Privacy Policy

Last Updated: December 26, 2025

Privacy at a Glance

Free Practice Exams

  • No account required
  • No personal data collection
  • Anonymous analytics only
  • Progress saved locally in browser
  • Cookie consent required

Premium Courses (Optional)

  • Account required with email address
  • Email used only for account recovery

At Nex Arc Learning ("we", "our", or "us"), we are committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard information when you visit our website nex-arc-learning.com (the "Site").

1. Information We Collect

We collect minimal information from visitors to our Site:

Data Protection Impact Assessment (DPIA): We have conducted a Data Protection Impact Assessment under Article 35 GDPR. Our assessment determined that this service presents minimal privacy risks due to our data minimization approach, use of local storage for user preferences, and pseudonymized analytics. No high-risk data processing activities are performed.

Privacy by Design and by Default (Article 25 GDPR): We implement privacy by design principles throughout our service. This includes: data minimization (collecting only essential information), local-first storage (exam progress stored in your browser, not our servers), pseudonymized analytics (IP anonymization enabled), and granular cookie consent controls. Default settings prioritize your privacy.

2. How We Use Information

The information we collect is used solely to:

3. Cookies and Tracking Technologies

We use cookies and similar tracking technologies for:

Analytics Cookies:

Functional Cookies (for paid course platform):

CloudFront Signed Cookies (for content protection):

Local Storage:

Detailed Cookie Information

Cookie Name Type Purpose Expiration Provider
CognitoIdentityServiceProvider.* Essential Authentication session management Session AWS Cognito (First-party)
CloudFront-Signature, CloudFront-Key-Pair-Id, CloudFront-Policy Essential Signed cookies for premium content access 1 hour AWS CloudFront (First-party)
_ga Analytics Google Analytics user identification 2 years Google Analytics (Third-party)
_ga_* Analytics Google Analytics session tracking 2 years Google Analytics (Third-party)

Cookie Categories:

4. Payment Processing and Lemon Squeezy

When you purchase a course through our platform, payment processing is handled by Lemon Squeezy, LLC ("Lemon Squeezy"), our Merchant of Record. This means:

Data shared by Lemon Squeezy with us:

We use this data solely for:

Important: We do NOT receive your full payment card details - these remain securely with Lemon Squeezy.

Legitimate Interest for Order Fulfillment (Art. 6(1)(f) GDPR):

We receive your email, name, and course ID from Lemon Squeezy via webhooks to fulfill your purchase. Our legitimate interest is providing the digital course you paid for. This minimal data sharing is necessary, expected by customers, and poses minimal privacy risk. Our interests do not override your rights, as you receive the purchased service and can exercise your GDPR rights at any time.

5. User Accounts and Authentication

When you create an account to access paid courses, we collect and process the following information:

Account Information:

Authentication is managed through AWS Cognito, a service provided by Amazon Web Services (AWS):

You may enable optional multi-factor authentication (MFA) using time-based one-time passwords (TOTP) for enhanced security.

Account Data Retention:

6. Purchase History and Course Entitlements

We store the following information in our secure database (AWS DynamoDB) to manage your course access:

Course Entitlement Records:

Note: These records indicate which courses you own (entitlement), not when you access them (usage logs).

Transaction History:

Data Storage:

Data Retention:

7. Third-Party Services

Our Site uses the following third-party services:

We are not responsible for the privacy practices of third-party websites or services.

7a. Subprocessors

We use the following subprocessors to provide our services:

Subprocessor Purpose Location
Amazon Web Services (AWS) Cloud infrastructure (Cognito, DynamoDB, CloudFront, Lambda) EU (Frankfurt, Germany) & US (Northern Virginia)
Amazon Web Services (AWS) - CloudWatch Log aggregation and monitoring (data processor) EU (Frankfurt, Germany)
Lemon Squeezy (Lemonsqueezy Inc.) Payment processing (Merchant of Record) USA (Utah) - Protected by SCCs
Google LLC Analytics (Google Analytics) USA - Protected by adequacy decision

Subprocessor Changes: We will notify you of any new subprocessors via email at least 30 days before the change takes effect. You have the right to object to new subprocessors.

Data Processing Agreements: We have executed Data Processing Agreements (DPAs) with all subprocessors as required by GDPR Article 28. Copies are available upon request by contacting info@nex-arc-learning.com.

8. Data Security

Our Site is hosted on AWS infrastructure with industry-standard security measures. Since we collect minimal data and store exam progress locally in your browser, there is minimal risk to your personal information.

8a. Data Breach Notification

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will:

  1. Authority Notification: Notify the relevant data protection authority (German BfDI for EU users, ICO for UK users) within 72 hours of becoming aware of the breach (GDPR Article 33).
  2. User Notification: If the breach poses a high risk to your rights and freedoms, we will notify you directly without undue delay via email (GDPR Article 34).
  3. Information Provided:
    • Nature of the breach (what happened)
    • Categories and approximate number of affected users
    • Likely consequences
    • Measures taken to address the breach
    • Contact information for further inquiries

Reporting a Breach to Us: If you suspect unauthorized access to your account, immediately contact us at info@nex-arc-learning.com with subject "Security Breach Report".

