We collect information you provide directly and information collected automatically when you use our services:
Account information: Email address, password hash, and any profile details you choose to provide
Payment information: Processed through our payment provider. We do not store credit card details.
Learning data: Course progress, challenge completions, flag submission records, exam timing and results
Contact form submissions: Name, email, company name, message content
Technical data: IP address, browser type, device information, pages visited
Newsletter subscriptions: Email address and consent status
3. How We Use Your Information
Provide access to courses, labs, and certification exams
Track your learning progress within the platform
Process payments and manage your account. After a purchase, we create an account using your checkout email if you do not already have one, and email you a password setup link.
Respond to contact form inquiries
Send service notifications (account, access, course updates)
Send marketing communications (only with your explicit consent)
Improve our platform based on usage patterns
4. Legal Basis for Processing (GDPR/nDSG)
We process data to deliver the services, meet legal duties, and protect the platform. Where the GDPR applies, the relevant bases include:
Legitimate interest: Platform security, fraud prevention, service improvement
Legal obligation: Tax and accounting records as required by Swiss law
5. Information Sharing
We do not sell your personal information. We share data only in these cases:
Stripe: Processes payments and provides purchase confirmations. We retain license and transaction references, but do not store card numbers.
Hetzner: Hosts the platform in Germany.
Hoststar: Delivers account, license, certificate, and support email.
Google Analytics: Receives usage information only if you accept analytics cookies.
External page assets: Google Fonts, Cloudflare, and StackPath receive connection data such as your IP address when your browser requests fonts, icons, or interface files from their networks.
Public certificate verification: Anyone with a certificate verification link can view the certificate holder’s name, certification, and issue information. Email addresses are not shown.
Legal requirements: When required by Swiss law or to protect our rights
6. Cookies
We use cookies for:
Essential cookies: Required for platform functionality (session management, authentication)
Analytics cookies: To understand how the platform is used (only with your consent)
You can at any time. Declining analytics does not affect course access.
7. Data Retention
Account data: Retained while your account is active. Deleted upon account deletion request.
Learning progress and certificates: Kept while your account is active. Account deletion removes these records and their public verification pages.
Invalid challenge submissions: Stored only as nonreversible hashes and removed after 30 days.
Backups: Encrypted backup copies are scheduled for removal after 180 days. Deleted data may remain in restricted backups until those copies expire.
Contact form submissions: Retained for up to 2 years
Payment records: Retained as required by Swiss tax and accounting law (10 years)
Server logs: Retained for up to 30 days
8. Your Rights
Subject to the conditions and exceptions in the Swiss Federal Act on Data Protection and, where applicable, the GDPR, you may:
Access: Request a copy of your personal data
Correction: Request correction of inaccurate data
Deletion: Request deletion of your account and associated data
Data portability: Receive your data in a structured format
Withdraw consent: Withdraw marketing consent at any time
Object: Object to processing based on legitimate interest
To exercise these rights, contact us at contact@endolum.io. You can delete your account directly through the academy platform settings. You can unsubscribe from marketing emails using the link in every email.
9. Data Security
We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS), access controls, and regular security reviews.
10. International Data Transfers
The Academy application and its primary database are hosted by Hetzner in Germany. Hoststar is based in Switzerland and provides email delivery. Stripe and Google may process data in other countries, including the United States. External page asset providers may also process connection data outside Switzerland.
Where applicable law requires a transfer safeguard, we use the safeguard made available in the relevant provider agreement, such as an adequacy decision, the Swiss-US Data Privacy Framework, or contractual clauses adapted for Switzerland.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated through the platform or by email. The "Last updated" date at the top indicates the most recent revision.
12. Contact
For privacy-related questions or to exercise your rights:
Essential cookies keep the site working. Optional analytics help us understand usage.
Analytics load only after you accept. Declining keeps the site available.
Learn more
