Privacy Policy

EASEC European Accreditation SL  ·  Last updated: June 2026  ·  Applies globally across all EASEC services and platforms

1. Introduction

EASEC – European Accreditation of Soft Skills & Employability Competencies – is an independent international certification authority dedicated to evaluating, certifying, and credentialling transversal competencies and employability skills under internationally recognised standards including ESCO, EQF, the World Economic Forum Competency Framework, and Europass.

This Privacy Policy explains how personal data is collected, processed, stored, shared, and protected when individuals, institutions, or organisations interact with any EASEC service, platform, or digital environment.

EASEC operates three market verticals — EASEC for Schools, EASEC for Higher Education, and EASEC for Work — and this Policy applies uniformly across all of them, with vertical-specific provisions noted where applicable.

EASEC also offers ten professional competency certification programmes available to both institutional clients and individual consumers directly through EASEC's website.

By accessing or using any EASEC service, you acknowledge that you have read and understood this Privacy Policy. Where services are accessed through an institution or employer, you should also refer to that organisation's own privacy notices.

2. Legal Entities Operating Under This Policy

Both entities operate under a unified privacy governance framework. References to "EASEC" in this Policy apply to both entities where relevant to the context.

3. Regulatory Framework and Standards Alignment

EASEC operates in compliance with the following regulatory frameworks:

• Regulation (EU) 2016/679 (GDPR) — General Data Protection Regulation
• Spanish Organic Law 3/2018 (LOPDGDD) — on Personal Data Protection and Guarantee of Digital Rights
• Regulation (EU) 2024/1689 (EU AI Act) — Artificial Intelligence Act, applicable to EASEC's deployment of AI systems in assessment processes, including the obligations of transparency under Article 50 and the governance requirements applicable to AI systems interacting with natural persons
• Regulation (EU) 910/2014 (eIDAS) — on electronic identification and trust services, applicable to digital credential issuance and verification
• Europass Digital Credentials Infrastructure (EDCI) — interoperability principles for digital credential formats
• Texas Data Privacy and Security Act (TDPSA) and applicable US federal privacy law, where Innzpira LLC is the processing entity
• Open Badge 3.0 Standard (1EdTech) — governing digital badge issuance and portability
• 1EdTech CASE (Competency and Academic Standards Exchange) — metadata framework applied to issued credentials

EASEC holds certifications under ISO 9001 (Quality Management) and ISO 27001 (Information Security Management).

4. Data Protection Officer and Contact

EASEC has designated a Data Protection Officer (DPO) responsible for overseeing compliance with data protection obligations and serving as the primary contact for data subjects and supervisory authorities.

All data subject requests, privacy complaints, or enquiries regarding this Policy should be directed to the DPO. EASEC commits to responding to verified data subject requests within thirty (30) calendar days.

5. Role of EASEC as Certification Authority

Irrespective of how an individual accesses EASEC services — directly, through an institution, through an employer, or through a partner — EASEC acts as the independent legal issuer of all competency certifications and digital credentials. Specifically, EASEC:

• Determines and applies all certification methodologies, scoring rules, and competency frameworks
• Is the sole authority responsible for deciding whether a competency certification is issued, maintained, or revoked
• Maintains all certification records, audit trails, and verification systems
• Is responsible for the authenticity, integrity, and permanent availability of issued credentials
• Operates as a trust infrastructure enabling credential traceability and public verification

Co-branded credentials include an institution's or employer's logo but this does not alter EASEC's role as sole legal issuing authority, nor does it transfer to institutions any ownership of, or responsibility for, certification data held by EASEC.

6. Platforms and Domains Covered by This Policy

This Policy applies to all domains and subdomains operated by EASEC European Accreditation SL:

7. Relationship with Institutions, Employers, Partners, and Direct Consumers

Institutions and Certification Centres

Where universities, schools, or educational groups operate as EASEC Certification Centres, the institution acts as an independent Data Controller for participant data it collects and introduces into the EASEC platform. EASEC acts as an independent Data Controller for certification records, credential issuance, and verification data. For the limited purpose of administering assessments and generating cohort analytics, EASEC may act as Data Processor following institutional instructions.

