Human Rights Careers Academy | Last updated: 18 July 2026
1. Who we are
Human Rights Careers Academy (the “Academy”) is operated by:
Human Rights Careers e.U.
Mag. Robert Markus Fellner
Breitenfeldergasse 6-8/1/23
1080 Vienna, Austria
Company number: FN 534686 d
VAT number: ATU75556337
Email: admin@humanrightscareers.com
Human Rights Careers e.U. is the controller responsible for the personal data described in this Privacy Policy. “We”, “us” and “our” refer to Human Rights Careers e.U.
2. Scope of this policy
This Privacy Policy explains how we collect and use personal data when you visit academy.humanrightscareers.com, create or use an Academy account, purchase a membership, take a course, complete an activity, save information in a course, download or print learning materials, contact us, or subscribe to communications.
It applies to the Academy website and membership platform. A third-party website or service linked from the Academy may have its own privacy policy.
3. Personal data we collect
3.1 Account and profile data
When you create an account, we may collect your name, email address, username, encrypted or hashed password, account preferences, membership status, and information you choose to add to your profile.
3.2 Membership, payment and transaction data
When you purchase a membership, we collect information needed to manage the transaction and your access, such as the membership plan, billing interval, payment status, transaction identifiers, invoice details, billing country, applicable tax information, renewal date, cancellations and refunds.
Payments are processed by Stripe. We do not receive or store your complete card number. Stripe receives payment and device information directly and may process personal data as an independent controller for some of its own legal and compliance purposes.
3.3 Learning, progress and certificate data
We store information generated while you use the Academy, including course enrolments, lesson progress, activity completion, quiz answers and results, assessment results, certificates, and dates and times associated with your learning activity. This lets us provide the course, remember your progress and issue certificates where offered.
3.4 Information you save inside courses
Some Academy activities allow you to type and save answers, reflections, plans, application materials, workbook entries, toolkit content or similar information so that you can return to it and later view, download or print it. We store these entries as part of your Academy account in order to provide that feature.
Private documentation and workbook entries are not published to other members. We use them only as needed to store, display, edit, export, print, secure and support the relevant Academy function. We do not use private course entries for advertising and do not sell them.
Some clearly labelled activities, such as a shared word cloud, map or community reflection, may be designed to show a contribution in aggregate or to other participants. The activity should indicate this before you submit. Do not place anything in a shared activity that you want to keep private.
3.5 Communications and support
If you contact us, we collect the information you provide, such as your name, email address, message, attachments, and any information needed to respond to a technical, account, payment or data-protection request.
3.6 Technical, login and security data
Our systems and hosting provider may automatically process technical information such as IP address, browser and device type, operating system, requested pages, date and time, login events, error logs, and security events. We use this information to deliver the website, keep accounts secure, diagnose problems and prevent misuse.
3.7 Website analytics
We use Plausible Analytics to understand aggregate traffic and how the Academy is used. Plausible does not place analytics cookies, use persistent identifiers, or track people across websites or devices. It provides aggregated information such as page views, referral sources, countries, browsers and devices. We do not use Plausible to build individual learner profiles.
3.8 Newsletter data
If you separately subscribe to a newsletter or marketing communication, we process your email address, subscription choices, consent record and related delivery information. Academy membership does not automatically enrol you in marketing emails. We currently use MailerLite to manage email subscriptions. You may unsubscribe at any time using the link in an email or by contacting us.
4. Why we use personal data and our legal bases
We process personal data only when we have a legal basis under the General Data Protection Regulation (GDPR):
Contract — Article 6(1)(b) GDPR: to create and administer your account; process and manage your membership; provide courses and activities; store your progress and private learning entries; issue certificates; provide downloads and printing features; communicate about the service; and handle cancellations and refunds.
Legal obligation — Article 6(1)(c) GDPR: to meet accounting, tax, consumer-protection, fraud-prevention and other legal obligations, and to respond to lawful requests from authorities.
Legitimate interests — Article 6(1)(f) GDPR: to keep the Academy secure; prevent abuse; maintain and improve the service; troubleshoot errors; understand aggregate traffic through privacy-friendly analytics; manage and defend legal claims; and operate our business efficiently. We consider the impact on your rights before relying on this basis.
Consent — Article 6(1)(a) GDPR: where you choose to receive marketing communications or where we specifically request consent for an optional feature. You may withdraw consent at any time without affecting earlier lawful processing.
5. Please do not enter confidential or sensitive information
Course activities are designed for learning and career development. Unless an activity clearly states otherwise, do not enter confidential information, passwords, financial account details, health information, identity documents, or identifiable information about clients, colleagues, rights-holders, survivors, applicants or other third parties.
