Privacy Policy

1. Introduction

This Privacy Policy explains how The Protein Diversification Academy (“Protein Academy”, “PDA”, “we”, “our”, or “us”), a non-profit association registered in Denmark, processes personal data when you visit our website, create or use an account on our online learning platform, register for or participate in our educational programmes, make a donation, purchase merchandise, contact us, or otherwise interact with us.

The Protein Diversification Academy is a small EU-based non-profit association dedicated to developing educational programmes and contributing to the development of future food systems, with a particular focus on protein diversification.

Our website provides information about PDA and its activities and supports an online learning platform through which users can create accounts, access educational content, participate in courses and complete learning activities.

This Privacy Policy explains what personal data we collect, why we process it, the legal bases for processing, who may receive it, how long we retain it, and the rights available to you under applicable data protection law.

This Privacy Policy should be read together with our Cookie Policy, which explains how we
use cookies and similar technologies on our website.

2. Our Contact Details

All references to “Protein Academy”, “PDA”, “us”, “we”, or “our” refer to:

The Protein Diversification Academy
A non-profit association registered in Denmark
CVR number: 44375435
Address: C/O HaystackAgro Food Park 138200 Aarhus N, Denmark

For questions regarding this Privacy Policy or the processing of your personal data, please
contact:

Email: pdlp@proteinacademy.org

3. The Categories of Personal Data We Process

Depending on how you interact with PDA, we may process the following categories of personal data.

3.1 Website visitors

When you visit our website, we may process:

• IP address;
• browser and device information;
• operating system;
• technical identifiers;
• information about your interaction with our website;
• pages visited and navigation information;
• date and time of visits; and
• other technical information necessary to operate, secure and improve the website.

Where analytics, marketing or other non-essential tracking technologies are used, these will be handled in accordance with our Cookie Policy and applicable consent requirements.

3.2 Account holders and students

When you create an account or register for one of our educational programmes, we may process:

• full name;
• email address;
• username or user ID;
• password and other authentication credentials;
• gender;
• country of origin;
• country of residence;
• course registration and enrolment information;
• course participation and completion information;
• learning progress;
• assessment and assignment information;
• quiz or poll answers;
• scores and grades;
• communications relating to courses and learning activities;
• certification information; and
• technical information associated with your use of the learning platform.

For certain programmes, we may also collect the date on which a course is completed forcertification and reporting purposes.

3.3 Learning activities and assessment data

Through our online learning platform, students may participate in interactive learning activities delivered through LearnCast, which is integrated with our TutorLMS/WordPress learning environment.

Depending on the activity, LearnCast may process quiz and poll answers, scores, interaction data used for review, audio or video submissions, recordings, transcriptions, structured assessment outputs, PDF reports and other assessment artefacts.

LearnCast has informed PDA that its core application infrastructure for learner-related data is hosted in the European Union, including infrastructure located in the Scaleway Paris region.

LearnCast uses pseudonymised object keys for stored assessment files where possible. Assessment media and reports are held in private EU-hosted storage and accessed using time-limited signed URLs rather than permanent public links.

3.4 Course administration and certification

We process student information to administer courses and programmes and, where applicable, issue certificates.

This may include:

• student name
• email address
• gender
• country of origin
• country of residence
• course enrolment information
• course completion date
• assessment and completion information
• certificate information

For programmes supported or funded by EIT Food (European Institute for Innovation and Technology), certain student information is communicated to EIT Food and, where applicable, its designated certification provider for the purposes of EIT Labelled certificate issuance and programme reporting.

The information communicated for these purposes is expected to include:

• student name
• email address
• gender
• country of origin
• country of residence
• date of course completion

The precise controller/processor allocation between PDA, EIT Food and any certification provider will be reflected in this Privacy Policy once the applicable arrangement has been confirmed.

3.5 Donations

If you make a donation to PDA, we may process:

• your name
• email address
• contact information
• donation amount
• date and details of the donation
• payment or transaction reference
• information necessary for accounting and financial administration

Donations may be processed through Stripe, our third-party payment service provider.

We do not generally receive or store complete payment-card details where payment processing is handled directly by Stripe.

3.6 Merchandise purchases

We use Spreadshop as an external provider for our merchandise activities.

If you purchase merchandise, personal data may be processed in connection with:

• your name
• email address
• billing and/or delivery address
• contact details
• order details
• purchased products
• payment and transaction information
• fulfilment and delivery
• returns or refunds

The processing of personal data by Spreadshop is also subject to the provider’s applicable privacy information.

