Privacy Notice

CodeChest Ltd operates EduPortal and is responsible for the personal information it uses for account registration, authentication, platform security, billing administration, support, service analytics and management of the EduPortal service.

Privacy requests and data-protection complaints can be sent to [email protected]. We may ask for reasonable information to confirm your identity and authority before acting on a request.

CodeChest Ltd decides how account, security, billing, support and platform-usage information is used and acts as a data controller for those purposes.

Each Academy independently decides which people it admits, what courses it provides and how it uses Academy records such as membership, attendance, assignments, submissions, grades and instructor notes. For those Academy-managed records, the Academy is responsible for having a lawful reason to collect and use the information, giving any additional notice required, managing permissions and responding to requests about its educational decisions. CodeChest hosts and processes those records to provide EduPortal and does not use them for its own advertising or unrelated purposes.

Academy personnel can see personal information only where their assigned role and permissions allow it. Questions about an Academy’s enrolment, attendance, grades, teaching or use of records should normally be raised with that Academy.

Deleting an EduPortal account removes or anonymises the account profile, sign-in information and other personal information controlled by CodeChest as described in section 13. It does not automatically erase an Academy membership profile or Academy-managed academic records kept in EduPortal where the Academy has a valid lawful basis and retention need. Requests about those Academy records should normally be made directly to the Academy.

We collect information directly from you, from an Academy that adds or authorises you, automatically from your device and from connected providers. The information depends on how you use EduPortal.

To create an account, first name, last name, email, phone number, date of birth and country are required. We use these for identification, sign-in and verification, service and Academy communications, minimum-age and age-based controls, and regional operation of the service. If a required field is not provided, account registration cannot be completed.

City is optional. The gender field requires a selection, but 'Prefer not to say' is available, so you do not have to disclose a substantive gender value. A profile image is optional. If city is left empty, no city is placed in a later Academy membership snapshot; country may still form the address.

We use personal information only where we have an appropriate legal basis. Acknowledging this Notice is not treated as consent for processing that does not require consent.

When an authorised user chooses to connect Google Meet, EduPortal uses the Google Meet access granted by that user only to create Google Meet meeting spaces for scheduled classes at that user’s request. Basic Google account information is used to identify and display the connected account.

EduPortal accounts may be created from age 13. Users aged 13 to 17 may create and use their own account, but cannot create an Academy. EduPortal records the date of birth supplied at registration to enforce these age limits but does not independently verify age or operate a separate parental-email approval process.

Creating an account does not enrol a young person in an Academy or reveal Academy content. The Academy decides whom it invites. The Academy remains responsible for its relationship with young users and for any permission, safeguarding step or additional privacy information that applicable law requires for its own enrolment, teaching, attendance, grading, communications and uploaded work.

We use age-appropriate explanations, role-based access and data minimisation and do not knowingly profile children for personalised advertising. A young user, parent or guardian may contact [email protected] about access, correction or deletion. We will consider the young person’s age, understanding, best interests and the Academy’s responsibilities when handling the request. Young users can ask a trusted adult for help, but EduPortal does not impose a blanket parental-consent condition on every 13-to-17-year-old account.

EduPortal does not require users to provide health, disability, religion, ethnicity, biometric or other special-category information as part of ordinary account registration. Free-text attendance notes, support messages and uploaded files may nevertheless contain sensitive information.

Academies and users must enter sensitive information only where it is necessary, proportionate and lawful. The Academy is responsible for identifying an additional legal condition where special-category information is used and for limiting access to authorised people. Please do not include unnecessary sensitive information in notes, messages or files.

We do not sell personal information. We share only the information reasonably needed to operate EduPortal, process payments, deliver messages, provide connected functions, measure use, protect the service or comply with law. Providers may act as our processors and, for some activities such as regulated payment services, as independent controllers.

An Academy is also a recipient when you accept its invitation. It receives the Academy-specific membership copy described in section 3, and authorised personnel may see your current profile image and current phone number while your account remains linked. The Academy controls how it uses its membership and education records and must have its own lawful basis, access rules and retention period. CodeChest hosts those records for the Academy under the Data Processing Agreement.

We may also disclose information to professional advisers, courts, regulators, law enforcement or a buyer or successor in a genuine corporate transaction where lawful and appropriately protected.

EduPortal uses cookies and browser storage for authentication, security, preferences, analytics and advertising measurement. Necessary technologies operate because they are required to provide or secure the service. Google Analytics and Meta Pixel operate according to the consent choices made through our cookie controls where consent is required.

You can reject or withdraw consent for non-essential technologies through the cookie controls and can also clear cookies through your browser. Rejecting analytics or advertising cookies does not prevent you from using the core EduPortal service. Browser deletion may sign you out or reset saved preferences.

