Privacy policy

Kermit Tech AS (organisation number 927441217), L. P. Wettres vei 5, 1392 Vettre, Norway, runs Applied Academy. We decide how your personal data is used, so we are the controller under the GDPR.

Send questions about your data to the address below. We have no data protection officer; the same team answers.

support@appliedacademy.io

• Account: your name, email address and picture from Google sign-in, or the email address you type to get a sign-in code. Your choice of language.
• Purchases: what you bought, the amounts, your billing name and address, your country and any business VAT number you give at checkout. Stripe and Paddle handle your card details; we never see or store them.
• Learning: your bookings, course access, progress and completion from our learning platform, attendance marked by your teacher, and your certificates and badges.
• Acceptance: which version of the terms and this policy you accepted, and when.
• Messages: what you send through the contact, course enquiry and team training forms, and the reason you give when you ask for a refund.
• Notify me: your email address, so we can tell you once when a cohort opens.
• Sharing a course: the address and note you write are used for one email and then deleted. We keep only a scrambled code of the address, to stop the same course being sent to it again within 7 days.
• Company seats: if your employer gives you a course seat, your company, your role and your seats.
• Teachers: your profile, bio, photo and the cohorts you teach.

We do not ask for sensitive data, such as health, religion or political views. We do not store your IP address in our own database. It is held in memory for a short time to stop abuse of sign-in and forms, and our web server may keep it in its security logs for a short time. Our learning platform records your IP address with the pages you open in its activity log, to keep it secure and to show your progress.

You must give your name and email address to have an account, and billing details to buy. Without them we cannot sell you a course.

• To run your account, sell you courses, give you access, record attendance, issue certificates and send you emails about your courses, such as sign-in codes, booking confirmations and schedule changes: to carry out our contract with you (GDPR Art. 6(1)(b)).
• To keep orders, invoices and refunds, and to work out VAT: a legal obligation under the Norwegian Bookkeeping Act and tax rules (Art. 6(1)(c)).
• To answer your messages, quote requests and Notify me requests: steps you ask for before a contract (Art. 6(1)(b)), or our legitimate interest in answering people who contact us (Art. 6(1)(f)).
• To keep the service secure, stop abuse and keep backups: our legitimate interest in a safe service that works (Art. 6(1)(f)).
• To show your employer the seats it pays for: our contract with your employer and our legitimate interest in giving it the overview it pays for (Art. 6(1)(f)).

We do not send marketing email. If we ever want to, we will ask for your consent first, and you can withdraw it at any time.

These companies process data for us, only on our instructions:

• Stripe: payments for instructor-led courses, invoices, credit notes and VAT through Stripe Tax. Stripe is also a controller for some payment data, under its own privacy policy.
• Resend: sends our emails.
• Google: sign-in with Google.
• OVHcloud: hosts our servers and database.
• Amazon Web Services: stores our encrypted backups.
• Microsoft: sign-in for our own staff through Microsoft Entra ID. It does not process learner data.

Our learning platform is Moodle, run on our own servers. We give it your name and email address to create your learning account.

Your teacher sees the names and email addresses of the learners in their own cohorts. If your employer gives you a seat, the company admin sees your seats, progress and how many days you attended, never your own bookings or quiz scores. Your employer gave us your email address to invite you and is responsible for telling you about it.

Certificates and badges have a link that shows your name. Only people who have the link can open it, and search engines are asked not to list it. The links stop working when you delete your account.

We do not sell your data, and we use no advertising or analytics tools.

Stripe, Resend, Google, Amazon Web Services and Microsoft are American companies and may process data in the United States. We rely on the EU-US Data Privacy Framework where the company is certified under it, and otherwise on the EU Standard Contractual Clauses. Paddle is in the United Kingdom, which the EU recognises as protecting personal data adequately. Ask us if you want a copy of the safeguards.

• Orders, invoices and refunds: 5 years after the end of the financial year, as the Bookkeeping Act requires.
• Your account, learning records, the learning platform's activity log, certificates and acceptance records: while you have an account. When you delete your account under Profile settings, we remove your name, email address, picture, sign-in, messages and refund reasons at once, and keep your bookings, progress and attendance only without your name, for statistics. The learning platform account is made anonymous; its activity log stays linked only to that anonymous account. If you ask us by email instead, we do the same within one month.
• Messages and quote requests: until the matter is closed, or until you ask us to delete them.
• Notify me: until we have sent you the email or you withdraw.
• Sign-in codes: 10 minutes, and each works once.
• Backups: up to 90 days, then they are overwritten.

You have the right to:

• see the data we hold about you and get a copy of it,
• have wrong data corrected,
• have your data deleted,
• have the use of your data restricted,
• get your data in a format a machine can read, to take it elsewhere,
• object to our use of your data when we rely on legitimate interest,
• withdraw a consent at any time, if we have asked for one.

Email support@appliedacademy.io to use any of these rights. It is free, and we answer within one month. We may ask you to confirm who you are first. You can also delete your account yourself under Profile settings, Delete my account.

You can also complain to Datatilsynet, the Norwegian Data Protection Authority, or to the authority in the country where you live.

Datatilsynet

You must be at least 13 years old to create an account yourself. A child under 13 can use the service only with a parent or guardian, who agrees on the child's behalf.

We use only the cookies the site needs to work. They need no consent, so there is no cookie banner. We use no analytics, advertising or tracking cookies.

• next-auth.session-token: keeps you signed in. Up to 30 days, or 8 hours after a company key sign-in.
• next-auth.csrf-token: protects the sign-in form. Until you close the browser.
• next-auth.callback-url: the page to return to after sign-in. Until you close the browser.
• next-auth.state and next-auth.pkce.code_verifier: protect sign-in with Google. 15 minutes.
• NEXT_LOCALE: remembers English or Norwegian. 1 year.
• MoodleSession: keeps you signed in to the learning platform. Until you sign out or close the browser.

The Stripe payment page and Paddle's checkout set their own cookies, under their own privacy policies. Some choices, such as a course you picked before signing in, are kept in your browser only and are never sent to us.

We make no decisions about you by automated means that have legal or similar effects, and we do not profile you. We use no AI on your personal data.

The site uses HTTPS only, backups are encrypted, sign-in needs no password, and only staff who need it can see your data.

When we change this policy, the version date at the top changes, and we ask you to accept the new version before your next booking.