Privacy Policy

1. Introduction

This Privacy Policy explains how Edunexa ("Edunexa," "we," "us," or "our") collects, uses, discloses, and protects personal data in connection with our website and the Edunexa web-based business management platform (the "Platform"). It applies to visitors to our website, prospective customers, and customers who have purchased access to the Platform, as well as, in limited circumstances described below, individuals whose personal data is entered into the Platform by our customers.

This Policy should be read alongside our Terms and Conditions, which govern your access to and use of the Platform, our Cookie Policy, which explains our use of cookies and similar technologies, and our Refund Policy, which explains our 14-day money-back guarantee. Where there is any conflict between this Privacy Policy and those documents with respect to the handling of personal data specifically, this Privacy Policy will govern.

Edunexa is a software provider offering CRM, project management, HR administration, and financial record-keeping tools to small businesses, freelancers, consultants, agencies, and other service-based businesses. Because of the nature of these tools, this Policy distinguishes between two broad categories of personal data: data relating to you as a visitor, prospective customer, or customer of Edunexa (which we process as a data controller), and data relating to your own customers, leads, or employees that you choose to enter into the Platform (which we generally process on your behalf, as described in Section 9).

2. Who This Policy Applies To

This Policy applies to: (a) visitors to our website, including individuals researching or evaluating the Platform; (b) prospective customers who provide information to us, such as through a contact form or enquiry; (c) customers who purchase access to the Platform and their Authorised Users, being individuals granted access to a Customer's Account; and (d) to a more limited extent described in Section 9, individuals whose personal data a Customer chooses to enter into the Platform as part of their own business records, such as their own customers, leads, or employees.

3. Information We Collect

3.1 Information You Provide to Us Directly

We collect personal data that you provide to us directly, including when you: create an Account to access the Platform, such as your name, email address, business name, and login credentials; make a purchase of access to the Platform, including billing information processed through Stripe, as described in Section 3.3; contact us with a question, support request, or refund request, including any information you choose to include in your message; subscribe to marketing communications or newsletters; or otherwise voluntarily provide information to us, such as through a survey, feedback form, or in the course of correspondence with our support team.

3.2 Information Collected Automatically

When you visit our website or use the Platform, we and our service providers may automatically collect certain information about your device and how you interact with our website and the Platform, including: your IP address, browser type and version, device type, and operating system; information about your visit, such as the pages viewed, the time and duration of your visit, and the website you came from; usage information relating to your interaction with the Platform's dashboard and features, to the extent necessary to operate, maintain, and improve the Platform; and information collected through cookies and similar technologies, as described in more detail in our Cookie Policy.

3.3 Payment Information

When you make a purchase of access to the Platform, payment is processed securely through Stripe, our third-party payment processor. Edunexa does not directly collect or store your full payment card details; these are collected and processed by Stripe in accordance with Stripe's own privacy policy. We may receive limited transaction information from Stripe, such as confirmation of payment, the last four digits of a payment card, and billing details necessary to process your order, issue receipts, and administer refunds under our Refund Policy.

3.4 Information from Third Parties

We may receive limited information about you from third parties, such as Stripe in connection with processing your payment, or, where applicable, from marketing or analytics partners who help us understand how visitors find and interact with our website.

3.5 Categories of Personal Data, Summarised

To help you understand at a glance the types of personal data we typically collect and process in connection with our website and the Platform, the following is a non-exhaustive summary of categories of personal data relevant to visitors, prospective customers, and Customers: Identity and contact data — such as your name, email address, business name, job title (where provided), and phone number (where provided). Account data — such as your username, encrypted password, Account preferences, and records of your interactions with the Platform's support features. Transaction data — such as details of purchases you have made, the Package selected, billing address, and limited payment confirmation details received from Stripe. Technical data — such as your IP address, browser type and version, device identifiers, operating system, and other technology on the devices you use to access our website or the Platform. Usage data — such as information about how you use our website and the Platform, including pages visited, features used, and the frequency and duration of your sessions. Marketing and communications data — such as your preferences in receiving marketing communications from us, and your communication preferences generally.

We do not intentionally collect special categories of personal data (such as data revealing racial or ethnic origin, health data, or biometric data) about visitors or Customers in connection with our website or Account management processes, and we ask that you do not submit such information to us other than where it may form part of Customer Data you choose to enter into the Platform in connection with your own business records, which remains subject to Section 9.

