General privacy statement

Definitions

This section provides concise definitions of terms used in the policy to reduce ambiguity when describing processing activities and rights.

Purposes of processing

Personal data is processed for clearly identified purposes necessary to provide and improve training services, to manage accounts, and to meet legal and contractual obligations.

• Provision, administration and delivery of training courses and course materials
• Account setup, identity verification and access management for learners
• Billing, invoicing and payment reconciliation
• Communication about courses, updates and support requests
• Analysing platform usage and assessment results to improve content and usability
• Detecting and preventing security incidents, fraud or misuse
• Compliance with legal or regulatory obligations and responding to lawful requests
• Conducting anonymized research and quality assurance activities

Legal basis for processing

Processing is carried out on a lawful basis appropriate to the applicable jurisdiction. For Singapore, PDPA and related obligations inform our approach; where EU data is involved, lawful bases under GDPR may apply.

• Consent where individuals have provided clear permission for specific processing activities
• Performance of a contract where processing is necessary to provide agreed services
• Legal compliance where retention or disclosure is required by law
• Legitimate interests where processing is necessary for platform security, fraud prevention and operational improvement, balanced against individual rights

Applicable rights under GDPR (where relevant)

If European data protection rules apply to you, this section summarises the rights you may exercise and how to raise related requests with Lumora.

• Right of access: obtain a copy of personal data processed about you
• Right to rectification: request correction of inaccurate or incomplete data
• Right to erasure: request deletion of data in certain circumstances
• Right to restriction of processing: request limits on how data is used
• Right to data portability: request transfer of data in a structured, commonly used format
• Right to object: object to certain processing activities, including direct marketing

Cookies and similar technologies

Lumora uses cookies and similar technologies to enable essential functionality, remember preferences and gather anonymized analytics to improve our services.

Types of cookies used include essential session cookies, functional cookies for user preferences, analytics cookies for usage measurement, and third-party cookies where third-party services are embedded.

Essential: required for service operation. Functional: enable user preferences. Analytics: measure usage. Marketing: used only with consent for targeted content.

Users can manage cookie preferences through the consent banner, browser settings or device-level controls. Disabling certain cookies may affect platform functionality.

View cookie policy on yokora.digital

Data sharing

We share personal data only with authorised partners and service providers necessary to provide the services, and when required by law or to protect legal rights.

• Service providers supporting hosting, learning management and content delivery
• Payment processors and billing service providers
• Analytics and performance measurement providers under confidentiality obligations
• Regulatory bodies, law enforcement or other authorities when legally required
• Professional advisors, auditors and legal representatives where necessary
• Affiliated entities involved in providing contracted services to a client

International data transfers

Personal data may be transferred to countries outside Singapore to support hosting, analytics and service delivery. Transfers are performed only when appropriate protections are in place.

Safeguards may include contractual data protection clauses, reliance on adequacy decisions where available, encryption and access restrictions to protect data during transfer and while stored abroad.

Data retention

Lumora retains personal data only as long as necessary for the purposes described, for legitimate business needs and to satisfy legal or regulatory obligations.

Account and billing records are typically retained for the period necessary to provide services and to meet statutory accounting and tax requirements; in practice this may be several years for certain records.

Communications and support correspondence are retained for business continuity and dispute resolution, generally for a limited period consistent with operational needs.

System logs and security event records are retained for monitoring and incident response; retention periods are calibrated to balance contribute needs with data minimisation principles.

When retention periods expire or upon valid deletion requests (subject to legal constraints), data is securely deleted or anonymized in a manner appropriate to the data type.

Security measures

Lumora implements technical and organisational measures to protect personal data against unauthorized access, accidental loss, alteration and disclosure. Controls are selected based on risk assessments and industry practice.

• Encryption of data in transit using TLS and encryption at rest where appropriate
• Role-based access controls, multi-factor authentication for administrative access and regular access reviews
• Periodic security assessments, patch management, logging and an incident response process

Your data protection rights

You may exercise your rights to access, correct, restrict or delete personal data, request portability, or object to processing where applicable. To make a request, contact Lumora using the details provided below; we will respond in accordance with applicable law and internal procedures.

• Access: You have the right to request a copy of personal data we hold about you and to receive information about how it is processed.
• Rectification: You may request correction of inaccurate or incomplete personal information in our records.
• Erasure: Subject to applicable law, you can request deletion of personal data when retention is no longer necessary for the original purposes.
• Restriction: You can request limitation of processing in specific circumstances, for example while a dispute about accuracy is resolved.
• Portability: Where applicable, you may request a machine-readable copy of personal data you provided for transmission to another controller.
• Objection: You can object to processing based on legitimate interests or for direct marketing; we will assess and respond in accordance with law.
• Withdraw consent: If processing is based on consent, you may withdraw that consent at any time without affecting processing that occurred prior to withdrawal.
• Complaint: If you believe your rights are not respected, you may file a complaint with the relevant data protection authority in Singapore after contacting us.

How to make a rights request

To exercise any of the rights above, submit a request in writing to Lumora at our contact address or by email. Include enough information to identify yourself and to describe the specific request. We may ask for proof of identity to protect your information.

[email protected]

We aim to acknowledge requests within 7 business days and to provide a substantive response within 30 calendar days. Complex requests may require additional time; if so, we will notify you and explain the reason for the delay.