PPL4U Privacy Policy

This Privacy Policy explains how we collect, use, store, and protect personal data when you use the PPL4U website and learning app.

We process data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation (GDPR).

1. Data controller

The controller of your personal data is:

Contact for privacy and data protection matters: support@ppl4u.app

2. Who does this policy apply to?

This policy applies to people who:

• visit the PPL4U website,
• create an account in the app,
• use quizzes, questions, statistics, and other learning features,
• contact us.

3. What data do we process?

Depending on how you use PPL4U, we process the following categories of data.

Account data

When you register and use an account, we process:

• email address,
• account identifier,
• a username or first name, if provided,
• sign-in and authentication information,
• the account creation date,
• account, language, and app appearance settings.

We do not store passwords in plain text. Passwords are protected with appropriate cryptographic measures, and where you sign in with Google the authentication process is handled by that provider.

Learning and progress data

To provide the learning features, we process:

• the answers you give,
• quiz and test results,
• the number of correct and incorrect answers,
• progress within individual topics,
• your learning activity history,
• saved questions, flashcards, or other materials,
• information about completed study sessions,
• statistics and activity streaks.

We use this data to save your progress, present statistics, and adapt how the app works to your learning style.

4. Technical data

When you use the website or app, we automatically process technical data, such as:

• IP address,
• connection date and time,
• device type,
• operating system,
• browser type and version,
• app version,
• session identifiers,
• error and crash information.

This data may be held in server logs and security systems.

We do not use it to determine your precise location.

5. Data provided when you contact us

If you contact us, we process:

• email address,
• the name provided in the message,
• the content of the correspondence,
• attachments,
• information needed to respond and resolve your request.

Please do not send us data that is not needed to handle your matter.

6. Purposes and legal bases for processing

Running accounts and providing the service

We process account, progress, and learning activity data in order to:

• create and manage the account,
• let you use the app,
• save your progress,
• sync data across devices,
• provide quizzes, statistics, and other features.

The legal basis is performance of a contract or steps taken prior to entering into one — Article 6(1)(b) GDPR.

Providing the data required to create an account is voluntary, but without it you will not be able to create an account or use some features.

Security and abuse prevention

We process technical and activity data in order to:

• protect user accounts,
• prevent unauthorised access,
• detect abuse,
• secure our infrastructure,
• keep security logs,
• establish, exercise, or defend legal claims.

The legal basis is the legitimate interest of the controller — Article 6(1)(f) GDPR.

The controller's legitimate interest is ensuring the secure operation of the service and protecting PPL4U and its users.

Maintaining and improving the app

We process limited data about how the app performs in order to:

• fix bugs,
• diagnose failures,
• improve performance,
• develop existing features,
• analyse how the service works overall.

The legal basis is the legitimate interest of the controller — Article 6(1)(f) GDPR.

Where possible, we use aggregated or anonymised data for this.

Contact and support requests

We process the data contained in correspondence in order to:

• respond to you,
• resolve a technical problem,
• handle complaints,
• carry out a personal data request.

The basis may be:

• performance of a contract — Article 6(1)(b) GDPR,
• a legal obligation — Article 6(1)(c) GDPR,
• the legitimate interest of the controller in handling correspondence and supporting users — Article 6(1)(f) GDPR.

Meeting legal obligations

We process data where necessary, among other things, to:

• meet tax and accounting obligations,
• handle complaints,
• respond to requests from public authorities,
• carry out user rights under the GDPR.

The legal basis is a legal obligation on the controller — Article 6(1)(c) GDPR.

Activities requiring consent

If we want to process data for a purpose that requires consent, we will ask for it separately.

This may apply, for example, to:

• sending a newsletter or marketing information,
• using optional analytics tools,
• storing optional cookies,
• processing data for another clearly indicated purpose.

The legal basis will be consent — Article 6(1)(a) GDPR.

Consent can be withdrawn at any time. Withdrawing consent does not affect the lawfulness of processing carried out before it was withdrawn.

7. Cookies and local storage

The website stores only functional user settings, such as:

• the chosen site theme, in the browser's local storage,
• the chosen language, in a cookie.

The web app at ppl4u.app uses essential cookies to:

• keep a signed-in session,
• handle sign-in,
• protect the account against unauthorised access,
• keep the app working correctly.

In the mobile app, the data used to maintain your session is stored on the device rather than in browser cookies.

On the website we do not use advertising cookies or tools that track users across different websites.

More information is available in the PPL4U Cookie Policy.

8. Where do we obtain data from?

We obtain most data directly from you, for example when you:

• create an account,
• use the app,
• answer quizzes,
• change settings,
• contact us.

Technical data is transmitted automatically by your device, browser, app, or server while you use the service.

