Privacy Policy

The Chartered Institute of Lean Six Sigma LLC ("CILS," "we," "us," or "our") is a Delaware limited liability company and a global professional body serving Lean Six Sigma practitioners, learners, members, candidates, organizations, partners, assessors, mentors, speakers, and website visitors.

This Privacy Policy explains how CILS collects, uses, discloses, retains, and protects personal information through www.cilsglobal.com and any CILS page, portal, membership application, professional directory, credential-verification service, learning or assessment service, CPD feature, event, publication, communication, AI tool, or other service that links to this Policy (collectively, the "Services"). It covers relevant online and offline information practices.

This Policy does not govern an independent website, payment service, social-media platform, videoconferencing provider, learning platform, or other third-party service that displays its own privacy notice. When CILS processes personal information solely on behalf of an employer, training provider, educational institution, event organizer, or other customer, that organization may be responsible for the information and its own privacy notice may also apply.

"Personal information" or "personal data" means information linked or reasonably linkable to an identified or identifiable individual. It does not include information that has been lawfully made public or de-identified so that it cannot reasonably be linked to an individual. Depending on how a person uses the Services, CILS may collect the following categories:

CILS may collect personal information from the following sources:

• Directly from the individual, including through a form, account, membership or certification application, payment, examination, assignment, event, email, survey, complaint, or other interaction.
• From an organization or person acting with authority, such as an employer, sponsor, training provider, educational institution, referee, assessor, mentor, event organizer, authorized agent, or parent/guardian.
• Automatically through the Services, including cookies, server logs, security tools, analytics technologies, and similar mechanisms.
• From service providers and partners, such as payment processors, identity or exam-integrity providers, learning platforms, communications providers, or event systems.
• From public or professional sources, such as an employer website, professional profile, publication, conference biography, public registry, or information that an individual has intentionally made public.

CILS uses personal information for the following business and operational purposes:

• Provide the Services. Create accounts; receive and review applications; deliver membership benefits, learning, examinations, assessments, mentoring, events, resources, and support.
• Administer membership and professional standing. Evaluate eligibility; manage categories, renewals, CPD, designations, directories, complaints, appeals, conduct, and disciplinary processes.
• Administer assessments and credentials. Register candidates; confirm identity; maintain assessment integrity; score or review work; make certification decisions; issue certificates or digital badges; and verify credentials.
• Process transactions. Calculate and collect fees, issue receipts and invoices, process refunds, maintain financial records, and prevent payment fraud.
• Communicate. Respond to inquiries, deliver account and service notices, provide event or program information, request feedback, and send marketing communications where permitted.
• Operate public registers and verification tools. Allow employers, clients, regulators, or members of the public to confirm the authenticity and current status of a membership or credential.
• Protect people, systems, and integrity. Authenticate users, secure accounts, detect malicious activity, investigate suspected fraud or misconduct, enforce rules, protect intellectual property, and preserve examination confidentiality.
• Improve quality and accessibility. Analyze service performance, troubleshoot errors, conduct audits, evaluate program effectiveness, develop resources, and improve user experience. CILS uses aggregated or de-identified information where reasonably possible.
• Meet legal and governance obligations. Comply with tax, accounting, corporate, consumer-protection, privacy, security, sanctions, law-enforcement, accreditation, dispute, and recordkeeping requirements.
• Support organizational changes. Evaluate or complete a merger, reorganization, financing, acquisition, transfer, insolvency, or sale of all or part of the organization, subject to appropriate protections.

CILS does not disclose personal information indiscriminately. It may disclose the minimum information reasonably necessary to the following categories of recipients:

