Personal data processing policy

1. General provisions

This Policy sets how Ednice LLC processes personal data on the English-language site and platform. It works together with the Privacy policy, the Terms of use, the License agreement, the Public offer and the Student agreement. Cookie details are in the Cookie and analytics policy.

2. Controller

The controller is Ednice LLC, Office 2408, Mazaya Business Avenue BB2, Jumeirah Lakes Towers, Dubai, United Arab Emirates. Other details are on the contacts page. Personal-data requests: info@ednice.com.

3. Processing roles

Ednice is an independent controller when it:

• registers an author or student account on the platform;
• provides security, prevents abuse and gives support;
• provides information exchange for payments and performs the legal duties applicable to it;
• keeps its own records of requests and contractual relations with the user.

Where an author or school defines the purposes of processing their students’ and other users’ data, they are the controllers and Ednice processes that data on their instructions to run the platform. Substantive requests then go to the author; Ednice assists technically.

4. Categories of data subjects

• visitors to the public site;
• authors and school owners;
• students and buyers of authors’ products;
• webinar and consultation participants;
• author representatives contacting support;
• legal representatives of minors, if their data is provided for product access.

5. Purposes and legal bases

Ednice processes data to:

• register, sign in and maintain an account — performance of a contract and steps before it;
• provide access to courses, webinars, consultations and analytics — performance of a contract;
• take payments through the payment partner and settle with the author — contract and legal duties;
• provide support and investigate incidents — contract and legitimate interest in service security;
• send service notices about access, payment and security — performance of a contract;
• improve the site using anonymized statistics — legitimate interest;
• comply with applicable law, including the law of the United Arab Emirates — legal duty;
• protect sign-in and sign-up from automated registrations, password guessing and other abuse — the operator’s legitimate interest in service security.

Consent is requested where the law requires it. Reading the Privacy policy and this Policy at registration is not consent to marketing email if such email is introduced later.

6. Categories of data

Depending on the features used, processing may include:

• full name or display name;
• email, phone and other contact details;
• school name, seller details and author payout details without storing full card numbers;
• account, school, course, cohort and product identifiers;
• IP address and the approximate location derived from it, device, browser, session and security-event data, a device identifier and a derived hash of technical browser characteristics where full analytics consent is given, and the record of the chosen consent level;
• enrolment, attendance, progress and assignment results;
• messages, answers, uploaded files and other user materials;
• image, voice, audio and video when joining webinars and consultations;
• payment data: amount, status, product, payer, accepted document version;
• legal representative data for a minor, if provided for access;
• on the sign-in and sign-up forms — technical signals that help tell a person from a script: the number of key presses, taps and field switches without their content, the order in which fields were filled, the time taken to fill in the form and to pass the browser check, the device’s screen parameters, time zone, languages and number of CPU cores, and a derived hash of these parameters; field values and typed text are not recorded.

Special categories and biometric personal data are not required for registration. Do not upload them unless a feature is expressly designed for that processing.

7. Processing operations

Processing may be automated, non-automated or mixed. Ednice may collect, record, organise, store, update, retrieve, use, share with authorised persons and partners within this Policy, anonymise, restrict, delete and destroy data. Public disclosure of personal data is not a processing purpose unless the user published the information in a section available to them.

8. Place of processing

Ednice LLC is established in the United Arab Emirates. Hosting and infrastructure partners may process data where needed to run the site and platform. This Policy does not limit any rights you have under the law of your country of residence.

9. Sharing with third parties

Data may be shared with:

• hosting and infrastructure partners — to run the site and platform;
• the payment partner — to take payment and issue a receipt when required;
• email delivery services — for registration, access and support messages;
• the author or school — to the extent needed to perform the contract with the student;
• competent public authorities — on a lawful request.

A specific list of subprocessors for author-enabled features is provided in the dashboard or connection terms before they receive access to data.

10. Retention

Account data is kept while the account is active and needed to perform the contract or legal duties. When the processing purpose is achieved or consent is withdrawn, data is deleted unless a contract or law provides another basis to continue. Payment and document-acceptance records are retained to the extent and for the periods required for accounting, tax and contract purposes. Raw public-site analytics events are kept for 90 days, anonymized aggregates indefinitely, and the record of the chosen consent level for 3 years; the ed_consent cookie is kept for up to one year and the _ed device cookie for up to 400 days. See the Cookie and analytics policy. Records of sign-in and sign-up attempts collected to prevent abuse are kept for no longer than 12 months and are then deleted.

Where data is processed on an author’s instructions, export and deletion timelines follow those instructions and the contract with the author.

11. Your rights

You may:

• receive information about processing of your data;
• request correction, restriction or deletion if data is incomplete, outdated, unlawfully obtained or no longer needed for the stated purpose;
• withdraw consent where processing is based on consent;
• complain to a competent data-protection authority or a court;
• exercise other rights you have under the law of your country of residence.

Withdrawal of consent does not affect the lawfulness of processing before withdrawal and does not cancel retention required by law or to perform a contract.

12. How to submit a request

Send a request to info@ednice.com with the subject “Personal data” or via the contacts page. Include your name or dashboard display name, account email, information confirming your relationship with Ednice, the request and how you want the reply. We may ask for data sufficient to verify identity. We respond within a reasonable time. If the author is the controller for the relevant data, Ednice forwards the request without undue delay and informs the requester.

13. Security measures

Ednice applies access control, security-event logging, encrypted connections and other measures proportionate to the data. Employees and contractors with access must keep data confidential. If an incident is detected, Ednice contains and investigates it and notifies the people and authorities required by applicable law.

14. Policy changes

The current version is published on this page. For material changes Ednice publishes the updated text and, if required, notifies users or asks them to review it again in the dashboards.