9. Children's Privacy

Our Site is not directed to children under the age of 13. We do not knowingly collect information from children under 13. If you believe we have inadvertently collected such information, please contact us.

10. Your GDPR Rights

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

1. Right of Access (Art. 15 GDPR)

2. Right to Rectification (Art. 16 GDPR)

3. Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR)

4. Right to Data Portability (Art. 20 GDPR)

5. Right to Restriction of Processing (Art. 18 GDPR)

6. Right to Object (Art. 21 GDPR)

7. Right to Withdraw Consent (Art. 7(3) GDPR)

How to Exercise Your Rights:

To exercise any of these rights, contact us at: info@nex-arc-learning.com

Response Timeline:

Right to Lodge a Complaint:

If you believe we are not complying with GDPR, you may lodge a complaint with:

EU Representative:

Our data controller is established in the EU (Germany). For EU GDPR matters:
Nico Wichmann
c/o flexdienst
Kurt-Schumacher-Straße 76
67663 Kaiserslautern, Germany
Email: info@nex-arc-learning.com

10a. California Consumer Privacy Rights (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Categories of Personal Information Collected:

Your California Rights:

How to Exercise Your Rights:

Email: info@nex-arc-learning.com with subject "California Privacy Rights Request"
We will respond within 45 days (extendable to 90 days if complex).

Disclosure of Sale/Sharing:

We do NOT sell or share your personal information as defined by CCPA/CPRA.

Do Not Sell or Share My Personal Information: Not applicable - we do not sell or share your data.

California Regulatory Authority:

If you have a complaint about our CCPA compliance, you may contact:

10b. UK Data Protection Rights

If you are a UK resident, you have specific rights under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018:

Your UK Rights:

UK Data Controller:

Nico Wichmann, c/o flexdienst, Kurt-Schumacher-Straße 76, 67663 Kaiserslautern, Germany
Contact: info@nex-arc-learning.com

UK Supervisory Authority:

If you are in the UK, you can file a complaint with the Information Commissioner's Office (ICO):

International Data Transfers from UK:

Your data is primarily processed in the EU (AWS Frankfurt). The UK considers the EU an adequate jurisdiction for data protection. For any transfers outside the UK/EU, we use Standard Contractual Clauses approved by the UK ICO.

10c. Automated Decision-Making and Profiling

We do NOT use automated decision-making or profiling that produces legal effects or similarly significantly affects you (GDPR Article 22).

Exam Scoring: Our practice exam scoring is a transparent, rule-based algorithm for educational purposes only. It does not affect your legal rights, certification status, or have any binding effect.

Access Control: Course access is determined by a simple binary rule: paid users have access, unpaid users do not. This is a transparent business rule, not an automated decision with legal effects.

11. Data Retention Periods

We retain different types of data for specific periods based on legal requirements and business needs:

Analytics Data (Google Analytics):

Account Data (AWS Cognito):

Purchase and Transaction Data (DynamoDB):

Customer Support Communications:

System Logs (AWS CloudWatch):

Legal Basis for Retention:

12. Email Communications

Transactional Emails (Required):

Legal Basis: Contract performance (Art. 6(1)(b) GDPR) - These emails cannot be opted out of as they are essential to providing our service.

Marketing Emails (Optional):

We do NOT currently send marketing emails. If we introduce a newsletter in the future, you will have the right to opt-out via an unsubscribe link in every message.

Email Retention:

Support emails: Retained for 3 years for customer service quality and dispute resolution.

13. International Data Transfers

Your data may be transferred outside the European Economic Area (EEA) under the following circumstances:

AWS Infrastructure:

Lemon Squeezy Payment Processing:

Google Analytics:

We ensure all data transfers comply with GDPR Chapter V requirements through:

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last Updated" date. We encourage you to review this policy periodically.

15. External Links

Our Site may contain links to external websites and services. We are not responsible for the privacy practices or content of these external sites. We encourage you to read their privacy policies before providing any information.

16. Operational Logging and Monitoring

To ensure platform security, diagnose technical issues, and prevent fraud, we maintain system logs. This section explains what we log, why, and how long we keep it.

What We Log

Application Logs (AWS CloudWatch):

Performance Metrics (AWS CloudWatch Metrics):

Why We Log

We use logs for:

Who Can Access Logs

Internal Access:

Third-Party Processors:

Data Minimization

We practice data minimization in our logging:

Your Rights Regarding Logs

Under GDPR, you have the right to:

Note: We cannot delete logs retroactively (they are immutable for security/audit purposes), but they auto-delete after 1 month. For account deletion (Right to Erasure), historical logs expire automatically.

Back to Homepage