Privacy Policy (GDPR)
Last updated: 2026-06-01
1. Data Controller
Certalyth Academy ("we") acts as the data controller for personal data in accordance with Regulation (EU) 2016/679 (GDPR). For any request regarding your personal data, contact us at contact@certalyth.academy.
2. What data we collect
We collect only the data needed to provide our services: your first and last name, email address, order and payment history (processed by Stripe), exam schedules and results, and issued certificates. We never store your card details; they are processed exclusively by Stripe.
3. Purpose and legal basis of processing
We process data to: create and manage your account (contract performance), process payments (contractual and legal obligation), run the online examination and issue certificates (contract performance), and send marketing communications (only with your explicit consent, which you may withdraw at any time).
4. Retention period
We keep account data for as long as your account is active. Payment and billing data are retained according to legal obligations (usually 10 years). Issued certificates are retained to allow public verification of their authenticity.
5. Your rights
You have the right of access, rectification, erasure ("right to be forgotten"), restriction, data portability, and the right to object. You may also lodge a complaint with the competent data protection supervisory authority. Exercise your rights by writing to contact@certalyth.academy.
6. Data sharing
We share data only with trusted, strictly necessary processors: Stripe (payment processing) and our cloud infrastructure providers. We do not sell or rent your data to third parties.
7. Data security
We apply appropriate technical and organizational measures: password hashing, secure communications (HTTPS), and access controls. However, no method of transmission over the internet is 100% secure.