TOPSKILLS LAB LIMITED

Privacy Notice — SkillSystem and Related Services

Version: 1.0 Effective date: 1 October 2026 Last updated: 4 October 2026

1. Introduction

This Privacy Notice explains how Topskills Lab Limited (“Topskills”, “we”, “us” or “our”) collects, uses, stores and shares personal data when you engage with our training, career development and consultancy services, or use SkillSystem, our online and mobile learning platform.

This Notice covers our websites, including topskillslab.com and skillsystem.live, SkillSystem mobile applications, learning workspaces, programme channels, joining forms, events and related support services (together, the “Services”).

“Personal data” means information relating to an identified or identifiable individual. “You” and “your” refer to learners, applicants, trainers, facilitators, institutional representatives, website visitors and other individuals whose personal data we process through the Services.

Topskills Lab Limited owns and operates SkillSystem. We act as a data controller where we determine why and how personal data is processed. Where we process information solely on an employer’s, institution’s or other client’s documented instructions, we act as a data processor. The relevant organisation’s privacy notice may also apply to those activities.

This Notice should be read alongside our separate Terms of Use and any programme-specific information provided to you. It does not replace our Terms of Use.

2. Personal data you provide

Depending on the Services you use, we may collect:

• Identity and contact details: your name, email address, telephone number and relevant profile information.
• Joining and enrolment information: the person who invited you, your employer or sponsoring institution, the programme you wish to join and information you provide to support approval of your request.
• Account information: account identifiers, authentication information, preferences, permissions and membership roles.
• Learning information: programme enrolments, responses to questions, assignments, assessment results, trainer feedback, attendance, progress, approvals and completion records.
• Evidence of learning: documents, photographs, audio, videos, templates and other work you submit to demonstrate learning or practical application.
• Conversations and support requests: messages, channel posts, feedback, survey responses and information supplied when contacting us.
• Career and professional information: qualifications, work experience, skills, career interests and application or interview information where you use a relevant service.
• Payment information: transaction references, amounts, payment status, access periods and relevant billing details.

We collect only information relevant to the service or purpose explained to you. Please keep your details accurate and tell us when they change. Before submitting another person’s information, ensure you have a lawful reason to do so and direct them to this Notice. Do not upload confidential employer, client or third-party information without appropriate permission.

3. Information collected through use of the Services

We may collect technical and usage information, including your IP address, browser or application version, device type, operating system, session information, pages or features used, error reports and activity relevant to account security and learning progress.

Where cookies or similar technologies are used, we distinguish technologies needed for essential functions, such as signing in, from optional analytics or marketing technologies. We explain optional technologies and obtain consent where required. You can manage available choices through the relevant controls or your browser settings. Disabling essential technologies may affect platform functionality.

Where a mobile feature requires access to your camera, microphone or files, we request the relevant device permission when needed. You can manage device permissions through your phone settings; withdrawing permission may prevent that feature from working.

4. Information received from others

We may receive relevant information from an employer, sponsoring institution, authorised inviter, trainer, payment provider or service partner. This may include enrolment details, sponsorship confirmation, training requirements or payment confirmation.

We use such information only where there is a lawful basis and an identified purpose. Where required, we inform you about the source and categories of information received.

5. How we use personal data

We use personal data to:

• Create and administer accounts, review joining requests and manage access to programmes and channels.
• Deliver training, learning conversations, assessments, feedback, practical activities and evidence-based approvals.
• Maintain learning and completion records and issue relevant confirmation or certificates where offered.
• Process payments, reconcile transactions and administer paid, sponsored, institutional or other agreed access arrangements.
• Respond to enquiries and provide support.
• Send account, security, payment, programme and service notices.
• Support agreed employer or institutional training reporting, within the limits explained to learners.
• Improve content, accessibility and platform performance using proportionate analysis.
• Prevent misuse, investigate security incidents and protect users and the Services.
• Meet legal obligations and establish, exercise or defend legal claims.
• Send optional promotional messages where we have an appropriate lawful basis and meet applicable consent requirements.

If we propose a new use that is incompatible with the original purpose, we provide further information and obtain consent or establish another lawful basis before proceeding.

6. Legal basis for processing

We process personal data under Kenya’s Data Protection Act, 2019, applicable regulations and other applicable laws. Depending on the activity, our basis may be:

• Contract: processing necessary to provide Services you request or take steps at your request before entering an agreement.
• Legal obligation: processing required to meet applicable legal duties.
• Legitimate interests: proportionate processing necessary to administer, secure or improve the Services, where your rights and interests do not override those interests.
• Consent: processing for an optional purpose where your informed consent is appropriate or legally required.

Where we rely on consent, you may withdraw it at any time through the relevant setting or by contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal. We do not treat acknowledgement of this Notice as consent to every processing activity.

7. Learning conversations and visibility

SkillSystem supports learning through conversations and shared activities. Posts, submissions and profile information may be visible to participants, trainers or administrators according to the workspace, channel or activity’s access settings. Please consider the intended audience before posting.

