Privacy Policy

This notice explains what personal data we process, why we process it, who may receive it, how long we keep it and the choices available to you.

Last updated: August 24, 2026

1. Controller and contact

The controller is Paul Danci, trading as ISO 26262 Academy, Am Feger 3, 71063 Sindelfingen, Germany.

Privacy requests and questions can be sent to [email protected]. Further legal contact information is in our Impressum.

2. Personal data we process

Account and identity data, such as your name, email address, organisation, role and sign-in information
Learning and assessment data, such as progress, bookmarks, exam attempts, answers, scores, certificates and submitted work products
Billing and transaction records; payment-card details are entered with the payment provider and are not stored by us
Communications and content you send, including support requests, feedback, comments and uploaded files
Technical, security and usage data, such as IP address, browser and device information, authentication events, pages and features used, and diagnostic interaction data
AI feature inputs and outputs when you use a feature that requires automated grading or content generation

Diagnostic interaction data may reproduce navigation and feature use in the signed-in service. Fields intended for passwords or user-entered content are excluded or masked. We do not use this data for advertising.

3. Sources of personal data

We receive data from you, from an organisation that invites you to its workspace, from an identity provider you choose, from payment and communication providers, and automatically from your browser or device when you use the service.

4. Purposes and legal bases

Purpose	Legal basis
Create and administer accounts; provide courses, assessments, certificates and team workspaces	Performance of a contract or steps requested before entering a contract (Article 6(1)(b) GDPR)
Process subscriptions, invoices and related business records	Performance of a contract and compliance with legal obligations (Articles 6(1)(b) and 6(1)(c))
Protect accounts, prevent abuse, diagnose faults and maintain the reliability of the service	Our legitimate interests in providing a secure and dependable service (Article 6(1)(f))
Understand service usage and improve content and product features	Consent for optional device storage and, where no consent is required, our legitimate interests in service improvement (Articles 6(1)(a) and 6(1)(f))
Send service messages and respond to requests	Performance of a contract and our legitimate interests in customer support (Articles 6(1)(b) and 6(1)(f))
Send marketing messages	Consent where required (Article 6(1)(a)); you may unsubscribe at any time
Provide automated grading and other AI-assisted features	Performance of a contract for core features, or consent where a feature is optional (Articles 6(1)(b) and 6(1)(a))

Our legitimate interests are service security, fraud prevention, support, reliability and proportionate product improvement. We balance those interests against your rights and provide an objection route below.

5. Recipients

We disclose personal data only where needed to operate the service, follow your or an organisation's instructions, or meet a legal obligation. Recipient categories are:

EU-based hosting, storage and infrastructure providers
Payment and fraud-prevention providers
Email delivery and customer-communication providers
Analytics, service-monitoring and technical-support providers
Identity providers when you choose a third-party sign-in option
AI service providers when an AI-assisted feature is used
Network-security, content-delivery and bot-protection providers
Systems selected and configured by an organisation for its own workspace

We do not sell personal data or disclose it to advertising networks. A current list of processors, their locations and their functions is available by emailing [email protected].

6. International transfers

Our primary service infrastructure is located in the European Union. Some provider categories, including payments, communications, identity, network security and AI services, may process data outside the European Economic Area.

Where required, transfers rely on an adequacy decision, the EU-US Data Privacy Framework for participating providers, or Standard Contractual Clauses together with supplementary safeguards. You can request the applicable safeguard for a particular transfer using the contact address above.

7. Retention

Account data: while the account is active and thereafter only as needed for closure, disputes or legal obligations
Learning records and certificates: for the subscription term and generally up to three years afterwards for continuity and verification
Billing and tax records: for the statutory retention period, which may be up to ten years
Support and business communications: generally up to three years
Short-lived interaction diagnostics: up to 30 days
Operational error and security records: generally up to 90 days, unless an incident requires longer preservation
Backups: until overwritten in the ordinary backup cycle

We may retain specific records longer where law, a legal claim, fraud prevention or an active security investigation requires it. Data held by a provider is also subject to the provider's contractually agreed deletion process.

8. AI-assisted features

Open-text exam answers and other content submitted to an AI-assisted feature are sent to an AI service provider for the requested output. This may involve a transfer outside the EEA. Do not include confidential, special-category or third-party personal data unless it is necessary and you are authorised to do so.

Automated grading contributes to an Academy assessment result, but it does not produce a legal or similarly significant decision about you. You may dispute an exam result or request human review through the available support channel.

9. Cookies and device storage

Essential storage supports sign-in, security and requested preferences. Optional analytics and attribution storage is used only after consent and can be withdrawn through Cookie settings. The categories, purposes and durations are set out in our Cookie Policy.

10. Is the data required?

Account, authentication and billing information is required to create and provide a paid account. Without it we cannot provide the requested service. Other fields are optional unless marked otherwise. Optional analytics storage and marketing consent are not conditions of using the core service.

11. Your rights

Access your personal data and receive information about its processing
Correct inaccurate or incomplete data
Request erasure or restriction where the legal conditions apply
Receive portable data where Article 20 GDPR applies
Object to processing based on legitimate interests
Withdraw consent at any time without affecting earlier lawful processing
Lodge a complaint with a competent data protection supervisory authority

Send a request to [email protected]. We may need to verify your identity. We respond without undue delay and normally within one month. If your organisation controls the relevant workspace data, we may refer the request to that organisation and assist it as processor.

12. Security

We use technical and organisational measures appropriate to the risk, including access controls, encryption, credential protection, backups, monitoring and incident procedures. A customer-facing security summary is available on our Security & Data Protection page. Detailed security information is provided to authorised reviewers on request.

13. Children

The service is not directed to children under 16 and we do not knowingly create accounts for them. Contact us if you believe a child's data has been provided.

14. Changes

We may update this notice when the service or legal requirements change. We will update the date above and provide additional notice where a change materially affects users. Previous versions are available on request.

Privacy contact

Email [email protected] for rights requests, processor details, transfer safeguards or other privacy questions.