Privacy Policy

Students and job seekers; university, employer, funder and partner staff; visitors and people who contact us; and guardians who act for a user. Third-party sites (Coursera, JobStreet, payment providers, AWS, university portals) have their own policies.

You give us: name, email, phone, country, billing country, university; CV, skills, certificates, target jobs, practice interviews, applications; AWS re/Start application and funding path; payment metadata; messages.

Automatically: device, IP, approximate location, logs, cookies.

From others: university seat lists; employer interview outcomes; JobStreet / board events; Impact / Coursera click or conversion IDs; payment and hosting events.

Do not upload another person's data unless you have the right. We may refuse NRIC / FIN / passport scans unless a law or licensed placement process requires them.

We use personal data to run accounts, matching, the three target-job tiles, applications, the certificate vault, Plus, Job Ready, practice tools and AWS re/Start; to show relevant profiles to employers, universities and funders; to take payment and allocate seats; to send you to an external course when we do not teach a skill; to send service messages and, where allowed, marketing with an unsubscribe; to improve and train our systems (including under the PDPA business-improvement exception where it fits); and for security, law, audit and corporate transactions.

Singapore law does not ban every "sale" of data. It requires a valid basis and a purpose a reasonable person would consider appropriate. We do not sell identifiable CVs on an open broker list. We do disclose and commercially use data as follows.

4.1 Identifiable data as part of the service. If you use matching, Apply, employer visibility, Job Ready or a cohort, we may disclose relevant profile data to employers, recruiters, your university or funder, AWS or track partners, JobStreet-type boards, and interview vendors. That is reasonably necessary to perform the contract and is also deemed consent by conduct. Withdraw it and we may be unable to match or place you.

4.2 Identifiable data we will not sell without a further yes. We will not sell or license a file of identifiable student records (name + email + CV) to an unrelated advertiser or broker unless you give separate, specific consent. Section 4.1 job matching is not that kind of sale.

4.3 Anonymised and aggregated data (not personal data). If you cannot be identified, and there is no serious possibility of identification from that data plus other information we or the recipient are likely to have, the PDPA does not apply. We may create, keep, use, license, commercialise and disclose anonymised or aggregated datasets without further consent — including to universities, ministries, employers, funders, partners, researchers and buyers of insights (skill rates, salary bands, funnels). We will not publish a cell so small a person can be singled out. If a set can reasonably be re-identified, we treat it as personal data again. Anonymised data may be kept indefinitely.

4.4 Vendors, law, corporate events. Hosting, email, analytics, payments, app infrastructure, AI providers, support and affiliate networks process data for us. Coursera is an independent controller when you study there. We may disclose data in a sale or merger of the company (under confidentiality) or if law requires it.

Automated tools parse CVs and certificates, score matches, recommend modules and run practice interviews. They do not guarantee a job or a salary. You can edit skills and swap target jobs. We may use personal data to improve those tools; we anonymise or aggregate first where we can. We instruct model providers not to train public models on your content where the product allows.

Staff, cloud, universities, employers and vendors may be outside Singapore (UK, EU, ASEAN, US and elsewhere). We transfer personal data out of Singapore only with PDPA-required steps so the recipient provides a comparable standard of protection.

Essential cookies run login and checkout. Analytics help us see what breaks. Marketing cookies, if used, measure campaigns. You can block non-essential cookies in the browser.

We keep personal data for the purposes above and then as needed for claims, tax, audit or cohort records (typically up to 7 years after last activity unless law requires longer). Practice recordings may be shorter.

Under the PDPA you may request access (including use/disclosure in the past year), correction, and withdrawal of consent on reasonable notice, and you may unsubscribe from marketing. Email the contact below. We aim to respond within 30 calendar days. You may complain to the PDPC. UK/EEA users may have extra GDPR rights; use the same contact.

AWS re/Start is aimed at users 19+. We do not knowingly collect data from children under 13. A university that enrols a minor must have authority to share that student's data.

We use measures appropriate to the data. No method is perfectly secure. We will notify the PDPC and affected individuals where the PDPA requires it.

We may update this Policy. Material changes that need new consent will be shown in-product or by email.

Data Protection Officer / privacy contact
SkillUp Global Pte Ltd
60 Paya Lebar Road, #06-28, Paya Lebar Square, Singapore 409051
privacy@skillup.global · Contact us