ANAFI Academy Privacy Policy

1. Data controller

The controller of personal data is Łukasz Grzelak, ul. Antygony 2, 03-642 Warsaw, Poland, e-mail: info@anafi.online. You can contact us at this e-mail address or by post regarding any matter concerning personal data.

The controller has not appointed a data protection officer.

2. Data we process

• Account data: first name, last name, e-mail address, password (stored only as a cryptographic hash), interface language, role and Organization membership,
• learning data: course enrolments, lesson progress, quiz and test results, notes, bookmarks and Certificates,
• document acceptance data: document type and version and the date of acceptance,
• technical data: IP address, browser information and request times in server logs, and application error reports (without cookies, headers or form contents; with an Account identifier instead of the name and e-mail address).

3. Purposes and legal bases

• maintaining the Account, providing courses, issuing Certificates and sending Account-related e-mails – Art. 6(1)(b) GDPR (performance of a contract),
• public verification of Certificate authenticity – Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (legitimate interest in confirming the authenticity of documents),
• sharing progress and results with the administrator of the User's Organization – Art. 6(1)(f) GDPR (the Organization's legitimate interest in supervising the training of its personnel or customers),
• ensuring security, preventing abuse and diagnosing errors – Art. 6(1)(f) GDPR,
• documenting acceptance of the Terms and establishing, exercising or defending legal claims – Art. 6(1)(f) GDPR.

4. Whether providing data is required

Providing data is voluntary, but your first name, last name and e-mail address are necessary to create an Account and issue a Certificate.

5. Recipients

We entrust data to service providers who process it only on our instructions:

• Vercel Inc. – application hosting (servers in Frankfurt, Germany),
• Neon Inc. – database (servers in Frankfurt, Germany),
• Resend (Plus Five Five, Inc.) – e-mail delivery,
• Functional Software, Inc. (Sentry) – error reports (stored in the EU, Germany).

The progress and results of a User who belongs to an Organization are visible to that Organization's administrator. Data on the public Certificate verification page (§7(3) of the Terms) can be seen by anyone who knows its address.

6. Transfers outside the EEA

We store data on servers in the European Union. The providers listed above are based in the USA, so access to data from the USA cannot be ruled out. Such access is based on the European Commission's adequacy decision (EU-US Data Privacy Framework) for providers certified under it and otherwise on standard contractual clauses approved by the European Commission. You can obtain a copy of these safeguards by writing to the controller.

7. Retention

• Account and learning data – until the Account is deleted; on deletion the name and e-mail address are irreversibly anonymized and notes, bookmarks and acceptance records are deleted. Anonymized results may still be used for statistics,
• Certificates – the number, course and date remain in the database so that verification shows the document was issued, but after the Account is deleted they are no longer linked to a name,
• password reset and invitation links – valid for 1 and 72 hours respectively, deleted together with the Account,
• server logs and error reports – for the provider's retention period, no longer than 90 days.

8. Your rights

You have the right to access your data, to rectification, erasure and restriction of processing, to data portability and to object to processing based on legitimate interest.

In your profile you can export your data and delete your Account yourself. Send any other requests to info@anafi.online – we will reply within one month.

You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warsaw, Poland) or another EU supervisory authority.

9. Automated decisions

Quiz and test results are calculated automatically from the answers given. This is not automated decision-making producing legal effects within the meaning of Art. 22 GDPR. We do not use profiling.

10. Cookies and browser storage

The Platform uses only strictly necessary cookies without which it could not work, so they do not require consent:

• sign-in session cookies (authjs.*) – keep you signed in and protect forms; valid until you sign out, at most 30 days,
• NEXT_LOCALE – remembers the selected interface language; valid for 1 year.

Local browser storage is used only to remember interface settings (e.g. panel widths). We do not use analytics or advertising cookies. You can delete cookies in your browser settings, but blocking them will prevent you from signing in.

11. Changes to this Privacy Policy

We will inform you of material changes on the Platform at your next sign-in. The current version is always available at https://www.anafi.online/privacy.