and the choices you have. It does not cover other Zil Smart Solutions products, or third-party websites we link to.
ZSS Learning is intended for working professionals aged 18 and over. You must be 18 or older to create an account, per our Terms of Service. We do not knowingly collect personal information from anyone under 18. If we become aware that we have done so, we will delete that information promptly. If you believe a minor has provided us with personal information, please contact us at the address above.
We collect only what running the course platform actually requires. Depending on how you use ZSS Learning, this may include:
| What | Why |
|---|---|
| Account information — your name and email address | To create and secure your account, and to put your name on your certificate |
| Authentication data | Your password is stored in hashed form by our authentication provider (Supabase) — we never see or store it in plain text |
| Course access and progress — which courses you have access to, modules opened and completed, quiz results | To deliver the course, save your place, and issue your certificate when you finish |
| Workbook download activity | To confirm your download links work and to support you if something goes wrong |
| Certificate details — the name you choose to appear on it, and completion date | Certificates are generated in your own browser; we keep a record that a certificate was issued, not a copy of the image itself |
| Payment information — a transaction reference and the amount paid | To confirm your enrolment and meet accounting and tax record-keeping requirements. Card numbers, CVV codes and full payment details are handled directly by our payment processor and are never seen or stored by us |
| Organisational (B2B) enrolment details, where applicable — see "If your access came through your employer" below | To manage seats purchased by an organisation and report on completion to that organisation's nominated contact |
| Support and correspondence — messages you send to us | To answer your question or resolve your issue |
| Marketing preference | Only if you tick the box at signup asking to receive course updates and offers — see "Marketing communications" below |
| Technical information — IP address, browser type, and access timestamps | Captured by our hosting and database providers for security, abuse prevention, and service reliability |
We do not run advertising trackers, sell your data, or build an advertising profile on you.
Some organisations purchase ZSS Learning access for their staff ("organisational" or "B2B" enrolments). If that applies to you:
We only send you course updates, new releases, or promotional offers if you explicitly opt in — by ticking the marketing box when you create your account. This is entirely separate from, and does not affect, the transactional emails we send about your own enrolments (confirmations, certificates, access issues) or, where applicable, the organisational progress updates described above. You can withdraw marketing consent at any time by emailing us or using the unsubscribe link in any marketing email.
We rely on a mix of legal bases depending on the purpose: performing our contract with you (delivering the course you enrolled in), our legitimate interest in running a secure and reliable service, compliance with legal obligations (such as tax record-keeping), and your consent where we ask for it specifically (such as marketing emails).
We use a small number of specialist providers ("processors") to run the service. Each is contractually required to protect your data to a standard consistent with this notice and only to use it for the purpose we specify.
| Provider | What for | Where |
|---|---|---|
| Supabase | Account, authentication, course-access, and progress database | eu-west-1 (Ireland, EU) |
| Netlify | Website hosting and content delivery | Global content delivery network |
| Resend | Transactional and marketing email delivery | United States |
| MCB Mastercard Payment Gateway (Mauritius Commercial Bank Seychelles) | Payment processing, once live | Handled directly by MCB — card data never reaches our servers |
Certificates are generated as an image directly in your own browser using information already in your account — no third party is involved in producing them.
Most of your data is stored in the European Union (Ireland). Email delivery via Resend involves a transfer to the United States. Where we transfer personal data outside Seychelles, we do so only to processors who are contractually bound to protect it to a standard consistent with this notice, and we take reasonable steps to ensure an equivalent level of protection applies.
| Category | Retention period |
|---|---|
| Account data (name, email, login) | While your account is active |
| Course access and progress | 12 months from enrolment per course, per our Fulfilment Policy, or as long as your account remains active if renewed |
| Payment records | 7 years, to meet accounting and tax record-keeping requirements |
| Workbook download records | Same period as the related course access |
| Marketing consent record | Until you withdraw consent, plus a short period to record that withdrawal |
| Support correspondence | As long as reasonably needed to resolve your query, or longer where we're required to keep a record by law |
| Technical and security logs | A limited period set by our hosting and database providers for security and reliability purposes |
| After account deletion | Personal data is purged within 30 days, except payment records retained for legal compliance |
Under the Seychelles Data Protection Act 2023, you have the right to:
To exercise any of these rights, email zss-learning@zilsmartsolutions.com with the subject line "Privacy request". We respond within 30 days.
Privacy-first is a core value of ZSS Learning, not an afterthought. We collect what running the course actually requires, nothing more, and we tell you plainly when that changes.
If we change how we handle your data, we'll update this page and change the version and date at the top. Material changes will be emailed to registered users. Continued use of ZSS Learning after an update means you accept the revised notice.
This notice is governed by the laws of the Republic of Seychelles.
Questions about your privacy or this notice? Email zss-learning@zilsmartsolutions.com. We read every message.