• Technology and hosting providers. Website, application, database, cloud hosting, storage, cybersecurity, authentication, backup, analytics, and technical-support providers.
• Professional-service providers. Accountants, auditors, insurers, attorneys, consultants, accreditation or quality-assurance reviewers, and other advisers bound by appropriate duties.
• Payment and transaction providers. Payment processors, banks, invoicing providers, and fraud-prevention services needed to complete or protect a transaction.
• Assessment and credential providers. Authorized assessors, proctors, identity or integrity-check providers, digital-badge platforms, learning-management systems, certificate-production services, and verification systems.
• Program, event, and communications providers. Email and newsletter services, videoconferencing systems, event platforms, survey tools, mentors, speakers, and authorized program partners.
• Employers, sponsors, and institutional customers. An organization that purchased, sponsored, or legitimately administers an individual's membership, program, assessment, or event, subject to the organization's authority, the individual's expectations, and applicable law.
• The public. Limited data in a credential-verification tool or professional directory, as explained in Section 9. CILS does not publish supporting identity documents, exam responses, payment data, or private contact details.
• Authorities and protected parties. Courts, regulators, law-enforcement bodies, government agencies, or other persons when disclosure is required by law or reasonably necessary to protect rights, safety, systems, users, or the public.
• Transaction counterparties. Potential or actual parties and advisers involved in an organizational transaction, subject to confidentiality and lawful-use restrictions.
• Recipients chosen by the individual. Any person or organization the individual directs or authorizes CILS to contact or disclose information to.

The Services may use cookies, local storage, pixels, software development kits, server logs, and similar technologies. These technologies may be set by CILS or by a service provider and may serve the following purposes:

• Strictly necessary. Enable core functions, maintain sessions, authenticate accounts, balance traffic, process requests, prevent fraud, and protect the Services.
• Preferences and functionality. Remember choices such as language, region, display, or consent preferences.
• Analytics and performance. Understand aggregated use, diagnose errors, measure content or campaign performance, and improve the Services.
• Embedded content and communications. Operate video, maps, forms, social-media content, chat, email, or event features requested by a user.

CILS retains personal information only for as long as reasonably necessary for the purposes described in this Policy, including the integrity and verification of professional credentials, and as required by law. Retention may be extended for an active dispute, audit, legal hold, fraud investigation, safety matter, or other lawful need. When information is no longer needed, CILS deletes, anonymizes, or securely isolates it. The following are general periods and may be adjusted when the circumstances or law require:

To protect the public, support professional recognition, and reduce credential fraud, CILS may maintain a public or request-based verification record. The record may show a person's name, approved designation, membership or credential number, category or level, current status, issue date, expiry date, and any minimum status information required for accurate verification.

A broader professional directory profile, biography, photograph, employer, location, or contact link is published only when the member elects or otherwise authorizes publication. A person may ask CILS to correct inaccurate public information or remove optional profile content. CILS may retain and continue to disclose the minimum verification record when reasonably necessary to confirm an authentic, expired, suspended, revoked, or historical credential and prevent misleading claims.

CILS uses reasonable administrative, technical, and physical safeguards appropriate to the nature and volume of the information processed. Measures may include access controls, role-based permissions, encryption in transit, secure hosting, authentication controls, logging, backups, vendor review, confidentiality obligations, staff awareness, incident response, and data minimization.

CILS limits access to examination materials, candidate records, personal information, project evidence, client information, and other confidential content to persons with a legitimate need. Where practicable, project and case-study data should be anonymized before being used for learning, quality review, or publication.

No method of transmission, storage, or security is completely reliable. CILS cannot guarantee absolute security. Users are responsible for keeping passwords confidential, using strong and unique credentials, signing out of shared devices, and promptly reporting suspected unauthorized access to connect@cilsglobal.com.

Depending on residence and applicable law, an individual may have some or all of the following rights:

• Confirm and access. Confirm whether CILS processes personal information and obtain access to it, subject to lawful exceptions.
• Know. Receive information about categories collected, purposes, sources, categories disclosed, and categories of third parties.
• Correct. Request correction of inaccurate personal information.
• Delete. Request deletion, subject to exceptions such as completing a transaction, maintaining credential integrity, security, legal obligations, and claims.
• Portability. Receive certain information in a portable and, where technically feasible, readily usable format.
• Third-party categories. Request a list of categories of third parties to which personal data has been disclosed, where applicable law provides that right.
• Opt out. Opt out of sale, targeted advertising, cross-context behavioral advertising, or qualifying profiling. CILS does not currently engage in these activities.
• Limit or withdraw consent. Limit certain uses of sensitive information or withdraw consent where processing is based on consent.
• Object or restrict. Object to or request restriction of certain processing where applicable outside the United States.
• Appeal. Appeal CILS's refusal to act on an eligible privacy request.
• Non-discrimination. Exercise privacy rights without unlawful denial of service, retaliation, or discriminatory price or quality.
• Complaint. Complain to an applicable privacy or consumer-protection authority.

