Privacy notice

Draft for Lavylites’ approval. Written by the Academy’s developers from what the Academy does, not legal advice. Text in square brackets is for Lavylites to complete or confirm before publishing.

The Lavylites Academy is Lavylites’ knowledge base for its partners. This notice explains which data about you the Academy uses, what for, how long it is kept and what you can ask of Lavylites.

Who is responsible

Lavylites is responsible for your data in the Academy (the controller): [to be confirmed by Lavylites: legal name, address and company registration number]. The services listed at the end process it on Lavylites’ behalf.

Data protection contact: [to be confirmed by Lavylites: email address, and the data protection officer if there is one].

What the Academy receives when you sign in

You sign in with your Lavylites account on lavylites.com (the Weboffice). Each time, and once a day while you use the Academy, the Weboffice sends the Academy your partner ID, name, email address, rank (your career level), market (the country you are registered in) and preferred language. It also confirms that your partnership is active; the Academy checks this but doesn’t store it.

What the Academy stores

• Your profile: the data above, the language you pick in your profile, and when you first and last signed in.
• Favourites: the items you mark with the heart.
• Entitlements: event tickets, purchased courses and promotions that Lavylites gives you, one by one or from a list (for example of event attendees). They name your partner ID, so they can exist before your first sign-in.
• Usage statistics: which item pages and previews of locked items you open, which files you download or view and which videos you open, when you search (not what you search for) and when you sign in, each with your market, rank and language at the time. They are counted on the Academy’s own server, without cookies and without your IP address or browser. Lavylites’ reports show totals and numbers of partners, not individual partners.
• Sessions: while you use the Academy, the server keeps a session with your IP address and browser for security, your language, the last page you visited, and your last search, so that typing on doesn’t count as a new search. The cookie notice has the details.
• Audit log: when Lavylites staff give, end or revoke one of your entitlements, the Academy records who changed what and when, with your partner ID.
• Imported lists: rows of an imported list that couldn’t be read are kept so that staff can correct them.
• Server logs: technical logs record errors, with the IP address and browser of a request that fails, and rarely a partner ID (for example when the Weboffice sends a rank the Academy doesn’t know). They are overwritten as new entries arrive.
• Backups: an encrypted copy of the database, made every day.

Files and videos come straight from the storage and video services listed below: your browser downloads a file from Cloudflare with a link that is valid for 5 minutes, loads a view-only document from Cloudflare into the Academy’s viewer with a link that is valid for an hour, and loads the video player of Bunny.net on items with a video. These services receive your IP address and browser details, as any website does that your browser loads something from.

The Academy sends no emails.

What the data is used for

[To be confirmed by Lavylites: the purposes, and the legal basis of each, for example the partnership agreement or Lavylites’ legitimate interest.]

• Signing you in and showing you the content meant for your rank, market, entitlements and language. Legal basis: [to be confirmed by Lavylites].
• Usage statistics: seeing which content partners use, to improve the Academy. Legal basis: [to be confirmed by Lavylites].
• Security and accountability: sessions, the audit log and the server logs. Legal basis: [to be confirmed by Lavylites].
• Backups: restoring the Academy after a failure. Legal basis: [to be confirmed by Lavylites].

How long the data is kept

[To be confirmed by Lavylites.]

• Profile, favourites and entitlements: until Lavylites deletes them when your partnership ends or when you ask (see below). [To be confirmed by Lavylites: whether profiles of partners who no longer sign in are deleted after a time.]
• Usage statistics: 25 months, then they are deleted.
• Audit log: 365 days.
• Rows of imported lists that couldn’t be read: 30 days.
• Sessions: until they expire (see the cookie notice); the server deletes expired sessions regularly.
• Backups: 30 days.
• Server logs: until they are overwritten (rotated by size, and cleared at each update of the Academy).

When you leave, or if you ask

Lavylites can give you a copy of your data as a file (JSON), with your profile, entitlements, favourites, usage statistics and sessions, and can delete your data. Deleting removes your profile, favourites, entitlements and sessions. The usage statistics keep counting what you opened, but without any link to you and without your market, rank and language. The audit log keeps its entries, with a code in place of your partner ID. Rows of imported lists that name you, and backups that contain your data, are deleted within 30 days. If you sign in again later, you start with an empty profile.

Your rights

[To be confirmed by Lavylites.] You can ask Lavylites for access to your data and a copy of it, for its correction or deletion, or to restrict its use, and you can object to its use. Your name, email address, rank and market come from the Weboffice: correct them there, and the Academy takes them over at your next sign-in. You can also complain to a data protection supervisory authority [to be confirmed by Lavylites: for example the Hungarian National Authority for Data Protection and Freedom of Information (NAIH)].

To use these rights, contact [to be confirmed by Lavylites: contact].

Services the Academy uses

These services process data for Lavylites to run the Academy; the Weboffice is Lavylites’ own system.

[To be confirmed by Lavylites: transfers outside the EU and their safeguards. Cloudflare, Sentry and Better Stack are US companies: state whether data reaches them or their subprocessors outside the EU, and on what basis, for example the EU–US Data Privacy Framework or standard contractual clauses.]