Employers and EASEC for Work Clients

Where employers access EASEC for Work services, the employer is the Data Controller for employee data introduced into the platform. EASEC acts as Data Processor for assessment administration and report generation, and as independent Data Controller for credential issuance and employee EASEC Wallet accounts.

Individual Direct Consumers (B2C)

Where individuals purchase assessment or certification services directly through www.easec.eu, EASEC acts as the sole Data Controller for all data collected in connection with that purchase and the resulting assessment and credential issuance. No institutional intermediary is involved in B2C transactions. The same certification standards and credential validity terms apply as in institutional B2B arrangements.

Authorised Partners

Authorised EASEC Partners may introduce clients to EASEC services. Partners do not access personal data unless explicitly authorised under a separate written agreement with EASEC.

8. Categories of Personal Data Processed

Identity and Contact Data

• Full name and surname
• Email address (institutional or personal)
• Country or region
• Institutional or employer affiliation

Assessment and Certification Data

• Psychometric assessment responses (self-report instrument items)
• Scoring outputs and competency level results
• Certification outcomes and proficiency levels attained (Emerging, Foundational, Intermediate, Advanced, or Mastery)
• Credential identifiers, metadata, and CASE-standard skills data
• Timestamped issuance and verification records

AI-Assisted Situational Assessment Data

The following data categories are generated and processed in connection with the EASEC AI Engine situational assessment dimension, which is integrated as a complementary qualitative layer within EASEC's diagnostic and certification instruments:

• Open-text situational response: the free-text written by the participant in response to an AI-generated situational scenario. This constitutes a behavioural and potentially psychological data point and is treated with heightened care.
• AI-generated interpretive analysis: the structured qualitative output (identified strengths, development opportunities, suggested performance contexts, and recommended next steps) produced by the EASEC AI Engine from the participant's open-text response. This analysis is accessible exclusively to the individual participant through their EASEC Wallet.
• Response time data: the elapsed time between display of the situational scenario and submission of the participant's response, recorded as a behavioural contextual metric.
• Internal competency indicator: an internal classification derived by the AI Engine on a numeric scale of 1 to 5, used solely for instrument calibration and quality assurance. This indicator is not displayed to the participant, is not communicated to any institution or employer, and does not form part of the certified assessment score.

Professional Certification Assessment Data

For participants completing EASEC professional certification programmes (including the ten professional certifications across the For Schools, For Higher Education, and For Work domains), the same categories of psychometric assessment data and AI-assisted situational assessment data as described above are processed, together with:

• Professional role and domain context data where provided during registration
• Competency framework alignment data specific to the professional certification assessed

Programme Accreditation Data

• Programme documentation submitted by institutions
• Participant lists (name and institutional email) provided for quality surveys
• Quality and satisfaction survey responses
• Programme alignment evaluation records (ESCO, EQF, Tuning, WEF framework alignment data)

Vocational Assessment Data (EASEC Ikigai — Schools only)

• Vocational orientation responses and outputs
• Motivational and interest profile data
• Ikigai report content, retained only for report generation and not published

Platform and Technical Data

• IP address and approximate geolocation
• Device type, browser, and operating system
• Session activity logs and navigation data
• Security events and access logs

Communications Data

• Support requests and correspondence
• Feedback and survey responses
• Newsletter and communications preferences

Billing and Commercial Data

• Legal entity name, billing address, and tax identification (B2B) or individual billing name and address (B2C)
• Payment transaction references (processed by Stripe — EASEC does not store card data)
• Invoice and contract records
• Credit activation dates and credit validity periods

9. Purposes of Processing and Legal Bases

10. Automated Decision-Making and Certification Outcomes

EASEC's competency certification process involves automated scoring that may produce a legally or similarly significant effect — namely, whether a competency credential is issued or not.

The automated certification process:

• Applies validated psychometric models and predefined scoring rules aligned with internationally recognised competency frameworks (ESCO, EQF, WEF)
• Is designed to ensure consistency, objectivity, and comparability across all assessments
• Does not involve subjective human judgement in the scoring calculation itself
• Produces a proficiency level result (Emerging, Foundational, Intermediate, Advanced, or Mastery) and determines whether the minimum threshold for certification is met

Where EASEC for Work platform analytics or reports are generated automatically based on assessment data, these constitute informational outputs to support employer decision-making and do not themselves constitute automated decisions with legal effect for individuals.

