Preamble

At Britto Academy ("the Academy", "Company", "we", "our", or "us"), we are committed to safeguarding the privacy, confidentiality, and integrity of the personal data entrusted to us by our students, instructors, affiliate partners, and website visitors ("User", "you", or "your").

This Privacy Policy sets out the principles and technical standards governing how we collect, process, store, disclose, and protect your personal information across our website (brittoacademy.com), partner subdomains (partner.brittoacademy.com), course player systems, and integrated transactional notification services.

By accessing our services, creating an account, or interacting with our platform, you acknowledge and agree to the practices outlined in this Policy.

1. Scope and Legal Basis

This Privacy Policy applies to all services, content, products, and features delivered via our Learning Management System (LMS). We process personal data in full compliance with the statutory laws of Bangladesh, including:

• The Information and Communication Technology (ICT) Act, 2006 (as amended);
• The Cyber Security Act and applicable telecommunication regulations;
• Applicable consumer protection and commercial digital transaction directives.

We process your data under legitimate legal bases, including contractual necessity (delivering enrolled courses, issuing certificates, and processing payouts), compliance with statutory obligations, and your explicit consent.

2. Categories of Information We Collect

We collect only the information necessary to provide, protect, and optimize our academic and commercial ecosystem:

2.1 Identity and Contact Data

• Students: Full legal name, email address, mobile phone number, residential/billing address (including District, Thana, and Division), profile image, and optional educational/professional background.
• Minors: If a student is under 18 years of age, guardian consent records and emergency contact details.
• Instructors: Government-issued identification (NID/Passport), academic credentials, professional designations, biographical summary, portfolio links, and tax/banking details.
• Affiliates: Identification details, promotional URLs, customized coupon codes, and sponsor network linkage data.

2.2 Billing and Financial Data

• Transaction Records: Transaction ID (TrxID), payment method (bKash, Nagad, Card, Bank Transfer), paid amounts, currency, timestamp, and applied promo/referral coupon codes.
• Payment Credentials Safeguard: We do not collect, process, or store credit/debit card numbers, CVVs, or MFS PINs. All financial transactions are processed directly through certified, PCI-DSS compliant third-party payment gateways and Mobile Financial Services (MFS).
• Payout Data: Account details submitted by instructors and affiliates for earnings withdrawals (e.g., personal bKash/Nagad account numbers, bank account titles, account numbers, and branch routing details).

2.3 Academic, Assessment, and Learning Telemetry

• Video lecture completion timestamps, watch-time duration, and attachment download logs.
• Assessment history: quiz attempts, submitted responses, question-level scores, pass/fail results, and final exam submissions.
• Certificate records: unique credential identifiers (CERT-XXXXXX), issue timestamps, validity windows, and associated cryptographic verification hashes.
• Course feedback, ratings, and written reviews submitted on course pages.

2.4 Partner and Marketing Attribution Data

• Referrer tracking codes (?ref=CODE), sponsor-downline relationship trees, Level-1 direct sales, Level-2 override allocations, and 7-day maturity escrow timelines.

2.5 Technical, Device, and Security Telemetry

• Internet Protocol (IP) addresses, browser type, operating system, device hardware fingerprints, login session tokens, concurrent access logs, and referral headers.
• Dynamic anti-piracy telemetry (forensic watermarking timestamps displayed during video playback).

2.6 Communications and Inquiries

• Inquiries submitted through our public Contact Us form, email support threads, WhatsApp/chat helpdesk records, and internal administrative notes.

3. How We Collect Your Information

• Direct Submission: When you register, enroll in a course, submit an exam, request a withdrawal, apply to become an instructor, or contact support.
• Automated System Tracking: As you navigate the LMS, our servers automatically log course progress, lesson completions, quiz attempts, and diagnostic session data.
• Third-Party Integrations: Payment gateway status webhooks (confirming transaction success) and external single sign-on / communication relays.

4. Purposes of Data Processing

Britto Academy uses collected information exclusively for lawful business and educational objectives:

1. Academic Fulfillment: Provisioning course access, tracking module progress, conducting quizzes, auto-grading assessments, and issuing digital QR-verified completion certificates.
2. Financial Management & Auditing: Reconciling payments, splitting 4-way financial distributions (Teacher Royalty, Promotional Fund, Reserve Fund, and Company Net Profit), validating affiliate commissions, and disbursing requested payouts.
3. Identity Verification & Security: Mitigating unauthorized account sharing, preventing multiple concurrent logins, and enforcing intellectual property rights.
4. Transactional Notifications: Sending automated email confirmations for account registration, enrollment invoices, exam results, certificate readiness, and payout disbursements via our dynamic transactional mail engine.
5. Quality Assurance & Platform Optimization: Analyzing drop-off rates in video lessons, diagnosing server latency, and improving user experience across geographical regions in Bangladesh.
6. Statutory and Legal Compliance: Cooperating with law enforcement agencies, preventing financial fraud, and fulfilling accounting/tax reporting obligations.