3.7 Communications

If you contact PDA, we may process:

• your name
• email address
• other contact details
• the content of your communication
• attachments or other information you provide
• information necessary to respond to and manage your enquiry

3.8 Volunteers, contributors and other participants

Where you participate in PDA activities as a volunteer, contributor, speaker, mentor, partner or other participant, we may process:

• name
• contact details
• professional or educational background
• role or affiliation
• information concerning your participation
• correspondence and other information necessary for the relevant activity

4. Purposes of Processing

We process personal data for the following purposes.

4.1 Website operation and security

We process personal data where necessary to:

• operate and maintain our website
• provide website functionality
• maintain security
• prevent misuse
• troubleshoot technical problems
• administer our online services

4.2 Account administration

We process personal data to:

• create and administer student accounts
• authenticate users
• maintain secure login sessions
• provide access to relevant courses
• maintain account information
• provide technical assistance
• communicate with account holders

4.3 Course and programme administration

We process personal data to:

• register students
• administer course enrolments
• provide access to educational content
• deliver interactive learning activities
• monitor participation and progress
• administer assessments
• review learning activities
• record scores and completion status
• communicate with students
• provide learner support
• administer course requirements

4.4 Certification

We process personal data to:

• determine whether course requirements have been completed
• record course completion
• issue certificates
• maintain certification records
• verify certificates where appropriate
• respond to certification-related enquiries

4.5 EIT Food certification and reporting

For relevant EIT Food-supported programmes, PDA may communicate specified student information to EIT Food and/or its designated certification provider for the purposes of issuing EIT Labelled certificates and fulfilling programme reporting requirements.

EIT Food has informed PDA that the relevant information is used as part of its reporting obligations in connection with the funding and administration of the relevant programmes.

The precise legal role of EIT Food and any certification provider in relation to this information is currently being confirmed and will be reflected accordingly once confirmed.

4.6 Donations

We process personal data to:

• administer donations
• process and reconcile payments
• maintain financial records
• provide donation confirmations where applicable
• communicate with donors where necessary
• comply with applicable accounting and legal requirements

4.7 Merchandise and orders

We process personal data to:

• administer merchandise orders
• facilitate payment
• arrange fulfilment and delivery
• process returns and refunds
• communicate about orders
• maintain appropriate transaction and accounting records

4.8 Communications

We process personal data to:

• respond to enquiries
• provide administrative information
• communicate with students and other participants
• communicate with donors, volunteers and partners
• provide information concerning programmes and activities

Where consent is required for direct electronic marketing, we will obtain the required consent before sending such communications.

4.9 Organisational and legal purposes

We may process personal data where necessary to:

• comply with applicable legal obligations
• maintain accounting and financial records
• establish, exercise or defend legal claims
• resolve disputes
• protect our rights and interests
• maintain the security of our systems
• prevent unauthorised access, misuse or other unlawful activity

4.10 Website analytics and improvement

Where the required consent has been obtained, we may use analytics technologies to understand how visitors interact with our website and to improve its functionality, content and user experience.

The specific technologies and providers are described in our Cookie Policy.

5. Legal Basis for Processing

The legal basis for processing personal data depends on the particular processing activity.

We may rely on the following legal bases under the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or GDPR).

Contractual necessity

We may process personal data where this is necessary to enter into or perform an agreement with you, including where necessary to:

• create and administer your learning account
• provide access to courses and educational services
• administer your participation in a programme
• provide other services you have requested

Compliance with legal obligations

We may process personal data where necessary to comply with applicable legal obligations, including accounting, financial, tax or other statutory requirements.

Legitimate interests

We may process personal data where this is necessary for our legitimate interests, provided that those interests are not overridden by your fundamental rights and freedoms.

Our legitimate interests may include:

• administering and developing PDA
• operating and securing our website and learning platform
• administering educational programmes
• maintaining course and certification records
• communicating with students and participants
• maintaining appropriate organisational records
• preventing misuse and protecting our systems
• establishing, exercising or defending legal claims

Consent

Where required by law, we rely on your consent for specific processing activities.

This may include certain analytics, marketing or other non-essential cookies and similar technologies.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Public interest

Where applicable and legally justified, we may process personal data where necessary for activities carried out in the public interest.

6. Sources of Personal Data

We primarily collect personal data directly from you.

You may provide information when you:

• create an account
• register for a course
• complete a course registration
• participate in learning activities
• submit assignments or assessments
• contact us
• make a donation
• purchase merchandise
• otherwise communicate with PDA

We may also receive personal data from third-party service providers involved in providing our services, including:

• TutorLMS/WordPress
• LearnCast
• Stripe
• Spreadshop
• hosting providers
• other technical or service providers

For EIT Food-supported programmes, we may also receive or process information in connection with certification and reporting arrangements involving EIT Food and/or its designated certification provider.

7. Recipients of Personal Data

We may share personal data with third parties where this is necessary for the purposes described in this Privacy Policy.

