Pursuant to Articles 13 and 14 of the GDPR, this notice describes how users’ personal data is collected and processed.
Data controller: the platform operator. For privacy requests, use the contacts listed under "Contacts".
Types of data processed
- Identification and contact data
- Billing data (address, tax code, VAT number, certified email / SDI)
- Purchase data
- Technical data (logs/progress/events)
- Technical cookies and, where enabled, analytics/marketing preferences
Purposes
- Account management
- Purchases, payments, and invoicing
- Course delivery and tracking
- Legal compliance
- Support and operational communications
- Aggregated statistical analysis
Legal basis
- Contract
- Legal obligations
- Legitimate interest
- Consent for optional processing
Retention
Appropriate measures and retention periods proportionate to the purposes and legal obligations.
Recipients and transfers
Suppliers (hosting, payments, email) acting as processors; payments via external providers (e.g. Stripe); any extra-EU transfers in compliance with Chapter V GDPR.
Rights
Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent.
Cookies
Necessary technical cookies; analytics/marketing cookies only with consent.
Security
Technical and organizational measures with continuous improvement.
Privacy by design and by default
- Data minimization: we collect only what is strictly necessary.
- Separation of roles and sensitive databases (for example, learning data kept separate from payment data).
- Pseudonymization of identifiers for analytics or statistics.
- Configurable visibility levels (teacher, learner, administrator).
Logical and physical data security
- Strong authentication and secure password management (ideally OIDC/OAuth2 with a federated Identity Provider).
- Encryption of data in transit (TLS 1.3) and at rest (AES-256 or equivalent).
- Immutable logging and audit trails for all sensitive operations.
- Encrypted backups and documented disaster recovery policies.
- Periodic vulnerability tests and penetration testing.
In the event of a data breach, it must be possible to produce logs and a timeline for notification within 72 hours.
Changes
Updates are published on this page.
Contacts
Visit the Contact us page.
