SHIFT — Disruptive eLearning SH!FTDISRUPTIVE ELEARNING
Legal

Privacy Policy

Effective date: July 9, 2026 · Last updated: July 9, 2026

Aura Interactiva S.A. — which operates commercially as Aura Interactiva and its SHIFT eLearning brand ("SHIFT", "we", "us", or "our") — respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard personal data when you visit https://www.shiftelearning.com and its subdomains (the "Website"), contact us, or otherwise interact with us, and it describes the rights available to you under applicable data protection laws.

This Policy covers personal data we process as a data controller in connection with our Website and our sales, marketing, and support activities. It does not govern personal data that we process on behalf of our clients when they use our learning products and platforms; that processing is governed by the applicable services agreement and data processing agreement between SHIFT and the client. See "Client Platform Data and AI Processing" below.

By using the Website, you acknowledge that you have read and understood this Policy.

1. Who We Are

The data controller responsible for your personal data is:

Aura Interactiva S.A. (SHIFT eLearning), Costa Rica
Email: privacy@aura.cr / info@aura.cr

For data protection questions, including how to exercise your rights, contact us using the details in the "Contact Us" section at the end of this Policy.

2. Personal Data We Collect

Depending on how you interact with us, we may collect the following categories of personal data:

Information you provide directly

  • Identity and contact data: first and last name, email address, telephone number, employer/organization, job title, and country or region.
  • Message content: information you include when you fill in a form, request a demo or quote, subscribe to our newsletter, download a resource, apply for a role, or contact us by email, chat, or messaging channels.
  • Commercial data: records of your requests, purchases, and correspondence with our sales and support teams.

Information we collect automatically

  • Usage data: pages viewed, referring pages, time and date of access, time spent, links clicked, and similar interaction data.
  • Device and connection data: IP address, approximate location derived from IP, browser type and version, operating system, language settings, and unique device or session identifiers.
  • Cookie and similar-technology data: as described in the "Cookies and Tracking Technologies" section.

Information from third parties

  • Data from analytics, advertising, and marketing platforms; publicly available professional information; and referrals, where permitted by law.

We do not intentionally collect special categories of data (such as health, biometric, or racial/ethnic data) through the Website, and we ask that you not submit such data to us.

3. How We Use Personal Data

We use personal data for the following purposes, each supported by a lawful basis (see Section 4):

  • To respond to your inquiries, provide quotes and demos, and deliver requested resources.
  • To provide, maintain, and improve the Website and our services.
  • To manage our relationship with you and provide customer and technical support.
  • To send you newsletters, marketing communications, and information about products, services, and events similar to those you have shown interest in — where permitted, and always with an option to opt out.
  • To analyze and measure the performance of the Website and our marketing, and to understand how visitors use our content.
  • To personalize content and advertising and to conduct remarketing, subject to your consent where required.
  • To detect, prevent, and address security incidents, fraud, and technical issues.
  • To comply with legal obligations and to establish, exercise, or defend legal claims.

We will not use your personal data for purposes that are incompatible with those described here without informing you and, where required, obtaining your consent.

4. Legal Bases for Processing

Where the EU/UK General Data Protection Regulation (GDPR) applies, we rely on one or more of the following legal bases:

  • Consent — for example, for marketing emails and non-essential cookies. You may withdraw consent at any time.
  • Performance of a contract — to take steps at your request before entering into a contract and to fulfill our obligations to you.
  • Legitimate interests — to operate, secure, and improve our Website and business, provided these interests are not overridden by your rights.
  • Legal obligation — to comply with applicable laws.

Where Costa Rican law (Ley N.º 8968, Protección de la Persona frente al tratamiento de sus datos personales) applies, we process personal data based on your informed consent and the other bases permitted under that law and its regulations, under the oversight of the Agencia de Protección de Datos de los Habitantes (PRODHAB).

5. Cookies and Tracking Technologies

We use cookies and similar technologies (such as pixels, tags, and scripts) to operate the Website, remember your preferences, measure performance, and support marketing.

The categories we use are:

  • Strictly necessary — required for the Website to function and to keep it secure. These cannot be switched off in our systems.
  • Preference — remember choices you make (such as language) to personalize your experience.
  • Analytics/performance — help us understand how visitors use the Website so we can improve it.
  • Marketing/advertising — used to deliver relevant advertising and measure campaign effectiveness, including remarketing.

You can control cookies through your browser settings and, where offered, through our cookie preferences tool. If you disable certain cookies, some parts of the Website may not function properly. Because analytics and advertising cookies are set only where permitted, your choices in our consent banner (where displayed) determine whether non-essential cookies are used.

6. How We Share Personal Data

We do not sell your personal data for money. We share personal data only as described below:

  • Service providers (processors) who process data on our behalf under contract and only on our instructions — including providers of website hosting and CRM, email and marketing, analytics, advertising, customer messaging, and payment processing.
  • Professional advisers such as auditors, lawyers, and consultants, where necessary.
  • Authorities and other parties where required to comply with law, respond to lawful requests, enforce our terms, or protect our rights, users, or the public.
  • Corporate transactions — in connection with a merger, acquisition, or asset sale, subject to appropriate confidentiality protections.

