Privacy policy

Who is responsible for your data

Krong Academy, operated by Damian Powell, an individual trading as a sole proprietor based in South Africa, is the “responsible party” (under South Africa’s POPIA) and the data controller (in GDPR terms) for the personal data described below. Contact: use the contact form and choose Legal.

What we collect

• Waiting list, free access or the free toolkit. Your first name (and last name, if you give it) and email address. Free access opens on 1 December 2026. It also creates your free login to Modules 1 and 8.
• A Sen account. Your first and last names and email address, collected by our authentication provider (Clerk), to create and manage your account and control who can use the full export features.
• A purchase. Your first and last names, email address, billing details processed by our payment provider (Stripe; we do not receive or store your full card number), and your purchase and lesson-progress history.
• A Human Audit submission. Your name and purchase email, the plan sections and supporting documents you upload, and the feedback and result we give you. These go through Google Forms and are stored in Google Drive and Sheets.
• Certificates. The certificate number, type, holder’s name and issue date, and a short log of verification lookups (see Section 5).
• The student community. Your name, profile details and anything you post or comment, which other members can see.
• A case study (optional). If you choose to share one: your answers, any files or video you upload, whether you agree to be named, and your consent record.
• Using the Site. Standard technical data collected by our hosting platform (systeme.io) and, if you accept analytics, by Google Analytics. See Section 6 and the Cookie Policy.
• Emailing us. Whatever you include in the correspondence.

We do not knowingly collect any special category of data (health, political or religious belief and similar) and ask that you do not include it in messages to us, in a Human Audit submission, or in a refund request, beyond what is naturally relevant. We ask you to sanitise your plan before you submit it, using a fictional organisation name and role titles in place of personal names.

Why we collect it, and our legal basis

• Deliver the free access and toolkit you asked for, including your free course login (name, email). Legal basis: your consent.
• Send the emails you signed up for, including the waiting-list and nurture emails (email, engagement data). Legal basis: your consent, which you can withdraw at any time with the unsubscribe link.
• Create and manage your Sen account and control access to full exports (first and last name, email). Legal basis: performance of a contract with you.
• Process your purchase and give you course access (name, email, purchase record). Legal basis: performance of a contract with you.
• Check refund and certificate eligibility using your lesson-progress record. Legal basis: performance of a contract with you.
• Run the Human Audit and issue certificates (your submission, feedback, result, certificate record). A person reads your submission. We do not use an AI tool to read it. Legal basis: performance of a contract with you.
• Verify certificates for third parties who enter a matching number and name. Legal basis: your agreement when you ask for the certificate, and our legitimate interest in keeping certificates trustworthy.
• Provide the student community and keep it safe and respectful (name, profile details, posts). Legal basis: performance of a contract with you and our legitimate interest in moderating the community.
• Consider and publish a case study, only if you choose to share one. Legal basis: your consent, which you can withdraw (see the Terms, Section 3).
• Respond to support and refund requests (your email and message content). Legal basis: performance of a contract with you and our legitimate interest in resolving your query.
• Improve the Programme and the Site using aggregated, where possible de-identified, usage data. Legal basis: our legitimate interest, balanced against your privacy.

Consent and email

When you join the waiting list or sign up for free access or the free toolkit, the sign-up page tells you what you will receive: the toolkit, a free login to Modules 1 and 8 and a short series of emails. Submitting the form is your consent to those emails. Every email includes an unsubscribe link, and unsubscribing takes you out of marketing emails immediately. We may still send transactional emails related to a Product you bought or an account you created (such as access instructions, a certificate or a refund confirmation) when needed to fulfil that purchase or maintain that account.

After your Human Audit feedback we ask every student for a review, in the same words. Leaving a review is optional, has no effect on your result or certificate, and earns no reward or discount.

Who we share data with

• systeme.io. Our course, community, email and checkout platform. Your data is processed on their infrastructure to run the Site, the course and our emails.
• Clerk. Our account and sign-in provider for Sen. Your login email and account and access status are processed on their infrastructure.
• Stripe. Our payment processor, for any purchase.
• Google. Forms, Sheets, Drive, Gmail and Apps Script, used to receive certificate requests and plan submissions, store records, and email certificates, results and reminders. Google Tag Manager and Google Analytics, only if you accept analytics cookies. Google Fonts, which loads the typefaces on this Site and in Sen (your browser contacts Google when a page loads).
• Netlify. Hosts Sen and its guides. jsDelivr serves the code libraries Sen uses to build exports.
• Cloudflare. Runs the certificate verification page at verify.krong.academy.
• Spaceship and Spacemail. Our email domain and mailbox provider, for sending our emails.

Certificate verification. We run a public page at verify.krong.academy so an employer or other third party can check that a Krong Academy certificate is genuine. To get a result, the person checking must enter both the certificate number and the holder’s full name. If they match a certificate we issued, the page confirms the certificate type, the holder’s name as printed on it, the date it was issued and whether it is still valid. It does not reveal anyone’s name or details without a matching number and name, and it cannot be searched by name alone. We keep a short log of lookups (the time, the number entered and the result, but not the name entered) to detect misuse. If a certificate was issued in error or is withdrawn, the page says it is no longer valid and gives no reason. The lookup runs on Google Apps Script and reads the record held in our Google Sheets. By asking us for a certificate you agree that we may confirm its details in this way. If you would rather your certificate could not be verified online, use the contact form, choose Legal, and we will discuss it with you.

