UNODC SPARK

SPARK is the e-learning platform of the United Nations Office on Drugs and Crime (UNODC), run by its Learning and Innovation Programme. This policy explains what personal data the platform holds about you, why it holds it, who else can see it, and how you can ask us to change or remove it.

In short: we hold the details you give us when you register, a record of the courses you take and how far you get in them, and technical logs of your visits. We use that to give you access to courses, to issue certificates, and to understand which material is being used. We do not sell personal data and we do not use it for advertising.

Who is responsible for this platform

SPARK (elearningunodc.org) is operated by the Learning and Innovation Programme of the United Nations Office on Drugs and Crime (UNODC), Vienna International Centre, P.O. Box 500, 1400 Vienna, Austria.

Questions about this policy, or about the personal data the platform holds about you, can be sent to unodc-elearning@un.org.

The framework this policy follows

UNODC is part of the United Nations. As such it is not subject to national or regional data protection legislation; instead it applies the United Nations Personal Data Protection and Privacy Principles adopted by the High-Level Committee on Management in October 2018. Those principles require, among other things, that personal data be processed fairly, for specified purposes, only to the extent necessary, kept accurate, retained no longer than needed, and held securely.

Nothing in this policy waives the privileges and immunities of the United Nations.

What personal data the platform holds

Data you provide

• Account details — your name, email address, and the country, institution and professional role you enter when registering. Some of these are required to create an account; the rest are optional and can be left blank or removed later.
• Profile content — anything you choose to add to your profile, such as a description or a profile picture.
• Contributions — posts you write in course forums, answers you submit in quizzes and activities, and files you upload as part of a course.

Data the platform records as you use it

• Course activity — which courses you are enrolled in, which activities you have opened and completed, your progress and your results.
• Certificates — the certificates issued to you, including your name as it appears on them and the date of issue. Certificates carry a verification code so that a third party you show one to can confirm it is genuine.
• Technical logs — the pages you request, the time of the request, your IP address and your browser's user agent string. Moodle keeps these to let administrators trace problems and investigate misuse.

Why the platform holds it

• To give you access to the courses you enrol in and to record your progress.
• To issue and verify certificates of completion.
• To send you messages about courses you are enrolled in, and to answer you when you contact us.
• To understand which material is being used, so that the programme can decide what to improve or retire.
• To keep the platform secure and to investigate misuse.

We do not sell personal data, we do not share it for advertising, and we do not use it to build profiles for any purpose other than showing you your own learning progress.

Who else can see your data

• Course teachers and facilitators see the participation, submissions and results of the learners in their own courses.
• Other participants see what you post in shared spaces such as forums, and the parts of your profile you have chosen to make visible.
• Platform administrators at UNODC can access account and activity data where needed to run the platform and to support you.
• Partner institutions that sponsor a particular course or cohort may receive participation and completion figures for that group. Where this applies, it is stated on the course itself.

Services outside the platform

SPARK is hosted in Europe and its web analytics run on UNODC's own infrastructure. A small number of components are nevertheless loaded from, or send data to, services outside it:

• Web analytics (Matomo) — self-hosted at analytics.elearningunodc.org. Usage statistics stay on UNODC infrastructure and are not shared with an analytics provider. See the Cookie Policy for the cookies this sets. 
• Content delivery networks — some scripts and stylesheets are loaded from cdn.jsdelivr.net and cdnjs.cloudflare.com. Requesting a file from those services discloses your IP address and browser to them. They are used to deliver files only; they receive no account or course data.
• Video meetings — where a course includes a live webinar, the meeting itself runs on Zoom, and the data you provide when joining is processed by Zoom Video Communications under its own terms. 
• Mobile app stores — links to the SPARK mobile app point to Apple's App Store and Google Play. Following one takes you to that provider, where its own terms apply.

How long data is kept

Certificates and the records that prove them are kept longer than ordinary account data, because their purpose is to remain verifiable after a course has ended.

Your rights over your data

You may ask us to:

• tell you what personal data the platform holds about you;
• correct anything that is wrong;
• delete your account and the personal data attached to it.

Some of this you can do yourself: your profile is editable at any time from your account, and the platform's privacy tools let you request a copy of your data or its deletion under Profile → Privacy and policies → Data requests.

Deletion has limits we should be honest about. Contributions you have made to shared spaces, such as forum discussions, may remain where removing them would break a conversation others took part in; where that applies, they are detached from your name. Records that prove an issued certificate are kept so that the certificate stays verifiable.

Security

The platform is served over encrypted connections (HTTPS), passwords are stored only as cryptographic hashes, and administrative access is limited to the staff who need it. No system is perfectly secure, and we do not claim otherwise; if a breach affects your data, UNODC will act on it under the UN system's procedures for such incidents.

Changes to this policy

When this policy changes materially, the platform will ask you to review the new version the next time you sign in. Earlier versions remain on record.