Privacy Policy

این صفحه به زبان انگلیسی نمایش داده می‌شود. تا زمانی که ترجمه‌ها بازبینی حقوقی نشده‌اند، متن انگلیسی ملاک است.

This policy explains what personal data Neda eCampus collects, why, where it is kept, who else sees it, how long we keep it, and what you can do about it. It covers every part of the platform: the website and shop at nedaecampus.com, the learning platforms at learn.nedaecampus.com (Moodle) and openedx.nedaecampus.com (Open edX), the account service at auth.nedaecampus.com, and Neda Creator at creator.nedaecampus.com. It is written to be read, not skimmed. If anything in it is unclear, ask us.

1. Who is responsible

The controller of your personal data is Khusraw Parwez, trading as Neda eLearning Solutions (a sole trader), Blumenstrasse 2/10, 3170 Hainfeld, Austria. Full details are in the Imprint.

For anything about your data, write to info@neda-els.com with “Privacy” in the subject line, or by post to the address above. We have not appointed a data protection officer: the law requires one only for organisations whose core activity is large-scale monitoring of people or large-scale processing of sensitive data, and ours is neither. A person at Neda reads every privacy message.

Courses by independent creators. Creators who publish on Neda eCampus see some information about the learners in their own courses — names, progress, submissions and grades — because teaching needs it. They see it under our rules and only for that purpose; the Data Processing Terms set out what they may and may not do with it. You deal with us about your data, whichever course it concerns.

Courses an organisation enrols you in. If your employer, university or another organisation enrolled you — for example with an enrolment code — that organisation may decide what it does with your learning records for its own purposes, such as tracking training it requires. For that use the organisation is responsible, and its own privacy notice applies; we process the records on its behalf. We remain responsible for your account and for everything else in this policy.

2. Where your data is kept

Every system that makes up Neda eCampus runs on a server we control, rented from Hetzner Online GmbH in its data centre in Finland. Backups are copied, encrypted, to separate Hetzner storage in Germany. Your data stays in the European Union except in the specific cases listed in section 7.

3. What we collect, why, and on what legal basis

For each kind of data, this section says what it is, why we need it, and which legal basis in the EU General Data Protection Regulation (GDPR) allows us to use it. Most of it we need to provide the service you asked for. Where something is optional, we say so.

Your account

One account signs you in everywhere on Neda eCampus. It holds your name, username, email address, whether your email address is verified, your preferred language, and your password, which is stored only as a salted hash that nobody — including us — can read back. If you set up two-factor authentication, we also store what is needed to check your second step: the secret behind your authenticator-app codes, or the public key of a security key or passkey. The account service also keeps a record of your sign-in sessions so that it can sign you out everywhere and detect misuse.

Your account is copied to each learning platform you use, linked by an internal identifier, so that one sign-in works everywhere. If you add a profile photo, it is shown on the platforms that display one.

Signing in with Google is optional. If you use it, Google tells us your name, email address, profile picture and language, and confirms that it has verified your email address. We copy the picture to our own server, so later page views do not contact Google. If you sign in with a password instead, Google is not involved.

Your acceptance of the Terms of Service. When you create an account, or accept a new version of the Terms at log-in, we record which version you accepted, the time (in UTC), how you accepted (registration form, Google, or at log-in), the language the page was shown in, and which version of this Privacy Policy was linked beside it. The record is kept with your account and cannot be changed by you or by anyone else through the account settings, because its purpose is to show what was agreed.

Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)); for the acceptance record, also our legitimate interest in being able to prove what was agreed (Art. 6(1)(f)). Two-factor data and session records also serve our legitimate interest, and yours, in keeping accounts secure (Art. 6(1)(f)).

Your learning

Which courses you are enrolled in, your progress and completion, what you submit, your grades and the feedback on them, what you post in forums, and any certificates issued to you. The learning platforms also keep an activity log — which pages and activities you opened, and when. Teachers use it to see where learners get stuck; we use it to investigate problems and keep the platform secure.

