DataCamp

GDPR overview

GDPR implementation is concrete and documented. DataCamp Belgium BV, company number 0542351249, Martelarenlaan 38, 3010 Kessel-Lo Leuven, Belgium, is named as the EU representative, with DataCamp, Inc. as controller. Transfers outside the EEA, Switzerland and the United Kingdom, principally to the United States, rely on the applicable Standard Contractual Clauses. Rights of access, rectification, erasure, portability, objection and restriction are set out, alongside an absolute right to opt out of direct marketing and marketing profiling, and a route to complain to a local supervisory authority. A Data Processing Addendum is published and incorporated into the Terms of Use, and both privacy@datacamp.com and a dedicated privacy form are offered. No personal data is knowingly gathered from children under 13. The site never writes the words GDPR compliant outright, but every substantive mechanism is in place.

Who owns the data?

DataCamp, Inc., a Delaware corporation headquartered in New York, owns and operates the websites, the e-learning platform and the mobile application, and acts as the data controller for European purposes. Three wholly-owned subsidiaries form the wider group with which data may be shared: Data Science Central UK Ltd., DataCamp Belgium BV and Optima Learning Technologies FZ-LLC. Learners keep rights over their own User Content, and organisations can edit their company details directly in account settings. An account and its data can be deleted permanently from those settings, while records that cannot be removed there are handled through the dedicated privacy contact form.

Reuse rights

DataCamp collects registration and support details, learning history and exercise submissions. Section 10 of the privacy policy governs artificial intelligence: inputs submitted to AI-Native Features, together with the surrounding exercise context, are processed by AI systems, and personal data such as a learner's name, learning history and past submissions may be transmitted to third-party large language model providers. DataCamp may use exercise submissions, inputs and outputs to train AI models and improve its services, and learners can opt out at any time through a documented help-centre procedure, although content flagged for safety review stays in scope and the opt-out never extends to third-party platforms. Data also feeds direct marketing, mobile notifications and targeted advertising delivered through Facebook, Google and other ad networks, with customer.io handling communication channels. Under the CCPA, sharing with advertising partners may qualify as a sale, and a Do Not Sell page is provided. End users cannot freely reuse the platform's own course material, which remains DataCamp's property.

Data retention & training

Hosting summary

Learner data is stored in the United States. The sign-up screen states it plainly, and the privacy policy confirms that personal data may be transferred outside the European Economic Area, Switzerland and the United Kingdom, principally to the US. Those transfers rely on the applicable Standard Contractual Clauses, whether the recipient is a group company or a third-party service provider. DataCamp says personal data is held only on access-restricted servers inside controlled facilities, encrypted at rest and in transit, with single sign-on, multi-factor authentication and directory sync available through Okta, Microsoft and other identity providers. ISO 27001:2017 certification is claimed on both the DataLab pages and the Trust Center, where the subprocessor list, including AI and LLM providers, is published. One caveat for anyone checking the infrastructure themselves: the domain resolves to a CloudFront edge node in Zurich, which reflects content delivery and not the jurisdiction where data is actually held.