Privacy Policy

This policy explains which personal data the KITC learning platform (https://kitc.bubblelms.com) processes, why, for how long, who receives it and what rights you have.

1. Who is responsible

KITC, Prishtinë, Kosovë, is responsible for your personal data (the "controller"). The platform is built, hosted and supported for us by Bubble LMS, which processes personal data only on our instructions (a "processor"). For any question about your data, use the Privacy Center in your profile or write to [email protected].

2. What data we process

• Account: first and last name, username, email address, password (stored only in a protected, irreversible form), birth date, role (student or instructor), language and currency settings.
• Profile details you choose to add: phone, address, profession, a short biography, profile picture and links.
• Learning: courses you enrol in, progress, attendance, evaluations and results, certificates, and the comments and reviews you write.
• Live classes: your name and your participation in the class. If a class is recorded, you are told before it starts.
• Payments: orders, payments, invoices, wallet top-ups and refunds. Card payments are processed by our payment provider; we never receive your full card number.
• Communication: contact-form messages, privacy requests, and the emails we send you about your account, orders and courses.
• Technical data: error logs needed to run and protect the platform, which can include your IP address.

3. Why we process it, and on what legal basis

• To create your account and provide courses, live classes, certificates and support: necessary for our contract with you.
• To issue invoices and keep accounting records: legal obligation.
• To keep the platform secure, prevent misuse and investigate problems: our legitimate interest in a safe service.
• To play lesson videos and videos embedded from other websites, which come from external providers: your consent, which you can withdraw at any time.
• To show a student's profile to everyone: the student's own choice, which can be switched off at any time.
• To answer privacy requests and keep proof that we did: legal obligation.

We do not sell your data, we do not use it for advertising, and we do not take decisions about you based only on automated processing.

4. Who can see your data

• Instructors and assistants of your courses: your name, progress, attendance, evaluations and comments in their courses.
• Administrators of KITC: what they need for their work; their access to personal data is logged.
• Public profiles: instructor profiles are public. A student's profile is visible only to the student, the administrators and the instructors of the student's courses, unless the student makes it public in the Privacy Center. Email, phone, address and birth date are never public.
• Service providers working for us (hosting, file storage, email, payments, video): the current list, with what each one does and where it processes data, is published at https://kitc.bubblelms.com/sub-processors.
• Authorities, only when the law requires it.

5. Transfers to other countries

Some providers process data outside Kosovo or outside the European Union. We use them only with the safeguards the law requires, such as an adequacy decision or standard contractual clauses. The list of service providers shows where each one processes data.

6. How long we keep data

Data	How long
Your account and profile	While your account exists; then see section 8
A downloadable copy of your data	72 hours, and deleted after the first download
Error logs	90 days
Contact-form messages	1 year
Accounts whose email was never confirmed	30 days, then the personal details are removed
Participant lists of live classes	180 days (attendance records stay)
Proof of your consent choices and policy confirmations	3 years after a newer choice replaces them; the current one is kept
Privacy audit log	3 years
Orders, payments, invoices and refunds	As long as tax and accounting law requires
Certificates and academic results	As long as they must remain verifiable or the law requires

7. Your rights

• Access and portability: the Privacy Center shows what we store about you, and you can download a copy of your data in a machine-readable format.
• Correction: you can change most details in your profile; for the rest, send a request.
• Deletion: use "Close account" in your profile (see section 8).
• Restriction and objection: you can ask us to stop using your data for anything optional, or object to a particular use.
• Withdrawing consent: change your choice about external videos at any time ("Cookie preferences" at the bottom of the page, or the Privacy Center). This does not affect what was done before.
• Complaint: you can complain to a data protection authority. In Kosovo this is the Information and Privacy Agency (Agjencia për Informim dhe Privatësi, aip.rks-gov.net); you can also turn to the authority of the country where you live or work.

Requests are sent from the Privacy Center or to [email protected]. We answer within one month. When a request is complex or there are many requests, we may extend this by up to two more months (at most three months in total); we then tell you why within the first month. We may ask you to confirm your identity.

8. Deleting your account

When you ask us to delete your account, we remove or anonymize your personal data. Records the law requires us to keep, such as invoices and accounting records, are kept for the legal period: the billing name and address they need are kept separately, shown only to administrators, and deleted when that period ends.

9. Children

Users under 16 may register only with the consent of a parent or guardian. If you believe a child has registered without that consent, contact us and we will delete the account.

10. Security

Data is transmitted over encrypted connections. Access is protected by passwords and roles, administrators' access to personal data is logged, and downloading a copy of your data requires your password.

11. Cookies and similar technologies

What the platform stores on your device, and which external services may do so, is explained in the Cookie Policy.

12. Changes to this policy

Every version is published with its date, and earlier versions remain readable. If a change affects you materially, you are asked to confirm the new version the next time you sign in.