10A. EASEC AI Engine — Situational Assessment Dimension

10A.1 Nature and Purpose

The EASEC AI Engine is a qualitative assessment component integrated into EASEC's diagnostic and certification assessment instruments across all three verticals. It presents the participant with a contextualised situational scenario generated by an AI language model, calibrated to the participant's assessed competency, segment, approximate age range, and cultural context. The participant's free-text response is analysed by the AI Engine to produce an interpretive reading.

This dimension is interpretive and developmental in nature. It does not constitute, influence, or modify the participant's certified competency score, which is determined exclusively by the validated psychometric instrument and automated scoring model described in Section 10. The AI Engine output is not shared with any institution, employer, or third party — it is accessible exclusively to the individual participant through their personal EASEC Wallet account.

10A.2 Transparency Disclosure at Point of Interaction

Before initiating the AI Engine dimension, participants are informed within the assessment interface of all of the following:

• (a) that the situational scenario has been generated by an artificial intelligence system (the EASEC AI Engine), calibrated to their profile;
• (b) that their open-text response will be processed by an AI system to produce an interpretive qualitative analysis;
• (c) that this analysis is interpretive, developmental, and does not form part of their certified assessment score;
• (d) that the AI dimension operates with full methodological independence from the psychometric score;
• (e) that they may request review of the interpretive analysis by a qualified EASEC evaluator at any time;
• (f) the applicable regulatory reference: EU AI Act 2024/1689, Article 50; GDPR Article 22.

The participant's explicit action to continue (clicking the initiation button) constitutes informed acknowledgement of these disclosures. The participant may choose not to complete the AI Engine dimension without affecting their access to the psychometric assessment or certification.

10A.3 AI Sub-Processors

EASEC uses the following AI service providers as sub-processors for the EASEC AI Engine:

Both providers are engaged under data processing agreements (DPAs) that: (a) expressly prohibit use of EASEC participant data for AI model training, fine-tuning, or product improvement; (b) ensure that data transmitted via API is not retained by the provider beyond the duration necessary to generate the API response; (c) require compliance with applicable EU data protection law through Standard Contractual Clauses.

10A.4 Data Storage and Infrastructure

All AI Engine data — including open-text responses, AI-generated analyses, response time data, and internal competency indicators — is stored exclusively within EASEC's cloud infrastructure located within the European Economic Area: Google Cloud Platform (EU region) and DigitalOcean (EU region). No AI Engine data is permanently stored outside the EEA.

10A.5 What Institutions and Employers Do and Do Not See

Institutional Certification Centres and employer clients with access to EASEC's platform receive:

• Psychometric certification results (proficiency level and whether the certification threshold was met)
• The issued digital credential (diploma, Open Badge, Europass EDC) associated with the individual
• Cohort analytics derived from certified assessment data (aggregated or per-individual, as agreed under the institutional agreement)

Institutional Certification Centres and employer clients do NOT receive, and EASEC does not share with them:

• The participant's open-text situational response written during the AI Engine dimension
• The AI-generated interpretive analysis (strengths, opportunities, performance contexts, next steps)
• The internal competency indicator generated by the AI Engine

10A.6 Human Review Protocol

Participants have the right to request review of their AI Engine interpretive analysis by a qualified EASEC evaluator. This right is presented to participants within the assessment interface at the conclusion of the AI Engine dimension. Review requests may also be submitted at any time to info@easec.eu. EASEC commits to acknowledging review requests within five (5) working days.

10A.7 Rights in Relation to AI Processing

The AI Engine's interpretive analysis constitutes automated processing of personal data to produce an output describing the individual's characteristics. In accordance with Article 22 GDPR, participants have the right to: (a) obtain human review of the AI Engine analysis; (b) express their point of view; (c) contest the analysis where they believe it does not accurately represent them. To exercise these rights, contact info@easec.eu or mfernandez@easec.eu.

11. Participation of Minors

EASEC for Schools services are specifically designed for secondary and baccalaureate students aged 15 to 18 years. EASEC for Higher Education and EASEC for Work services are intended for individuals aged 18 or over. B2C direct purchases are available only to individuals aged 18 or over.

Institutions must not enrol students under the age of 15 in any EASEC service.

