Privacy
Policy.

1. Scope of this policy and the data controller

This policy explains how ALA Core UG (haftungsbeschränkt), the operator of the ALA Academy Platform, handles the data of visitors, learners and programme applicants. It covers registration, purchases, live learning, session replays and support. Provisions concerning standalone recorded courses, subscriptions or artificial intelligence tools apply only when those services are offered and disclosed.

We collect data for a specific purpose, limit it to what is necessary, keep it accurate, protect it, and delete it when there is no longer a legitimate need to retain it. We do not sell learners' data or give advertisers independent access to it. Reading this policy or accepting the learning terms is not blanket consent to marketing, photography or filming, or any optional processing.

Legal operator and contact details

Engaging an instructor or a technical service provider does not change our responsibility for our obligations to the learner.

2. Data, its sources and the purposes of processing

We identify mandatory fields when collecting data and explain the consequences of not providing it; without essential information it may not be possible to create an account or complete a purchase. Refusing to provide optional data will not result in denial of the core service. We do not request sensitive data or identity documents merely for general registration.

If we obtain your data from an organisation that nominates you for training, or from a parent or guardian in a programme intended for minors, we explain the source, data, purpose and legal basis within the required period, or upon the first communication or disclosure if earlier. We use special-category data about health or disability only for a necessary, disclosed purpose and where an appropriate legal condition is met, with restricted access.

3. Payments and communications

The payment page identifies the transaction provider and how payment information is entered, and the vendor table below specifies which data reaches the Platform. We do not ask you to send your full card number or security code by email or chat. Do not include this information in a refund request; the order reference and the information needed to identify the transaction are sufficient, and we request further information only when necessary.

Messages about schedules, access, invoices, security and refunds form part of delivering the service. Marketing offers are optional and require separate consent. You can stop them using the unsubscribe method in the message or through the Contact page, without affecting your learning. We do not add you to a group that reveals your phone number or other data to others without explaining this and providing a suitable alternative for educational communications.

4. Recorded sessions and participant privacy

Before and during a session we explain whether it is being recorded, what will appear in the recording, who can view it, and how long it will remain available. We focus recordings on the instructor and the content and do not include a learner's image or voice without separate consent. You may learn with your camera switched off and ask questions in writing in a way that does not add your identity to the recording; declining to appear does not affect your right to education or assessment.

Replays are restricted to authorised learners, the instructor and staff whose duties require access. Recordings that include participants must not be republished, or downloaded and shared outside the permitted scope. Consent to recording does not cover advertising or public publication; each requires separate permission. If you withdraw consent to appear, we stop future use based on that consent and delete the relevant portion or conceal your identity, without affecting educational rights that can be fulfilled through a suitable alternative.

5. Learners' work and artificial intelligence

You retain the rights to your work, and your permission to the Platform is limited to storing it, displaying it to those who need access, assessing it and providing the agreed service. We do not publish projects in a public showcase or advertisement without additional permission. This policy does not grant an unrestricted licence to train general-purpose artificial intelligence models on your data or work.

If we make an artificial intelligence tool available, we explain the provider, the data sent, the purpose, retention and international transfers before you use it. We minimise the data and select controls that prevent its use outside the approved purpose. If the tool is optional, a suitable alternative is available without requiring additional consent to obtain the core educational service. A decision with a significant impact, such as withholding a certificate or ending enrolment, will not be made solely on the basis of automated processing; a qualified person reviews the decision and considers your objection.

6. Minors

As a general rule the services are intended for people aged 18 or over. Anyone younger is accepted only into a programme expressly advertised as suitable for their age, under a clear contractual arrangement with a parent, guardian or other legal representative. We explain the minor's data, the purposes for which it is used and the required consent process in age-appropriate language, and we do not assume that a guardian's consent authorises every form of processing. We use the minimum age-related information necessary and do not target minors with marketing based on tracking their behaviour.

