CertyAcademy privacy policy
Which data CertyAcademy processes, why, for how long, and how to exercise your rights.
Version: CERTYACADEMY-LEGAL-2026-10-25
1. Controller
The controller is the publisher of CertyAcademy: Benjelloun Consulting, Audit et Expertise, S.A.R.L. AU (single-member limited liability company) with a share capital of MAD 100,000, registered office: Immeuble Perla Oficinas, corner of rue Oujda and rue Tantan, 1st floor, No. 5, Tangier (Morocco), Trade Register (RC) Tangier 540409, ICE 003019492000082. For any question or request about your data: contact@certynex.com.
When a company or firm invites you, it is the controller for the training follow-up it organizes for its collaborators; for this follow-up, CERTYNEX acts as its processor, under the group contract.
Representative in the European Union (Article 27 GDPR): being appointed; in the meantime, your requests are received at contact@certynex.com.
2. Data processed
Account: first name, last name, e-mail address, preferred language, password kept only as a hash (argon2id), date the address was confirmed, version and date of acceptance of the Terms and of this policy.
Group: type (company or firm), corporate name, ICE if you provide it, roles, units, invitations, assigned learning paths, version and date of the information text on group tracking and, if you gave it, consent to the detailed tracking (version, date).
Learning: answers to exercises, lessons read, exam and quiz results, estimated time spent on the pages of the learning paths (counted while the page is shown and you are active) and date of last activity.
Security: sessions (token hash only), sign-in codes (hash only, 10 minutes), security log in which the e-mail address and IP address appear as hashes (pseudonymized data, which remain personal data).
Trial register: hash (HMAC, computed with a secret key) of an individual’s e-mail address, or of a group’s corporate name and ICE, to prevent repeated trials. These pseudonymized data are not erased with the account.
Access requests: name, e-mail address, plan, organization, number of licences, message and IP address as a hash; a copy is sent by e-mail to contact@certynex.com.
Administration logs: actions of a group’s administrators (invitations, roles, deactivations, learning paths), visible to the group’s administrators, and actions of the CERTYNEX administration (access opened, trials granted). When an administrator deletes their account, their actions remain in the log under the label “Former administrator”, with no data that would identify them.
3. Purposes and legal bases
Providing the service, your learning path and your progress on all your devices: performance of the contract.
Securing accounts, preventing abuse (attempt limits, disposable addresses refused) and diagnosing incidents: legitimate interest.
Enabling a group to follow the training of its collaborators: the group’s legitimate interest in organizing and following the training it sets up, for the base tracking (assigned trainings, lessons completed, exam results); consent, which you may refuse or withdraw with no consequence for your access, for the detailed tracking (quiz scores, estimated time spent, last activity).
Preventing repeated free trials (trial register): legitimate interest.
Answering a request for full access: pre-contractual measures taken at your request.
Keeping the administration logs: legitimate interest (traceability and security).
4. Recipients
You; the administrators and authorized team managers of your group, within the limits of the information text shown when joining for the base tracking and, for the detailed tracking, of the consent you gave; our technical processors, to provide the service. Your data are neither sold nor used for advertising.
5. Hosting and processors
Application: Vercel Inc. (United States), functions run in Frankfurt (Germany). Database: PostgreSQL hosted by Neon (United States) in the European Union (Frankfurt, Germany). Transactional e-mails (sign-in codes, password reset, invitations, access requests): Brevo (France), with no tracking pixel or link.
As Vercel and Neon are US companies, access to your data from the United States cannot be ruled out. These transfers are governed by the contractual safeguards provided for in these providers’ data processing agreements. For data subject to Law No. 09-08, the transfer formalities with the CNDP are in progress.
6. Retention periods
Account and learning data: as long as you use the service; erased after 3 years without sign-in, or at your request.
Sign-up whose code was not entered: 7 days. Unaccepted invitation: 90 days. Security log: 12 months.
Trial register: 3 years from the start of the trial, including after the account is deleted. Access requests: 12 months, including the copy sent by e-mail. Group and CERTYNEX administration logs: 12 months.
Sign-in code: 10 minutes. Password reset link: 30 minutes. Session: closed after 30 minutes of inactivity, 12 hours at most.
7. Your rights
You have the right of access, rectification, erasure, portability, objection and restriction, and may withdraw your consent to the detailed tracking by a group at any time.
From the Account page, you export your data (JSON file) and erase your account (subject to the trial register and the logs described in § 6). For any other request: contact@certynex.com; we reply within one month.
You may also lodge a complaint with the competent data protection authority: the CNDP (www.cndp.ma) in Morocco or, if you reside in the European Union, the data protection authority of your country of residence.
8. Law No. 09-08 (Morocco)
For persons and processing subject to Moroccan law, the processing is subject to Law No. 09-08 on the protection of individuals with regard to the processing of personal data. The formalities with the National Commission for the Control of Personal Data Protection (CNDP) are in progress.
9. Security
Hashed passwords (argon2id), codes and tokens kept as hashes, encrypted connections, protected session cookies (httpOnly, Secure), a code required at every sign-in, attempt limits and sign-out after inactivity.
11. Changes
This policy may change; each version carries a number. We will inform you of any significant change.