Privacy policy
1. Data controller
Equalization Academy (brand «Equalization Academy»), based at 28 Gzirt Badran Street, Rod Elfarag, Cairo (Egypt). Privacy contact: info@equalizationacademy.com.
2. What data we process, why, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and managing your account and course enrolment (student, instructor, trainer, centre) | Name, surname, email, password (stored in encrypted form), date of birth, gender, nationality, address, phone, photo (optional), chosen instructor, courses and levels, messages you send | Performance of a contract or pre-contractual steps (Art. 6.1.b) |
| Shipping kits and materials, shop orders | Name, delivery address, email, phone, items ordered | Contract (Art. 6.1.b) |
| Payments | Amount, date and payment identifier. Card details are entered only on the Stripe page: we do not receive or store them | Contract (Art. 6.1.b) |
| Certificates, cards and public verification | Name, level, dates, verification code (the public page shows only what is needed to verify) | Contract and legitimate interest in guaranteeing the authenticity of certificates (Art. 6.1.b and f) |
| Service messages (confirmations, expiry notices, reminders) | Email, enrolment data | Contract (Art. 6.1.b) |
| Newsletter and offers | Email, name | Consent (Art. 6.1.a), optional and revocable at any time. For customers, offers for similar products within the limits of the law |
| Information requests (contact and workshop forms) | Name, email, message | Pre-contractual steps / legitimate interest in replying (Art. 6.1.b and f) |
| Site security and abuse prevention; protection of instructor-only content | IP address, date and time of access, log of reads of restricted documents | Legitimate interest (Art. 6.1.f) |
| Accounting and tax obligations | Billing and payment data | Legal obligation (Art. 6.1.c) |
Providing the data marked as required in the forms is necessary to deliver the service: without it we cannot complete the registration or the order. We do not take automated decisions and we do not profile.
3. Who receives the data
- Technical providers processing data on our behalf: hosting and database (Aruba S.p.A., Italy), email delivery services.
- Stripe for payments (independent controller for anti-fraud and anti-money-laundering duties).
- Your chosen instructor and the diving centre (Freediving World): they receive the data strictly needed to follow you, ship the kit and issue the certificate.
- Couriers for shipments; advisers (accountant, lawyer) for legal obligations.
We do not sell your data.
4. Transfers outside the European Economic Area
Our servers are in Italy. Some providers (for example Stripe) may process data outside the EEA: this is done with the safeguards required by law (an adequacy decision such as the EU-US Data Privacy Framework, or standard contractual clauses). If you live outside the EEA (for example in China, Japan, Russia, Egypt or other countries), by registering you ask us to process your data in our country and by our providers; where the law of your country requires it, we ask for your explicit consent to this transfer at registration. If the law of your country gives you additional rights, please write to us.
5. How long we keep the data
- Account, enrolments and certificates: for the duration of the relationship and for the time needed to verify the certificates issued; then deleted or anonymised on request, unless the law requires otherwise.
- Accounting and tax records: 10 years.
- Newsletter: until you withdraw consent.
- Technical logs (access, security): for a limited period (normally up to 12 months).
6. Your rights
At any time you can request access, rectification, erasure, restriction, portability, objection to processing based on legitimate interest, and withdrawal of consent (without affecting processing already carried out). Write to info@equalizationacademy.com: we reply within one month. You also have the right to lodge a complaint with the supervisory authority: Garante per la protezione dei dati personali (www.garanteprivacy.it), or the authority of your country of residence.
7. Minors
Our online services are not intended for persons under 14. For children under 14, consent must be given by the holder of parental responsibility. If you believe a minor has given us data without authorisation, write to us and we will delete it.
8. Security
We adopt appropriate technical and organisational measures: encrypted connection (HTTPS), passwords stored in encrypted form, role-based access, protected backups. If a data breach occurs, we notify the authority and the individuals concerned in the cases and within the time required by law.
9. Cookies
Information about cookies is on the Cookies page.
10. Changes
We may update this policy. The current version is always on this page, with its number and date.