12. Personal EASEC Wallet Accounts

Upon completing their first EASEC competency assessment — whether through an educational institution, an employer, or through a direct B2C purchase — each individual is automatically assigned a personal EASEC Wallet account. This account:

• Belongs to the individual and is independent of any institutional or employer contractual relationship with EASEC
• Persists indefinitely, for as long as the individual chooses to maintain it
• Stores all EASEC competency certifications and professional certifications issued to that individual, permanently and without expiry of the record itself
• Stores the AI Engine interpretive analyses generated for that individual, accessible exclusively to the individual
• Enables the individual to download, share, and manage their credentials at any time, including sharing to LinkedIn and other professional platforms
• Cannot be closed or restricted by any institution, employer, or partner
• Allows the individual to configure their own data processing preferences and permission settings directly within the platform

Individuals may request closure of their Wallet account at any time by contacting info@easec.eu. Closure of a Wallet account does not delete certification issuance records maintained by EASEC for verification and audit purposes.

12A. Individual Data Control and Permission Management

Each individual with a personal EASEC Wallet account has full control over the data access permissions granted to institutions and employers that have administered EASEC assessments to them. Through their Wallet account settings, individuals may:

• (a) View which institutions and employers currently have access to their assessment results, credential records, and profile data;
• (b) Revoke access permissions granted to any specific institution or employer at any time, with immediate effect;
• (c) Configure whether EASEC may use their individual data (beyond what is required for certification integrity) for internal research and improvement purposes;
• (d) Exercise all applicable GDPR data subject rights directly through the platform interface.

Effect of Revoking Institutional Access

Upon revocation of an institution's or employer's access permissions by the individual:

• The institution or employer immediately loses all visibility of the individual's identifying data, including name, surname, email address, assessment results, credential records, and historical performance data.
• The individual's data is anonymised from the institution's perspective. Aggregate and benchmarking data may remain available to the institution in fully non-identifiable form only.
• EASEC continues to retain the individual's certification records and personal Wallet data in accordance with this Policy.
• EASEC's obligations as certification issuer are independent of any institutional relationship.
• Issued credentials remain permanently verifiable through EASEC's public verification infrastructure, as the integrity of the certification registry is a core function of EASEC's role as an independent certification authority and cannot be affected by institutional access revocation.

Effect of Revoking or Restricting EASEC's Own Processing

Where an individual exercises their right to restrict or object to EASEC's processing of specific data categories:

• Certification issuance records and credential metadata cannot be deleted from EASEC's certification registry, as their retention is necessary to preserve the integrity of the verification system on which relying parties (employers, institutions, regulatory bodies worldwide) depend.
• AI Engine data (open-text response, interpretive analysis, internal indicator) may be deleted upon a valid erasure request, subject to the 24-month retention period set out in Section 19, where no overriding legitimate interest applies.
• All other personal data categories are subject to deletion or restriction rights as set out in Section 21.

13. Digital Credentials and Public Verification

EASEC issues competency credentials in the following formats:

• Co-branded digital diploma — PDF bearing both the EASEC and institutional or employer logos, with a unique verification code and QR
• Verifiable digital credential — shareable directly to LinkedIn and other professional platforms
• Open Badge 3.0 — compatible with any standards-compliant digital wallet or badge platform
• Europass Digital Credential (EDC) — compatible with the Europass infrastructure and portfolio
• Blockchain-anchored credential — where activated, the credential hash is anchored to a public blockchain for additional immutability and third-party verifiability (terms applicable to this format are published separately when the feature is launched)

Each credential carries a stated validity of three (3) years from issuance. The credential record is never deleted from EASEC's certification registry. Credentials are publicly verifiable at https://cert.easec.eu/certificates/verify. The verification service does not expose assessment response data or AI Engine outputs.

14. Co-Branding and Institutional Profiles

Credentials issued under an institutional agreement include the co-branding of both EASEC and the participating institution or employer. This co-branding does not transfer any data controller responsibility to the institution in respect of EASEC's certification records, nor does it alter EASEC's status as the sole legal issuing authority.

Where an institution operates as an EASEC Certification Centre or holds Programme Accreditation status, EASEC publishes and maintains an institutional profile on the EASEC website for the duration of the agreement. Programme Accreditation status is granted where an institution's programme demonstrates at least 80% alignment with the applicable international competency frameworks (ESCO, EQF, Tuning, and WEF Future of Jobs). This profile may include the institution's name, logo, contact details, number of certified individuals, competency areas of strength, and accreditation status. Institutions may configure their profile through their administrative account on cert.easec.eu.

