This Privacy Policy explains how the Studus learning platform collects, uses, stores, and protects personal data when you use our website and service. Personal data is processed in accordance with Regulation (EU) 2016/679 (GDPR), Slovak Act No. 18/2018 Coll. on the protection of personal data, and ePrivacy rules for cookies and similar technologies.

1. Controller and contact

Studus is a product operated by CREBISO | corp.systems s.r.o., a company registered in the Slovak Republic. All matters relating to operation, data processing, billing, or legal questions about Studus are handled by this entity.

If you need the company's full identification details (company ID, VAT ID, registered seat) for legal documents, signing a DPA, or procurement, write to us at info@crebiso.com and we will provide them without undue delay.

2. Roles in processing

• Controller: for managing administrator/billing accounts, support, service communication, and web analytics/marketing cookie consents.
• Processor: for organizational content processed in Studus on behalf of the customer organization — in particular student data (test results, course progress, certificates). The customer organization is the controller of this content.

3. What data we process

Depending on how the Service is used, we process the following categories of data:

Administrator/contact account data

• First and last name
• Email address
• Organization name and affiliation
• Login credentials (passwords are stored only as a hash)

Organizational content (on behalf of the customer, as processor)

• Student data — name, email, course and group assignment
• Test results, course progress, and issued certificates
• Courses, lessons, attachments, and other content uploaded to the platform

Technical and operational data

• IP address
• Browser type and version, operating system, device type
• Platform interactions and activity timestamps
• Referring URL

Payment data

• Billing name and address
• Payment method details (processed by payment gateways; card numbers are not stored)
• Transaction history and billing records

4. Purposes and legal bases (Art. 6 GDPR)

• Providing the service and managing accounts — performance of a contract (Art. 6(1)(b)).
• Payments, invoicing, and tax/accounting obligations — legal obligation (Art. 6(1)(c)) and performance of a contract (Art. 6(1)(b)).
• Security, misuse prevention, and service reliability (including the functional protection script, see section 8) — legitimate interest (Art. 6(1)(f)).
• Web analytics and marketing cookies — consent (Art. 6(1)(a) and ePrivacy).
• AI-assisted features (processing of inputs/outputs via an AI provider, unless you use your own API key) — performance of a contract, or legitimate interest.
• Service notifications (non-marketing) — performance of a contract and legitimate interest.

Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before withdrawal.

5. Retention periods

• Account data and organizational content: for the duration of the active subscription and up to 30 days after termination (data export is available during this period).
• Backups: 30-day rolling retention.
• Usage/analytics data: up to 26 months in analytics systems (or shorter depending on configuration), only when consent has been given.
• Payment records: per applicable tax and accounting rules (typically up to 10 years).
• Cookie consent record: 180 days, after which we ask again.

6. Your rights

If GDPR applies to you, you have the right to access, rectify, erase, restrict processing, port your data, object, and withdraw consent (where processing is based on it).

If you are a student or other user within an organization that uses Studus and want to exercise your rights over data processed on that organization's behalf, please contact your organization (the controller) first — Studus acts as a processor for this content.

7. Security measures

• Encryption in transit (TLS)
• Encryption at rest in the production environment
• Role-based access control and access logging
• Operational monitoring and daily backups
• Primary hosting in the EU

8. Recipients and subprocessors

We share data only to the extent necessary to provide the Service or fulfill legal obligations:

• Hosting and infrastructure providers (EU) — secure operation of the platform and data storage.
• AI providers (e.g. OpenAI, Anthropic) — only if the organization uses AI-assisted features via the Provider's API key. When using your own API key (BYOK), inputs/outputs are processed directly by the organization's chosen AI provider, not by the Provider.
• Cookie/analytics and marketing providers — Google (Analytics, Ads), Meta, and Aderius; deployed only after the corresponding consent is given (see section 12).
• Corpilus protection script — a functional/security script protecting the website against abuse; it always runs, as it is an essential function (see section 12).
• Payment gateways — payment processing and fraud prevention.

9. International transfers

Some providers (for example AI providers, when using the Provider's API key) may process data outside the EEA (e.g. in the US). In such cases we apply GDPR safeguards:

• Adequacy decisions issued by the European Commission (where they exist)
• Standard Contractual Clauses (SCC)
• Supplementary protective measures where needed

10. Data Processing Agreement (DPA)

For organizational content where the Provider acts as processor, a Data Processing Agreement (DPA) is available on request. Write to us at info@crebiso.com.

Cookie Policy

Effective as of: September 1, 2026

11. Cookies and similar technologies

We use cookies and similar storage (including browser local storage) to run the site, remember your consent choices, and — only with consent — for analytics or marketing. Your consent is stored in browser local storage (key studus_cookie_consent) for 180 days.

12. Cookie categories we use

Essential (functional)

Required for the site's basic operation and security, and to remember your consent. Always on and cannot be disabled.

• Session support and basic site operation
• Cookie consent record
• Corpilus protection script — a security/protection function against site abuse

Analytics

Only with consent. Helps us understand overall site usage and improve performance.

• Google Analytics (GA4) — anonymized IP address, traffic statistics

Marketing

Only with consent. Used to measure campaigns and ad relevance.

• Google Ads
• Meta Pixel
• Aderius (marketing script)

13. Managing your consent

• Cookie banner: shown on your first visit with "Accept all", "Reject all", and "Customize" (granular settings per the categories above).
• Withdraw at any time: click the "Cookie settings" link in the site footer.
• Browser settings: you can also block or delete cookies via your browser settings.
• Google Analytics opt-out: Google Analytics Opt-out Browser Add-on.

14. Changes to this policy

We may update this policy due to legal, operational, or product changes. When published, the date at the top of this section is updated.

Where required by law, we will ask for renewed consent before applying changes to consent-based processing.

15. Contact

For any questions, concerns, or requests regarding privacy or cookies, contact us:

For questions about our terms of service, see our Terms of Service.