Privacy Policy

This Privacy Policy explains how Islam Fakrul, operating as a ditta individuale under the name PoliPrep ("PoliPrep", "we", "us" or "our"), collects, uses, stores and otherwise processes personal data when you visit the PoliPrep website, create an account, purchase or use our courses and simulations, contact us, or otherwise use our services (the "Service").

We process personal data in accordance with Regulation (EU) 2016/679 ("GDPR"), the Italian data protection legislation applicable to our activities, including Legislative Decree 196/2003, as amended by Legislative Decree 101/2018, and other applicable laws.

The Data Controller is:

Islam Fakrul, ditta individuale

Via Belmonte 6

10155 Turin, Italy

P.IVA: 13489590011

For privacy-related questions or requests:

support@poliprep.com

PoliPrep has not appointed a Data Protection Officer (DPO), as we currently do not consider the conditions requiring the appointment of a DPO under Article 37 GDPR to apply to our processing activities.

The categories of personal data we process depend on how you interact with PoliPrep.

Waitlist

When you join a PoliPrep waitlist, we may collect: email address; the exam or course you are preparing for; target university, where provided.

Contact and support

When you contact us through our website, email or support channels, we may process: name; email address; message or request; attachments or other information you voluntarily provide.

Account

When you create an account, we may process: email address; password credentials, stored using appropriate hashing and security measures; name; preferred language; account and authentication information.

We do not store your password in plain text.

Purchases

When you purchase a PoliPrep product, we may process: name and billing information; email address; purchase and order information; course or simulation purchased; price paid and applicable discount; transaction date; information required for invoicing and accounting.

Payment card details are processed by our payment service provider. PoliPrep does not store complete payment card numbers.

Community participation

Where you voluntarily participate in an optional community channel, such as the WhatsApp community for enrolled students, Telegram or another supported communication service, we may process your username, display name and messages you choose to post. Other members of the same group may see your name, profile picture and phone number as shown by that service.

When you use the Service, we may collect technical and usage information, including: IP address; browser and device information; operating system; referring URL; pages or screens visited; interaction and usage information; security and diagnostic information.

We process this information only for the purposes and on the legal bases described in this Policy.

If you purchase or participate in a PoliPrep course or simulation, we may process: lessons or materials accessed; dates and times of access; simulations or tests started and completed; answers and scores; learning progress; session attendance; course participation and related activity.

This information is used to provide the Service, maintain course functionality, support students, monitor progress and improve the platform.

We do not purchase personal data from data brokers.

We may receive limited information from service providers, such as Stripe, necessary to confirm and reconcile payments and transactions.

We process personal data only where a valid legal basis exists under Article 6 GDPR.

Creating and managing your account: Contract, Art. 6(1)(b); Providing purchased courses and simulations: Contract, Art. 6(1)(b); Processing payments and refunds: Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c), where applicable; Customer and technical support: Contract, Art. 6(1)(b) and/or legitimate interests, Art. 6(1)(f); Invoicing and accounting: Legal obligation, Art. 6(1)(c); Fraud prevention and platform security: Legitimate interests, Art. 6(1)(f); Defending or establishing legal claims: Legitimate interests, Art. 6(1)(f); Service improvement and technical analysis: Legitimate interests or consent, depending on the technology and processing involved; Optional analytics: Consent where required; Marketing communications: Consent, Art. 6(1)(a), where required; Compliance with legal obligations: Legal obligation, Art. 6(1)(c).

Where we rely on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Providing data marked as required (for example, your email address to join the waitlist, or the data needed to create an account or complete a purchase) is necessary to provide the relevant service. If you do not provide it, we will not be able to add you to the waitlist, create your account or process your purchase. Invoicing data is required by Italian tax law. Providing all other data is optional.

We may use personal data to: provide and operate PoliPrep courses, simulations and other services; create and manage accounts; authenticate users; provide customer support; communicate important service information; process payments and refunds; issue invoices and maintain accounting records; monitor course participation and learning progress; maintain and secure the platform; detect fraud, abuse and unauthorized access; troubleshoot technical problems; improve our services and educational content; send marketing communications where legally permitted and where required consent has been obtained; comply with legal obligations; and; establish, exercise or defend legal claims.

We do not use personal data for purposes incompatible with those described in this Policy without providing appropriate information and, where required, obtaining additional consent.

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, taking into account contractual, legal, accounting, security and dispute-resolution requirements.

Our current retention periods are: Waitlist information: generally until you request deletion or, where appropriate, up to 2 years after the last relevant interaction. Account information: while your account remains active and for a limited period afterwards where necessary for security, recovery, legal or dispute-resolution purposes. Purchase, invoicing and accounting records: for the period required by applicable Italian tax and accounting legislation. Learning and course activity: generally for the duration of the relevant course and for a limited period afterwards where necessary for support, contractual records, security or legitimate operational purposes. Support communications: generally for up to 3 years after the last interaction, unless a longer period is required or justified. Marketing consent records: while consent remains active and, after withdrawal, for as long as reasonably necessary to maintain a record of the withdrawal and prevent unwanted future communications.

Different retention periods may apply where required by law or necessary to establish, exercise or defend legal claims.

When personal data is no longer required, we will delete it or anonymize it where appropriate.

We use selected third-party providers to operate PoliPrep.