5. Forensic Watermarking and Anti-Piracy Disclosure

To protect proprietary video assets, Britto Academy utilizes dynamic client-side and server-side forensic watermarking. During video streaming, your registered account identifier (User ID / Email) and dynamic IP address may be subtly stamped across video frames. This data is strictly utilized for copyright protection and forensic auditing in the event of unauthorized stream capturing or commercial redistribution.

6. Information Sharing and Disclosure

We do not sell, rent, monetize, or trade your personal data to third-party data brokers. We disclose personal information strictly under the following limited operational frameworks:

• Authorized Service Providers: Trusted cloud infrastructure providers, SMS/email transactional delivery relays (e.g., SMTP gateways, Resend, Brevo), and licensed payment gateways. These vendors receive only the information strictly required to perform their functions under non-disclosure obligations.
• Faculty and Mentors: Course instructors receive enrollment rosters containing the names and learning analytics of students enrolled in their specific courses, solely for academic mentorship and project reviews.
• Public Certificate Verification: Anyone presenting a valid certificate credential ID or scanning a certificate QR code will be able to view the public verification page showing the student’s name, course title, completion date, and credential status.
• Legal and Regulatory Demands: When legally mandated by a formal order from a court of competent jurisdiction, regulatory authority, or law enforcement agency operating under Bangladesh law.
• Corporate Transactions: In the event of a merger, acquisition, or restructuring, user records may be transferred to the continuing entity under equivalent privacy standards.

7. Cookies and Tracking Technologies

Britto Academy uses cookies, local storage, and similar session technologies to:

• Authenticate active user logins and sustain secure dashboard sessions;
• Maintain referral attribution parameters (ref_code) across the 30-day affiliate cookie lifecycle;
• Analyze aggregated site traffic and diagnostic crash logs.

You can modify cookie settings in your web browser. However, disabling essential session cookies will inhibit login authentication and course playback. If advertising pixels (e.g., Meta Pixel) are deployed for marketing campaigns, they operate under anonymized telemetry.

8. Data Security and Technical Safeguards

We implement high-grade administrative and technological controls to protect your data against unauthorized access, destruction, disclosure, or alteration:

• Transport Encryption: All web traffic and streaming payloads are encrypted using standard Transport Layer Security (TLS 1.2 / 1.3 / HTTPS).
• Credential Protection: User passwords are encrypted using one-way cryptographic hashing algorithms (Bcrypt/Argon2). We cannot read your raw password.
• Access Control: Production databases, payout queues, and student dossiers are accessible only by authenticated administrative personnel with role-based permissions (role:admin).
• Resilience: Daily automated database backups and redundant storage structures.

While we employ industry-standard protocols, no internet-connected platform can claim 100% invulnerability. Users are urged to maintain strong passwords and safeguard their login credentials.

9. Data Retention and Archiving Policy

• Account Records: Kept active as long as you maintain an account on our platform.
• Academic Credentials: Certificate records, credential hashes, and final exam pass logs are retained permanently in our public verification registry to enable future employer validation.
• Financial Transactions: Transaction ledgers, withdrawal requests, and invoicing distributions are retained for a minimum of seven (7) years to comply with statutory accounting and audit guidelines.
• Inactive Data: Accounts subjected to permanent administrative deletion will have personal identifiers purged or anonymized, except where preservation is required by ongoing legal obligations.

10. Your Rights as a Data Subject

Subject to applicable laws and verification of your identity, you possess the right to:

1. Access and Portability: Request a copy of your personal data stored within our systems.
2. Rectification: Update, correct, or complete inaccurate information directly through your dashboard profile or via administrative support.
3. Withdrawal of Consent: Opt out of promotional/marketing newsletters at any time using the unsubscribe link.
4. Erasure (Right to be Forgotten): Request deletion of your account and personal details, provided no active legal, academic certificate, or financial dispute requires its retention.

11. Minor Protection Policy

Britto Academy is committed to protecting minors. We do not knowingly collect personal data from individuals under 18 years without verified parental or legal guardian consent. If we become aware that a child under 18 has registered independently without parental knowledge, we will promptly delete the data and terminate the account upon notification from a guardian.

12. Changes to This Privacy Policy

Britto Academy reserves the right to amend, update, or revise this Privacy Policy to reflect technical updates, statutory requirements, or operational changes. All revisions will be posted on this page with an updated "Last Updated" timestamp. Substantial changes will be communicated via administrative dashboard banners or transactional email notifications.

13. Data Protection Officer and Contact Details

For privacy-related questions, data access requests, or regulatory communications, please contact our Data Protection and Compliance Team:

• Organization: Britto Academy Limited
• Email: [email protected]
• Direct Helpdesk: +880 1626-448799
• Corporate Website: brittoacademy.com
• Registered Office: Dhaka, Bangladesh.