Last updated: Version 1.0
1. Who we are and how to contact us
The controller of your data, that is, who decides why and how it is processed on KurseInformatike, is:
- Name
- Kurse Informatike
- Privacy email
- info@kurseinformatike.com
For any question or request about your data, write to us at info@kurseinformatike.com.
2. What data we collect
We collect only the data we need for the service you ask for:
- Account: name, email, password (stored only in encoded form, as a hash), phone number if you give it, language, time zone and account status.
- Profile: your profile photo if you upload one and, for teaching staff, the headline and biography they choose to publish.
- Courses and learning: the courses and groups you are enrolled in, progress, quiz answers, the assignments and files you submit, grades, staff feedback, assessment adjustments when staff set them, and your private notes.
- Communication: messages, course discussions, course reviews and notification preferences.
- Certificates: the certificate number, course and date of issue.
- Orders and payments: the course, amount, currency, payment status and its reference.
- Events: name, email and, if you give it, phone number when you register for an event.
- Contact form: name, email, phone number if you give it, and your message.
- Technical data: IP address and browser details, for the sign-in session, protection against abuse and the log of administrative actions.
We do not ask for special categories of data, such as data about health, beliefs or ethnic origin.
3. Where the data comes from
- From you, when you create an account, enrol in a course, submit an assignment or write to us.
- From your use of the platform, such as lesson progress and quiz results.
- From the course staff, such as grades, feedback and group placement.
- Automatically from your browser, such as the IP address and browser type.
4. Why we use it and on what legal basis
Every use has a purpose and a legal basis. Consent is not the basis for everything: most processing is necessary to provide the service you ask for.
| Purpose | Legal basis |
|---|---|
| Opening, approving and securing the account | Performance of the contract and steps you request before it |
| Course enrolment, learning, assessment and certification | Performance of the contract |
| Service notices and course communication | Performance of the contract |
| Orders, payments and accounting records | Performance of the contract and legal obligations |
| Replying to your messages | Legitimate interest in replying to you |
| Security, abuse prevention and the action log | Legitimate interest in protecting the platform and its users |
| Public display of reviews and staff profiles, certificate verification | Legitimate interest, with your right to object |
Name, email and password are needed to create an account: without them we cannot open one for you. Phone number, profile photo and reviews are optional.
5. What is shown publicly
- When you review a course, the review appears on the course’s public page with your name and profile photo. Reviews with text and 4 or 5 stars may also appear on the home page and on “About”.
- Anyone who has a certificate’s number or link can see the holder’s name, the course and the date of issue, in order to verify it.
- For teaching staff, the name, photo, headline and biography appear on course and instructor pages.
Grades, submissions, messages and your contact details are not published.
6. Who we share it with
We do not sell your data or give it out for advertising. We share it only with:
- teaching staff, only for the courses and groups they teach;
- the platform’s administrators, who manage accounts, enrolments and payments;
- our hosting and email provider, Namecheap, which stores the data and sends emails on our behalf;
- the providers of content embedded in lessons (YouTube, Vimeo, CodePen, GeoGebra, Desmos), when a lesson uses it;
- public authorities, only when the law requires us to.
We do not use analytics, advertising pixels or session recording.
7. Transfers outside Albania
The platform’s data is stored with the hosting provider, in USA.
When a lesson contains a video or other external content, your browser connects directly to its provider, which may process the connection data outside Albania under its own privacy policy.
You can write to us at any time about the safeguards that apply to these transfers.
8. How long we keep it
We keep data only as long as we need it for its purpose or as long as the law requires:
- Account: until you ask for it to be deleted or the administration deletes it. On deletion, the name, email, phone number, photo and sign-in methods are removed or anonymised.
- Academic record: enrolments, grades, submissions and certificates are kept after the account is deleted, linked to an anonymised account, so that the record does not change and certificates stay verifiable.
- Orders and payments: as long as legal obligations for accounting records require.
- Contact messages: until staff have handled the request and deleted the message.
- Sign-in: the session expires after a period of inactivity, and a password-reset link expires after 60 minutes.
- Security: the log of administrative actions and backups are kept for the platform’s security and recovery.
