Privacy Policy

At Sura Academy (accessible at https://sura-academy.com and https://4mystics.org), protecting your personal data is a top priority. This Privacy Policy informs you about the type, scope, and purpose of personal data processing under the European General Data Protection Regulation (GDPR - Regulation (EU) 2016/679) and the German Federal Data Protection Act (BDSG).

1. Data Controller Information (Art. 4(7) GDPR)

2. Categories of Personal Data Processed

• Account & Identity Data: Full name, username, email address, password hash (encrypted via bcrypt), avatar image, biographical details, language, and timezone.
• Educational & Telemetry Records: Enrolled courses, lesson video progress logs, timestamp records, quiz attempts, submitted assignments, and certificate hashes.
• Financial & Billing Information: Order numbers, purchased items, transaction amounts, billing address country, invoice records, and payment provider tokens. (Raw card details are processed directly by PCI-DSS certified processors and never stored on our servers.)
• Technical & Connection Logs: IP address, device specifications, browser type, operating system, session cookies, and login timestamps to enforce platform security and prevent account takeover.

3. Legal Bases for Processing (Art. 6(1) GDPR)

• Performance of a Contract (Art. 6(1)(b) GDPR): Account registration, delivery of course videos, course progress tracking, certificate generation, and customer support.
• Legitimate Interests (Art. 6(1)(f) GDPR): Cyber security, anti-fraud prevention, account protection, performance optimization, and learning analytics.
• Legal Obligations (Art. 6(1)(c) GDPR): Compliance with statutory tax, commercial bookkeeping, and legal invoicing duties (§ 147 AO, § 257 HGB).
• Consent (Art. 6(1)(a) GDPR): Optional newsletter marketing or non-essential cookies and third-party script integrations. You may revoke consent at any time.

4. Data Retention Periods & Schedule

We store personal data strictly in accordance with statutory retention schedules:

5. Data Processors & Infrastructure

We never sell or rent your data. Data is shared solely with vetted processors under Art. 28 GDPR Data Processing Agreements:

• Hosting & Server Infrastructure: Hetzner Online GmbH (European data centers with TLS 1.3 encryption and automated backups).
• Payment Providers: Stripe Payments Europe Ltd. and PayPal (Europe) S.à.r.l. for tokenized payment processing.
• Content Delivery Network (CDN): High-speed video streaming delivery networks.

6. Your Rights Under the GDPR

As a data subject, you have the following rights under GDPR Articles 15–22:

• Right of Access (Art. 15 GDPR): Request confirmation and details of personal data processed.
• Right to Rectification (Art. 16 GDPR): Correct inaccurate profile data directly from your account settings.
• Right to Erasure (Art. 17 GDPR): Request complete deletion ("Right to be Forgotten") from your account dashboard or by emailing [email protected].
• Right to Data Portability (Art. 20 GDPR): Download your complete personal and learning history in a machine-readable JSON format.
• Right to Object & Revoke Consent (Art. 7(3) & 21 GDPR): Adjust or withdraw cookie consent anytime via the "Cookie & Privacy Preferences" footer link.
• Right to Lodge a Complaint (Art. 77 GDPR): You have the right to lodge a complaint with a competent supervisory authority (e.g. Der Hessische Beauftragte für Datenschutz und Informationsfreiheit).