Current categories of third-party providers we use include:

The specific providers we use may change over time as we update our tools; we maintain the categories above and update named providers when material changes occur.

7. Client Platform Data and AI Processing

SHIFT builds and delivers AI-powered learning products, authoring tools, and simulations. This section explains how automated and AI-based processing relates to your personal data.

On this Website. We may use automated tools and AI-assisted features to analyze Website usage, personalize content, qualify inquiries, and improve our marketing. Where such processing is based on your data, we rely on the legal bases described in Section 4 and apply appropriate safeguards. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing without a lawful basis and, where required, human review. You can contact us to request human intervention, express your point of view, or contest such a decision.

In our products and platforms. When our clients use SHIFT products to create, publish, distribute, or measure learning, they may process personal data of their own learners and users. In that context, SHIFT acts as a data processor on behalf of the client, who is the controller. Such processing — including any use of AI or machine learning features — is governed by the services agreement and data processing agreement with the client, not by this Website Policy. We process that data only on documented instructions from the client and do not use client or learner personal data to train general-purpose AI models for our own unrelated purposes without an appropriate legal basis and authorization. If you are a learner and have questions about how your data is handled inside a SHIFT platform, please contact the organization that provided your training; we will support them in responding to your request.

8. International Transfers

We operate globally, and your personal data may be transferred to and processed in countries other than your own — including Costa Rica and countries where our service providers operate — which may have different data protection laws.

When we transfer personal data internationally, we take steps to ensure it receives an adequate level of protection, including through recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), or transfers to jurisdictions recognized as providing adequate protection. You may request more information about the safeguards we use by contacting us.

9. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Policy, including to satisfy legal, accounting, or reporting requirements, resolve disputes, and enforce our agreements.

  • Inquiry and marketing data is retained while you remain an active contact and for a reasonable period afterward, or until you unsubscribe or ask us to delete it.
  • Usage and analytics data is generally retained for a shorter period, except where needed for security or to improve the Website, or where a longer retention period is legally required.

When personal data is no longer needed, we delete or anonymize it.

10. Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, or alteration. However, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security. If you have reason to believe your interaction with us is no longer secure, please contact us immediately.

11. Your Privacy Rights

Depending on where you live and which laws apply, you may have some or all of the following rights regarding your personal data.

Costa Rica (Ley N.º 8968). You have the rights of access, rectification, and deletion, and the right to object to or limit certain processing of your data. You may also file a complaint with PRODHAB.

European Economic Area and United Kingdom (GDPR). You have the right to:

  • Access the personal data we hold about you;
  • Request rectification of inaccurate or incomplete data;
  • Request erasure of your data;
  • Restrict or object to our processing;
  • Data portability, in a structured, commonly used, machine-readable format;
  • Withdraw consent at any time where processing is based on consent; and
  • Lodge a complaint with your local supervisory authority.

California (CCPA/CPRA). If you are a California resident, you have the right to:

  • Know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties with whom we share it;
  • Request deletion of your personal information;
  • Correct inaccurate personal information;
  • Opt out of the "sale" or "sharing" of personal information (including certain cross-context behavioral advertising) — you can exercise this by adjusting your cookie preferences and by using the opt-out links in Section 6; and
  • Not be discriminated against for exercising your rights.

We do not sell personal information for monetary value. Some cookie-based advertising may be considered a "sale" or "sharing" under California law; you can opt out as described above.

How to exercise your rights. Contact us using the details below. We may need to verify your identity before acting on your request, and you may use an authorized agent where the law permits. We will respond within the timeframes required by applicable law. These rights are not absolute and may be subject to legal exceptions.

12. Children's Privacy

The Website is intended for a business audience and is not directed to children under 18. We do not knowingly collect personal data from children under 18 through the Website. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

13. Third-Party Links

The Website may contain links to third-party websites and services that we do not operate or control. This Policy does not apply to those third parties, and we are not responsible for their content or privacy practices. We encourage you to review the privacy policies of any site you visit.

14. "Do Not Track" and Global Privacy Signals

Some browsers offer a "Do Not Track" (DNT) setting. Because there is no common industry standard for DNT, our Website does not currently respond to DNT signals. Where required by law, we honor recognized opt-out preference signals (such as Global Privacy Control) for opting out of the sale or sharing of personal information.

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technologies, or legal requirements. When we make material changes, we will post the updated Policy on this page, revise the "Last updated" date, and, where appropriate or required, notify you by email or a notice on the Website. We encourage you to review this Policy periodically.

16. Contact Us

If you have questions about this Policy or wish to exercise your privacy rights, please contact us:

We will do our best to resolve your concerns. If you are in the EEA/UK, you also have the right to complain to your local data protection authority; if you are in Costa Rica, you may contact PRODHAB.