OSHA US
1. Overview and Scope
OSHA US is committed to safeguarding the personal information entrusted to us by learners, corporate safety directors, and credential verifiers. This Privacy Policy outlines our data governance standards and explains your choices regarding how your personal information is processed.
This policy governs data gathered through our training catalog, enrollment forms, inquiry desks, and customer support channels.
2. Information We Collect
We collect information directly from you when you register for courses, request group quotes, or submit inquiries:
- Contact and Identification Data: Full legal name, business title, company name, postal address, email address, and phone number.
- Academic and Training Records: Course enrollment selections, module completion percentages, test scores, attendance timestamps, and issue dates.
- Billing and Transaction Information: Payment card details, invoice addresses, and purchase histories processed through secure, PCI-DSS compliant payment gateways.
- Technical and Network Information: IP address, device type, browser user agent, referral source, and session timestamps collected automatically via server logs.
3. How We Use Your Information
We process personal information under legitimate business and educational bases, including:
- Administering safety education modules and tracking learner progress.
- Generating and authenticating verifiable completion credentials.
- Responding to corporate training inquiries and customer service tickets.
- Maintaining audit records required for curriculum accreditation reviews.
- Protecting platform integrity and preventing examination fraud.
4. Public Credential Verification Transparency
verify.oshaus.org.
When a third party enters an issued certificate ID (such as GSAC-001) into the public verification tool, the registry confirms:
- Recipient legal name
- Specific course standard completed (e.g., General Industry 10-Hour)
- Date of issue and credential validity status
- Accredited training facility
Sensitive personal data, such as email addresses, payment history, physical street addresses, and exam question details, are never made public in the verification lookup.
5. Data Sharing and Third-Party Disclosures
We do not sell, rent, or trade personal data to third parties for commercial advertising. We only disclose information under the following limited circumstances:
- Sponsoring Employers: When a business purchases training seats for employees, course progress and completion status are shared with that employer.
- Service Providers: Cloud infrastructure hosts, email delivery systems, and payment processors bound by strict confidentiality agreements.
- Legal Obligations: Compliance with subpoenas, court orders, or legitimate regulatory audits.
6. Data Retention and Security Standards
We retain credential verification records indefinitely to allow workers to prove qualification across employers over the course of their careers. Account transaction logs are retained in accordance with federal tax and accounting laws, typically 7 years.
All digital records are protected using industry-standard TLS 1.3 encryption in transit, AES-256 encryption at rest, role-based access control, and routine vulnerability audits.
7. Your Privacy Rights
Under California Consumer Privacy Act (CCPA), the General Data Protection Regulation (GDPR), and related state laws, you possess specific rights:
- Right to Know & Access: Request a copy of the personal information we hold about you.
- Right to Rectification: Request correction of inaccurate names or details on your profile.
- Right to Deletion: Request erasure of non-essential personal information, subject to mandatory educational record-keeping requirements.
- Right to Non-Discrimination: Equal service access without penalty for exercising privacy rights.
9. Privacy Officer Contact Details
To exercise privacy rights or submit questions regarding this policy, contact our Data Governance Officer:
OSHA US Privacy Office
Email: privacy@oshaus.org
Subject Line: Privacy Rights Request