Privacy Policy

We collect the following categories of personal data:

• Account Data: Name, email address, phone number, password (hashed), profile picture, bio, location
• Enrollment Data: Course enrollments, payment history, M-Pesa transaction receipts, certificates earned
• Learning Data: Course progress, quiz scores, notes, discussions, assignments, attendance records
• Technical Data: IP address, browser type, device information, cookies, usage analytics
• Payment Data: M-Pesa phone numbers (processed via Safaricom Daraja API; we never store full card numbers)

We process your data based on the following legal bases (GDPR Article 6):

• Contract Performance: To provide educational services, process enrollments, and deliver courses
• Legitimate Interest: To improve our services, prevent fraud, and ensure platform security
• Consent: For marketing communications, analytics cookies, and AI tutor interactions
• Legal Obligation: To maintain financial records for tax compliance (7 years), and respond to legal requests

We implement PCI DSS compliant security measures:

• No Card Storage: We use M-Pesa (mobile money) for payments. No credit/debit card numbers are ever stored on our servers.
• Encryption: All data is transmitted over TLS/HTTPS encryption. Passwords are hashed with PBKDF2.
• Access Controls: Role-based access control (RBAC) limits data access to authorized personnel only.
• Audit Logging: All payment operations and data access are logged in an immutable audit trail.
• Network Security: Cloudflare WAF, DDoS protection, and Turnstile CAPTCHA protect against attacks.
• Incident Response: Security incidents are tracked, investigated, and resolved per PCI DSS requirements.

Under the GDPR, you have the following rights:

• Right of Access (Article 15): Request a copy of all personal data we hold about you
• Right to Rectification (Article 16): Request correction of inaccurate personal data
• Right to Erasure (Article 17): Request deletion of your personal data ("right to be forgotten")
• Right to Data Portability (Article 20): Receive your data in a structured, machine-readable format
• Right to Restrict Processing (Article 18): Request restriction of processing in certain circumstances
• Right to Object (Article 21): Object to processing based on legitimate interests or direct marketing

To exercise any of these rights, visit your dashboard profile or contact us at privacy@jetbrainscollege.com.

We retain personal data only as long as necessary:

• User Accounts: 7 years after last login (legal/tax compliance)
• Payment Records: 7 years (tax requirements)
• Enrollment Records: 7 years (certification verification)
• Course Notes: 1 year after course completion
• Discussion Posts: 3 years
• Contact Submissions: 1 year
• AI Conversations: 6 months
• Cookie Preferences: 1 year

When data is erased, some records are retained in anonymized form for legal compliance (e.g., PCI DSS audit logs, financial records).

We share data with the following processors for specific purposes:

• Cloudflare: Hosting, CDN, DDoS protection, Turnstile CAPTCHA
• Safaricom (M-Pesa): Payment processing via Daraja API
• Workers AI (Cloudflare): AI tutor and content generation
• Resend/Agentic Inbox: Transactional email delivery

All processors are bound by data processing agreements and comply with applicable data protection laws.

We use the following types of cookies:

• Essential Cookies: Required for authentication and security (cannot be disabled)
• Analytics Cookies: Help us understand how users interact with our platform
• Marketing Cookies: Used to deliver relevant advertisements
• Preference Cookies: Remember your settings and choices

Manage your cookie preferences in Cookie Settings.