Privacy Policy

1. Data we collect

• Account data: first/last name, username, password (hashed), internal e-mail.
• Identity data used for verification: date of birth, sex, national ID (CNP) where required by the employer.
• Activity data: course progress, scores, learning time.
• Technical data: IP address, device type, access logs.
• Biometric data (see the separate "Biometric Data" notice).

2. Why we use it (purposes & legal basis)

• Providing the course and your account — performance of a contract (Art. 6(1)(b) GDPR).
• Identity verification and fraud prevention — employer legitimate interest and explicit consent for biometric data (Art. 9(2)(a)).
• Compliance and reporting to your employer — legitimate interest / legal obligation.
• Platform security — legitimate interest.

3. Who we share with

Your data may be accessed by your employer (for progress and compliance reports) and by our service providers acting as processors: the identity-verification provider (Didit), the face-verification service (Amazon Web Services – Rekognition, EU region), hosting and e-mail. We do not sell your data.

4. How long we keep it

Account and activity data are kept while your account is active and for a reasonable period afterwards for legal obligations. Biometric data follows the "Biometric Data" notice. Exact periods: [RETENTION PERIODS].

5. Your rights

You have the rights described on the "GDPR" page (access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to the supervisory authority).

6. Security

We use encryption in transit and at rest, access control and logging. No system is 100% secure, but we apply appropriate technical and organisational measures.

7. Contact

For questions or data requests: [EMAIL CONTACT / CONTACT EMAIL]. Data Protection Officer (DPO): [EMAIL DPO / DPO EMAIL].