Depending on the Service you use, these may include: Lovable Cloud — Hosting, database and platform infrastructure: Account, service and application data; Lovable Emails — Transactional emails (e.g. confirmations and account emails): Email address and message content; Stripe — Payment processing: Payment and billing information; Bunny.net — Video delivery and streaming: Video access and technical streaming information; Zoho Mail — Customer support email: Communications sent to us; PostHog — Product analytics and session recording, only with your consent (see the Cookie Policy): Usage and event data; session recordings with typed inputs masked; WhatsApp, Telegram / other community providers — Optional community communication: Username and messages you choose to post.

We select service providers appropriate to the services they perform and, where required by GDPR, establish appropriate contractual arrangements governing the processing of personal data.

Third-party providers may process data on our behalf or, depending on the service and their role, act as independent controllers. Their own privacy policies may therefore also apply.

We do not sell your personal data.

We do not provide your personal data to third parties for their own independent marketing purposes.

Some service providers used by PoliPrep may process personal data outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we use an appropriate transfer mechanism under Chapter V GDPR where required, which may include: an applicable European Commission adequacy decision; Standard Contractual Clauses approved by the European Commission; or; another legally recognized transfer mechanism.

Where required, we also consider appropriate supplementary safeguards.

You may contact us at support@poliprep.com to request further information about applicable transfer safeguards.

Subject to the conditions and limitations established by GDPR, you may have the right to: Access your personal data (Article 15); Rectify inaccurate or incomplete personal data (Article 16); Request erasure of personal data (Article 17); Request restriction of processing (Article 18); Receive or transfer certain personal data through data portability (Article 20); Object to certain processing, including processing based on legitimate interests and direct marketing (Article 21); Withdraw consent where processing is based on consent (Article 7(3)).

These rights are not absolute. For example, we may need to retain certain information to comply with legal obligations or establish, exercise or defend legal claims.

You may exercise your rights by contacting:

support@poliprep.com

Please provide sufficient information for us to identify your account or request.

We will normally respond without undue delay and, in any event, within one month of receiving your request. This period may be extended by up to two further months where permitted by Article 12 GDPR, particularly where requests are complex or numerous. If an extension is required, we will inform you within the initial one-month period.

Requests are generally handled free of charge. Where permitted by GDPR, we may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive.

You have the right to lodge a complaint with the competent data protection supervisory authority.

For Italy, this is:

Garante per la protezione dei dati personali

Piazza Venezia 11

00187 Roma, Italy

Website: https://www.garanteprivacy.it

You may also contact the supervisory authority in the EU Member State where you normally live, work, or where you believe an infringement occurred.

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, accidental loss, alteration, disclosure or destruction.

Depending on the relevant system, these measures may include: HTTPS/TLS encryption for data transmitted between your device and our services; secure password hashing; access controls and authentication; server-side authorization checks; database access controls; restricted administrative access; payment processing through Stripe rather than storage of complete card details by PoliPrep; protected video delivery mechanisms; managed storage of application secrets; and; security testing and review before production releases.

No online service can guarantee absolute security. If you believe that your account or personal data has been compromised, contact us promptly at support@poliprep.com.

PoliPrep uses cookies and other tracking technologies.

Some are strictly necessary for the operation, security and functionality of the Service. Other technologies, such as certain analytics or marketing technologies, may require your consent under applicable law.

Our Cookie Policy explains: which cookies and tracking technologies we use; their purposes; the relevant providers; retention periods; whether they are necessary or optional; and; how you can manage or withdraw your choices.

Where consent is required, non-essential tracking technologies will not be activated before the relevant consent is obtained.

You can change your cookie preferences through the cookie settings mechanism provided on the website.

We may send marketing communications where we have a valid legal basis to do so.

Where consent is required, we will request it separately from consent necessary to provide the Service.

You may unsubscribe at any time using the unsubscribe mechanism included in our marketing communications or by contacting:

support@poliprep.com

Withdrawal of marketing consent does not affect service-related communications that are necessary to provide a purchased service or otherwise permitted by law.

PoliPrep does not currently make decisions based solely on automated processing that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR.

Course scores, learning analytics and progress information may be generated automatically, but they are used for educational and informational purposes and do not by themselves determine legal rights or access to unrelated services.

PoliPrep is primarily intended for students preparing for university admission and related educational examinations.

We do not knowingly seek to collect personal data from children in circumstances where applicable law requires parental or guardian involvement without obtaining the required involvement or authorization.

If you believe that a child has provided personal data to PoliPrep in circumstances where this was not permitted, please contact us at support@poliprep.com.

Where applicable, we will take appropriate steps to delete the information.

Under Italian law (Art. 2-quinquies, Legislative Decree 196/2003), minors aged 14 or older may consent to the processing of their personal data in connection with online services. Users under 14 may use services requiring consent only with the authorization of a parent or legal guardian. Purchases by minors may additionally require parental involvement under applicable contract law.

Where a personal data breach occurs, we will assess the breach and take the measures required by GDPR and applicable law.

Where GDPR Article 33 requires notification to the competent supervisory authority, we will notify the authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach.

Where Article 34 requires communication to affected individuals, we will communicate the breach without undue delay.

We may update this Privacy Policy when our services, processing activities, legal obligations or business practices change.

When appropriate, we will publish the updated version on this page and update the "Last updated" date.

Where required by applicable law, we will provide additional notice or obtain consent before material changes take effect.

For privacy questions, requests or concerns:

Islam Fakrul, ditta individuale / PoliPrep

Via Belmonte 6

10155 Turin, Italy

Email: support@poliprep.com

P.IVA: 13489590011