- Data copies: a copy the administration prepares for one of your requests is deleted after 7 days.
10. Payments
When you buy a course, we keep the order, the amount, the currency and the payment status. Our staff confirm payments: the platform neither receives nor stores card numbers or bank credentials.
11. Problem reports
When you report a problem, we store what you were doing, your description, an optional screenshot and limited technical information about the page, browser, device and platform version. Do not include passwords or sensitive information.
We use this information to investigate errors and keep the platform secure and working. Only authorised administrators can access reports and screenshots.
If GitHub synchronisation is configured, summaries of submitted reports are sent to the external GitHub service to track errors. The summary excludes your identity, screenshot and credentials; personal information is filtered from the text. In a public repository, this summary is public. This provider’s privacy policy also applies to its processing and international transfers.
Automatic reports you do not submit are deleted after 7 days, dismissed reports after 30 days and submitted reports after 365 days, together with their screenshots. Technical summaries in GitHub remain in the error-tracking history. Your data export includes the text of reports you submitted.
12. Emails and notifications
We send you emails and in-platform notifications about the service: account verification, enrolments, deadlines, grades and changes to your courses. We do not send you marketing emails.
You can adjust most notifications in your notification settings.
13. Minors
We do not ask for your date of birth and we use nobody’s data for marketing or profiling. If you are a parent or guardian and believe your child has given us data without your knowledge, write to us and we will look into your request.
14. Automated decisions
Some quizzes are graded automatically, by comparing your answers with the correct answers the instructor set. The course staff can review the grading and you can ask them to. We do no profiling and make no decisions based solely on automated processing that produce legal effects for you.
15. How we protect it
The platform uses encrypted connections (HTTPS), stores passwords only as hashes, offers two-step verification and limits access by role: everyone sees only what they need. Administrative actions are logged and the data is backed up.
If a personal-data breach may put your rights at risk, we notify the Commissioner within 72 hours of becoming aware of it, and we notify you as well when the risk is high, as the law requires.
16. Your rights
Under the law you have these rights:
- Information and access: to know whether we process your data and to receive a copy of it.
- Rectification: to correct data that is inaccurate or incomplete.
- Erasure: to ask for your data to be deleted when we no longer need it or when its processing has no legal basis.
- Restriction: to ask us to keep the data but not use it, for example while we consider an objection.
- Portability: to receive the data you gave us in a structured, machine-readable format.
- Objection: to object to processing we base on legitimate interest, such as the public display of your review.
- Human review: to ask for a person to review a decision taken automatically.
- Withdrawing consent: where processing relies on consent, to withdraw it at any time, as easily as you gave it.
- Complaint: to complain to the Commissioner or to bring a claim before a court.
Some rights have limits. For example, we cannot delete accounting records the law requires us to keep, and the academic record is kept linked to an anonymised account. When we cannot fully meet a request, we explain why.
17. How to exercise your rights
- If you have an account, send your request from “My privacy” in your settings and follow it there until we answer. Open “My privacy”
- If you have an account, you can download your main data yourself from your profile, under “Export my data”. Open your profile
- You can change your profile details, such as name, phone number and photo, yourself in your profile.
- For any other request, write to us at info@kurseinformatike.com, preferably from your account’s email address.
- Before acting we may ask you to confirm your identity, so that your data does not go to someone else.
- We answer as soon as possible and no later than 30 days from receiving your request. When a request is complex, the period may be extended up to 60 days; we then tell you why within the first 30 days.
- Exercising your rights is free. Only for manifestly unfounded or excessive requests does the law allow a reasonable fee or a refusal, and we must then show why.
18. Your right to complain
If you believe we process your data in breach of the law, you have the right to complain to the Commissioner for the Right to Information and Protection of Personal Data. You may also write to us first, so that we can try to resolve your concern.
19. Changes to this policy
When we change this policy, we update the version and date at the top of the page. Changes that affect how we use your data are announced with a notice on the platform.
Published versions
- Version 1.0, 18 October 2026: A complete policy explaining what data we collect, why, how long we keep it, who we share it with and how you exercise your rights.