Legal basis: contract (Art. 6(1)(b)) for enrolment, progress, submissions, grades and certificates; our legitimate interest in running a working, secure platform (Art. 6(1)(f)) for the activity log, which is why we keep it only for a limited time (section 8).

Your purchases

What you bought, when, and for how much; your name, email address and billing address; the payment provider’s reference for the payment; and the type, last four digits and issuing country of the card used, which the payment provider gives us. We never see or store your full card number or security code — you enter them directly with the payment provider.

For every order containing a paid course we also keep the record of your checkout choices: that you accepted the Terms of Service, and that you asked for immediate access and acknowledged that your right of withdrawal ends when access begins — with the date and time. If you withdraw through the online withdrawal function, we keep your withdrawal statement and our acknowledgement.

Where you were when you bought. Tax law requires us to know, and be able to show, in which country our customers are, because that decides which country’s tax rules apply to an online sale. So for every order we record your IP address and the country it belongs to, the billing country you gave, your browser’s language setting and the card’s issuing country. The IP address is looked up on our own server against a database we hold; it is not sent to any outside service. This record is written once and never changed.

Legal basis: contract (Art. 6(1)(b)) for the order itself; legal obligations under Austrian tax and accounting law (Art. 6(1)(c)) for the records we must keep and the location evidence; our legitimate interest in being able to prove what was agreed at checkout (Art. 6(1)(f)) for the record of your choices. Because the law requires the tax records, you cannot opt out of them, and they are kept for the full legal period even if you close your account.

Fraud screening. Our payment provider, Stripe, automatically checks card payments for signs of fraud. If it declines a payment, no contract is made and nothing is charged. You can contact us, and a person will look at it and help you pay another way; a declined payment is never held against you in any other respect.

If you contact us

The contact form stores your name, email address, chosen topic and message, and the page you sent it from. It does not store your IP address. The only exception is a rate limit that keeps a salted, truncated code derived from your address for up to one hour, so that one sender cannot flood the inbox; the code cannot be turned back into an address and is never written to a permanent record. Emails you send us are kept in our mailbox. Legal basis: our legitimate interest in answering you (Art. 6(1)(f)), or contract where your message is about a purchase or your account (Art. 6(1)(b)).

If you are a course creator

In addition to the above: your name or business name and address, your VAT number if you have one, the courses and spaces you hold, and your messages with us about them. We check a VAT number you give us with the European Commission’s VIES service and keep the answer. When creator payouts are introduced, the identity and bank details needed for them will go to the payment provider, under its own privacy policy; we will update this policy before that happens. Legal basis: contract (Art. 6(1)(b)) and tax law (Art. 6(1)(c)).

Neda Creator stores the courses you build — text, images, media, settings — and who in your team worked on what. It does not hold learners’ records; those live on the learning platforms. If you choose to connect an AI assistant to your Neda Creator workspace, the assistant can read the course content you give it access to, and that content goes to the assistant’s provider under your own agreement with that provider. You decide whether to connect one, you can disconnect it at any time, and you remain responsible for reviewing anything an assistant helped you produce. Nothing is sent to an AI provider unless you connect it.

Technical records

Our web server keeps access logs — IP address, the page requested, the time, and the browser’s identification — for 14 days. The account service keeps a record of sign-in events — time, IP address, account and whether the sign-in succeeded — for 90 days, so that we can spot and investigate attempts to break into accounts. The learning platforms and the account service also write technical logs that can contain IP addresses and account identifiers. We use all of these only to keep the platform secure and to diagnose faults. Legal basis: legitimate interest (Art. 6(1)(f)).

Cookies and similar browser storage are described in the Cookie Policy, including which ones need your consent and how to change your choice. We do not use analytics, advertising cookies or tracking pixels, and we do not sell or share data for advertising.