If you sign in with a Google account, we receive from Google the basic data needed to create or link an account, in particular an email address and user identifier. The scope of data depends on your Google account settings.

9. Who may we share data with?

We do not sell or rent users' personal data.

We may share data with entities that help us run PPL4U, in particular providers of:

• hosting and cloud infrastructure,
• databases,
• authentication and sign-in,
• email delivery,
• error monitoring and security,
• legal, accounting, or technical support.

These entities receive data only to the extent needed to provide their services. Where they process data on our behalf, they act under an appropriate data processing agreement.

Data may also be disclosed to authorised public bodies where required by applicable law.

10. Transfers outside the European Economic Area

Some technology providers may process data outside the European Economic Area, in particular in the United States.

For providers in the United States, transfers may rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework, provided the given provider holds a current certification under that mechanism. In other cases we may use standard contractual clauses approved by the European Commission and, where necessary, additional technical and organisational measures.

You can obtain information about the safeguards in place by contacting us at support@ppl4u.app.

11. How long do we keep data?

We keep data no longer than is necessary for the purposes for which it was collected.

In particular:

• we keep account data for as long as the account is active,
• we keep learning and progress data for as long as the account exists,
• we keep session data for as long as needed to maintain sign-in and ensure security,
• we keep technical and security logs as a rule for 30 days, unless a longer retention period is necessary to investigate a security incident or defend against claims,
• we keep correspondence for as long as needed to handle the matter, and then for the period needed to protect against claims,
• we keep accounting documents for the period required by law,
• we keep data processed on the basis of consent until consent is withdrawn or the purpose ends earlier.

After an account is deleted, data is deleted or anonymised, unless we must keep certain information longer due to a legal obligation, security, or the need to establish, exercise, or defend legal claims.

Backups are automatically overwritten or deleted within 30 days.

12. How do we protect data?

We apply appropriate technical and organisational measures to protect data against:

• loss,
• unauthorised access,
• disclosure,
• alteration,
• destruction,
• misuse.

These measures may include, among others:

• encryption in transit,
• access control,
• secure storage of credentials,
• backups,
• logging of security events,
• keeping systems up to date,
• limiting access to data to people and entities that need it.

However, no method of storing or transmitting data can eliminate all risk.

13. Your rights

Depending on the basis and circumstances of processing, you may have the right to:

• be informed about the processing of your data,
• access your data and receive a copy of it,
• rectify inaccurate data or complete incomplete data,
• erase your data,
• restrict processing,
• data portability,
• object to processing based on legitimate interest,
• withdraw consent at any time,
• lodge a complaint with a supervisory authority.

Not every right applies in every situation. For example, the right to erasure may be limited where further storage is required by law or needed to establish, exercise, or defend legal claims.

To exercise your rights, write to support@ppl4u.app.

We may ask for additional information needed to confirm the identity of the person making the request. However, we will not request more data than necessary.

We respond to requests without undue delay, within the time limits set out in the GDPR.

14. Objection to processing

You have the right to object to processing based on the legitimate interest of the controller.

On receiving an objection we will stop such processing, unless we demonstrate compelling legitimate grounds to continue that override your interests, rights, and freedoms, or we need the data to establish, exercise, or defend legal claims.

15. Automated decision-making and profiling

We do not make decisions about users based solely on automated processing that would produce legal effects or similarly significantly affect them.

The app may automatically calculate results, statistics, progress levels, or suggest study materials. These activities serve the learning features and do not produce legal effects for the user.

We do not use data for advertising profiling.

16. Children's and minors' data

PPL4U is not intended for people under the age of 16. People who are under 16 should not create an account on their own or provide us with their personal data.

If we learn that data of a person under the age of 16 has been provided to us without a valid basis, we will take steps to delete it.

17. Account deletion

You can delete your account:

• from the app settings,
• by sending a message to support@ppl4u.app.

We delete or anonymise the data of an active account without undue delay, and no later than within 30 days of the effective deletion of the account, except for data we must retain under the law or to establish, exercise, or defend legal claims.

18. Complaint to a supervisory authority

If you believe we process your data unlawfully, you can contact us so we can look into the matter.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO).

The current contact details and ways to submit a complaint are available on the website of the Personal Data Protection Office.

19. Links to external sites

The website or app may contain links to external services.

We are not responsible for the data processing practices of those services. Before using them, it is worth reviewing their privacy policies.

20. Changes to this Privacy Policy

We may update this Privacy Policy, in particular when we:

• change how the app works,
• add new features,
• change service providers,
• face changed legal requirements,
• change the purposes or means of processing data.

The current version of the document will be available on the site together with the date of the last update.

If a change is significant, we may additionally notify users in the app or by email.

21. Contact

If you have questions about this Privacy Policy or the processing of personal data, contact us at support@ppl4u.app.