These recipients may include:

EIT Food

For relevant EIT Food-supported programmes, PDA may provide specified student information to EIT Food for certification and reporting purposes.

The precise controller/processor role of EIT Food is currently being confirmed.

Where applicable, the same or related information may be provided to EIT Food’s designated certification provider, including the Fraunhofer Institute, for the purpose of issuing EIT Labelled certificates.

LearnCast

LearnCast acts as a processor/sub-processor in connection with the delivery of interactive course activities.

LearnCast processes learner information in order to:

• deliver interactive learning activities
• process learner submissions
• process assessment artefacts
• provide scoring and review functionality
• return scores and completion status to TutorLMS
• provide links to relevant reports or review materials

LearnCast has informed PDA that its core learner-related infrastructure is hosted in the EU, including the Scaleway Paris region.

LearnCast does not store PDA’s WordPress administrator credentials. Grade synchronisation is performed through the configured TutorLMS integration and signed results callback.

Further information is available in LearnCast’s Privacy Policy.

TutorLMS and WordPress

Our WordPress/TutorLMS environment is used to provide and administer the online learning platform, including:

• user accounts
• course enrolments
• learning progress
• assignments
• grades
• completion records
• other educational records

PDA’s WordPress/TutorLMS environment is hosted by Hostinger on servers located in Frankfurt, Germany.

Stripe

Stripe acts as our payment service provider for applicable donations and other payments.

Further information is available in Stripe’s applicable Privacy Policy.

Spreadshop

Spreadshop acts as an external provider for our merchandise service and may process information necessary to fulfil merchandise orders.

Further information is available in Spreadshop’s applicable Privacy Policy.

Other service providers

We may also use:

• website hosting providers
• email and communications providers
• IT and software providers
• analytics providers
• professional advisers
• accounting providers
• other service providers acting on our behalf

Where a third party processes personal data on our behalf, we will implement appropriate contractual safeguards where required by applicable data protection law.

We do not sell your personal data.

8. LearnCast and the Processing of Learning Data

Our online learning environment consists of two complementary systems:

A. PDA’s WordPress/TutorLMS environment

This environment contains institutional learning records, including student accounts, course information, progress, assignments, grades and related educational records.

B. LearnCast

LearnCast delivers interactive activities embedded within TutorLMS and processes learning activity and assessment information.

Depending on the activity, this may include quiz answers, scores, recordings, audio/video submissions, transcripts, review information, structured assessment outputs and assessment reports.

LearnCast processes this information on PDA’s behalf for the purposes of delivering assigned educational activities, assessment, instructor review and synchronisation of results with TutorLMS.

LearnCast has confirmed that its core application infrastructure for learner-related data is hosted in the EU, including compute, PostgreSQL databases, private object storage for assessment artefacts and EU-based generative AI routing through infrastructure such as Scaleway’s services.

LearnCast has also confirmed that learner assessment media and reports are stored in private EU-hosted storage and accessed through time-limited signed URLs.

Further information concerning LearnCast’s processing practices is available in LearnCast’s Privacy Policy.

9. International Transfers

PDA seeks, where reasonably possible, to use service providers that process learner and other personal data within the European Economic Area.

LearnCast has confirmed that its core learner-related processing infrastructure is hosted within the EU.

However, some third-party services used by PDA or our service providers may involve processing outside the EEA.

Where personal data is transferred outside the EEA, we will ensure that the transfer is carried out in accordance with Chapter V of the GDPR.

Depending on the circumstances, this may include:

• an adequacy decision by the European Commission
• Standard Contractual Clauses
• other appropriate safeguards recognised under the GDPR
• an applicable derogation under Article 49 GDPR

Where appropriate, PDA will assess whether third-party services process learner data or only limited account, technical or administrative information.

10. Personal Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, taking into account our legal, contractual and operational obligations.

Different categories of personal data may therefore be retained for different periods.

In particular:

• Student account information: retained while your account remains active and for a reasonable period thereafter where necessary for administrative, legal or security purposes.
• Course registration and administration data: retained for as long as necessary to administer the relevant programme and maintain appropriate educational records.
• Learning activity and assessment data: retained in accordance with the relevant course and LMS lifecycle and PDA’s educational and administrative requirements.
• Grades and completion records: retained for as long as necessary to administer courses and demonstrate completion.
• Certification records: may be retained for an extended period where necessary to verify certificates and document educational achievements.
• Information provided to EIT Food for certification and reporting: retained in accordance with applicable programme, reporting and legal requirements.
• Donation and financial records: retained for the period required by applicable accounting, tax and financial legislation.
• Merchandise and transaction records: retained for as long as necessary for order administration, accounting, legal and dispute-resolution purposes.
• Communications and enquiries: retained for as long as necessary to respond to and manage the enquiry and, where appropriate, for subsequent administrative or legal purposes.
• Marketing subscriptions: retained until you unsubscribe or withdraw your consent, subject to limited record-keeping necessary to respect your preferences.

