Privacy Policy

Who is the controller

For the marketplace and platform accounts, MB Handel is the controller. For data you share with an individual school (enrolments, progress, messages within that school), the school is the controller and we act as its processor. Each school is responsible for its own use of personal data on its storefront.

What we process

Account data: name, email, password hash, language. Learning data: enrolments, course progress, certificates. Payment data: handled by Stripe; we store transaction metadata, not card numbers. Technical data: IP address, device/browser, and — with consent — analytics and marketing identifiers.

Legal bases

Contract (providing your account and purchased courses), legitimate interests (security, improving the service), consent (analytics and marketing cookies, optional emails), and legal obligation (accounting, e.g. invoices via inv123.lt).

Sharing

We share data with processors and partners only as needed: Stripe (payments), our hosting provider (Hetzner, EU), email providers (Resend or a school’s own SMTP), video delivery (Bunny), invoicing (inv123.lt), and — with your consent — Google and Meta for analytics/marketing.

Marketing contacts and segmentation

When you create an account on courses123 — whether on the marketplace or through any school’s storefront hosted on it — MB Handel collects your contact details (name, email and preferred language/region) into its own platform contact database. We use this database to send you news, course updates and offers, and we organise it into regional segments (for example by language) so that communication is relevant to you. This processing for marketing is based on the consent you give when registering. You can withdraw it at any time using the unsubscribe link in any email or by contacting us, without affecting your access to purchased courses.

Each school separately collects the contacts of its own students for its own communications; the platform maintains the overall contact database across all schools. Contacts are stored within the EU and are not sold to third parties.

Reviews, moderation and account blocking

If you have access to a course you may leave a review. Reviews are public and may be moderated: a school can hide or remove reviews of its courses, and the platform can remove reviews that are abusive, defamatory or otherwise inappropriate. To protect schools and learners, the author of an inappropriate review may receive a warning. After two warnings the associated email address is permanently blocked from registering or signing in. We process this data on the basis of our legitimate interest in keeping the platform safe and trustworthy.

Your rights

Under the GDPR you can request access, rectification, erasure, restriction, portability, and object to processing. You can withdraw consent at any time. To exercise your rights, contact us below or the relevant school. You may also complain to your local data protection authority.

Retention

We keep data for as long as your account is active and as required for legal and accounting purposes, then delete or anonymise it.

Contact

Email hello@courses123.eu.