EDU EFFECTIVE

Comprehensive Data and Personal Data Protection Documentation

This document complies with the GDPR, the EU AI Act, and the EDU Effective Terms & Conditions

Effective October 1, 2026

1. PERSONAL DATA PROTECTION PRINCIPLES (PRIVACY POLICY)

This documentation represents a strategic pillar of the institutional integrity of EDU Effective, ensuring the alignment of European and American standards in the field of digital education. In a global environment where EU and U.S. jurisdictions intersect, the protection of personal data is a key instrument for building trust between the student and the educational institution. These rules are fully consistent with the Terms & Conditions and reflect the most current requirements for data transparency and security. Compliance with the GDPR is, for EDU Effective, not merely a legal obligation but a cornerstone of our international reputation and a commitment to the ethical handling of information.

These Data and Personal Data Protection Principles (hereinafter the "Principles") provide students, prospective students, and website visitors with detailed information on how their personal data is collected, processed, stored, and secured in connection with the educational activities of EDU Effective. These Principles apply equally to both websites operated by the Controller, edueffective.online and edueffective.com. These Principles are effective as of October 1, 2026, and fully supersede all previous versions.

1.1. Identity of the Joint Controllers of Personal Data

Given the interconnection and joint organization of the educational programs and other educational services that link American and European professional education, the entities listed below act as joint controllers of personal data (jointly referred to as the "Controller" or "EDU Effective"):

EDU Effective, z.s., a non-profit professional education institution established under the laws of the Czech Republic, Company ID No.: 22691367, with its registered office at Antala Staška 1859/34, Prague 4, 140 00, Czech Republic (representing interests within the European Union; hereinafter "EDU Effective EU").
EDU Effective Business School, LLC, a professional education institution registered under the laws of the State of Hawaii, USA, with its registered office at 500 Ala Moana Blvd., Honolulu, Hawaii, HI 96813, USA, File No. 172107 C5 (hereinafter "EDU Effective US").

The principle of joint responsibility means that both entities cooperate closely to ensure data security and to give effect to your rights. While the American entity provides the primary educational platform and global certification, the European entity guarantees compliance with the strict privacy protection standards of the EU and serves as the primary point of contact for data subjects within the European Economic Area. This synergy ensures that the categories of data described in the following section are protected regardless of the jurisdiction in which they are being processed at any given time.

Data subjects may contact the Controller regarding all matters relating to the processing of personal data and the exercise of their rights at the email address: dataprotection@edueffective.online.

1.2. Categories of Personal Data Processed

EDU Effective processes personal data provided to it by data subjects in connection with registration, entering into a study agreement, or during the course of study itself. The scope of processing complies with the principle of data minimization (Art. 5(1)(c) GDPR).

A. Basic identification and contact data (required for registration and study)

Identification data: First name, surname, academic title, gender, date of birth, nationality, place of birth.
Contact data: Permanent or temporary residential address, email address, telephone number.
Study and professional profile: Educational background (previous diplomas and certificates), current employment, job position.

B. Data for identity verification and performance of contractual terms

Identity verification: Government-issued identity document number (national ID card, passport) or a copy of such a document, to the extent necessary to verify the student's identity upon enrollment and issuance of a certificate.
Payment data: Bank account number and transaction history (payments themselves are processed securely through the certified provider Global Education s.r.o. and payment gateways; the Controller does not store complete payment card details).

C. Electronic and technical data (collected automatically)

Technical parameters: IP address, MAC address, browser data, geolocation data, and information about interaction with the website collected through cookies.
Study activity: Operational logs from the LMS learning system (TalentLMS) — time spent studying, test results, and interactions within courses.

1.3. Purposes, Legal Bases, and Retention Periods for Data and Personal Data

The processing of data and personal data is carried out exclusively on the basis of valid legal grounds and for a precisely defined period. The following table summarizes these key parameters:

Purpose of Processing	Legal Basis (Title)	Scope of Data	Retention Period
Provision of education, administration of study, access to the LMS	Performance of a contract (Art. 6(1)(b) GDPR)	Name, surname, contact details, study results, IP address	For the duration of the contractual relationship (active study)
Maintenance of the study register, certificates, and diplomas	Legitimate interest of the Controller (verifying the authenticity of study, preventing fraud)	Name, surname, certification obtained, student ID	Securely retained in the register for 5 years after graduation, then permanently archived
Bookkeeping, tax administration, and invoicing of tuition	Compliance with a legal obligation (Art. 6(1)(c) GDPR)	Name, billing address, transaction data, tax documents	5 to 10 years in accordance with applicable Czech/U.S. tax and accounting regulations
Marketing, sending newsletters, offering programs, profiling	Voluntary consent of the data subject (Art. 6(1)(a) GDPR)	Name, email, preferences, on-site behavior history	5 years from the granting of consent, or until it is withdrawn
Ensuring network and IT system security, preventing fraud	Legitimate interest of the Controller (Art. 6(1)(f) GDPR)	IP address, operational logs, identification data of the examinee	The period strictly necessary to investigate incidents (typically 1 year)

