Edita’s English Hub AB

Privacy policy

This Privacy Policy explains how Edita's English Hub AB collects, uses and protects personal information when you visit https://editasenglishhub.com, use our school at https://courses.editasenglishhub.com, purchase or manage a subscription, submit a withdrawal or refund request, or contact us. It also covers the connected forms and service messages we use for these purposes. Edita's English Hub AB is the controller of the processing described here. Organisation number: 559588-8768. Registered office: Luleå, Sweden. Business address: Docentvägen 461, 977 52 Luleå, Sweden. Our services are offered globally where lawful.

Privacy contact: [email protected]. School: https://courses.editasenglishhub.com. Effective date: 7 October 2026.

1 What information do we collect and what do we do with it

We collect account names, email addresses, account identifiers, enrolments and course progress to provide the school. Where you use a course feature, we process the quiz answers, assignments, feedback or completion records you submit or generate. We receive billing addresses, currency, tax, invoice, payment, refund and subscription-status information from our payment provider. Website, school and form technical information may include IP address, browser and device information, access activity and security logs. We collect enquiries and preferences you send us. For an eligible minor, we also process the guardian’s contact and purchaser details, the named learner’s details, country, proportionate age-eligibility information and authorisation records. Information comes from you or your guardian, your use of the service, and the providers described below. Books are online-only. With your consent, we also process public-website analytics information as described in Section 6.

Withdrawal, refund and service records

When you submit a withdrawal or refund request, we process your name, purchase email, information identifying the purchase or subscription, your chosen acknowledgment email address, and the information you include in your request. We record when the request was received, acknowledgment and notification timestamps, its review status, relevant correspondence and administrative notes. Where needed, we link it to customer, invoice, subscription, payment, refund or credit-note identifiers to verify the purchase and process the outcome.

We also keep operational records of completed membership actions, payment failures, grace-period deadlines and recovery status to administer access, avoid duplicate actions, and investigate errors. Internal error alerts may include workflow names, error details and links to restricted run records. Please do not send passwords, full card numbers, card security codes or information unrelated to your request. The acknowledgment email address you provide is used to send the receipt confirmation; it does not automatically replace the email address on your learning or billing account.

During subscription checkout, the adult subscriber can choose to receive promotional emails about our courses, books and offers by actively selecting a separate optional marketing checkbox. This choice is not preselected or required to purchase. Every promotional email includes an unsubscribe link. Unsubscribing does not cancel course access or prevent necessary account, payment, course-access or security messages.

2 Legal bases and consent

We use purchaser account and payment information to enter into and perform the subscription contract and take requested steps before purchase (GDPR Article 6(1)(b)). Where the learner is also the contracting customer, this basis covers information necessary to provide that learner’s course access and progress features. We process required billing, tax, statutory withdrawal and refund records to meet legal obligations (Article 6(1)(c)); where a request concerns a contractual refund or cancellation, we process it as necessary to administer that contract (Article 6(1)(b)). We rely on legitimate interests in protecting accounts, preventing misuse and duplicate transactions, monitoring and correcting automation errors, responding to general enquiries and handling legal claims (Article 6(1)(f)), subject to balancing those interests against your rights. Section 7 explains the basis for essential learner information where a guardian purchases for a minor.

Optional promotional email uses consent (GDPR Article 6(1)(a)). Consent is recorded, specific to the stated purpose and separate from the subscription contract. We obtain any additional consent required by applicable law before starting the relevant processing. We keep essential service messages separate from promotional email. Optional Google Analytics on our public website also uses consent under Article 6(1)(a), separately from marketing consent, as described in Section 6.

How do I withdraw my consent

Use the unsubscribe link in a promotional email or contact [email protected] to withdraw marketing consent. Withdrawal does not affect earlier lawful processing. You may also object to direct marketing at any time. Necessary billing, security, course-access, withdrawal-acknowledgment and refund messages may continue where needed to administer your account or request, or meet a legal obligation. You can withdraw public-website analytics consent through Cookie Settings in the public website footer, as explained in Section 6. Withdrawing privacy consent, cancelling future renewals, and withdrawing from a purchase are separate actions.