We do not sell your personal data, and we do not share it with anyone for their own independent marketing. We may disclose personal data if required by law, regulation, legal process or a governmental request, or where we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, or to investigate fraud.

Cookies

The Site uses a cookie banner that separates essential cookies (needed for the Site and checkout to work) from optional analytics cookies. Google Tag Manager and Google Analytics load only after you accept them. We do not currently use advertising or tracking pixels. If we add any, we will name them in the Cookie Policy first, and they will be optional and off by default. Sen sets no analytics or advertising cookies. The Cookie Policy lists everything in detail.

How we protect your data, and how long we keep it

We rely on the security measures of our infrastructure providers (systeme.io, Clerk, Stripe, Google, Netlify, Cloudflare, Spaceship) to protect the personal data processed on their platforms, and we do not independently store your data on our own servers outside those platforms. We take reasonable steps appropriate to a small business to keep access to our own accounts on those platforms secure. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal data that creates a real risk of harm to you, we will notify you and, where legally required, the relevant regulator, without undue delay.

• Plan documents and feedback from the Human Audit: deleted 24 months after your purchase.
• Certificate and result record (number, type, name, date, valid or withdrawn): kept for as long as the certificate can be verified, so that verification keeps working.
• Purchase, progress and tax records: kept for as long as you have an active opt-in, Sen account or Programme access, and afterwards for a reasonable period, up to 7 years, to meet our accounting, tax and dispute-resolution obligations. That is recordkeeping, not continued access.
• Emails you opted in to: until you unsubscribe or ask us to delete them.

Programme access itself is time-limited (12 months from purchase; see our Terms and Conditions). If you ask us to delete your data under Section 8 and no legal retention obligation applies, we will do so.

Your rights

Wherever you are, you can ask us at any time, through the contact form (choose Legal), to:

• Access the personal data we hold about you.
• Correct anything inaccurate.
• Delete your data, where we are not required to keep it for a legal reason (such as the tax record of a purchase).
• Object to or restrict our use of your data for marketing.
• Receive a copy of your data in a portable format.
• Withdraw consent for anything based on consent (such as the email sequence), at any time, without affecting anything done before you withdrew it.

You can also delete your own Sen account directly, at any time, from the Account menu (Account, then Delete account). See Section 11. This removes your sign-in and access immediately and permanently, without you needing to email us first. Use the rights above for anything beyond the account itself, such as purchase records we must keep for tax purposes.

If you are in South Africa, you also have rights under the Protection of Personal Information Act (POPIA) and can complain to the Information Regulator of South Africa. If you are in the EU or UK, you have the equivalent right to complain to your local data protection authority. We aim to respond to any request within 30 days. We do not make decisions about you by automated means that have legal or similarly significant effects: people decide your Human Audit results and refund requests.

US residents

If you are a resident of a US state with its own privacy law (such as California’s CCPA/CPRA), you have rights broadly similar to those in Section 8: to know, access, correct and delete your personal data, and to opt out of any sale or sharing of it. We do not sell your personal data, and we do not use it for cross-context behavioural advertising. We do not use or disclose sensitive personal information except as needed to provide the Products. Analytics run only if you accept them and you can turn them off at any time through Cookie settings in the footer. To use any of your rights, use the contact form as described in Section 8. We may need to confirm that the request comes from the email address on your purchase. We reply within 30 days, and we do not treat you differently for using your rights.

International data transfers

Because our platform providers (systeme.io, Clerk, Stripe, Google, Netlify, Cloudflare, Spaceship) operate internationally, your data may be processed in a country other than the one you are in. Each of these providers maintains its own compliance framework for international transfers (such as EU Standard Contractual Clauses, where applicable). We rely on those safeguards rather than operating our own servers.

Sen: account access and local storage

Creating a free account lets you sign in to Sen. We use it only to manage your access, not to view your project work. You can delete your own account at any time from inside Sen (Account, then Delete account). This is immediate and permanent, and you do not need to contact us first. Sen saves your in-progress project work in your own browser’s local storage, not on a Krong Academy server, and any export file you create is yours to keep. Sen has no analytics, and Sen itself makes no calls to any AI service. The optional Ask AI feature works only if you paste your own Anthropic or OpenAI key (or the key and address of another OpenAI-format service). It shows you exactly what will be sent, and sends it from your browser straight to the provider you chose only after you agree, each time; Krong Academy never receives it. Its other outside connections are Clerk (sign-in), Netlify (hosting), jsDelivr (code libraries) and Google Fonts (typefaces). We do not have access to what you build in Sen unless you choose to send us an export file. The current Privacy Policy and Terms and Conditions are always available inside Sen from the Account menu.

Third-party links

The Site or our emails may occasionally link to third-party websites or content we do not control (for example, a source we cite in course materials). This Policy does not apply to those sites, and we are not responsible for their privacy practices. Check their own policy before sharing personal data with them.

Children

The Programme is intended for working professionals and is not directed at, or knowingly collecting data from, anyone under 18.

Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be posted here with an updated date.

Contact

Questions about this policy, or to use any of the rights in Section 8: use the contact form and choose Legal.