15. Ikigai Vocational Assessments (EASEC for Schools)

The EASEC Ikigai Vocational Assessment is a distinct product within the EASEC for Schools portfolio and differs from competency certifications in the following ways relevant to data processing:

• No digital credential, Open Badge, Europass document, or personal EASEC Wallet account is created as a result of an Ikigai assessment
• Results are processed to generate a single PDF Report with two sections: one addressed to the student, one addressed to the counsellor and family
• The PDF Report is made available to the purchasing institution for download — EASEC does not send it directly to students, parents, or counsellors
• Ikigai assessment data is retained by EASEC for a maximum of twenty-four (24) months from the assessment date, after which it is anonymised or deleted
• EASEC acts as Data Processor for Ikigai assessments, processing data on behalf of the purchasing institution which acts as Data Controller

16. Third-Party Services and Technology Providers

EASEC integrates with the following third-party services. EASEC has entered into appropriate data processing agreements with each provider where required:

"SCCs" refers to EU Standard Contractual Clauses pursuant to Article 46 GDPR.

EASEC does not sell personal data to any third party and does not use personal data for behavioural advertising targeting individual users based on their assessment content or certification outcomes.

17. Data Sharing

Personal data is shared only where strictly necessary and in accordance with the purposes described in this Policy. Recipients may include:

• Participating institutions and employers — for cohort analytics, quality reporting, and programme management, in accordance with institutional agreements and the individual's permission settings in their EASEC Wallet
• Technology and infrastructure providers — listed in Section 16, for the operation and maintenance of EASEC platforms
• Credential verification systems and infrastructures — including Europass and LinkedIn integrations, where individuals choose to share their credentials through those channels
• Blockchain infrastructure providers — where the individual's credential is blockchain-anchored and the individual has consented to this feature
• Competent authorities and supervisory bodies — where required by applicable law, court order, or regulatory investigation
• Innzpira LLC — where billing and service delivery for USD-denominated EASEC for Work services requires data exchange between the two group entities, governed by an intra-group data transfer agreement incorporating appropriate safeguards

18. International Data Transfers

EASEC operates its core certification infrastructure within the European Economic Area (EEA). Certain operations involve the transfer of personal data outside the EEA. All international transfers are conducted using:

• EU Standard Contractual Clauses (SCCs) — applied to transfers to providers in the USA and other non-adequate countries, pursuant to Article 46(2)(c) GDPR
• Adequacy decisions — relied upon where the European Commission has determined that a recipient country provides an adequate level of protection
• Intra-group agreement — governing data flows between EASEC European Accreditation SL and Innzpira LLC, incorporating SCCs

18A. Global Regulatory Compliance

EASEC operates in over 64 countries and is committed to meeting applicable data protection standards in each jurisdiction where its services are accessed. The following summarises EASEC's approach to key international regulatory frameworks in addition to EU GDPR.

India — Digital Personal Data Protection Act 2023 (DPDP Act)

For assessments involving participants located in India, EASEC acts as a Data Fiduciary within the meaning of the DPDP Act. EASEC processes personal data on the basis of consent obtained through the assessment consent mechanism. Participants in India have the right to access, correct, and erase their personal data, and to grievance redressal through EASEC's DPO. Cross-border transfers of Indian personal data to EASEC's EEA infrastructure are conducted under applicable lawful transfer mechanisms under the DPDP Act and its implementing rules.

Brazil — Lei Geral de Proteção de Dados (LGPD)

For Brazilian participants, EASEC processes personal data on the legal bases of contract performance and legitimate interest as provided under the LGPD. In accordance with Article 20 LGPD, participants have the right to request review of automated decisions. This right is operationalised through the Human Review Protocol described in Sections 10 and 10A.6.

Colombia — Ley 1581 de 2012

For Colombian participants, EASEC obtains express authorisation for the processing of sensitive data categories (including psychometric and situational assessment responses, which may relate to psychological characteristics) in accordance with the requirements of Ley 1581. The assessment consent mechanism constitutes the required express authorisation.