4. How We Use Your Information

We use the personal data described above for the following purposes: To provide and maintain the Platform. This includes creating and managing your Account, granting you access to the features associated with your purchased Package, and enabling the core functionality of the CRM, project management, HR administration, and financial record-keeping tools. To process your purchases. This includes processing payments through Stripe, sending order confirmations and receipts, and administering refund requests under our 14-day money-back guarantee, as described in our Refund Policy. To provide customer support. This includes responding to your questions, troubleshooting issues you report, and communicating with you about your Account or purchase. To communicate with you. This includes sending administrative communications relating to your Account or purchase, as well as optional marketing communications, where you have consented to receive them or where otherwise permitted by applicable law, and from which you may opt out at any time. To maintain and improve our website and the Platform. This includes monitoring performance, diagnosing technical issues, understanding how our website and Platform are used, and developing new features or improvements. To maintain security. This includes detecting, investigating, and preventing fraudulent activity, unauthorised access, and other security incidents affecting our website, the Platform, or your Account. To comply with legal obligations. This includes complying with applicable laws, responding to lawful requests from public authorities, and enforcing our Terms and Conditions and other applicable policies.

5. Legal Basis for Processing (For Individuals in the EEA, UK, and Similar Jurisdictions)

Where applicable data protection law requires us to identify a legal basis for processing personal data, we generally rely on the following: Performance of a contract. Where processing is necessary to provide the Platform to you under our Terms and Conditions, such as creating your Account, granting access to your purchased Package, and processing your payment. Legitimate interests. Where processing is necessary for our legitimate interests, such as maintaining the security of our website and Platform, improving our services, and responding to support enquiries, provided that these interests are not overridden by your data protection interests or fundamental rights. Consent. Where you have given us consent, such as for optional marketing communications or non-essential cookies, as described in our Cookie Policy. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before you withdrew it. Legal obligation. Where processing is necessary to comply with a legal obligation to which we are subject, such as retaining certain records for tax or accounting purposes.

6. How We Share Your Information

We do not sell your personal data. We may share your personal data with the following categories of recipients, in each case only to the extent reasonably necessary for the relevant purpose:

6.1 Service Providers

We work with third-party service providers who perform services on our behalf, such as hosting and infrastructure providers, payment processing (Stripe), customer support tools, email delivery services, and analytics providers. These service providers are only permitted to use your personal data to the extent necessary to perform the services we have engaged them to provide, and are subject to contractual obligations to protect your personal data and use it only for the purposes we specify.

6.2 Professional Advisers

We may share personal data with our professional advisers, including lawyers, accountants, and auditors, where necessary in connection with the operation of our business, compliance with legal obligations, or the exercise or defence of legal claims.

6.3 Legal and Regulatory Disclosures

We may disclose personal data where required to do so by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect our rights, your safety or the safety of others, investigate fraud, or respond to a government request.

6.4 Business Transfers

If Edunexa is involved in a merger, acquisition, reorganisation, sale of assets, or similar transaction, personal data may be transferred as part of that transaction, subject to appropriate confidentiality safeguards and, where required, notice to affected individuals.

6.5 With Your Consent

We may share your personal data with other third parties where you have given us your consent to do so.

7. International Data Transfers

Edunexa and the third-party service providers we work with, including Stripe, may process personal data in countries other than the country in which you are located, including countries that may not have data protection laws equivalent to those in your own jurisdiction. Where we transfer personal data internationally, we take steps intended to ensure that such transfers are conducted in accordance with applicable data protection law, which may include the use of standard contractual clauses, adequacy decisions, or other legally recognised transfer mechanisms, depending on the jurisdictions involved.

7.1 Safeguards for International Transfers

Where personal data is transferred from a jurisdiction with data protection laws that restrict international transfers, such as the European Economic Area or the United Kingdom, to a jurisdiction that has not been recognised as providing an adequate level of protection, we rely on legally recognised transfer mechanisms, such as standard contractual clauses approved by the relevant regulator, together with any supplementary measures reasonably necessary to ensure an adequate level of protection for the transferred data. We require our service providers, including those involved in payment processing and hosting, to commit to appropriate contractual safeguards regarding their handling of personal data, consistent with applicable law.

If you would like further information about the safeguards we apply to a specific international transfer of your personal data, please contact us using the details in Section 15.

8. Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including to provide the Platform to you, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention periods depend on the type of data and the purpose for which it is held. For example: Account information is generally retained for as long as your Account remains active, and for a limited period thereafter to allow you to request data export following termination, as described in our Terms and Conditions; transaction and billing records may be retained for longer periods where necessary to comply with applicable tax, accounting, or financial record-keeping obligations; and support correspondence is generally retained for a reasonable period to allow us to reference prior interactions in connection with any related future enquiries.

When personal data is no longer needed for the purposes described in this Policy, we will take reasonable steps to delete or anonymise it, except where we are required to retain it for legal, regulatory, or legitimate business purposes.