3 Disclosure

Authorised personnel access personal information only as needed to deliver courses, respond to enquiries or administer the business. Service providers receive information needed for hosting, payment processing, tax and invoicing, withdrawal-request handling, automation, operational record storage, email delivery, consent-based website analytics and technical support. Accountants and other professional advisers may receive relevant records for accounting, advice or legal claims. We disclose information to authorities when legally required. We do not sell personal information or share it for cross-context behavioural advertising, and do not provide learner progress reports to employers.

4 Payment

Stripe processes EUR payments and recurring subscriptions and supports tax calculation, invoices, refunds and credit notes. It collects payment credentials and provides us with transaction identifiers, billing and tax information, payment outcomes and subscription status. Relevant payment events and records are passed to our connected workflows to administer course access and customer service. We do not receive your full payment-card number through normal checkout. Purchase records remain subject to the retention rules in Section 9.

Stripe may act as a processor for some activities and as an independent controller for its own regulatory and fraud-prevention purposes. Its privacy information is at https://stripe.com/privacy.

5 Third party services

Thinkific hosts our school and processes learner information on our behalf under its data processing terms. Its authorised subprocessors support functions such as hosting and content delivery. Thinkific may also process some data as an independent controller for purposes described in its privacy policy: https://www.thinkific.com/privacy-policy/. Subprocessors: https://www.thinkific.com/thinkificsubprocessors/.

Zapier connects our payment, course-delivery and customer-service workflows. It processes payment-event and API-response information as well as the fields used by individual actions. This can include names, purchaser or guardian email, billing address and tax details, customer and school user identifiers, invoice and subscription identifiers, payment amounts and outcomes, refund information, course identifiers and access-expiry dates. Full card numbers and card security codes are not included in these workflows.

Our online withdrawal form is hosted by Zapier. Zapier Forms and Tables store submitted request details, receipt and acknowledgment timestamps, review status and administrative notes. Zapier Tables also store membership-processing, grace-period and refund records used to avoid duplicate processing and support account administration. Workflow histories contain information processed by the relevant steps and are used for troubleshooting. Learning submissions are not intentionally included in these payment and withdrawal workflows. Zapier’s privacy information is at https://zapier.com/privacy.

Microsoft 365 and GoDaddy. We use Microsoft 365/Outlook, supplied through GoDaddy, for our business mailboxes, support correspondence and service notifications, including payment-failure, recovery, cancellation, withdrawal-acknowledgment and refund messages. Microsoft processes email addresses, message content, attachments where supplied, and delivery and security metadata to provide the email service. GoDaddy supplies and administers the email service and may process information needed for provisioning, account administration and support. See Microsoft’s Privacy Statement and GoDaddy’s Privacy Notice.

Internal email alerts. Limited automation-error alerts are also delivered to an authorised administrator’s Gmail mailbox. Google processes the alert content and email metadata to deliver and store those messages. Error details may contain account or transaction identifiers or contact information relevant to the failure. This operational email use is separate from optional website analytics and does not subscribe you to marketing. See Google’s Privacy Policy.

Google provides optional Google Analytics 4 for our public website, as described in Section 6. Cloudflare delivers and protects the public website and may process technical request information, including IP address, browser information and requested pages, for hosting and security.

Where a provider processes information on our behalf, we use appropriate data processing terms. Where it is an independent controller, its own privacy notice explains its processing. This does not remove our responsibility for the information we collect or disclose.

Personal data may be processed outside the European Economic Area, including in Canada and the United States through our service providers.

Where required for transfers outside the EEA, we use a European Commission adequacy decision covering the relevant recipient or contractual safeguards, including Standard Contractual Clauses, together with supplementary measures where necessary. Transfers from other jurisdictions use the safeguards required by their applicable law. Provider processing arrangements govern the destinations and authorised subprocessors. You can request details of the safeguards applicable to your information, or a copy, from [email protected], subject to necessary redactions. Thinkific’s data processing terms are available at https://www.thinkific.com/dpa/.

Independent websites and services have their own notices. This policy continues to apply to our processing of information received from or shared with those services, including an external checkout.