1.4. Transfer of Personal Data and Transfer to the USA

EDU Effective does not sell, rent, or trade the data and personal data of its students. Access to the data is available only to authorized employees of the Controller and to contractual processors that provide sufficient data security guarantees. These vetted processors include:

IT and learning system operators: TalentLMS (course administration and LMS), FAPI (invoicing and order system), Stripe (online payment processing), Anabix (CRM system for contact management), and Smartemailing (a tool for distributing marketing, commercial, and informational communications).
Payment and financial service providers: Global Education s.r.o., which handles the clearing and processing of payments to the Controller's bank accounts.

Transfers to third countries (USA): Because the study programs are carried out in cooperation with the American joint controller EDU Effective Business School, LLC, based in the USA (Hawaii), personal data of students is transferred to the United States of America. This transfer is legally secured on the basis of Standard Contractual Clauses (SCCs) approved by the European Commission in accordance with Article 46 GDPR, supplemented by additional technical and organizational measures to ensure a high level of personal data protection. In accordance with the Schrems II case law, EDU Effective regularly conducts a Transfer Impact Assessment (TIA) to ensure an equivalent level of protection. We have implemented above-standard technical and organizational measures, including advanced SSL (Secure Socket Layer) encryption and the pseudonymization of data wherever technically feasible.

1.5. Cookies, Remarketing, and Tracking Technologies

The Controller's website uses cookies to improve browsing efficiency, personalize content, and analyze traffic. We distinguish the following categories of cookies:

Necessary cookies: Required for the proper functioning of the website (e.g., storing the CookieConsent state for 1 year). They do not require the user's consent.
Preference and analytical cookies (e.g., Google Analytics): Help us understand how visitors interact with the website. They are stored solely on the basis of the user's voluntary consent (opt-in) in the Cookiebot banner.
Marketing and remarketing cookies (e.g., Google AdSense, DoubleClick): Used to target relevant advertising based on the user's previous visits. They are activated only if the user gives active consent in the Cookiebot banner.

Important notice: Users may change, adjust, or fully withdraw their cookie storage preferences at any time, directly through the Cookiebot declaration link on our website or through their web browser settings.

1.6. Profiling, Automated Decision-Making, and Artificial Intelligence (AI)

EDU Effective uses modern technologies to make instruction more efficient, but with strict regard for ethical rules and legislative standards.

Marketing profiling: Automated processing of data for the purpose of tailoring offers takes place solely on the basis of the student's separate, voluntary consent. Refusing or withdrawing this consent has no effect on the ability to begin or successfully complete study.

Automated decision-making and human review (Art. 22 GDPR)

Certain parts of the study process are evaluated by automated means, as this is necessary for the performance of the study contract between the student and the Controller (Art. 22(2)(a) GDPR). Specifically:

E-tests used to verify acquired knowledge are evaluated automatically on the basis of predefined parameters (correct answers set in advance) and a minimum pass threshold published to the student before the test.
Certificates of completion of individual parts of study are generated automatically once the system records that the student has completed all mandatory components of the relevant part.

The following decisions are never made solely by automated means and are always subject to review and approval by an authorized member of the Controller's staff:

The evaluation of open-ended assignments and questions.
The decision to issue the final certificate of completion of the entire study program, which is made after verifying that the student has fulfilled all academic, administrative, and financial obligations.
Any decision on the termination of study or on a refund of tuition.

With respect to decisions under (a) and (b), the student has the right to obtain human intervention on the part of the Controller, to express their point of view, and to contest the decision. The student may exercise these rights by contacting dataprotection@edueffective.online, and the request will be reviewed by an authorized staff member without undue delay.

Safe and ethical use of AI (EU AI Act & NIST AI RMF): In accordance with the European Artificial Intelligence Act (EU AI Act — Regulation (EU) 2024/1689) and the NIST AI RMF 1.0 standards, the Controller undertakes to:

Not use prohibited AI systems: EDU Effective strictly rejects any social scoring practices or manipulative systems that would fall into the category of unacceptable risk under the EU AI Act.
Transparency of interaction: If a student communicates with an AI assistant or chatbot, they are clearly informed of this fact in advance.
Accountability for high-risk systems: If AI tools are used to evaluate study results or to monitor the course of examinations (proctoring), these systems are subject to continuous testing for accuracy, cybersecurity, and the absence of discrimination, and remain under constant human supervision.
Opt-out option: A student has the right to opt out of AI-powered learning personalization by emailing studentsupport@edueffective.online. This opt-out will in no way limit their basic access to the course.

