Privacy Policy

Who is responsible

The controller for the processing described here is the provider named in the Imprint, 14.1 — Metropolitan Digital, Potočani 278, Tešanj, Bosna i Hercegovina — contactable at amir@ultimamemoria.ba.

Data protection officer: not appointed — no statutory obligation.

What we process

• A Account data — salutation and title, first and last name, date of birth, email address, telephone number, postal address, country, username, registration date, last login.
• B Authentication data — the password, stored only as a cryptographic hash and never in readable form, together with email-verification and password-reset tokens.
• C Learning data — entrance-test answers and scores, the programme assigned (S2/200, S3/300, S10/1000), the phase and task currently due, deadlines, results of each timed test across the four measured dimensions, progress through the practice modules, and the data printed on a certificate.
• D Payment data — the fact and status of a payment, the amount, and the reference returned by the payment provider. The card form at checkout is Stripe’s own, embedded in our page: card numbers travel to Stripe directly and are never received or stored by our servers.
• E Communication data — the content of messages sent through the contact form or by email, and the correspondence that follows.
• F Technical data — session identifier, IP address, date and time of the request, the page requested, browser and operating system as reported by the browser, and error records.

Providing the data under A and B is necessary to create an account; without them the service cannot be provided. The data under C arise from participation itself.

Why — and on what legal basis

• A Providing the platform, the account, the tests, the practice modules and the certificate — performance of the contract with the learner GDPR Art. 6(1)(b).
• B Payment processing, invoicing and bookkeeping — contract performance and legal obligation Art. 6(1)(b), (c).
• C Email verification, password reset, service messages about a course in progress — contract performance Art. 6(1)(b).
• D Answering enquiries — contract performance or legitimate interest in responding Art. 6(1)(b), (f).
• E Security, prevention of misuse, error analysis, keeping the service stable — legitimate interest Art. 6(1)(f).
• F Newsletter or other optional messages, if offered — consent, withdrawable at any time Art. 6(1)(a).
• G Where results are used for the further development of the method, they are used only in anonymised, aggregated form, carrying no name and not traceable to an individual — Art. 6(1)(f).

Learning results are not used for automated decisions producing legal effects. The assignment of a programme after the entrance test is a rule-based recommendation and can be discussed with us at any time.

Cookies and server logs

The platform sets a single strictly necessary cookie, which holds a session identifier so that a signed-in learner is recognised from page to page. It is marked httpOnly, is transmitted over an encrypted connection in live operation, and expires automatically. The session record itself is held on our own database server, not in the browser. No consent banner is required for a cookie of this kind; the service cannot be provided without it.

The hosting infrastructure keeps access logs containing the data described under 15.2 F. They serve the security and stability of the service and are deleted or anonymised after 30 days.

No tracking or advertising content is embedded. Three third-party sources are nevertheless contacted by the browser when a page is displayed, and each of them therefore receives the visitor’s IP address: Google Fonts (fonts.googleapis.com, fonts.gstatic.com) for the typefaces, and the jsDelivr content delivery network (cdn.jsdelivr.net) for the icon set. At checkout, Stripe is contacted in the same way. Everything else — stylesheets, scripts, images, audio and video — is served from our own domain, and the site’s content security policy blocks any script outside the sources named here.

Who else sees the data

• A Hosting and database — Cloudflare, Inc., USA, operating the servers on which the platform and its database run.
• B Payment provider — Stripe, which processes card payments, refunds and payment notifications. Card data are entered with Stripe directly and are not visible to us. Stripe’s own privacy information: stripe.com/privacy.
• C Email dispatch — Cloudflare, Inc., USA, used for verification, password reset, payment confirmation and service messages.
• D Fonts and icons — Google (Google Fonts) and jsDelivr, which receive the IP address of the browser requesting a page, as described in 15.4. They receive no account or learning data.
• E Professional advisers and authorities — tax advisers, auditors, or public bodies where a legal obligation applies.

Personal data are not sold and are not passed to third parties for advertising. Where a provider processes data outside the European Economic Area, the transfer is safeguarded by standard contractual clauses.

How long data are kept

• A Account and learning data — for the duration of the account, and for 12 months thereafter, so that a certificate can be re-issued and a completed programme evidenced.
• B Invoices and payment records — 10 years.
• C Correspondence — 3 years.
• D Server logs — 30 days, see 15.4.

When an account is deleted, the data listed under A are erased or anonymised, except where a retention obligation under B applies; such records are then blocked from further use.

Your rights

• A Access — confirmation of whether data are processed, and a copy of them.
• B Rectification — correction of inaccurate data and completion of incomplete data.
• C Erasure — deletion where the data are no longer needed and no retention obligation applies.
• D Restriction — processing limited while a dispute over accuracy or lawfulness is resolved.
• E Portability — the data provided by you, in a structured, machine-readable format.
• F Objection — to processing based on legitimate interest, on grounds relating to your situation.
• G Withdrawal of consent — at any time, with effect for the future.
• H Complaint — to a supervisory authority, in particular the one at your place of residence: Agencija za zaštitu ličnih/osobnih podataka u Bosni i Hercegovini, Sarajevo.

Requests are made to the contact address in 15.1 or through the contact form. We may ask for confirmation of identity where a request concerns an account.

Security and changes to this policy

Traffic between browser and server is encrypted in live operation. Passwords are stored only as hashes. Access to learner data is limited to the accounts that require it for operating the service; learning materials are delivered only to a signed-in learner whose access has been paid for. The site enforces a content security policy that blocks external scripts, and administrative functions are separated from learner functions.

No transmission over the internet can be guaranteed absolutely secure. Should a data breach occur that is likely to result in a high risk to affected persons, they will be informed without undue delay, and the competent supervisory authority notified as required.

This policy may be amended where the service or the legal position changes. The version in force is the one published here, marked with the date given in the header; substantial changes affecting registered learners are announced by email.