Educherry - Privacy Policy
Version 1.3 - effective 1 October 2026
This Privacy Policy explains how Educherry s.r.o. processes personal data when you visit educherry.com, use the Educherry platform, order training, work with us as a training provider, or receive our communications.
1. Controller
Educherry s.r.o., Ovocný trh 573/12, Staré Město, 110 00 Praha 1, Czech Republic, Company ID 29845599, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File 453298 ("Educherry", "we").
Contact for all data protection questions: info@educherry.com. We have not appointed a data protection officer because we are not required to.
2. Whose data we process
Website visitors
Users with an Educherry account, including Workspace Admins and Members
Individual customers who buy training for themselves
Contact persons of customers (HR, L&D, procurement, IT, accounts payable)
Participants - employees for whom training is ordered
Contact persons of training providers and other business partners
Newsletter subscribers and people who register interest (for example early access or the Founding Programme)
3. What we process, why, and on what legal basis
| Purpose | Data | Legal basis (GDPR) | How long |
|---|---|---|---|
| Account and Workspace | name, business email, company, job role, login data, preferences and interests you select | contract - Art. 6(1)(b); for users acting for their employer, legitimate interest of the employer and us in providing the service - Art. 6(1)(f) | while the account is active, then 3 years |
| Orders, quotes and delivery of training | contact person, participant name, business email, company, course, dates, special requirements you provide | contract - Art. 6(1)(b); for participants, legitimate interest in administering training ordered by their employer - Art. 6(1)(f) | 3 years after the course (limitation of claims) |
| Registration with exam bodies | participant name and email | legitimate interest / contract performance - Art. 6(1)(b), (f) | as for orders |
| Orders by individual customers | name, email, address, phone (if given), course, dates, payment data, withdrawal and complaint records, requests and consents given when ordering (for example to start a course or supply e-learning within the withdrawal period) | contract - Art. 6(1)(b); legal obligation - Art. 6(1)(c) (consumer protection law) | 4 years after the contract ends (limitation of claims) |
| Invoicing and accounting | billing data, invoices, payments | legal obligation - Art. 6(1)(c) (Czech Accounting Act, VAT Act) | 10 years |
| Customer service and complaints | communication, complaint details | contract / legitimate interest - Art. 6(1)(b), (f) | 3 years after resolution |
| Work with training providers | names, business contacts and roles of provider staff | contract / legitimate interest - Art. 6(1)(b), (f) | while the cooperation lasts, then 3 years |
| Marketing emails to our existing customers about our own similar services | name, business email, company, role | Section 7(3) of Act No. 480/2004 Coll. (only for email contacts obtained in connection with a sale, with a free and simple option to refuse offered when the contact was obtained and in every email) together with legitimate interest - Art. 6(1)(f) | until you object, max. 3 years after last purchase |
| Other marketing emails | name, business email, company, role, interests | consent - Art. 6(1)(a) | until you withdraw consent |
| Newsletter and early-access lists | email, name, company, interests | consent - Art. 6(1)(a) | until you unsubscribe |
| Personalised recommendations and AI training planner for your own account | courses viewed and ordered, interests, certifications and training history you enter | contract / legitimate interest - Art. 6(1)(b), (f) | while the account is active |
| Evidence of acceptance of our Terms and of consents | version of the document accepted, date and time, account or email, IP address | legal obligation and legitimate interest in proving the contract and consents - Art. 6(1)(c), (f) | for the duration of the contract or consent, then 4 years (limitation of claims) |
| Website operation, security and error monitoring | IP address, device and browser data, logs | legitimate interest - Art. 6(1)(f) | up to 90 days |
| Website analytics | aggregated traffic statistics (Plausible), configured without cookies; we do not send names, emails or other identifiers to analytics | legitimate interest - Art. 6(1)(f); if a configuration ever requires consent under the Cookie Policy, consent - Art. 6(1)(a) | aggregated only |
| Advertising and remarketing (LinkedIn, Google) | cookies and online identifiers | consent - Art. 6(1)(a) | see Cookie Policy |
| Legal claims | data relevant to the dispute | legitimate interest - Art. 6(1)(f) | until the dispute is closed |
Where a customer uses our tools to manage training plans of its employees on its own instructions, we act as the customer's processor under a separate data processing agreement, and the customer's privacy information applies to that processing.
We do not make decisions producing legal effects based solely on automated processing. Course recommendations and training plans generated with the help of AI are suggestions only.
We do not knowingly process data of children. We do not need special categories of personal data; please do not send them to us.
4. Where the data comes from
Mostly from you. Participant data usually comes from the participant's employer (the customer). The employer is asked to give participants this Privacy Policy when providing their data to us. Where the participant has not already received this information, we provide it within a reasonable period, no later than one month after obtaining the data, and in any event no later than our first communication with the participant or our first disclosure of the data to another recipient (such as the training provider or an exam body), whichever occurs first. Business contact data may come from publicly available professional sources (for example company websites, LinkedIn) or from our founders' existing business contacts.
5. Who receives the data
Training providers delivering the ordered course - only the data they need for delivery (typically name, email, company).
Exam and certification bodies (for example PeopleCert, Pearson VUE, vendor certification systems) - where registration for an exam is part of the order.
Conference organisers - for ticket orders.
Our service providers (processors) acting on our instructions, in particular: hosting and infrastructure (Vercel, Supabase, Cloudflare), email and office tools (Microsoft 365), invoicing (Fakturoid), email marketing, CRM, error monitoring (Sentry), web analytics (Plausible), accounting and legal advisors.
Advertising platforms (LinkedIn, Google) - only with your consent to marketing cookies.
Public authorities where required by law.
We do not sell personal data.
6. Transfers outside the EEA
Some service providers may process data outside the European Economic Area, in particular in the United States. We transfer data only where the recipient is certified under the EU-US Data Privacy Framework, where an adequacy decision applies, or on the basis of the European Commission's Standard Contractual Clauses. Transfers to training providers, exam bodies and other recipients outside the EEA are subject to the same transfer requirements. We use an applicable adequacy decision or appropriate safeguards, such as Standard Contractual Clauses, where required. A derogation under Article 49 GDPR is used only where its specific conditions are met and documented, and is not our routine transfer mechanism. Information on the applicable safeguards and how to obtain a copy is available at info@educherry.com.
7. Your rights
You have the right to:
access your data and receive a copy,
rectification of inaccurate data,
erasure ("right to be forgotten"),
restriction of processing,
data portability,
object at any time to processing based on legitimate interest, and to direct marketing (after an objection to direct marketing we stop immediately),
withdraw consent at any time (this does not affect processing before withdrawal),
lodge a complaint with the supervisory authority: Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz.
To exercise your rights, write to info@educherry.com. We respond within one month. Every marketing email contains an unsubscribe link.
8. Security
We use access controls, encryption in transit, role-based permissions in Workspaces and contractual obligations with our processors. Only people who need data for their work have access to it.
9. Cookies
Details are in our Cookie Policy at educherry.com/cookies.
10. Changes
We update this Privacy Policy when our processing changes. The current version is always available at educherry.com/privacy, with the date of effect.