Links

Independent websites and services have their own privacy notices. This policy covers our processing on both our public website and school, including information received through our connected checkout. Contact [email protected] for a copy or an explanation.

6 Security

We use appropriate technical and organisational safeguards, including restricted access, administrator authentication, secure provider connections and procedures for handling incidents and deletion requests. We require appropriate protections from providers processing information on our behalf. Please protect your login credentials and contact support promptly if you suspect unauthorised access.

Payment credentials are handled through the authorised payment provider. No system guarantees absolute security.

Cookies and privacy choices

Our public website, school and checkout use necessary cookies and similar browser storage to support security, login sessions, payment processing, course delivery and privacy preferences. Session storage lasts for the relevant session; persistent essential cookies remain until their set expiry or earlier deletion. Their duration depends on the function and provider. Your browser’s site-data controls show stored cookies and their expiry information. Blocking necessary technologies may prevent login, checkout or course access.

On our public website at editasenglishhub.com, optional Google Analytics is disabled until you actively consent. You can choose Accept analytics, Reject analytics, or manage your preferences. Simply browsing the website does not enable analytics. Rejecting analytics does not affect your ability to use the website or purchase our services.

We remember your privacy choice in browser storage named eeh_cookie_consent for up to 180 days, after which we ask again. Clearing browser storage may cause us to ask sooner.

You can withdraw analytics consent at any time through Cookie Settings in the public website footer. When you withdraw, we stop further analytics collection, remove accessible first-party Google Analytics cookies and reload the page where needed to stop the analytics script. Withdrawal does not affect the lawfulness of processing before withdrawal and does not automatically delete information already collected. You may contact our privacy address to exercise your rights concerning information already collected.

Further information about the public website’s cookies and controls is available in our Cookie Policy. This Privacy Policy is our main privacy notice for both the public website and Thinkific school; the Cookie Policy provides supplementary information about the public website. Information about Thinkific’s cookies is available in Thinkific’s Cookie Policy; that policy also describes Thinkific’s own websites, whose optional technologies may differ from those used by our school.

We do not use optional advertising pixels, behavioural advertising, or email-open or email-click tracking. The optional analytics described below is separate from advertising and email tracking. If we introduce additional optional cookies or similar tracking, we will first provide information about their purpose, provider and duration, obtain consent where required, and make withdrawal of that consent available.

We respect browser privacy signals where required by applicable law. Because we do not sell personal information or use it for cross-context behavioural advertising, there is no such processing to opt out of in our current service.

Web analysis tools — Google Analytics 4

Provider and purpose. With your consent, we use Google Analytics 4, provided by Google, to understand visits, page use and engagement on our public website. We use these reports to assess and improve the website’s content and usability. This analytics setup applies to editasenglishhub.com, including its www address; it does not itself enable analytics on our Thinkific school or checkout.

Information processed. Google Analytics may process cookie and online identifiers, pages visited, referring pages, browser and device information, approximate location, and interaction information such as session activity and engagement. Google also receives technical request information, including your IP address, when your browser connects to its service.

Consent and advertising settings. Our legal basis for optional analytics is your consent under GDPR Article 6(1)(a). We load the Google Analytics script only after you allow analytics. We disable Google signals and advertising personalization in this public-website integration. Analytics consent is separate from marketing-email consent and is not required to create an account or purchase a subscription.

Cookies. Google Analytics may set first-party cookies named _ga and _ga_* to distinguish visitors and maintain session information. We configure these cookies with a lifetime of up to 180 days, which may renew with use. Cookie expiry is separate from the retention of information already collected by Google Analytics.

Analytics data retention. Our Google Analytics property is configured to retain event-level data for 2 months and user-level data for 14 months. Reset on new user activity is enabled: new activity resets the user-data retention period, so continuing activity can extend retention beyond 14 months from the first visit. This reset applies to user-level data, not the event-data retention period. Data reaching the end of the applicable retention period is deleted through Google Analytics’ monthly deletion process. These settings do not control retention of standard aggregated reports, which may remain available longer.