In determining how long to retain a particular category of personal data, we generally consider factors including: the amount, nature, and sensitivity of the personal data; the potential risk of harm from unauthorised use or disclosure; the purposes for which we process the data and whether we can achieve those purposes through other means; and any applicable legal, regulatory, tax, accounting, or reporting requirements that specify a minimum retention period.

Where you close your Account or your access to the Platform is terminated in accordance with our Terms and Conditions, we will retain your Account information and Customer Data for a limited period to allow you to request an export, after which such data will generally be deleted or anonymised in accordance with our standard data retention practices, except to the extent we are required or permitted to retain specific records for longer, such as transaction records needed to comply with financial record-keeping obligations or to respond to any dispute, refund request, or chargeback relating to your purchase.

9. Customer Data Entered Into the Platform

9.1 Our Role

The Platform allows Customers to enter Customer Data relating to their own business, including information about their own customers, leads, employees, and financial records, as described in our Terms and Conditions. Where a Customer enters personal data relating to third parties, such as their own customers or employees, into the Platform, Edunexa generally acts as a data processor or service provider on behalf of the Customer, who acts as the data controller responsible for determining the purposes and means of processing that personal data.

9.2 Customer Responsibility

As set out in our Terms and Conditions, Customers are solely responsible for the accuracy, legality, and appropriateness of the Customer Data they enter into the Platform, including ensuring that they have an appropriate legal basis to collect and process any personal data relating to their own customers, leads, or employees, and for complying with any notice or consent obligations that may apply to them under applicable data protection law in connection with that data.

Edunexa does not independently verify or vet the personal data entered by Customers into the Platform, and individuals whose personal data has been entered into the Platform by a Customer, such as that Customer's own customers or employees, should direct any requests relating to that data, including requests to access, correct, or delete it, to the relevant Customer directly, as the data controller responsible for that information.

9.3 Our Processing of Customer Data

Where we process Customer Data on behalf of a Customer, we do so only to the extent necessary to provide the Platform and related services, in accordance with the Customer's instructions as reflected in our Terms and Conditions, and subject to appropriate technical and organisational security measures described in Section 11. We do not use Customer Data entered by our Customers for our own independent marketing purposes, and we do not sell such data to third parties.

10. Your Data Protection Rights

Depending on your location and applicable law, you may have certain rights in relation to your personal data, which may include the right to: Access the personal data we hold about you; Correct inaccurate or incomplete personal data; Delete your personal data, subject to certain exceptions, such as where we are required to retain it for legal or legitimate business purposes; Restrict or object to certain processing of your personal data, including processing based on legitimate interests or for direct marketing purposes; Data portability, being the right to receive certain personal data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible; Withdraw consent at any time, where processing is based on your consent, without affecting the lawfulness of processing carried out before withdrawal; and Lodge a complaint with a supervisory authority or other applicable data protection regulator in your jurisdiction, if you believe our processing of your personal data infringes applicable law.

To exercise any of these rights, please contact us using the details in Section 15. We will respond to your request within the timeframe required by applicable law. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data, or to otherwise exercise any of your rights.

Please note that where personal data relates to you as an individual whose data has been entered into the Platform by one of our Customers (for example, as that Customer's own customer, lead, or employee), the appropriate first point of contact for exercising these rights will generally be that Customer directly, as described in Section 9.2, rather than Edunexa.

10.1 Verifying Your Identity

Because personal data is sensitive, and to protect against unauthorised requests made on your behalf, we may ask you to verify your identity before fulfilling a request to access, correct, delete, or otherwise act on your personal data. This may involve confirming details associated with your Account, such as your registered email address, or providing additional information reasonably necessary to confirm that the request has genuinely come from you or someone properly authorised to act on your behalf.

10.2 Timeframes for Responding to Requests

We aim to respond to requests to exercise your data protection rights within the timeframe required by applicable law in your jurisdiction, which is often within one month of receiving a valid request, subject to extension in certain circumstances, such as where a request is particularly complex or where we have received a high volume of requests. If we need additional time to respond to your request, we will let you know the reason for the delay and the anticipated timeframe for our response.

10.3 No Fee Generally Required

You will not generally be required to pay a fee to exercise your data protection rights. However, we may charge a reasonable fee, or decline to act on a request, where a request is manifestly unfounded, excessive, or repetitive, to the extent permitted by applicable law.

11. How We Protect Your Information

We implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include, depending on the context, encryption of data in transit, access controls limiting who within our organisation can access personal data, regular review of our security practices, and contractual security obligations imposed on our third-party service providers, including Stripe.