How you found us — only if you allow marketing cookies. If you allow Marketing in the cookie banner, our shop software records how you came to the site — the referring website or campaign, the page you arrived on, the type of device and how many pages you viewed — and saves it with any order you place, so that we can tell which channels bring people to our courses. If you do not allow it, nothing is recorded. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time with the Cookie settings link; information already saved with an order is kept with the order record.

4. What we do not do

• We do not sell, rent or trade personal data.
• We do not build marketing profiles of you, and we make no decision about you by purely automated means that has a legal or similarly significant effect on you. The payment provider’s fraud screening (section 3) is the one automated check in the purchase process, and a person at Neda will review a declined payment if you ask.
• We do not send newsletters or marketing email. If we ever offer them, they will be opt-in, and every such email will have an unsubscribe link. Service emails — order confirmations, account and security messages, and notices about changes to our terms — are part of the service.
• We do not use your personal data, your submissions or course content to train AI models, and we do not allow our service providers to do so. Where Neda tools use AI to help people work, a person stays in charge of the result.

5. Children and younger learners

Neda eCampus has no minimum age, but it is built for professional learning and collects the same, limited data from everyone. We do not ask for dates of birth. Most of what we process does not depend on consent — it is needed to provide the service. Where we would rely on consent, such as for optional cookies, the law in Austria says that a person under 14 needs a parent or guardian to give or approve it. If you are a parent or guardian and believe we hold data about your child that we should not, write to us and we will deal with it promptly.

6. Who else sees your data

Only companies that provide part of the service, each under a contract that restricts what they may do with the data, and the few recipients the law or your own choices involve. The full list — who, what they receive, and where — is on the Sub-processors page, and we update it before adding anyone. In summary:

• Hosting: Hetzner Online GmbH — every system (servers in Finland) and the backups (storage in Germany).
• Email: Purelymail, United States — sends our emails and receives email sent to us.
• Payments: Stripe Payments Europe, Limited, Ireland — processes card payments and screens them for fraud. For its own legal obligations (anti-money-laundering, fraud prevention, financial regulation), Stripe decides itself how it uses payment data and is responsible for that under its own privacy policy.
• Only if you use them: Google, when you sign in with Google (on the account service, or on the Open edX platform); public content delivery networks, when your browser loads the Moodle or Open edX sign-in pages (section 7); the European Commission’s VIES service, when a creator gives us a VAT number.
• Creators and organisations: as described in section 1, for the courses you are enrolled in.
• Authorities and advisers: tax authorities, courts or police where the law requires us to disclose data, and our tax adviser and lawyers under professional confidentiality. We keep a record of every request from an authority.

7. Transfers outside the EU

Some of the services above are run by companies in the United States, or may give US staff and systems access to data. Transfers to the United States rely on the EU–US Data Privacy Framework, under which the European Commission has decided that certified US companies protect personal data adequately; where a company is not certified, on the European Commission’s standard contractual clauses. You can ask us for a copy of the relevant safeguards. These are the cases:

• Email. Our outgoing and incoming email is handled by Purelymail in the United States. This covers receipts, account messages, and anything you write to us. We have decided to move to an email provider inside the EU and will update this policy when that is done.
• Signing in with Google. Only if you choose it; a password sign-in avoids it.
• The language switcher. No other company is involved, and nothing is transferred. The translations of the pages of nedaecampus.com are prepared in advance and stored on our own server. When you choose a language, our server sends you the page in that language: no translation service is contacted, and no page text is sent to anyone. We no longer use GTranslate.
• Content delivery networks. The sign-in and some other pages of the Moodle and Open edX learning platforms load standard software libraries or fonts from public content delivery networks (Cloudflare’s cdnjs and jsDelivr on Moodle; Google Fonts on Open edX). When your browser fetches them, those networks see your IP address and browser details; they receive nothing else about you. We are moving these files onto our own server and will remove this paragraph when that is done.
• Payments. Stripe’s European company processes your payment, but parts of Stripe’s processing — for example fraud screening — may take place at Stripe, Inc. in the United States.