7. Data sharing, vendors and international transfers

Staff and instructors access only the data necessary for their duties. We may share limited data with the vendors listed below, professional advisers where necessary, or a competent authority pursuant to a valid legal request. Organisations that process data on our behalf are bound by appropriate instructions and contracts, and we explain when a payment provider or another provider acts as an independent data controller for its own processing.

We do not assume that a provider's presence in Europe means all processing remains there. Before transferring data to another country we verify the appropriate legal mechanism and document the countries, recipients and safeguards, and we fulfil Egyptian requirements where applicable. You may request details of the safeguards or an appropriate copy of them. Acceptance of the terms is not blanket authorisation for international transfers, and we do not rely on an exceptional derogation as a routine transfer mechanism.

8. Retention periods and deletion

We apply the following periods separately to each category; retaining a necessary invoice does not justify keeping all assignments or recordings. When the purpose ends, we delete the data or convert it into information that cannot identify you. Any extension due to a dispute or legal obligation is limited to the necessary data, with restrictions on its use and reviews of whether the reason continues to apply.

We carry out a deletion request that meets the applicable conditions without undue delay and within 30 calendar days of receipt as an operational maximum, or within a shorter statutory deadline where applicable. If the law permits an extension because of complexity or the number of requests, we notify you of the reasons within the required period. Backups complete their specified cycle, and deletion instructions are reapplied if a backup is restored.

The certificate verification service does not allow public searches by a learner's name. If a verification code is made available, it is optional and displays only the minimum data necessary. You may request that visible verification be disabled or object to retention of the verification record, without affecting the validity of a properly issued certificate.

Retention periods for German records begin at the end of the calendar year in which the event specified by law occurs, such as issuing an invoice, creating an accounting document or sending or receiving correspondence. The period may be extended because of tax proceedings. Deleting the account does not change the statutory starting point. After you opt out of marketing we may keep a limited suppression record (contact detail and opt-out status) to prevent you being added again by mistake; it is kept separate from advertising lists and is not used to send offers.

9. Security and incidents

We apply technical and organisational measures proportionate to the risks, including access controls, reviews of staff permissions, and management of vendors, deletion and incidents. If a breach occurs, we assess its impact, take measures to mitigate it, and notify the competent authority and affected individuals where required and within the statutory deadlines. Please tell us promptly if you suspect unauthorised access to your account.

10. Your rights and how to submit a request

• Request information about your data and a copy of it, and have inaccurate data corrected or incomplete data completed.
• Request deletion or restriction of processing where the conditions are met, and obtain portable data in a structured format where that right applies.
• Withdraw consent easily without affecting the lawfulness of earlier processing; object to processing based on legitimate interests for reasons relating to your situation; object to direct marketing without giving a reason.
• Request human intervention and review of an automated decision with a significant impact, and lodge a complaint with the competent authority.

Send your request to [email protected], explaining what you want and providing the contact details associated with your account. No special form or copy of an identity document is automatically required; we request proportionate additional verification only where there are reasonable doubts. We respond without undue delay and within one month of receipt where the GDPR applies, or within a shorter mandatory period. The deadline is extended only as far as permitted, by no more than two additional months, and we inform you of the reasons within the first month.

Exercising your rights is free of charge as a general rule. We explain the reason for any partial refusal or legal exception and how to lodge a complaint. Deleting an account does not cancel a refund request or an existing financial entitlement. If you object to processing based on legitimate interests, we stop it unless we demonstrate compelling legitimate grounds that override your rights or a need related to a legal claim, and we inform you of the outcome.

You may complain directly, without waiting for an internal process, to the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI): datenschutz-hamburg.de. You may also contact another competent supervisory authority, including the Egyptian Personal Data Protection Center where its jurisdiction applies: pdpc.gov.eg.

11. Policy updates

We display the effective date and version number and explain material changes a reasonable time before applying them. We do not repurpose earlier consent for a new purpose it did not cover. If a change requires new consent, we request it separately and preserve your accrued rights. You may request a copy of the policy that applied when you registered.