1. Who we are
The controller is José Covas Education Academy, Lda, with registered office at Avenida Engenheiro Duarte Pacheco, Torre 1, Piso 2, Escritório 10, 1070-101 Lisbon, Portugal, sole registration and legal-person number 519 093 500. Contact: [email protected]. Telephone: +351 962 802 463.
2. Scope
This Policy explains how personal data are processed when the user visits academy.josecovas.com, creates an account, subscribes to the newsletter, contacts the Academy, including through its contact forms, or, once sales are activated, buys and accesses a course. Access to the courses requires an account.
3. Data we may process
- Technical and security data: IP address, browser and device information, request time, pages requested, error and security logs and server/CDN logs generated when accessing the site.
- Account and learning data: name, email address, password (stored encrypted by the platform), courses enrolled in, progress, completion and certificates issued.
- Statistics data: page views and related technical data processed by Jetpack Stats, a service of Automattic. Jetpack Stats does not place cookies on visitors’ devices. We see the statistics in aggregate only.
- Newsletter data: email address, subscription date and status, and — only if the subscriber agrees when asked — whether newsletters are opened and which links are clicked.
- Purchase and delivery data (after sales activation): name where provided, email, country or tax-location information, order or receipt identifier, product purchased, amount, currency, tax information, payment status and delivery records. Sales are processed by Paddle as Merchant of Record; full card details are entered and processed by Paddle and are not received or stored by the Academy.
- Communications and compliance records: messages sent through the contact form or by email, support and privacy requests, complaints, evidence of consent and acceptance of terms, and records needed to exercise or defend rights.
4. Purposes and legal bases
We process data to operate and protect the site and prevent abuse, based on legitimate interest; to create and manage the account, give access to the courses, record progress and issue certificates, based on performance of the contract; to process orders, deliver access and provide support, based on performance of the contract or pre-contractual steps; to answer messages, based on legitimate interest; to produce aggregated statistics about the use of the site, based on legitimate interest; to send the newsletter, based on consent, which can be withdrawn at any time through the unsubscribe link in every email; to measure newsletter opens and clicks, only for subscribers who agree; to comply with legal obligations, including accounting and tax; and to manage disputes and complaints, based on legitimate interest and applicable law.
5. Cookies and similar technologies
The site uses only cookies that are strictly necessary: session and authentication cookies to log in and access content, cookies that keep a basket working when one is used, and a cookie that records the choice made in the cookie notice. These are exempt from consent. No analytics, advertising or cross-site tracking cookies are used. Should non-essential cookies be introduced, this Policy and the consent mechanism will be updated before their use.
6. Service providers and recipients
We use providers for hosting, security, the course platform, email, the newsletter, statistics, accounting and professional support. Current providers include StellarSites/Nexcess (hosting and security), LearnDash (course platform), Resend (transactional email), and Automattic (Jetpack Stats, the contact forms and the MailPoet newsletter sending service), acting as processors on the Academy’s behalf under data-processing agreements. Payments are processed by Paddle, as authorised reseller and Merchant of Record, which processes, as an independent controller, the data needed for the transaction — payment, tax, fraud prevention, receipt and buyer support — under its own Privacy Policy. The Academy processes, as an independent controller, the data it receives or collects to give access to the course, manage the account and license, provide support and comply with its legal obligations. The Academy does not receive or store full card details.
7. International transfers
The site is hosted in the United States, in a StellarSites/Nexcess data centre. Automattic, Resend and Paddle may also process data outside the European Economic Area. Where this occurs, transfers rely on a lawful basis, such as an adequacy decision (for example the EU–US Data Privacy Framework, where the entity is certified), approved standard contractual clauses or another recognised safeguard. Information on the safeguards can be requested at [email protected].
8. Retention
Technical and security logs are kept for the shortest necessary period, normally no more than 30 days, unless an incident needs investigating. Statistics are consulted in aggregate; the underlying records are kept by Automattic under its own terms. Newsletter data are kept until the subscriber unsubscribes. Messages are kept for as long as needed to answer them and for up to two years after the last reply. Account and learning data are kept while the account is active and for the period necessary after closure for support, evidence and legal obligations. Invoices and accounting records are kept for the period required by Portuguese tax and accounting law, generally 10 years. Data are deleted or anonymised when no longer needed.
9. Data subject rights
Under applicable law, the data subject may request access, rectification, erasure, restriction, portability or information about the processing, and object to processing based on legitimate interest. Where processing is based on consent, it may be withdrawn at any time, without affecting prior lawful processing. These rights are not absolute and may be limited where data must be kept by law or to defend rights.
10. Automated decisions and minors
We do not use personal data to make decisions based solely on automated processing with legal or similarly significant effects. The site and courses are not directed to children and we do not knowingly request data from persons under 16.
11. Security
We apply proportionate technical and organisational measures to protect personal data. No Internet service can be guaranteed as fully secure; the user should avoid sending unnecessary confidential information by email.
12. Complaints and contact
To exercise a right or raise a privacy question, contact [email protected]. The data subject may also lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD).
13. Changes
We may update this Policy to reflect changes in the site, providers or the law. The version in force will indicate its effective date.