For employer-sponsored or institutional programmes, authorised representatives may receive agreed information such as enrolment, attendance, progress, completion and assessment outcomes. We explain the reporting scope before participation or before introducing a materially different reporting arrangement. Sponsorship does not automatically give an employer access to all your conversations or activity.

We do not publish identifiable learner work, testimonials, photographs or recordings for promotional purposes without an appropriate legal basis and any required separate permission.

8. Recordings, sensitive information and AI features

Where a session or support interaction will be recorded, we inform participants in advance about its purpose, intended audience and relevant retention arrangements, and obtain consent where required. Permission to record a learning session is separate from permission to use it in publicity.

Please avoid sharing sensitive personal information unless it is necessary for a clearly explained service. Where we need such information, for example to consider an accessibility request, we explain the purpose and apply the additional protections required by law.

If an AI-assisted feature is offered, we explain its role and any relevant external processing before use. Avoid entering confidential or sensitive third-party information into that feature. AI-generated responses may be inaccurate and should be checked. Where a decision is made solely through automated processing and has legal or similarly significant effects on you, we provide the information, safeguards and review opportunities required by applicable law.

9. How we share personal data

We may share relevant personal data with:

• Authorised employees, trainers and facilitators who need it to deliver or support the Services.
• Employers or institutions within the disclosed reporting arrangements for their programmes.
• Service providers supporting hosting, communications, payment processing, technical support or other necessary functions, subject to appropriate contractual and security requirements.
• Professional advisers where necessary for accounting, legal or related business purposes.
• Courts, regulators or law enforcement where disclosure is legally required or otherwise lawfully justified.
• Parties involved in a business restructuring, merger or transfer, with appropriate safeguards and notice where required.

We limit disclosures to what is necessary for the stated purpose. Payment providers process information under their own notices where they act as independent controllers. Enter payment credentials only through the designated secure payment process.

We do not sell personal data. We may use genuinely anonymised information for statistics and service improvement. Pseudonymised information remains personal data where it can be linked back to an individual.

10. International processing and transfers

Some providers may store or process information outside Kenya. Where this happens, we comply with applicable transfer requirements and put appropriate safeguards in place, including contractual protections or another lawful transfer mechanism. Where consent is required, we obtain it separately. You may contact us for information about relevant destinations and safeguards.

11. How long we retain information

We retain personal data only for as long as necessary for its purpose, applicable legal obligations or legitimate resolution of disputes. Retention depends on the type of record, the programme or contract, and relevant accounting or legal requirements.

Closing an account does not necessarily require immediate deletion of every record. We explain any continuing retention that applies and securely delete or anonymise information when it is no longer needed. Backup copies are removed through applicable backup retention cycles. You may request information about the retention period for a particular record.

12. Security

We use appropriate technical and organisational measures to protect personal data from unauthorised access, loss, alteration or disclosure. Measures are selected according to the nature of the information and the risks involved. Access is restricted to authorised persons and relevant service providers.

No online service is entirely risk-free. Keep your sign-in details confidential, use secure devices and report suspected unauthorised access promptly. Where a personal data breach occurs, we assess it and notify the relevant authorities and affected individuals as required by law.

13. Children

Where a programme is intended for children, we apply appropriate age verification, parental or guardian consent and safeguards required by applicable law, and process information in a manner that protects the child’s rights and best interests. A school’s enrolment process does not replace parental or guardian consent where that consent is legally required.

If you believe a child’s information has been collected without the required safeguards, contact us so that we can investigate and take appropriate action.

14. Your rights and choices

Subject to applicable law, you may request information about our use of your data, access your personal data, correct inaccurate or misleading information, object to processing, and request deletion where applicable. You may also request restriction or portability where the law provides those rights, withdraw consent for consent-based processing, and exercise applicable rights concerning significant automated decisions.

Contact us using the details below. We may request proportionate identity verification to protect your information and will respond within applicable legal timelines. Where a request cannot be fully fulfilled, we explain the reason and available complaint options.

You may complain to Kenya’s Office of the Data Protection Commissioner through https://www.odpc.go.ke/. You do not need to contact us first to exercise that right.

15. Marketing preferences

Where we request marketing consent, you can choose whether to receive promotional information about programmes, events or related services. You can unsubscribe through the instructions in a message, available account settings or by contacting us.

Declining marketing does not prevent participation in a programme. We may still send necessary account, payment, security and service messages.

16. External websites and services

The Services may link to external websites, payment pages or learning resources. Those services have their own privacy practices. Read their notices before providing personal information. This Notice applies to processing carried out by or on behalf of Topskills within its scope.

17. Changes to this Notice

We may update this Notice to reflect changes in the Services, processing activities or legal requirements. We show the revised version and effective date and provide appropriate notice of material changes. Where a change requires fresh consent, we obtain that consent before the relevant processing begins.

18. Contact us

Data controller: Topskills Lab Limited Platform: SkillSystem — https://skillsystem.live Company website: https://topskillslab.com Privacy contact email: support@topskillslab.com Telephone: +254708115433 Postal address: P.O. Box 14089-00400, Nairobi, Kenya Physical address: Limuru Road, Nairobi, Kenya

Please identify your request as a “Privacy request” and provide enough information for us to assist you without including unnecessary sensitive details.