Recipients and international transfers. Google processes analytics information to provide the service under its applicable data-processing terms. Information may be processed outside the European Economic Area, including in the United States. Where required, transfers rely on an applicable adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, as described in Google’s international-transfer information. Further information is available in Google’s Privacy Policy. You can request information about the safeguards applicable to your information from our privacy contact.

Your rights. You can change your analytics choice through Cookie Settings on the public website. For questions about analytics information already collected, international-transfer safeguards, or requests to exercise your privacy rights, contact [email protected]. The rights described in Section 10 also apply to this processing.

7 Learner age and guardian arrangements

Learners must be at least 16 years old, or meet any higher minimum required by applicable law. We do not accept under-16 learners, even through a guardian’s account. Purchasers must be at least 18 and have the age and capacity to contract in their jurisdiction. For a learner aged 16 or over who is under 18 or below the applicable age of majority, a parent or legal guardian creates and manages the learning account, purchases the subscription and authorises participation.

For an eligible minor, the guardian creates one account for one named learner, using the guardian’s email for login and service messages. The learner uses this account for learning under the guardian’s supervision. There are no separate parent and learner permissions. Both people using that login may see profile details, learning progress, submissions and account or order information available there. The guardian manages purchases. The account does not keep learning submissions confidential from the guardian. Optional marketing is offered only to the adult. Requests for records outside the account are assessed separately under applicable privacy law.

For essential personal information about a minor learner whose guardian is the contracting customer, we rely on our legitimate interests in providing the guardian-authorised educational service, maintaining progress and protecting the learner’s account (GDPR Article 6(1)(f)). We balance those interests against the learner’s rights, give particular weight to children’s privacy, restrict use and access, and do not use that information for behavioural advertising. Where local law requires a different basis or additional learner or guardian consent, we obtain it before that processing. Guardian purchase alone does not authorise unrelated use of the learner’s information. A learner or guardian may contact us to object, ask about this assessment or exercise privacy rights.

For younger learners: your guardian helps manage this account. We use your learning activity to provide courses and remember your progress. Your guardian can see information in the same account. We do not automatically sign you up for advertising emails. You can ask us about your information at [email protected].

8 Changes to this privacy policy

We may update this policy when our Services, processing or legal requirements change. The effective date will be updated, and we will provide additional notice where appropriate. If new consent is required, we will obtain it before starting the relevant processing.

In a merger, restructuring or business transfer, relevant personal data may be disclosed to advisers or a successor where lawful and necessary, with appropriate safeguards. We will provide any notice required by law. This does not authorise unrelated reuse of learner information.

Contact information

For privacy questions or to exercise your rights, contact Edita's English Hub AB at [email protected], or write to Docentvägen 461, 977 52 Luleå, Sweden. See Section 10 for your rights and complaint options. Telephone: +46 76 126 55 36. For course, account or billing support, email [email protected].

9 How long we keep your information

Account and learning records are kept while needed to provide active subscription access. If there is no active entitlement and the account has been inactive for 12 months, we delete or irreversibly anonymise those records unless specific information must be retained for a legal obligation or claim. Inactivity is measured from the later of the last login or the end of purchased access. You may request earlier deletion where applicable. Cancelling a subscription does not itself delete the account.

Accounting records are generally retained through the seventh year after the end of the calendar year in which the financial year ended, as required by Swedish bookkeeping law. Records subject to the VAT One Stop Shop rules are retained for 10 years from the end of the year of the relevant transaction. Other legally required tax periods apply to the records they cover.

Ordinary support correspondence, including correspondence about withdrawal and refund requests, is kept for 24 months after the enquiry or request is resolved. We keep the records needed to evidence a withdrawal, refund, payment or credit note for the applicable accounting, legal-obligation or claims period instead where required. Security logs under our control are kept for 90 days unless an incident requires longer retention. We stop promotional use when consent is withdrawn or after 24 months without meaningful engagement, such as a purchase, enquiry or renewed signup; email-open tracking is not used to measure this. We retain only the suppression information needed to honour an unsubscribe while we continue relevant marketing activities. Consent and guardian-authorisation evidence is kept while relied on and afterwards only as necessary to demonstrate lawful processing or address claims within the applicable limitation period. We review that need and delete evidence when it ends.