CILS makes this Policy conspicuously available to describe its practices under the Delaware Online Privacy and Protection Act and, where its applicability thresholds are met, the Delaware Personal Data Privacy Act (DPDPA). Sections 2 through 6 identify the categories of personal data processed, purposes, categories disclosed, categories of recipients, review and correction process, change-notice process, effective date, online tracking disclosures, and contact mechanism.

A Delaware consumer may, where the DPDPA applies, confirm and access processing, correct inaccuracies, request deletion, obtain portable data, obtain categories of third parties, and opt out of targeted advertising, sale, or qualifying profiling. CILS obtains consent before processing sensitive data when required, allows consent to be revoked, and does not knowingly sell or use for targeted advertising the data of a person known to be between 13 and 17 years old without legally required consent.

The request, response, verification, authorized-agent, and appeal procedures are stated in Section 11. Delaware residents may also obtain information from the Delaware Department of Justice Personal Data Privacy Portal at attorneygeneral.delaware.gov/fraud/personal-data-privacy-portal/.

The Services are intended primarily for adults and professionals and are not directed to children under 13. CILS does not knowingly collect personal information online from a child under 13 without verifiable parental consent as required by the Children's Online Privacy Protection Act (COPPA). If CILS learns that it collected such information without required consent, it will take reasonable steps to delete it.

A person under 18 may use a Service only when the relevant program permits and with the authorization of a parent or lawful guardian where required. Parents or guardians may contact connect@cilsglobal.com to ask about, review, correct, or request deletion of a child's information. CILS does not knowingly sell a minor's information or use it for targeted advertising.

CILS is a professional institute and is not necessarily an educational agency or institution subject to the U.S. Family Educational Rights and Privacy Act (FERPA). When CILS receives FERPA-covered education records from a school or institution as an authorized service provider, CILS processes those records only as permitted by the applicable agreement and law, maintains appropriate controls, and does not use or redisclose them for an independent purpose unless authorized or legally permitted.

CILS may send news, event notices, professional resources, membership information, and service offers when permitted by law. A recipient may unsubscribe through the link in a marketing email or by contacting connect@cilsglobal.com. CILS will process the request promptly and maintain a minimal suppression record so the preference is respected. An opt-out from marketing does not stop transactional or service communications such as account, payment, membership, exam, certificate, security, or legal notices.

CILS operates from the United States and serves an international community. Personal information may be processed in the United States and in other countries where CILS, its authorized personnel, partners, or service providers operate. Privacy laws in those countries may differ from the law in the individual's country.

Where required, CILS uses an appropriate transfer mechanism or safeguard, such as contractual data-protection terms, recognized standard contractual clauses, adequacy decisions, consent, or another lawful basis. CILS also applies the purpose limitation, security, retention, and access controls described in this Policy to transferred information.

CILS maintains processes to assess and respond to suspected unauthorized access, use, modification, disclosure, loss, or destruction of personal information. If an incident requires notice under applicable law, CILS will notify affected individuals and relevant authorities within the legally required period and provide information reasonably necessary to understand the incident and protective steps.

The Services may link to or integrate independent websites and services. CILS does not control their privacy, security, availability, or content. Users should review the privacy notice and settings of each third party before providing information. A link or integration does not mean that CILS is responsible for the third party's practices.

CILS may update this Policy to reflect changes in the Services, technology, law, or organizational practices. The revised Policy will be posted with a new "Last updated" date. For a material change, CILS will provide additional notice reasonably appropriate to the change, such as a prominent website notice, account notice, or email, before the change takes effect where required. Earlier versions may be requested through the contact details below.

For privacy questions, requests, complaints, or security concerns, contact:

CILS will make reasonable efforts to resolve a complaint. An individual may also contact the privacy, consumer-protection, or data-protection authority with jurisdiction over the matter. Delaware residents may contact the Delaware Department of Justice; California residents may contact the California Privacy Protection Agency or California Attorney General.