Where LearnCast processes assessment submissions on our behalf, PDA may instruct LearnCast to delete such submissions and assessment artefacts in accordance with PDA’s applicable retention requirements.

When personal data is no longer required, we will securely delete or anonymise it.

11. Your Rights

Subject to the conditions and limitations provided by applicable law, you may have the following rights concerning your personal data:

Right of access

You may request confirmation as to whether we process your personal data and, where applicable, request a copy of the personal data we hold about you.

Right to rectification

You may request that inaccurate or incomplete personal data be corrected.

Right to erasure

In certain circumstances, you may request deletion of your personal data.

Right to restriction

In certain circumstances, you may request that we restrict the processing of your personal data.

Right to object

You may have the right to object to certain processing based on our legitimate interests.

You may also object to the processing of your personal data for direct marketing purposes.

Right to data portability

Where the relevant legal conditions are satisfied, you may request to receive personal data you have provided to us in a structured, commonly used and machine-readable format.

Right to withdraw consent

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Rights relating to automated decision-making

You have rights concerning decisions based solely on automated processing, including profiling, where such decisions produce legal effects or similarly significantly affect you, subject to the exceptions provided by applicable law.

PDA does not intend to make decisions concerning students, donors or other users based solely on automated processing where such decisions would produce legal or similarly significant effects.

12. Exercising Your Rights

To exercise any of your rights, please contact:

pdlp@proteinacademy.org

Please provide sufficient information to allow us to identify you and understand your request.

We may need to verify your identity before responding to your request.

We will respond within the applicable statutory time period.

Your rights are not absolute and may be subject to legal limitations or exemptions. If we cannot comply fully with your request, we will explain the reasons where legally permitted.

13. Right to Lodge a Complaint

If you believe that we process your personal data unlawfully or otherwise fail to comply with applicable data protection legislation, you have the right to lodge a complaint with the competent supervisory authority.

As PDA is registered in Denmark, the relevant supervisory authority is:

Danish Data Protection Agency (Datatilsynet)
Carl Jacobsens Vej 35
2500 Valby
Denmark

Website: www.datatilsynet.dk

14. Personal Data Security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration or unlawful processing.

These measures may include:

• access controls
• authentication mechanisms
• encryption and secure communication protocols
• appropriate permissions and user-access management
• security monitoring
• software and security updates
• backup and recovery procedures
• secure hosting and infrastructure
• confidentiality obligations for persons authorised to access personal data

Our website uses SSL/TLS and other appropriate security technologies to protect information transmitted through the website.

LearnCast has informed PDA that learner assessment media and reports are stored in private EU-hosted storage and accessed using time-limited signed URLs rather than permanent public links.

No online system can be guaranteed to be completely secure. We nevertheless regularly review and improve our technical and organisational security measures.

15. Personal Data Breaches

If we become aware of a personal data breach, we will assess the breach and take appropriate measures in accordance with applicable data protection legislation.

Where required by law, we will notify the relevant supervisory authority and/or affected individuals within the applicable statutory time limits.

16. Children’s Personal Data

Our educational programmes may be accessible to individuals of different ages.

Where we process personal data relating to children, we take appropriate measures to ensure that such processing is lawful, proportionate and appropriate to the child’s age and circumstances.

Where consent is required under applicable law for an online service offered directly to a child, we will comply with the applicable requirements concerning parental or guardian consent.

17. Cookies and Similar Technologies

Our website uses cookies and similar technologies, including Local Storage.

These technologies may be used for:

• website functionality
• security
• account and session management
• learning-platform functionality
• analytics
• marketing
• other purposes described in our Cookie Policy

Non-essential Analytics, Marketing and Advertising technologies will only be activated where the required consent has been obtained.

For further information about the cookies and similar technologies used on our website, please see our Cookie Policy.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to our activities
• new educational programmes or services
• changes to our website or learning platform
• changes to third-party service providers
• changes to applicable law or regulatory requirements
• changes to our data processing practices

The latest version of this Privacy Policy will be published on our website together with the applicable “Last updated” date.

19. Contact Us

If you have any questions about this Privacy Policy or how we process personal data, please contact:

The Protein Diversification Academy
A non-profit association registered in Denmark
CVR number: 44375435
Address: C/O HaystackAgro Food Park 138200 Aarhus N, Denmark

Email: pdlp@proteinacademy.org

Website: https://proteinacademy.org/