Privacy Notice

Controller

The intended data controller is ENERGY CENTURY XXI S.R.L.. The production legal and privacy contact will be published before commercial activation.

Data and purposes

The platform is designed to process account details, learning progress, assessment attempts, purchases, company seat assignments, consent evidence, support requests and certificate records to provide the requested service, administer contracts, protect the platform and meet legal obligations.

With an optional choice, Google Analytics measures pseudonymous use of public and purchase-journey pages, including page paths, device or browser signals and interaction events. It is not used to send email addresses, course answers, payment-card details or authentication data to Google. Analytics remains off until the visitor chooses it and can be withdrawn through Privacy choices.

Data categories

Identity and account data may include name, email, authentication identifiers and role. Learning data may include progress, answers, attempts, challenge submissions, completion and certificate status. Commerce data may include buyer type, organization, order, entitlement, consent and provider reference records.

Technical and security data may include timestamps, IP address, device or browser information, correlation identifiers and redacted audit events. Support and rights-request records may include correspondence, evidence and resolution history.

Lawful-basis review matrix

Contract necessity is intended for account access, course delivery, progress, orders and seat administration. Legal obligation may apply to accounting, consumer and compliance records. Legitimate interests may apply to proportionate security, fraud prevention and service integrity after a documented balancing review.

Consent will be used only where it is freely given, specific, informed and withdrawable. The final mapping of each purpose, field, recipient and retention period remains a launch-blocking legal review item.

Recipients and international transfers

Production recipients include configured identity, hosting, database, payment, email, analytics and professional-support providers acting under appropriate terms, plus authorities or advisers where lawfully required. Optional analytics is provided through Google Analytics.

Where analytics data is transferred outside the EEA, the operator will rely on the provider's applicable transfer safeguards and maintain the relevant documentation.

Retention and deletion

A record-specific retention schedule remains to be approved. Account and learning records should be retained only for the service term and a justified post-contract period; transaction, consent, dispute and audit records may require longer legal retention; recoverable drafts should be shorter lived.

Deletion or anonymisation will follow the approved schedule unless preservation is needed for a legal obligation, dispute, security investigation or exercise of legal claims.

Security and automated decisions

The platform is designed around role checks, server-authoritative records, least-privilege access, idempotent mutations, redacted logs and controlled recovery. No measure can eliminate all risk, and the final incident and breach-response workflow remains an operational launch gate.

The platform does not make solely automated decisions producing legal or similarly significant effects. Automated scoring supports learning feedback and does not determine employment, accreditation or access to a regulated profession.

Your rights and requests

Depending on the circumstances, individuals may request access, correction, deletion, restriction, portability or objection, and may withdraw consent without affecting earlier lawful processing. Identity may need to be verified before a request is fulfilled.

A production request channel and response workflow will be published before launch. Individuals may also complain to the competent data-protection supervisory authority.