In particular, avoid entering information that reveals another person’s ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data, health, sex life or sexual orientation. Use anonymised or fictionalised examples where possible. If you enter information by mistake and cannot delete it yourself, contact us at admin@humanrightscareers.com.
6. Cookies and similar technologies
The Academy uses cookies or similar local storage that are strictly necessary for functions such as account login, session continuity, membership access, checkout and security. These technologies cannot reasonably be disabled without affecting the service.
Plausible Analytics does not use analytics cookies. We do not use advertising cookies or cross-site behavioural tracking on the Academy. If this changes, we will update this policy and, where required, request consent before non-essential technologies are used.
7. Who receives personal data
We do not sell or rent personal data. We disclose or make data available only when needed for the purposes described above, including to:
our website hosting, database, backup, security and technical-support providers, which help us operate and protect the Academy;
Stripe, which processes membership payments, refunds and related fraud-prevention information;
Plausible Analytics, which provides privacy-friendly aggregate website analytics;
MailerLite, only where you choose to subscribe to a newsletter or marketing communication;
professional advisers such as accountants, legal advisers or insurers where necessary; and
courts, regulators, tax authorities, law-enforcement bodies or other public authorities where disclosure is required by law or necessary to establish, exercise or defend legal claims.
Where a provider acts as our processor, we require it to process data only under our instructions, keep it secure and comply with applicable data-protection law. Some providers, particularly payment providers, may also act as independent controllers for specific purposes described in their own privacy notices.
8. International data transfers
We prefer providers and infrastructure located in the European Economic Area. Plausible states that its hosted analytics data is processed on European-owned infrastructure in the EU.
Some service providers or their sub-processors may process data outside the EEA. Where that occurs, we use a lawful transfer mechanism, such as an adequacy decision, the European Commission’s Standard Contractual Clauses, or another safeguard permitted by GDPR, together with supplementary measures where required. You may contact us for information about the safeguards relevant to your data.
9. How long we retain data
We retain personal data only for as long as it is needed for the purposes described in this policy or to meet legal obligations. In particular:
Account, course-progress and saved learning data are normally kept while your Academy account remains open so that you can return to your work and export or print it. Cancelling a paid membership does not automatically delete the account or its saved learning data. You may request deletion at any time, subject to legal exceptions.
We may delete or anonymise accounts and learning data that are no longer needed after an extended period of inactivity. Where reasonably possible, we will provide advance notice so you can download your work.
Payment, invoice, accounting and tax records may be retained for up to ten years, or longer where a legal proceeding or other applicable rule requires it. These records do not include your full card number.
Support communications are normally retained until the issue is resolved and, where needed, for up to three years to document the request and our response.
Routine server and security logs are normally kept for no longer than 30 days, unless an event requires longer retention for investigation or legal claims.
Data removed from active systems may remain temporarily in restricted backups until the relevant backup is overwritten under our normal retention cycle.
10. Security
We use appropriate technical and organisational measures designed to protect personal data, including encrypted connections, access controls, account authentication, software updates, backups and restrictions on administrative access. No online service can guarantee absolute security. You are responsible for using a strong, unique password and keeping your login details confidential.
11. Your data-protection rights
Subject to the conditions in applicable law, you may have the right to:
receive information about how we process your personal data;
access the personal data we hold about you;
correct inaccurate or incomplete data;
request deletion of personal data;
request restriction of processing;
receive data you provided in a structured, commonly used and machine-readable format, and transmit it to another controller where the right to portability applies;
object to processing based on legitimate interests and object at any time to direct marketing;
withdraw consent at any time where processing is based on consent; and
not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, where applicable.
These rights are not absolute. For example, we may need to retain invoice or transaction information to comply with tax law. To exercise a right, email admin@humanrightscareers.com. We may need to verify your identity before responding.
12. Complaints
Please contact us first if you have a privacy concern so we can try to resolve it. You also have the right to lodge a complaint with the Austrian Data Protection Authority or another competent supervisory authority in the EU/EEA.
Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna, Austria
Email: dsb@dsb.gv.at
Website: https://dsb.gv.at
13. Automated decision-making
We do not use Academy account, learning or payment data to make decisions based solely on automated processing that produce legal effects or similarly significant effects for you.
14. Children
The paid Academy is intended for adults and is not directed to children under 16. If you believe a child has provided personal data without appropriate authorisation, contact us so we can investigate and take appropriate action.
15. Changes to this Privacy Policy
We may update this Privacy Policy when the Academy, our service providers or legal requirements change. We will publish the updated version with a new “last updated” date. If a change materially affects how we use existing account or learning data, we will provide an additional notice where appropriate.
16. Contact
For privacy questions or requests, contact:
Human Rights Careers e.U.
Mag. Robert Markus Fellner
Breitenfeldergasse 6-8/1/23
1080 Vienna, Austria
Email: admin@humanrightscareers.com