Privacy Policy

Introduction

This website is owned and operated by XED Institute of Management Pte. Ltd. (Singapore Company Registration Number: 2018166665G), from now on referred to as "XED". This Privacy Policy (the "Policy") applies to information that we collect through the XED Website (the "Site", which consists of all content and pages located within the xed.io web domain, the Atrium learner portal at atrium.xed.io, and the Atrium mobile application), the information provided during telephone communications, the information we collect from websites of our University partners, and information we collect from our referral partners. This Policy does not apply to information that we may collect from you in other ways (for example, this Policy does not apply to information that you may provide to us by fax or through conventional mail).

For purposes of this Policy, "Personal Data" means your personal data and any third party's personal data such as the personal data of your parents.

We may log the IP address, operating system, and browser software used by each user of the Site, and we may be able to determine from an IP address a user's Internet Service Provider and the geographic location of his or her point of connectivity. Various web analytics tools are used to collect this information. Some of the data is collected through cookies. If you reject our cookies, many functions and conveniences of this Site may not work correctly. Although user sessions are tracked, a user remains anonymous.

As a responsible private educational institution, XED is committed to maintaining a high standard of confidentiality with respect to the Personal Data of our students, alumni, employees, and faculty in accordance with the requirements of the Personal Data Protection Act 2012 (the "PDPA"), Singapore. For more information about the PDPA, please visit the Personal Data Protection Commission's website at https://www.pdpc.gov.sg.

Our courses are delivered to students from many different countries – in recognition of this, we endeavor to process all data in accordance with principles of internationally accepted best practices, and in compliance with the legal provisions relating to data protection in Singapore. We regularly review our compliance with this Policy and whenever we receive a formal complaint, we will contact the person who made the complaint to attempt to resolve his or her concerns.

To safeguard your Personal Data, all electronic storage and transmission of Personal Data are secured with appropriate security technologies.

By reading this Policy and submitting any application or applying for any of our products or services, you hereby agree to this Policy and consent to our collection, use, and disclosure of your Personal Data.

Information We Collect

When you create an account and sign in to Atrium, whether on the web or in our mobile application, we collect your email address. If you sign in with Google, Google confirms your identity and also shares your name and profile picture with us. We record your enrollments and your progress through your course.

When you enquire about a program or apply for one on our website, we collect your full name, email address and telephone number from the form you submit, so that we can respond to you and enroll you.

When you use the Learning Coach, we collect the questions you ask and the coach's replies. If you turn on voice mode, we also collect the audio you record while voice mode is switched on. We use this to answer your questions and support your learning on your program.

When you are offered a place on a program, you complete your enrollment and pay through the Atrium learner portal. The payment itself is taken by our payment providers on their own checkout pages, where you enter your payment details; they tell us the outcome, and we keep a record of the payment and of the terms you accepted when making it. Payments are not taken inside the mobile application.

We use the following service providers: Supabase, which stores your sign-in credentials and authenticates you; Google, where you choose to sign in with your Google account; Stripe and Razorpay, which process payments made on our website; our email provider, which delivers the messages we send you, including account confirmation and deletion codes; and the AI service providers that operate the Learning Coach, which receive your questions and, in voice mode, your audio, so that the coach can understand you and reply.

We do not sell your Personal Data, and we do not use it for advertising.

Deleting Your Account

You may permanently delete your XED account at any time.

In the Atrium mobile app, open Account and choose Delete account. You do not need the app to do this: you can also request deletion at https://atrium.xed.io/delete-account. In both cases we email a confirmation code to your registered address, and deletion proceeds only once you enter it.

If you were enrolled by your employer or organization, we may not be able to delete your account here. If that applies to you, the app and the deletion page will tell you, and you can request deletion of your account and personal data through your employer's or organization's HR team, or by writing to support@xed.io.

When you delete your account, your sign-in and the personal details we hold about you are permanently removed. Your name, email address and telephone number are deleted, and you lose access to your cohorts, course materials and certificates. This cannot be undone.

You are free to sign up again later using the same email address, but that creates a new account: your earlier enrollments, course progress and certificates are not restored, and we cannot recover them for you.

What We Keep After Deletion

We retain records of enrollments and payments after an account is deleted, because we are required to keep them for legal, accounting, tax and reporting purposes. Before they are retained, the fields that identify you – your name, email address and telephone number – are permanently removed and replaced with a placeholder, so that what remains records a transaction and not a person. We keep these records for as long as the law requires us to, which for accounting and tax records is five years.

Your Rights and How to Contact Us

Under the PDPA you may ask us for access to the Personal Data we hold about you, ask us to correct it if it is inaccurate, and withdraw your consent to our collecting, using or disclosing it. To make any of these requests, or to ask a question about this Policy, write to support@xed.io. Our Data Protection Officer can be reached at the same address.

We protect your Personal Data with access controls, encryption in transit, and restrictions on who inside XED can see it.

Some of our service providers store or process Personal Data outside Singapore. Where that happens, we take steps to ensure it is given a standard of protection comparable to that required under the PDPA.

Data Breach Notification

If we become aware that a data breach has occurred involving Personal Data in our possession or control, we will assess, in a reasonable and expeditious manner, whether the breach is likely to result in significant harm to any affected individual, or affects 500 or more individuals.

Where we assess that the breach meets either of these thresholds, we will notify the Personal Data Protection Commission (PDPC) as soon as practicable, and in any case no later than 3 calendar days after completing that assessment. Where the breach is likely to result in significant harm to affected individuals, we will also notify those individuals, at the same time as or after notifying the PDPC.

Notifying us of a suspected data breach, or asking about our data breach response, can be done by writing to support@xed.io.

Last updated: 19 August 2026