While we take reasonable steps to protect your personal data, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. You are encouraged to take your own precautions to protect your personal data, such as using a strong, unique password for your Account and keeping your login credentials confidential, as described further in our Terms and Conditions.

11.1 Access Controls Within Your Organisation

Where you grant access to the Platform to Authorised Users within your own organisation, you are responsible for managing the level of access granted to each Authorised User and for ensuring that access to sensitive Customer Data, such as employee HR records or financial information, is limited to individuals within your organisation who have an appropriate need to access it. Edunexa provides the underlying tools to support this kind of access management, but the specific configuration of user permissions within your Account is a matter for you to determine based on your own organisational structure and internal policies.

11.2 Incident Response

In the event of a security incident affecting personal data that we are required to notify under applicable law, we will take reasonable steps to investigate the incident, mitigate any harm, and notify affected individuals and, where required, relevant supervisory authorities, within the timeframes required by applicable law. We encourage Customers to notify us promptly if they become aware of any suspected unauthorised access to their Account or any other security concern relating to their use of the Platform.

12. Children's Privacy

The Platform and our website are not directed at, and are not intended for use by, children. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact us using the details in Section 15 so that we can take appropriate steps to delete such information.

We recognise that the Platform's HR administration functionality may, in limited circumstances, involve records relating to a Customer's own younger employees where permitted by applicable employment law, such as details of a young worker's onboarding or leave records. Such information is entered and managed by the Customer as part of its own HR administration, in accordance with Section 9, and remains subject to the Customer's own obligations to comply with applicable employment and data protection laws relating to young workers.

13. Marketing Communications

Where you have provided consent, or where otherwise permitted by applicable law, we may send you marketing communications about the Platform, including new features, updates, or promotional offers. You may opt out of receiving marketing communications at any time by using the unsubscribe link included in such communications, or by contacting us using the details in Section 15. Opting out of marketing communications does not affect your receipt of administrative or transactional communications relating to your Account or purchase, which are necessary for us to provide the Platform to you.

14. Cookies and Similar Technologies

Our website and the Platform use cookies and similar tracking technologies to operate, personalise, and improve our services, and to understand how our website and Platform are used. Detailed information about the specific categories of cookies we use, the purposes for which we use them, and the choices available to you, including how to manage or disable cookies, is set out in our separate Cookie Policy, which forms part of, and should be read alongside, this Privacy Policy.

15. Contact Us

If you have any questions about this Privacy Policy, would like to exercise any of the rights described in Section 10, or have any other questions or concerns about how we handle personal data, please contact us using the contact details published on the Edunexa website and set out below.

If we have appointed a Data Protection Officer or other designated privacy contact, that contact information will also be made available through the same channels.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the personal data we collect, applicable law, or for other operational, legal, or regulatory reasons. Where we make material changes to this Policy, we will update the "Last updated" date at the top of this page and, where required by applicable law, provide additional notice to you, such as through the Platform or by email, before the changes take effect.

We encourage you to review this Privacy Policy periodically to stay informed about how we collect, use, and protect your personal data. Your continued use of our website or the Platform following the posting of any changes constitutes your acceptance of the updated Policy.

17. Relationship to Other Policies

This Privacy Policy should be read together with our Terms and Conditions, Cookie Policy, and Refund Policy, all of which are available on the Edunexa website. Where a specific provision of another policy addresses a matter in more detail than this Privacy Policy, such as the specific categories of cookies described in our Cookie Policy or the process for requesting a refund described in our Refund Policy, that more specific provision will apply in relation to that particular matter, without limiting the general privacy protections described in this Policy.

18. Summary of Key Points

For ease of reference, the key points of this Privacy Policy are summarised below. This summary does not replace the detailed terms set out above, which govern in the event of any inconsistency.

We collect personal data you provide directly (such as Account and billing information), information collected automatically through your use of our website and Platform, and limited information from third parties such as Stripe. We use your personal data to provide and maintain the Platform, process your purchases, provide customer support, communicate with you, improve our services, maintain security, and comply with legal obligations. We do not sell your personal data, and we share it only with service providers, professional advisers, and other limited categories of recipients as described in Section 6, or where required by law. Where you enter personal data relating to your own customers, leads, or employees into the Platform, you act as the data controller for that information, and Edunexa generally acts as a data processor on your behalf. Depending on your location, you may have rights to access, correct, delete, restrict, or port your personal data, and to withdraw consent or lodge a complaint with a relevant authority. We implement reasonable technical and organisational measures to protect your personal data, though no method of transmission or storage is completely secure. Further detail on our use of cookies and similar technologies is set out in our separate Cookie Policy.