Operational membership, grace-period and duplicate-prevention records are retained while needed to administer the relevant entitlement, reconcile payment or refund events, prevent duplicate actions, or resolve an outstanding issue. After those purposes end, we delete or anonymise them unless the applicable accounting or claims requirements justify keeping specific fields. Withdrawal form and table records follow the request and evidence-retention criteria above. Zapier Tables and form content are stored until deleted; they do not disappear merely because a workflow history expires. We apply the relevant retention criteria across our forms, tables and mailboxes. Workflow histories and provider technical logs have separate product-specific retention cycles; these are distinct from our stored business records.

Cookies and browser privacy preferences follow the session and expiry criteria explained in Section 6. Google Analytics event-level data is retained for 2 months and user-level data for 14 months, with the user-data retention period resetting on new activity. Section 6 explains this reset, the monthly deletion process and the separate treatment of standard aggregated reports. Provider backups and technical histories follow the applicable service’s retention cycle. After deletion from active systems, residual backup copies are restricted to recovery and security purposes until overwritten or deleted; if restored, applicable deletion instructions are reapplied. We may retain limited records longer for a continuing legal obligation or a specific legal claim. When the relevant purpose and retention requirement end, we delete or irreversibly anonymise the information.

10 Your rights and complaints

Subject to the applicable conditions, you may request access and a copy, correction, deletion, restriction of processing, and portability of information you provided where processing is automated and based on consent or contract. You may object to processing based on legitimate interests for reasons relating to your situation. You may object to direct marketing at any time, and withdraw consent without affecting earlier lawful processing.

Send requests to [email protected]. We may request proportionate proof of identity. We normally respond within one month; where law permits an extension for complexity or the number of requests, we will explain within that month, and the extension may be up to two further months. Requests are normally free. Legal exceptions may apply, such as retaining required accounting records.

You may complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), https://www.imy.se/en/, or the competent supervisory authority where you habitually live or work in the EU/EEA, or where the alleged infringement occurred. You do not have to contact us first.

Customers outside the EU/EEA may have additional rights under applicable law, including rights to know about, access, correct or delete personal information, receive a portable copy, restrict certain uses, or appeal a refused request. Contact our privacy address to exercise these rights or ask for review of a decision. We apply the required response periods and verification procedures and do not unlawfully discriminate against you for exercising your rights. You may also contact the privacy regulator or other competent authority where you live.

11 Required information and automated processing

We need basic account and purchase details to provide your course and meet billing obligations. If required information is not provided, we may be unable to create an account or supply the paid service. To handle a withdrawal or refund request, we need enough information to identify you and the relevant purchase, and an address or other appropriate means to send the acknowledgment. We may seek proportionate clarification or identity verification where needed; a clear withdrawal notice does not have to be submitted through our online form. Optional marketing and profile details are voluntary.

Stripe payment and subscription events trigger automated actions through Zapier and Thinkific. A successful accepted purchase or renewal enables or extends course access. Scheduled cancellation normally leaves access available until the paid period ends. For a failed renewal, the workflow records the first payment-failure timestamp, calculates an access deadline 72 hours later and applies that expiry to the relevant course enrolments. The payment-failure email provides the deadline and a link to the invoice. Further payment retries do not restart the grace period. If payment remains unpaid at the deadline, access expires; a qualifying successful renewal payment can update the entitlement.

Withdrawal requests are automatically recorded and acknowledged, but acknowledgment is not refund approval. We review the request and applicable purchase records before deciding its outcome. Following an approved refund, verified payment events can trigger the corresponding access update, operational record and confirmation email.

These automated actions administer the subscription and customer-service process; they do not assess academic ability, creditworthiness or suitability for learning. If an automated access decision affects you, you may request human review, explain your position and contest it by contacting [email protected]. We investigate the relevant payment and account records and correct errors. The learner or guardian can make this request.

We do not offer public learner communities, learner-to-learner messaging, learner-facing AI, recording of learners or employer progress reporting at launch.