ApprendoLab processes personal data in order to deliver online training to individuals and companies. This notice describes which data we process, why, for how long, and what your rights are (Articles 13-14 GDPR).
Data controller
The controller is the company that operates ApprendoLab (company details to be completed before going live). Privacy contact: privacy@apprendolab.it.
Where training is assigned by a company, that company is the controller of the data relating to its employees' training, and ApprendoLab acts as a processor (Article 28 GDPR) under the agreement signed with the company.
What data we process
- Account: first name, last name, email, language, password (stored in encrypted form by the authentication provider).
- Learning data: enrolments, lessons followed, video position, active time, study sessions, test answers and results, certificates.
- Company data (if assigned by a company): employee ID, site, department, groups, manager, deadlines.
- Purchase data: orders, billing details. Payment data is processed by the payment provider and does not pass through our servers.
- Technical data: security logs and audit logs of administrative operations.
Why we process it
- To deliver courses, save progress and issue certificates (performance of a contract, Article 6(1)(b)).
- To allow the company to monitor mandatory or assigned training (legal obligation or the company's legitimate interest, Article 6(1)(c)/(f)).
- To ensure the reliability of tracking and to prevent fraud or abuse (legitimate interest, Article 6(1)(f)).
- Anonymous usage statistics, only with your consent (Article 6(1)(a)), which you can withdraw at any time from the cookie preferences.
- Promotional communications, only with optional consent.
Study tracking
During a lesson the player sends the playback status every 15 seconds (position, whether playback is running, whether the tab is visible, recent interaction). Time is calculated using the server's clock. We do not record audio, video, screen or webcam images, or geographical location.
Retention
- Account data: for as long as the account is active; upon a deletion request the profile is deleted and learning data is pseudonymised.
- Certificates and records of training assigned by a company: for the period required by the regulations applicable to the company.
- Billing data: 10 years, to comply with tax obligations.
- Security and audit logs: up to 24 months.
Where data is stored
Application data is hosted on Google Cloud/Firebase in the European region (eur3). Video files and certificates are stored on Cloud Storage and can only be accessed via signed, time-limited links.
Your rights
Access, rectification, erasure, restriction, portability and objection (Articles 15-22 GDPR). From your profile you can download all your data in JSON format and request deletion of your account. You also have the right to lodge a complaint with the competent data protection supervisory authority (in Italy: Garante per la protezione dei dati personali).