Privacy Policy

1. Who we are and how to contact us

merkel.academy ("we", "us", "our"), operated by Mohamed Ali in London, United Kingdom, is the data controller for the personal data described in this policy. That means we are responsible for deciding how and why your data is used.

For any question about this policy or your data, contact us at hello@merkel.academy. We are not required to appoint a Data Protection Officer.

2. Scope of this policy

This policy covers the personal data we process through the merkel.academy website and the online German courses offered through it, whether you are browsing, registering, purchasing, or using your account.

It does not apply to third-party services that have their own privacy policies, such as Stripe when you pay. We link to relevant policies where we can.

3. Personal data we collect

We collect the following categories of personal data:

Category	What it includes	How we get it
Account details	Your name, email address, your role (student or teacher), and a password. Passwords are stored only as a secure hash, never in plain text.	Provided by you when you register or update your profile.
Order and purchase records	Which courses you bought, the amount paid, currency, date, payment status, and references such as the Stripe checkout session and payment intent IDs.	Created when you make a purchase.
Learning activity	Which lessons you have marked as complete, and any progress associated with your account.	Created as you use the course player.
Communications	The content of messages you send us through the contact form or by email, together with your name and email address.	Provided by you.
Technical and security data	IP address, browser and device information (user agent), and basic security logs such as rate-limiting records.	Collected automatically when you use the Website.
Authentication tokens	A session token that keeps you signed in. We store only a hash of the token on our servers.	Created when you sign in.
Email log	A record that a transactional email (for example a receipt or password reset) was sent or skipped.	Created when we send you service emails.

We do not ask for, and do not intend to collect, special category data such as health, religious or political information. Please do not include such information in messages to us unless it is necessary for your query.

4. How and why we use your data

We only use your personal data where the law allows it. The table below explains our purposes and the lawful basis we rely on for each one.

Purpose	Data used	Lawful basis
Creating and managing your account; giving you access to courses you have paid for.	Account details, order records, authentication tokens.	Performance of a contract.
Processing payments and issuing receipts.	Account details, order records.	Performance of a contract.
Keeping financial and tax records.	Order records.	Compliance with a legal obligation.
Providing, tracking and improving the learning experience (for example, showing your progress).	Learning activity.	Performance of a contract.
Answering your questions and providing support.	Communications, account details.	Legitimate interests (responding to people who contact us).
Sending service emails such as receipts, password resets and important course updates.	Account details, email log.	Performance of a contract; legitimate interests for updates.
Keeping the Website secure, preventing fraud and abuse, and limiting automated attacks.	Technical and security data, authentication tokens.	Legitimate interests (protecting our service and users).
Sending marketing emails, if you choose to receive them.	Account details.	Consent, which you can withdraw at any time.

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms, and you can object as described in section 10. We do not use your data for solely automated decision-making that has a legal or similarly significant effect on you.

5. Payment information

Payments are handled by Stripe. When you pay, you enter your card details directly on Stripe's secure checkout page. We do not receive or store your full card number or CVC.

We receive limited information from Stripe — confirmation that a payment completed, the amount and currency, and payment references — which we use to grant access and keep accounting records. Stripe processes personal data in accordance with its own privacy policy, available at stripe.com/privacy.

6. Cookies and local storage

We use a small amount of browser storage to keep you signed in. We do not use advertising or cross-site tracking cookies. For details of exactly what is stored and how to control it, see our Cookie Policy.

7. Who we share your data with

We do not sell your personal data. We share it only with service providers who help us run the Website, and only as far as necessary. These providers act on our instructions as our processors, except where they act independently (for example, payment providers for their own compliance obligations).

Recipient	Why
Stripe	Processing card payments securely and confirming completed payments.
Our hosting provider	Storing and serving the Website, the database and uploaded course files.
Our email delivery provider	Sending transactional emails such as receipts and password resets (when email is enabled).
Our professional advisers	Accountancy and legal advice, including for tax and record-keeping.
Regulators and law enforcement	Only where we are legally required to disclose data, or to establish or defend legal claims.

8. International transfers

Some of our providers are based outside the United Kingdom, mainly in the United States. Where personal data is transferred outside the UK, we rely on appropriate safeguards, such as the UK International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses), together with a transfer risk assessment where required.

9. How long we keep your data

Data	Retention period
Account and profile data	While your account is active, then up to 12 months after you close it.
Purchase and financial records	Six years from the end of the relevant accounting period, to meet UK tax and accounting requirements.
Learning activity (progress)	While your account is active; deleted with your account.
Contact messages	Up to 24 months after your query is resolved.
Security logs and rate-limiting records	Up to 12 months.
Authentication tokens	Up to 30 days, or until you sign out, whichever is sooner.
Password reset tokens	One hour, or until used.
Email log	Up to 24 months.

10. Your rights

Under UK data protection law you have the right to:

• Be informed about how we use your data — which is what this policy does.
• Access the personal data we hold about you and receive a copy.
• Rectify inaccurate or incomplete data.
• Erase your data where there is no good reason for us to keep it.
• Restrict processing in certain circumstances.
• Data portability — receive data you provided in a structured, commonly used format, or ask us to transfer it.
• Object to processing based on legitimate interests.
• Withdraw consent at any time where we rely on consent, without affecting processing carried out before you withdrew.

To exercise any of these rights, email hello@merkel.academy. We will respond within one month. Exercising your rights is free, though we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive. We may need to confirm your identity before acting.

11. How we protect your data

We take the security of your data seriously. Measures we use include:

• passwords stored as one-way hashes using bcrypt — we cannot read them;
• session tokens stored only as hashes, with an expiry time;
• encrypted connections (HTTPS) across the Website;
• access controls so that only authorised accounts can reach administrative functions;
• rate limiting on sign-in, registration and password reset to slow down attacks;
• course files kept outside the public web folder and served only through signed, expiring links;
• regular checks and updates to keep the platform secure.

No online service can be completely secure. If a breach affects your rights, we will notify you and the Information Commissioner's Office where we are legally required to do so.

12. Children

Our courses are designed for adult learners. You must be 18 or over to purchase a course. If you are under 18, you may only use the Website with the involvement of a parent or guardian. We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time, for example if we change how we use data or if the law changes. We will publish the new version on this page and update the "Last updated" date. Where changes are material, we will give you reasonable notice by email or a notice on the Website.

14. How to complain

If you have concerns about how we have handled your data, please contact us first at hello@merkel.academy so we can try to resolve the issue.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF