Privacy Policy
1Data Controller
CIT Copernicus, operating the cit.edu.pl platform, is the data controller for personal data collected through the Platform. Contact: [email protected].
2Data We Collect
| Category | Examples | Purpose | Legal Basis (GDPR) |
|---|---|---|---|
| Account data | Email, phone, name, password hash | Account creation, login | Contract (Art. 6(1)(b)) |
| Identity verification (Instructors) | ID document number (stored hashed/masked), qualification certificates | Instructor review, fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Payment data | Transaction IDs, billing country | Order processing, refunds, tax | Contract / Legal obligation |
| Learning data | Course progress, quiz scores, assignments, Q&A messages | Service delivery, certificates | Contract |
| Technical data | IP, device, cookies, logs | Security, analytics | Legitimate interest / Consent |
Payment card details are processed directly by our payment providers (Stripe, PayPal, WeChat Pay, Alipay); we never store full card numbers.
3Cookies
- Essential — session login, security (cannot be disabled).
- Analytics — aggregated usage statistics (consent-based).
- Marketing — only with your explicit consent; you can withdraw anytime.
4Data Sharing
We share data only with: payment processors, video/CDN infrastructure (Cloudflare), proctoring providers, and email delivery services — under data-processing agreements. We never sell personal data.
5International Transfers
Data is hosted on Cloudflare's network (EU/US edge locations). Transfers outside the EEA rely on Standard Contractual Clauses. For users in mainland China, cross-border transfer is performed with your consent in accordance with PIPL.
6Your Rights (GDPR / PIPL)
- Access, rectification, erasure ("right to be forgotten")
- Data portability, restriction of processing, objection
- Withdraw consent at any time (without affecting prior lawful processing)
- Lodge a complaint with your local supervisory authority (in Poland: President of UODO)
Exercise rights via [email protected]. We respond within 30 days.
7Retention
Account data: retained while the account is active. Order and invoice records: 5 years (tax law). Learning records: 3 years after last login. Instructor identity documents: deleted after review decision + 12 months (dispute window).
8Security
TLS encryption in transit, hashed passwords (bcrypt), hashed/masked ID numbers, least-privilege access, audit logs for admin operations.
9Minors
The Platform is not directed at children under 16. We do not knowingly collect their data; accounts found to belong to minors are closed.
Email: [email protected]