GDPR Privacy Policy
Last updated: March 11, 2024
This Privacy Policy describes how goodround ("we", "us", or "our") collects, uses, stores, and protects personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"). By using our platform at goodround, you acknowledge the practices described in this document.
1. Data Controller
The data controller responsible for your personal data is:
Goodround
Kehra, 74307 Harju County, Estonia
Email: help@goodround.com
Phone: +3724737030
2. Definitions
For the purposes of this policy, the following definitions apply:
| Term | Meaning |
|---|---|
| Personal Data | Any information relating to an identified or identifiable natural person. |
| Processing | Any operation performed on personal data, including collection, storage, use, or deletion. |
| Data Subject | The natural person whose personal data is being processed. |
| Data Processor | A third party that processes data on behalf of the controller. |
| Consent | A freely given, specific, informed, and unambiguous indication of agreement to data processing. |
3. Data We Collect
3.1 Data You Provide Directly
We collect personal data that you voluntarily submit when registering an account, enrolling in courses, contacting support, or completing forms on our platform. This may include:
Full name, email address, phone number, billing and payment information, learning preferences, and any communications you send to us.
3.2 Data Collected Automatically
When you use our platform, certain data is collected automatically through cookies, log files, and similar tracking technologies. This may include:
IP address, browser type and version, operating system, pages visited, session duration, referring URLs, and device identifiers.
3.3 Data from Third Parties
We may receive data about you from third-party services such as payment processors, authentication providers, or analytics platforms, where you have consented to such sharing or where it is necessary to deliver our services.
4. Legal Basis for Processing
We process your personal data only when a valid legal basis exists under Article 6 of the GDPR:
| Legal Basis | Purpose |
|---|---|
| Contractual necessity | To provide the services you have enrolled in or purchased. |
| Legitimate interests | To improve our platform, prevent fraud, and ensure security. |
| Legal obligation | To comply with applicable laws and regulatory requirements. |
| Consent | For marketing communications, optional cookies, and non-essential data uses. |
5. How We Use Your Data
We use the personal data we collect for the following purposes:
Creating and managing your user account; delivering and personalizing educational content and learning paths; processing payments and managing subscriptions; communicating service updates, notifications, and support responses; improving platform functionality and user experience; conducting internal analytics and performance monitoring; complying with legal obligations and resolving disputes.
6. Cookies and Tracking Technologies
6.1 Types of Cookies We Use
We use the following categories of cookies on our platform:
| Category | Description |
|---|---|
| Strictly necessary | Required for the platform to function. Cannot be disabled. |
| Functional | Remember your preferences and settings across sessions. |
| Analytical | Help us understand how users interact with the platform. |
| Marketing | Used to deliver relevant communications. Requires your consent. |
6.2 Managing Cookies
You may manage or withdraw your consent to non-essential cookies at any time through your browser settings or our cookie preference center. Disabling certain cookies may affect the functionality of the platform.
7. Data Sharing and Disclosure
We do not sell your personal data. We may share your data with trusted third parties only in the following circumstances:
With service providers who assist in operating our platform (such as hosting, payment processing, and analytics), under strict data processing agreements; when required by law, court order, or regulatory authority; in connection with a merger, acquisition, or business transfer, where you will be notified in advance; with your explicit consent for any other purpose not listed here.
All third-party processors are contractually bound to handle your data in compliance with GDPR and to use it only for the purposes we specify.
8. International Data Transfers
Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place as required by Chapter V of the GDPR. These safeguards may include Standard Contractual Clauses approved by the European Commission or adequacy decisions applicable to the recipient country.
9. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:
| Data Type | Retention Period |
|---|---|
| Account information | Duration of account plus 2 years after closure |
| Transaction and billing records | 7 years for accounting and tax compliance |
| Learning activity and progress data | Duration of account plus 1 year |
| Support correspondence | 3 years from last interaction |
| Marketing consent records | Until consent is withdrawn plus 1 year |
Upon expiry of the applicable retention period, data is securely deleted or anonymised.
10. Your Rights Under GDPR
As a data subject, you have the following rights with respect to your personal data:
| Right | Description |
|---|---|
| Right of access | Request a copy of the personal data we hold about you. |
| Right to rectification | Request correction of inaccurate or incomplete data. |
| Right to erasure | Request deletion of your data where no legitimate basis remains. |
| Right to restriction | Request that we limit the processing of your data in certain circumstances. |
| Right to data portability | Receive your data in a structured, machine-readable format. |
| Right to object | Object to processing based on legitimate interests or for direct marketing. |
| Right to withdraw consent | Withdraw consent at any time without affecting prior lawful processing. |
| Right to lodge a complaint | Submit a complaint to the relevant supervisory authority. |
To exercise any of these rights, please contact us at help@goodround.com. We will respond within 30 days of receiving your request. In complex cases, this period may be extended by a further two months, and you will be informed accordingly.
11. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include encryption of data in transit and at rest, access controls and authentication requirements, regular security assessments and audits, and staff training on data protection obligations.
While we take all reasonable precautions, no system is completely secure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay where required.
12. Children's Privacy
Our platform is not directed to children under the age of 16. We do not knowingly collect personal data from individuals under this age without verifiable parental or guardian consent. If we become aware that data has been collected from a child without appropriate consent, we will take immediate steps to delete it.
13. Automated Decision-Making and Profiling
We may use automated processes to personalise learning content and recommend courses based on your activity and preferences. These processes do not produce legal effects or similarly significant consequences. You have the right to request human review of any automated decision that does significantly affect you by contacting us at help@goodround.com.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by email or by posting a prominent notice on our platform prior to the changes taking effect. The date at the top of this page indicates when the policy was last revised. Continued use of our platform after changes take effect constitutes acceptance of the updated policy.
15. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:
Goodround
Kehra, 74307 Harju County, Estonia
Email: help@goodround.com
Phone: +3724737030
Website: Goodround