Privacy Policy · LMSCursio

1. Who we are

The data controller responsible for your personal data is [Institution / operating legal entity], registered at [registered address] (“we”, “us”). You can reach us at [privacy@your-domain.edu].

Our Data Protection Officer (DPO), where one is appointed, can be contacted at [dpo@your-domain.edu].

2. Personal data we collect

We only collect data we need to provide the learning platform:

Account & identity data — name, email address, username, role, and the institution or organisation you belong to.
Profile data — optional avatar, preferred language, time zone and accessibility preferences.
Learning data — courses, enrolments, submissions, grades, quiz attempts, discussion posts and other content you create or that staff record about you.
Usage & device data — pages visited, actions taken, IP address, browser and device type, and approximate location derived from your IP, collected to keep the service secure and reliable.
Authentication data — credentials (stored only as salted hashes), single sign-on identifiers, and multi-factor authentication settings.

We do not sell your personal data, and we do not use it for advertising.

3. How and why we use your data

To provide and operate the platform — authentication, courses, assessment, grading and communication.
To keep accounts and content secure, prevent abuse, and investigate incidents.
To support academic integrity (for example, originality and exam-integrity checks) where the institution enables it.
To provide support, send service-related notices, and respond to your requests.
To produce aggregated, statistical insights that help the institution improve teaching and learning.
To comply with our legal obligations.

4. Legal bases for processing

We rely on the following lawful bases under Article 6 GDPR:

Performance of a contract (Art. 6(1)(b)) — to deliver the platform to you and the institution.
Legitimate interests (Art. 6(1)(f)) — to secure the service, prevent abuse and improve the product, balanced against your rights.
Legal obligation (Art. 6(1)(c)) — where the law requires us to retain or disclose data.
Consent (Art. 6(1)(a)) — for non-essential cookies and any optional feature that asks for it; you may withdraw consent at any time.

Where special categories of data (Art. 9) — such as accessibility-related health information — are processed, we do so only on a valid Article 9 condition, typically your explicit consent or a substantial public-interest basis defined by the institution.

5. Cookies and similar technologies

We use strictly necessary cookies to keep you signed in, remember your preferences (such as theme and language) and protect against cross-site request forgery. These are required for the service to function and do not need consent.

Any non-essential analytics or similar technologies are used only with your consent, in line with the ePrivacy rules, and can be declined without losing access to core features.

6. Sharing and processors

We share personal data only as needed to run the service:

Your institution — staff with a legitimate role (for example instructors and administrators) can access the learning data relevant to their duties.
Service providers (processors) — hosting, email delivery, and optional integrations (such as originality checking or video), each bound by a data-processing agreement under Article 28 GDPR.
Authorities — where disclosure is required by law or to protect rights and safety.

A current list of sub-processors is available on request at [privacy@your-domain.edu].

7. International data transfers

We aim to store and process personal data within the European Economic Area (EEA). Where data is transferred outside the EEA, we rely on an adequacy decision of the European Commission or on appropriate safeguards — typically the Standard Contractual Clauses — together with any additional measures needed to ensure an equivalent level of protection. You may request a copy of the relevant safeguards.

8. How long we keep data

We keep personal data only for as long as necessary for the purposes above and as instructed by the institution. Academic records are typically retained for the period required by the institution’s policy and applicable law; account and security logs are kept for a limited period and then deleted or anonymised. When data is no longer needed, it is securely erased.

9. Your rights under the GDPR

Subject to the conditions in the GDPR, you have the right to:

Access your personal data (Art. 15);
Rectify inaccurate or incomplete data (Art. 16);
Erase your data — the “right to be forgotten” (Art. 17);
Restrict processing (Art. 18);
Data portability — receive your data in a portable format (Art. 20);
Object to processing based on legitimate interests (Art. 21);
Withdraw consent at any time, without affecting prior processing;
Not be subject to solely automated decisions with legal or similarly significant effects (Art. 22).

To exercise these rights, contact us at [privacy@your-domain.edu]. If your data is controlled by your institution, we may direct your request to them. We respond within one month, as required by the GDPR.

10. How we protect your data

We apply appropriate technical and organisational measures, including encryption in transit, hashed credentials, role-based access control, tenant isolation, audit logging and regular review. No system is perfectly secure, but we work to protect your data and to notify you and the relevant supervisory authority of a personal-data breach where the GDPR requires it.

11. Children and students

The platform is provided to institutions for educational use. Where students are minors, the institution acts as the data controller and is responsible for the appropriate legal basis, including any parental or guardian consent required under national law. We process such data only on the institution’s documented instructions.

12. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices or the law. We will post the updated version here and revise the “Last updated” date. Material changes will be communicated through the service where appropriate.

13. Contact and complaints

Questions about this policy or your personal data can be sent to [privacy@your-domain.edu].

You also have the right to lodge a complaint with a data-protection supervisory authority, in particular in the EU Member State of your residence, place of work or the place of the alleged infringement. Our lead supervisory authority is [name of supervisory authority].