We keep identifiable information only for as long as needed for the purposes described below. We may preserve limited records for longer where a dispute, security incident, legal hold or regulatory requirement applies. At present, EduPortal does not maintain a separate automatic backup system intended to restore personal information after a valid deletion.

EduPortal’s primary application, database and Redis infrastructure is hosted by Hetzner in Germany. Uploaded files are stored in Cloudflare R2 using the European Union jurisdiction. Cloudflare’s DNS, content-delivery and security network operates globally, so request and network information may pass through locations close to the user.

Stripe, Google, Zoom, Meta, Resend and Cloudflare may process limited information in the United Kingdom, European Economic Area, United States or other countries in which they operate. Where a restricted transfer requires safeguards, we rely on applicable adequacy regulations, the UK International Data Transfer Agreement or UK Addendum, standard contractual clauses and provider transfer mechanisms, together with appropriate technical and contractual protections.

We use measures designed to protect information against unauthorised access, alteration, disclosure and loss. These include HTTPS/TLS in transit, provider-managed encryption for R2 files at rest, password hashing, secure and same-site authentication cookies in production, CSRF protection, role-based permissions, encrypted Google and Zoom connection tokens, two-factor authentication options, rate limiting and access logging.

No online system is completely secure. Users must protect their credentials and notify [email protected] if they suspect unauthorised access. If a personal-data breach creates a legal notification duty, we will notify the ICO and affected people as required by law.

Depending on applicable law and our role, you may have rights to be informed, access your information, correct it, request deletion, restrict processing, receive portable information, object to processing based on legitimate interests and withdraw consent at any time for consent-based processing. Withdrawal does not affect processing that was lawful before withdrawal.

Requests concerning an Academy membership profile, attendance, exams, grades, assignments or other Academy-managed records should normally be made to the relevant Academy first. If the Academy cannot be reached or you believe it has refused or mishandled a valid request, contact [email protected]. We may verify your identity, coordinate the request with the Academy and, where applicable law, our contract or a valid instruction requires it, delete or anonymise the information or restrict its use. We normally respond within one month, although the law may allow an extension for a complex request. No fee is normally charged unless a request is manifestly unfounded or excessive.

A user may delete their account from the Security section of User Settings. EduPortal sends a six-digit, single-use code to the account email address; the code must be entered before deletion proceeds. Admin accounts cannot be deleted through this control. Before deletion, the user must leave every Academy they have joined and reject any pending Academy invitations. A user who owns an active Academy must first delete or transfer that Academy as permitted by the service.

Confirmed account deletion permanently disables sign-in and deletes or anonymises the user’s personal account profile, authentication and security information, sessions, connected-service tokens and account avatar. The user’s name, email, phone number, date of birth, gender and address are removed from the account record. A limited inactive record may remain under the same internal identifier to preserve database and historical-record integrity. The deleted account cannot be restored, and a later registration with the same email address creates a separate account.

Account deletion does not automatically erase the separate Academy membership profile created when an invitation was accepted, or Academy-managed attendance, assignment, exam, submission, grade, evaluation and historical statistical records. Those records may remain in EduPortal under the Academy’s control for as long as the Academy has a valid lawful basis and retention need. The member’s access is inactive and no live account avatar is retained.

An authorised Owner may delete an Academy after confirming a six-digit, single-use code sent to their email address. The Academy and its related non-file records immediately become inaccessible and are marked as deleted. Related files enter the storage-deletion process. The inaccessible Academy database records are retained for one year and are then permanently deleted by a cleanup task that runs daily, normally at the first run after the one-year anniversary. Deleted Academy information cannot be restored.

The right to deletion is not absolute. An Academy may retain limited information where a legal obligation, valid retention basis or the establishment, exercise or defence of legal claims requires it. If you want Academy-managed records corrected or deleted, contact the relevant Academy first. If the Academy cannot be reached or you believe it has unlawfully refused the request, contact [email protected]. After verification, we may ask the Academy to explain its basis and, where required, delete or anonymise the information or restrict its use.

A data-protection complaint may also be sent to [email protected]. We will acknowledge receipt within 30 days, investigate it without undue delay, keep you informed where appropriate and communicate the outcome. You also have the right to complain to the UK Information Commissioner’s Office and may have a right to contact a regulator in your country.

EduPortal does not sell personal information. We do not use account information, Academy content, student work, uploaded files or educational records to train artificial-intelligence models. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on users.

Google Analytics and Meta Pixel are used for measurement and marketing attribution, not to decide admission, grades, access to education or other educational outcomes. Non-essential analytics and advertising measurement are subject to applicable cookie choices.

We may update this Notice when our service, providers, legal obligations or data practices change. We will publish the revised date and provide an additional email or in-app notice where a change materially affects users. New uses that require consent will not begin until the required consent process is available.

The English version is the primary version. The Azerbaijani version is provided for accessibility and is intended to have the same meaning, subject to any mandatory local-language requirement.