1. Who we are
The controller is José Covas Education Academy, Lda, with registered office at Avenida Engenheiro Duarte Pacheco, Torre 1, Piso 2, Escritório 10, 1070-101 Lisbon, Portugal, sole registration and legal-person number 519 093 500. Contact: [email protected]. Telephone: +351 962 802 463.
2. Scope
This Policy explains how personal data are processed when the user visits academy.josecovas.com, creates an account, contacts the Academy or, once sales are activated, buys and accesses a course. Access to the courses requires an account.
3. Data we may process
- Technical and security data: IP address, browser and device information, request time, pages requested, error and security logs and server/CDN logs generated when accessing the site.
- Account and learning data: name, email address, password (stored encrypted by the platform), courses enrolled in, progress, completion and certificates issued.
- Analytics data: aggregated statistics produced by privacy-focused analytics, without advertising trackers or cross-site behaviour identifiers.
- Purchase and delivery data (after sales activation): name where provided, email, country or tax-location information, order or receipt identifier, product purchased, amount, currency, tax information, payment status and delivery records. Sales are processed by Paddle as Merchant of Record; full card details are entered and processed by Paddle and are not received or stored by the Academy.
- Communications and compliance records: support and privacy requests, complaints, evidence of consent and acceptance of terms, and records needed to exercise or defend rights.
4. Purposes and legal bases
We process data to operate and protect the site and prevent abuse, based on legitimate interest; to create and manage the account, give access to the courses, record progress and issue certificates, based on performance of the contract; to process orders, deliver access and provide support, based on performance of the contract or pre-contractual steps; to produce aggregated analytics, based on legitimate interest or consent where required; to comply with legal obligations, including accounting and tax; and to manage disputes and complaints, based on legitimate interest and applicable law.
5. Cookies and similar technologies
The course platform uses essential session and authentication cookies, necessary to log in and access content — these are exempt from consent as strictly necessary. Analytics are done with Plausible, in a cookieless configuration. No advertising or cross-site tracking cookies are used. Should non-essential cookies be introduced, this Policy and the consent mechanism will be updated before their use.
6. Service providers and recipients
We use providers for hosting, content delivery and security, the course platform, video hosting, email, analytics, accounting and professional support. Current providers include StellarSites/Nexcess (hosting and security), LearnDash (course platform), Vimeo (video hosting), Resend (email) and Plausible (cookieless analytics), acting as processors on the Academy’s behalf under data-processing agreements. Payments are processed by Paddle, as authorised reseller and Merchant of Record, which processes, as an independent controller, the data needed for the transaction — payment, tax, fraud prevention, receipt and buyer support — under its own Privacy Policy. The Academy processes, as an independent controller, the data it receives or collects to give access to the course, manage the account and license, provide support and comply with its legal obligations. The Academy does not receive or store full card details.
7. International transfers
Some providers may process data outside the European Economic Area. Where this occurs, transfers rely on a lawful basis, such as an adequacy decision (for example the EU–US Data Privacy Framework, where the entity is certified), approved standard contractual clauses or another recognised safeguard. Information on the safeguards can be requested at [email protected].
8. Retention
Technical and security logs are kept for the shortest necessary period, normally no more than 30 days, unless an incident needs investigating. Aggregated analytics are kept for no more than 24 months. Account and learning data are kept while the account is active and for the period necessary after closure for support, evidence and legal obligations. Invoices and accounting records are kept for the period required by Portuguese tax and accounting law, generally 10 years. Data are deleted or anonymised when no longer needed.
9. Data subject rights
Under applicable law, the data subject may request access, rectification, erasure, restriction, portability or information about the processing, and object to processing based on legitimate interest. Where processing is based on consent, it may be withdrawn at any time, without affecting prior lawful processing. These rights are not absolute and may be limited where data must be kept by law or to defend rights.
10. Automated decisions and minors
We do not use personal data to make decisions based solely on automated processing with legal or similarly significant effects. The site and courses are not directed to children and we do not knowingly request data from persons under 16.
11. Security
We apply proportionate technical and organisational measures to protect personal data. No Internet service can be guaranteed as fully secure; the user should avoid sending unnecessary confidential information by email.
12. Complaints and contact
To exercise a right or raise a privacy question, contact [email protected]. The data subject may also lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD).
13. Changes
We may update this Policy to reflect changes in the site, providers or the law. The version in force will indicate its effective date.