1.7. Rights of Data Subjects and the Procedure for Exercising Them

Under the General Data Protection Regulation (GDPR), data subjects have broad rights that they may exercise with the Controller free of charge:

Right of access: The right to obtain confirmation as to whether and which personal data is being processed and to receive a copy thereof.
Right to rectification: The right to have inaccurate personal data corrected and incomplete personal data completed.
Right to erasure ("right to be forgotten"): The right to have personal data deleted where the purpose of processing has ceased, consent has been withdrawn, or the Controller is processing the data unlawfully. This right cannot be exercised with respect to data that the Controller is required to retain by law (e.g., accounting records).
Right to restriction of processing: The right to request the temporary restriction of the processing of personal data (e.g., while its accuracy is being verified).
Right to data portability: The right to obtain the data in a structured, commonly used format and to transfer it to another controller.
Right to object: The right to object to processing based on the Controller's legitimate interest (e.g., in the case of direct marketing).

Procedure for exercising rights: Data subjects may exercise their rights by sending an email to dataprotection@edueffective.online. The request will be handled without undue delay, and no later than 1 month from receipt. If there are doubts about the lawfulness of processing, the data subject has the right to lodge a complaint with the supervisory authority — for the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), with its registered office at Pplk. Sochora 27, 170 00 Prague 7, website: www.uoou.cz.

1.8. Protection of the Personal Data of Children and Minors

The study programs and Flexible Credentials provided by EDU Effective are not intended for children under the age of 13. The Controller does not knowingly collect or process the personal data of children below this age threshold. Registration for study is permitted only to persons over the age of 18.

1.9. Alternative Dispute Resolution for Consumer Disputes (ADR)

In the event that a dispute arises between a student (who is a consumer) and the Controller that cannot be resolved by mutual amicable agreement via email skillup@edueffective.online, the student has the right to the out-of-court (alternative) resolution of the consumer dispute. The competent body is:

Czech Trade Inspection Authority (Česká obchodní inspekce, ČOI)

Central Inspectorate — ADR Department

Gorazdova 1969/24, 120 00 Prague 2

Email: podatelna@coi.gov.cz | Web: https://coi.gov.cz/en/about-ctia/contacts-inspectorates/

A student may file a proposal with the ČOI no later than 1 year from the day on which they first exercised their right with the Controller. The European online ODR platform was permanently discontinued pursuant to Regulation (EU) 2024/3228 with effect from July 20, 2025; consumers from the EU may use the European Commission's resources at https://consumer-redress.ec.europa.eu/.

2. CONSENT TO PERSONAL DATA PROCESSING

This document constitutes the specific and voluntary consent that you grant to the Controller upon registration on the websites edueffective.com and edueffective.online, or within study forms. By granting consent, you confirm that you agree to the processing of personal data for marketing and profiling purposes under the conditions defined below.

2.1. Who Is Requesting Your Consent?

Your consent is requested by the joint controllers of personal data:

EDU Effective, z.s., with its registered office at Antala Staška 1859/34, Prague 4, 140 00, Czech Republic, Company ID No.: 22691367 (representing interests in the EU).
EDU Effective Business School, LLC, with its registered office at 500 Ala Moana Blvd., Honolulu, Hawaii, HI 96813, USA, File No. 172107 C5 (joint controller in the USA).

2.2. Scope and Purposes of Processing Based on Consent

By checking the relevant box (opt-in), you grant the Controller consent to process your personal data to the following extent: first name, surname, gender, date of birth, email address, telephone number, IP address, and cookie identifiers for the following purposes:

Marketing activities and sending commercial communications: Sending information about new courses, special offers, events, and newsletters via email, telephone, or SMS.
Profiling and automated tailoring of offers: Creating analyses of on-site behavior and automated processing of data in order to provide benefits, discounts, and recommendations corresponding to your interests and preferences.
Invitations to events and networking: Sending invitations to events, webinars, and meetings organized by the Controller or its partners.

2.3. Voluntariness and Legal Effects

Granting this consent is entirely voluntary and is not a condition for registration for study or for entering into a contractual relationship with EDU Effective. If you do not grant consent or later withdraw it, this will have no effect on your course of study, access to the LMS, evaluation of tests, or ability to successfully complete study and receive a certificate.

2.4. Period of Validity of Consent

You grant this consent for a period of 5 years from the date it is granted, or until you withdraw it (whichever occurs first). After this period expires or after consent is withdrawn, your personal data processed on this basis will be deleted without delay, unless another legal basis exists for its retention (e.g., fulfillment of statutory tax obligations or protection of the Controller's rights).

2.5. How to Withdraw Consent at Any Time

You may withdraw your consent at any time, entirely free of charge and without any adverse consequences. Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal. Consent may be withdrawn:

By email: By sending an email to dataprotection@edueffective.online stating that you are withdrawing your consent to the processing of personal data.
By clicking the link: Through the "unsubscribe" link included in every marketing email.

2.6. Declaration of the Data Subject

By checking the box "I consent to the processing of personal data," I declare that I have read the contents of this document, fully understand the scope, purposes, and conditions of the processing of my personal data, and that I grant this consent freely, seriously, and voluntarily.