Privacy Policy

Digi Certifications (“we”, “us”) operates www.digicertifications.com. We are the data controller for the personal data described in this policy, except for payment data, for which Paddle acts as an independent controller (see section 4).

For any privacy question or to exercise your rights, contact us at contact@digicertifications.com.

We collect only the data we need to run the Site.

We do not receive or store your full payment card number or bank details. We do not knowingly collect special categories of personal data.

Where we rely on legitimate interests, we have balanced them against your rights and expectations. Where we rely on consent, you may withdraw it at any time without affecting earlier processing. We do not sell your personal data and we do not use it for automated decision-making that produces legal or similarly significant effects.

Our order process is conducted by our online reseller Paddle.com, which is the Merchant of Record for all our orders. When you buy, Paddle collects and processes your payment details, billing information and tax information as an independent controller under the Paddle Privacy Policy.

Paddle shares with us the information we need to deliver your purchase: your email address, the product bought, the amount, the order status and any refund or dispute status. The Paddle checkout may set its own cookies for fraud prevention and payment processing.

You can block or delete cookies in your browser settings, although the Site will not work correctly without the session cookie. You can opt out of Google Analytics using the Google Analytics opt-out add-on. Further information is in the Google Privacy Policy.

We share personal data only with the following categories of recipient, and only as needed:

• Paddle – payments, taxes, invoicing, refunds and fraud prevention.
• Hosting and infrastructure providers – Vercel (website hosting) and Microsoft Azure (database hosting), acting as our processors.
• Email delivery provider – to send password resets, service emails and replies to your messages, acting as our processor.
• Google – analytics, Google sign-in and reCAPTCHA.
• Professional advisers, authorities and courts – where required by law or to establish, exercise or defend legal claims.
• A successor business – if we are involved in a merger, acquisition or sale of assets, subject to equivalent protection of your data.

Our providers may process data in countries outside your own, including the United States. Where we transfer personal data out of the European Economic Area or the United Kingdom, we rely on an appropriate safeguard such as an adequacy decision, the EU–US Data Privacy Framework (and its UK extension) or Standard Contractual Clauses. You can request more information at contact@digicertifications.com.

• Account and practice data: while your account is active, and deleted or anonymised after you ask us to close your account.
• Enquiries: for as long as needed to respond and for a reasonable period afterwards.
• Security records (login attempts, reset tokens): kept briefly and deleted or expired once no longer needed for security.
• Transaction records: for the period required by tax, accounting and legal obligations. Paddle retains its own records under its own policy.

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected and incomplete data completed;
• have your data erased;
• restrict or object to certain processing, including processing based on legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with your local data-protection authority (for example the ICO in the UK, or your national supervisory authority in the EU).

California residents: you have the right to know what personal information we collect, use and disclose, to request deletion or correction, and not to be discriminated against for exercising these rights. We do not sell personal information or share it for cross-context behavioural advertising.

To exercise any right, email contact@digicertifications.com. We may need to verify your identity and will respond within the period required by law (generally one month).

We use appropriate technical and organisational measures to protect personal data, including HTTPS encryption, salted password hashing, httpOnly session cookies, access controls and rate limiting. No system is completely secure; if a breach affects your rights we will notify you and the relevant authorities as required by law.

The Site is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided data to us, contact us and we will delete it.

We may update this policy from time to time. The “Last updated” date above shows the current version. For material changes we will take reasonable steps to notify you, for example by posting a notice on the Site.

Email contact@digicertifications.com or use our contact page. See also our Terms of Service and Refund Policy.