8. How long we keep things

Data	Kept for
Account, profile, enrolments, progress, submissions, certificates	Until you close your account, then deleted from every system within 30 days
Record of your acceptance of the Terms of Service	As long as your account exists, and deleted with it; longer only while a dispute about the account is open
Purchase records, invoices, checkout consent records, VAT location evidence	7 years from the end of the year of the purchase (Austrian Federal Fiscal Code, § 132 BAO), longer only while a dispute or tax audit about them is open
Learning-platform activity logs	As long as needed for the purposes in section 3. We are setting a fixed retention period for these logs and will publish it here.
Contact-form messages and emails to us	24 months after our last reply, unless they are part of a purchase record or a dispute
Web-server access logs	14 days
Sign-in event records	90 days
Technical logs of the learning platforms and the account service	As long as needed to keep the platform secure and diagnose faults (section 3). We are setting a fixed retention period for these logs and will publish it here.
Sign-in sessions	Until you sign out, or after 30 minutes without activity, and at most 10 hours
Archived course content	See the Archival and Retention Policy
Backups	Database copies on our server: 14 days. Encrypted off-site copies: one a day for 14 days, one a week for 8 weeks, and monthly copies, which we keep only so that we can restore our systems. We are setting a maximum age for the monthly copies and will publish it here. Deleted data disappears from the backups as they expire.

9. Your rights

You have the right to:

• access — get a copy of the personal data we hold about you, and information about how we use it;
• rectification — have inaccurate data corrected or incomplete data completed;
• erasure — have your data deleted where there is no longer a reason to keep it;
• restriction — have us pause using your data while a question about it is resolved;
• data portability — receive the data you gave us, in a common machine-readable format, or have it sent to someone else;
• object — to any use of your data that relies on our legitimate interests. We will then stop unless we have compelling reasons that override your interests, or need the data for a legal claim;
• withdraw consent at any time, where we rely on it, without affecting what was done before. For cookies, use the cookie settings link described in the Cookie Policy.

Write to info@neda-els.com. We reply within one month, free of charge; if a request is complex we may extend that by up to two further months and will tell you why within the first month. We may ask you to confirm your identity, normally by replying from the email address on the account.

When you ask us to delete your account, we delete it from every system that makes up the platform, not just the one you can see. Two things survive deletion because the law requires them: purchase and tax records for seven years, and the VAT location evidence that belongs to them. We keep only what those obligations require.

If you think we have not handled your data properly, please tell us first so we can put it right. You also have the right to complain to a data protection authority — in Austria, the Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, dsb.gv.at — or to the authority in the EU country where you live or work.

10. Security

All connections to the platform are encrypted. Passwords are stored only as salted hashes. Two-factor authentication is available for every account. Access to the server is by key only, from named accounts. Backups on our server are readable only by the operating account, and the off-site copies are encrypted. Creators see only their own learners; staff access to personal data is limited to what their task needs.

If a breach puts your data at risk, we report it to the data protection authority within 72 hours where the law requires, and tell you directly and without undue delay if it is likely to put your rights at high risk. If you find a security problem, the Security page explains how to report it.

11. Changes to this policy

When this policy changes in a way that matters — a new service provider, a new purpose, or a change to how long we keep something — we email account holders before the change takes effect and say what has changed. Minor wording changes are made in place. Each version is dated at the top of this page, and earlier versions are available on request.

What changed in version 2.0: card payments through Stripe; checkout and withdrawal records; two-factor authentication; profile photos shared across the platform; Neda Creator and optional AI assistants; the cookie consent banner; LinkedIn sign-in removed; no minimum age; the record of your acceptance of the Terms; responsibility where an organisation enrols you; full list of your rights.

Version 2.2 (draft pending legal review) — effective 20 October 2026, last updated 19 October 2026. Earlier versions are available on request from info@neda-els.com.