Privacy Notice

This text is a draft for review by counsel before launch.

Who we are

aali is an online business school run by [legal entity: to be confirmed], a company of the onvuo group. This notice explains how we collect, use and protect your personal data when you visit the site, create an account or study with us. Contact for data protection: [data protection contact: to be confirmed].

What we collect

Account: your name, email, phone number, country, job title and employer if you give it.
Learning: your courses, progress, submissions, grades, discussion posts and certificates.
Payment: confirmation, amount, type of payment method and payer name. Our payment provider handles card details; we do not keep them.
Support and requests: your messages, and what you tell us so that we can adapt your study; we ask only for what is needed.
Device and use: pages visited, device type, language, approximate location from your connection address, and cookies.
Community: the profile you choose to create and what you post.

Why we use it

To provide courses, run cohorts and write to you about them.
To process payments and refunds.
To issue and verify certificates.
To give support and accommodations.
To keep the site secure and prevent fraud.
To improve courses and the site using combined statistics.
To send service messages, and news if you choose to receive it.
To meet our legal duties.

We rely on our contract with you, on your consent where it is needed, on a legitimate interest of ours that does not override your rights, and on our legal duties.

Who we share it with

Service providers, such as hosting, payment, email delivery, video and support, who work under contracts that bind them to protect your data.
Your employer or sponsor, who receive only the enrolment, progress and completion details you agreed to.
Your cohort, who see your name and what you post there.
Competent authorities, when the law requires it.
A successor company if aali is reorganised, with the same protection for your data.

We do not sell your personal data.

Transfers abroad

Our providers may process your data in a country other than yours. When that happens we apply safeguards that suit the law in force, and the regional data notice gives the detail.

How long we keep it

We keep your data while your account is open and while we need it for its purposes, then delete it or make it anonymous. We keep certificate and payment records for longer where the law requires. The exact periods: [retention periods: to be confirmed].

Your rights

You may ask to see, correct or delete your data, to limit or object to its use, to receive a portable copy, to withdraw consent at any time, and to complain to the competent data protection authority. Ask through the learner records page or the contact page. We may ask you to prove your identity, and we reply within the time the law sets.

We do not charge for a reasonable request. If we refuse a request in whole or in part, we will explain why in writing, and you can still complain to the competent authority or ask us to review our decision under the appeals policy.

Your choices

News messages: stop them at any time from the unsubscribe link in the message or from your account settings; you will still get the service messages that concern your study.
Cookies: set your preferences as the cookies page explains.
Your community profile: you choose what shows and to whom, and you can hide it completely.
Your account: you can ask us to close it and delete your data, and we will tell you what we must keep and why.

When your employer pays

If your employer or another sponsor pays your fees, we will not give it your grades, your work or your messages. It receives only what you agreed to, usually confirmation of enrolment, progress and completion. You can also ask for an enrolment or completion letter and hand it over yourself.

Automated decisions and other sites

We do not make automated decisions about you that have a legal or similar effect. We may use simple tools to spot duplicate accounts and suspicious payments, and a person reviews any effect they would have on you. Our pages may link to other sites; this notice does not cover them, so read their policies.

Security

We encrypt data in transit, limit access to people who need it for their work, and review permissions regularly. If a breach affects your data, we will tell you and the competent authorities as the law requires.

Under 18

aali is not meant for anyone under 18. If we learn that we have collected a child's data, we delete it.

Changes and contact

We may update this notice, show the date of the latest update at its top, and tell you before any material change. Questions: [contact email: to be confirmed] or the contact page.