Privacy Policy

BHP Affairs Sp. z o.o.

Last updated: 11 March 2026

1. Data Controller

The controller of your personal data is BHP Affairs Sp. z o.o., with its registered office at plac Wolności 6/108, 61-738 Poznań, Poland ("Company", "we", "us").

Contact: [email protected], phone: +48 61 224 88 19.

2. Legal Basis

We process your personal data in accordance with:

Regulation (EU) 2016/679 — General Data Protection Regulation (GDPR/RODO)
Polish Act on Personal Data Protection of 10 May 2018 (Ustawa o ochronie danych osobowych)
Polish Telecommunications Law (Prawo telekomunikacyjne) — for cookies and electronic communications

3. What Data We Collect

3.1. Data you provide directly

Data	Purpose	Legal Basis (GDPR)
First name, last name	Account creation, certificate generation	Art. 6(1)(b) — contract performance
Email address	Account login, notifications, verification	Art. 6(1)(b) — contract performance
Company name	Invoice generation, certificate details	Art. 6(1)(b) — contract performance
Password (hashed)	Account security	Art. 6(1)(b) — contract performance
Contact form messages	Responding to enquiries	Art. 6(1)(f) — legitimate interest

3.2. Data collected automatically

Data	Purpose	Legal Basis (GDPR)
IP address	Security, fraud prevention, device limitation	Art. 6(1)(f) — legitimate interest
Browser/device info (user agent)	Device limitation, security	Art. 6(1)(f) — legitimate interest
Session data	Platform functionality	Art. 6(1)(b) — contract performance
Course progress, exam results	Certificate issuance, learning analytics	Art. 6(1)(b) — contract performance
Referral click data (code used, IP address, browser, landing page, time)	Crediting the person who referred you, and detecting self-referral or fraudulent claims	Art. 6(1)(f) — legitimate interest (fraud detection); the referral cookie itself is set only with your consent, Art. 6(1)(a)

3.3. Data from third parties

Source	Data	Purpose	Legal Basis
Google OAuth	Name, email, profile picture, Google ID	Account creation/login	Art. 6(1)(b) — contract
Payment gateways (Stripe, PayPal)	Transaction ID, payment status, amount	Order processing	Art. 6(1)(b) — contract

4. Purpose of Processing

We process your data for the following purposes:

Account management — creating and maintaining your user account.
Service delivery — providing access to courses, issuing certificates, tracking progress.
Payment processing — handling course purchases, issuing invoices.
Communication — sending verification emails, password resets, course notifications, and responding to enquiries.
Security — fraud prevention, device limitation, account protection.
Legal compliance — tax records, regulatory obligations.
Platform improvement — internal analytics on course engagement (anonymised where possible).
Referral programme — recording who invited whom, calculating and paying rewards, and checking claims for abuse. If you were invited by another user, that user can see that you registered and whether the referral qualified; they are shown only your initials, never your full name, email address or what you bought.

5. Data Sharing — Third-Party Processors

We share your data with the following categories of processors, under appropriate data processing agreements:

Processor	Purpose	Data transferred	Location
Stripe, Inc.	Payment processing	Transaction data, email	USA (EU SCCs)
PayPal (Europe)	Payment processing	Transaction data, email	EU
Google LLC	OAuth authentication, Fonts	Email, name (OAuth); IP (Fonts)	USA (EU SCCs)
Gmail SMTP (Google)	Email delivery	Email address, message content	USA (EU SCCs)
Hosting provider	Server infrastructure	All platform data	EU

We do not sell your personal data to any third party.

6. International Data Transfers

Some processors are located outside the European Economic Area (EEA), primarily in the USA. Transfers are protected by:

EU Standard Contractual Clauses (SCCs)
EU-US Data Privacy Framework (where applicable)

7. Data Retention

Data type	Retention period
Account data	Duration of account + 30 days after deletion request
Course completion / certificates	5 years (Polish Labour Code requirements)
Payment / invoice data	5 years (Polish tax law — Ordynacja podatkowa)
Contact form messages	12 months
Session / device data	Deleted upon logout or session expiry (2 hours)
Cookie consent records	12 months
Referral click log (IP, browser, landing page)	12 months
Referral and reward records	5 years (Polish tax law — rewards are taxable income and must be documented)

8. Your Rights (GDPR Articles 15–22)

You have the following rights regarding your personal data:

Right of access (Art. 15) — obtain a copy of your data.
Right to rectification (Art. 16) — correct inaccurate data.
Right to erasure (Art. 17) — request deletion of your data ("right to be forgotten").
Right to restriction (Art. 18) — limit processing in certain circumstances.
Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
Right to object (Art. 21) — object to processing based on legitimate interest.
Right to withdraw consent (Art. 7) — withdraw consent at any time (e.g., cookie consent).

To exercise any of these rights, contact us at: [email protected]. We will respond within 30 days.

9. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Polish supervisory authority:

Prezes Urzędu Ochrony Danych Osobowych (UODO)
ul. Stawki 2, 00-193 Warszawa
Website: https://uodo.gov.pl

10. Cookies

We use cookies and similar technologies on our Platform. For detailed information about the types of cookies we use, their purposes, and how to manage them, please see our Cookie Policy.

11. Children's Privacy

The Platform is not intended for persons under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes take effect upon publication on the Platform. We encourage you to review this page periodically.

13. Contact

BHP Affairs Sp. z o.o.
plac Wolności 6/108, 61-738 Poznań, Poland
Email: [email protected]
Phone: +48 61 224 88 19