Privacy Policy
1. Controller
Pragmatic Five AS, organisation number 938 652 279, Støtvigveien 16, 1560 Larkollen, Norway, is the controller for personal data processed in Decision Workout (the “Service”). Contact: post@decisionworkout.com.
2. Personal data we process
- Account data: name, email address, password (hashed), profession track, role and access status.
- Training data: video progress, quiz and exam results, self-evaluations, cases, briefings and other saved content.
- Group licence data: seat assignments, nicknames, progress and results.
- Guest data: display name and answers submitted in a session joined by code.
- Communications: messages in the Service and emails sent to us. Questions in live feedback sessions are stored without name or email address.
- Purchase data: amount, status, date and payment reference. Card details are processed by Paddle only.
- Technical data: IP address, session cookie and login timestamps.
- Data about others: data you enter when rating or describing a colleague.
3. Purposes and legal bases
- Providing the Service, accounts and support: performance of a contract (Article 6(1)(b) GDPR).
- Orders and bookkeeping: performance of a contract and legal obligation (Article 6(1)(b) and (c)).
- Showing seat users’ progress to the group owner, and data about persons rated by users: legitimate interest in providing the requested training functions (Article 6(1)(f)).
- Security and prevention of misuse: legitimate interest (Article 6(1)(f)).
Account data is required to use the Service. We do not sell personal data, use it for advertising or make automated decisions within the meaning of Article 22 GDPR.
4. Sensitive data
The Service is not intended for special categories of personal data, national identity numbers or the identity of patients or clients. Users must not submit such data. We are not responsible for sensitive personal data that users choose to enter.
5. Recipients
Processors under a data processing agreement: our hosting provider and our email service provider.
Independent controllers: Paddle.com Market Limited, as Merchant of Record for payments, invoicing and tax; and Cloudflare, Inc., which delivers software libraries (cdnjs) loaded by your browser and receives your IP address.
We may also disclose personal data where required by law.
6. Transfers outside the EEA
Where recipients process personal data outside the EEA, transfers are based on an adequacy decision, including the EU–US Data Privacy Framework, or on the European Commission’s standard contractual clauses.
7. Retention
- Account, training and group seat data: until the account is deleted.
- Guest data: until the host deletes the session or the host’s account.
- Purchase data: five years after the end of the financial year of the transaction.
- Correspondence: as long as necessary to handle the enquiry.
- Backups: until overwritten in the regular backup cycle.
8. Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection under the GDPR. You can export your data and delete your account under My account, or contact post@decisionworkout.com. You may lodge a complaint with a supervisory authority.
9. Cookies and local storage
We use one strictly necessary session cookie that keeps you signed in for up to seven days, and local storage for course state and the cookie notice. We use no analytics or advertising cookies. Paddle may set cookies necessary to complete a purchase.
10. Security
We use measures appropriate to the risk, including HTTPS, password hashing and restricted access to production systems.
11. Children
The Service is not directed at children under 16.
12. Changes
Material changes to this Privacy Policy will be notified in the Service or by email.