Chile — Ley 21.096 and Ley 19.628

For Chilean participants, EASEC applies the principles of purpose limitation, proportionality, and habeas data rights in accordance with applicable Chilean data protection law. Participants may exercise rights of access, rectification, cancellation, and opposition through the DPO.

Singapore — Personal Data Protection Act 2012 (PDPA)

For Singaporean participants and institutional clients, EASEC complies with PDPA obligations including purpose limitation, data accuracy, protection, and retention limitation. Cross-border transfers are conducted under the contractual arrangements required by the PDPA.

Japan — Act on the Protection of Personal Information (APPI)

For Japanese participants, EASEC processes personal data in accordance with APPI requirements regarding purpose specification, use limitation, and third-party disclosure restrictions. Cross-border data transfers comply with APPI rules.

Argentina — Ley 25.326 de Protección de Datos Personales

For Argentine participants, EASEC processes personal data in compliance with Ley 25.326, applying the principles of quality, purpose, consent, and security. Sensitive data (including psychometric data) is processed only with the express consent of the data subject.

Mexico — Ley Federal de Protección de Datos Personales en Posesión de los Particulares

For Mexican participants, EASEC acts as a Responsable del tratamiento and complies with the LFPDPPP, including the obligation to make an Aviso de Privacidad available and to honour ARCO rights (Acceso, Rectificación, Cancelación, Oposición).

Other Jurisdictions

For participants and clients in jurisdictions not specifically listed above, EASEC's GDPR-compliant processing framework provides a level of protection that meets or exceeds the requirements of most applicable national data protection laws. Individuals in any jurisdiction may exercise their rights through the DPO contact details set out in Section 4.

19. Data Retention

20. Security Measures

EASEC implements technical and organisational security measures in accordance with its ISO 27001 certification, including:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Role-based access controls limiting data access to authorised personnel only
• Continuous monitoring, intrusion detection, and security event logging
• Secure cloud hosting environments (Google Cloud Platform, DigitalOcean) with geographic redundancy within the EEA
• Regular automated backups and tested recovery procedures
• Periodic security reviews and vulnerability assessments
• Incident response procedures aligned with GDPR 72-hour breach notification requirements
• Supplier security assessment for all third-party providers with access to personal data, including AI sub-processors
• Internal data protection training for all EASEC personnel

In the event of a personal data breach likely to result in a high risk to the rights and freedoms of individuals, EASEC will notify affected individuals without undue delay and will notify the Agencia Española de Protección de Datos (AEPD) within 72 hours.

21. Data Subject Rights

Requests may be submitted to info@easec.eu or directly to the DPO at mfernandez@easec.eu. EASEC will verify the identity of the requestor before processing and will respond within thirty (30) calendar days.

22. Cookies

EASEC uses cookies and similar tracking technologies on www.easec.eu. Cookie consent is managed through CookieYes, a GDPR-compliant Consent Management Platform.

You can manage your preferences at any time through the cookie settings panel available in the website footer.

Only strictly necessary cookies are activated without your consent. All other cookie categories — Analytics, Marketing, and Functional — require your explicit consent before being activated. For full details, refer to EASEC's Cookie Policy.

23. Research, Benchmarking, and Standard Development

EASEC may process assessment and certification data, exclusively in aggregated or pseudonymised form and never at an individually identifiable level, for the following purposes:

• Improving and validating psychometric assessment instruments and the EASEC AI Engine
• Developing international skills benchmarks and competency profiles aligned with ESCO, EQF, WEF, and Tuning frameworks
• Producing anonymised sector or regional reports on competency trends
• Advancing research on employability competencies in collaboration with academic or institutional partners
• Supporting the evolution of the EASEC certification standard
• Academic publications, conference contributions, and collaborative research projects

EASEC does not sell personal data. EASEC does not use personal data for behavioural advertising. Research outputs do not include any individually identifiable information. Individuals may configure their research processing preference through their EASEC Wallet account settings.

24. Changes to This Policy

EASEC may update this Privacy Policy to reflect changes in applicable law, operational practices, or the services offered. Material changes will be communicated by updating the "Last updated" date at the top of this Policy and, where appropriate, by direct notification to registered users or institutions.

Continued use of EASEC services following publication of an updated Policy constitutes acceptance of the revised terms. Prior versions may be obtained by contacting info@easec.eu.

25. Contact